Why does rsyncrypto require a public key during decryption?

Question

I recently came across a project called rsyncrypto that sacrifices some security so that you can have rsync-friendly files. My understanding is that it works by generating a symmetric key for each file you're encrypting, and saving that symmetric key to a file. It then encrypts the file using that symmetric key, encrypts the symmetric key with a public key, and concatenates the encrypted symmetric key to the encrypted file. The purpose of this is so that each file can be encrypted with a different key, but even if you lose the symmetric key file, the data can be decrypted by using the private key (private key decrypts symmetric key in the file, symmetric key decrypts the file itself).

The project seems to require the use of the public key in addition to the symmetric key file for decryption, however, and I'm confused as to why this is. It seems like if you have the symmetric key in a file already (which you do, generated by the program), you could just decrypt the data and disregard the embedded copy of the same symmetric key. I know that this is a question better posed to the maintainer, but he seems to have disappeared years ago. Anyone familiar with the program (or even if you're not) that could explain to me why you might need the public key in addition to the symmetric key for decryption? The most likely explanation I can think of is that I'm missing something about how this program works, but all the reading I've done doesn't seem to have cleared anything up about this.

Disclaimer: Thusfar my google-fu has been strong and I have never needed to post a question on any forum before, so this is my first. Please be gentle. =)

Answer 1

For completeness / posterity / future inquisitors, this is the response I got when I asked on the mailing list. I have also included it below because links sometimes break.

No, you're not missing anything. This requirement is not, algorithmically, necessary.

When you're decrypting with the symmetric key available, rsyncrypto uses the public key in order to know how much of the file's header to skip. In other words, all it actually needs from your public key is how many bits it is. Since the first part of the file is the symmetric key, encrypted using the private key, the key's length is needed in order to know how much to skip.

Of course, in retrospect, I could have stored that information inside the symmetric key file, and made the usage simpler. I'm hoping to, some day, get around to working on rsyncrypto again, and this will definitely go there.

Unfortunately, rsyncrypto's current file format makes it impossible to encrypt using a stream algorithm. Since this is a kinda important change, the changes planned for rsyncrypto 2.0 are breaking changes. As that's the case, I will not do another breaking change (changing the format of the symmetric key file) for so little gain.

If this restriction is a problem for the deployment type you are planning, you can simply generate some random public key for the decryption machine. So long as it is the same length as the original encryption key, everything should work fine.

Shachar