Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme:

  1. generate random seed z using n - 1 bits - where n is the size of the modulus N
  2. interpret the seed z as unsigned number and encrypt using the public key e: w = RSA(e, z)
  3. derive a session key and IV using s = KDF(z, "skey") and iv = KDF(z, "iv")
  4. encrypt the plaintext message m' using (c, t) = AEAD(s, iv, ad, m), where t is the authentication tag and ad is (additional) authenticated data
  5. output w | c | t

Would it be advantageous to include the value of w - the encrypted key seed - in the authenticated data ad?

  • $\begingroup$ I've left the decryption scheme to your imagination :) $\endgroup$
    – Maarten Bodewes
    Commented Sep 8, 2015 at 21:10
  • $\begingroup$ As this uses the standard RSA-KEM and a CCA secure private key encryption scheme in a standard composition (for which security proofs are available) I'd say the answer will be: "You don't have to include the encrypted seed in the AD, the scheme will be provably secure without doing this." Will it provide any advantages? maybe. Will it break anything? unlikely but possible. Result: You may do it if you see any advantages. This isn't an answer as I don't how the security proofs will behave with this modification $\endgroup$
    – SEJPM
    Commented Sep 8, 2015 at 21:35
  • $\begingroup$ @SEJPM That's my feeling as well. I'm slightly worried about meet-in-the-middle attacks though, so I'm just posting this question as a safeguard in case I'm overlooking something. $\endgroup$
    – Maarten Bodewes
    Commented Sep 8, 2015 at 21:38
  • 1
    $\begingroup$ This is CCA-secure in the random oracle model (assuming the KDF behaves like a random oracle). So there's no need to include $w$. In general, I am in favor of making it as simple as possible. $\endgroup$ Commented Sep 9, 2015 at 5:53
  • $\begingroup$ Isn't conventional RSA-KEM already CCA-secure in the random oracle model? $\endgroup$
    – cygnusv
    Commented Sep 9, 2015 at 8:54

1 Answer 1


It probably doesn't hurt to include the encapsulation as additional data for the AEAD, but there is no need. The generic KEM/DEM composition,

\begin{align} &(C_0, k) \leftarrow \operatorname{KEM}_{\mathit{pk}}() \\ &C_1 \leftarrow \operatorname{DEM}_k(M) \\ &\operatorname{return} C_0\mathbin\|C_1, \end{align}

provides adequate security by the standard theorems, e.g. Cramer–Shoup 2001, Theorem 5 on p. 41.

You can safely separate the concerns of

  1. generating the encapsulation $C_0$ and the key $k$ with RSA, and
  2. one-time authenticated encryption under $k$,

as separate subroutines that communicate only $k$.

See Shoup's ISO proposal for more practical details of composition and instantiation with less math.

Incidentally, it is also unnecessary to generate an IV, since the key is used only once: you can safely use an IV/nonce of zero for the AEAD as a DEM.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.