3
$\begingroup$

All of the information on asymmetric encryption I can find uses key-exchanging to get a mutual symmetric key.

What I am trying to do is encrypt a message with a public key and have it only readable by someone with the private key. ​ I don't even want the sender to be able to read it after it's been encrypted. ​ I don't care about the identity of the sender, only that if someone compromises the sender's computer, they can't derive a symmetric key and decrypt what was previously sent.

Is this possible?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Just use a one-time key-pair for the sender and include the public key with the message. $\endgroup$
    – CodesInChaos
    Nov 22, 2015 at 0:02
  • $\begingroup$ @CodesInChaos, that could work. I feel that it's a bit wasteful though. I will be storing each encrypted message, and storing another public key will double my storage requirements (the encrypted message is short). $\endgroup$
    – Alex
    Nov 22, 2015 at 0:08

2 Answers 2

Reset to default
3
$\begingroup$

Yes, RSA is an example of a cryptosystem where this is possible. The message is encrypted using the recipient's public key only and even the sender could not decrypt it.

However, in the comments you mention that you would like to minimize storage requirements. RSA would require e.g. 2048 bits for just the message. In comparison, with ECIES sending a one-time key with the message you are looking at a minimum of about 512 bits for a one AES block message, 256-bit curve and 128-bit MAC.

So it is not really wasteful to do it like CodesInChaos suggested.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Elliptic Curve with ephemeral keys should suffice for minimizing size. Given the public key of the recipient, you generate an ephemeral EC key and derive a shared secret (via some hashing algorithm, sha256 is common) as the symmetric key)from the private ephemeral key, and the public recipient key. Then encrypt the message with the derived symmetric key. The message that gets send to the recipient is the public ephemeral EC key, and the encrypted message. $\endgroup$
    – Tyzoid
    May 17, 2021 at 6:19
  • $\begingroup$ @Tyzoid Yes, that's exactly the suggestion here. $\endgroup$
    – otus
    May 17, 2021 at 10:14
2
$\begingroup$

  • Generate a random symmetric key (for example an AES key). We will use it only once for this transmission, and call it the session key.

  • encrypt the session key with the public key

  • encrypt the message with the session key

  • forget the session key

  • transmit the two encrypted message to the recipient

Since you are using a whole new encryption key for every message, and don't remember them, an attacker that compromises the sender will not be able to recover previously sent messages.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.