5
$\begingroup$

we normally always encrypt by public key and decrypt with private key.

  1. If i encrypt with private key, then its still secure as normal PKI ? i mean known-plain-text will not take private key on the risk ? (for example when people know the plain text and signed message with private key, then private key is safe or will compromise?

  2. When we encrypt with the public key then known-plain-text make public key compromise but private key is safe?

Improve this question
$\endgroup$
5

2 Answers 2

Reset to default
5
$\begingroup$

Well, first of all, this is not a generic 'public-key' question. With RSA, it can make sense to talk about 'encrypting with the private key', for most other public key algorithms, there's isn't an obvious interpretation. For example, with DSA, the public key operation (which is a signature verification) is 'plug the data from the signature, the hash of the data and the public key into a formula; the signature passes of both sides are the same value'. There's no obvious way to use this type of operation to encrypt something.

Now, in your question, you ask whether encrypting with the RSA private key is secure. Well, that depends on what you mean by secure; what precisely are you attempting preventing someone from doing? In one sense, it is not secure at all; anyone who has the public key can decrypt the message. Since it is generally true that anyone can get the public key, well, this means that this is not at all a secure encryption method.

On the other hand, you might not be assuming that this is a secure encryption method; this might be an attempt to simulate RSA signature generation. Here, you have to be careful; RSA using padding methods to translate between the message being encrypted/signed into a value to give to the raw RSA function. The security properties for an encryption padding method are different from the security properties for a signature padding method; in fact, there are real world secure encryption padding methods (for example, RSAES-PKCS1-v1_5 with e=3) that could be insecure if used as a signature padding method.

However, you may simply be asking "would the key be secure"? In some sense, that is irrelevant; usually, the only reason an attacker wants the keys is that would allow him to perform some operation; if he can perform those operations without the keys (because, for example, of the vulnerabilities mentioned in the above two paragraphs), then he doesn't need the keys. However, if you are still concerned about the keying data, well, it turns out that RSA is safe; performing RSA operations (even on attacker chosen values) doesn't leak the private key.

Improve this answer
$\endgroup$
6
  • $\begingroup$ I'm not immediately seeing an attack against RSAES-PKCS1-V1_5-ENCRYPT (wrongly) used as a signature scheme that gets easier with e=3; any hint? $\endgroup$
    – fgrieu ♦
    Jul 10, 2012 at 6:57
  • $\begingroup$ Or perhaps there is that line of thought, where $e=3$ makes the attack easier; but it is going to be seriously hindered by the minimum of 64-bit (near) random introduced by RSAES-PKCS1-V1_5-ENCRYPT; it would work if the adversary also controlled that. BTW, 64-bit! That's so passé, and on the verge of unsafe if only a few bits of the message are unknown. $\endgroup$
    – fgrieu ♦
    Jul 10, 2012 at 8:43
  • 1
    $\begingroup$ @fgrieu: well, PSAES-PKCS1-V1_5-ENCRYPT makes it easy to forge signatures, if the modulus is big enough. This is not that profound an observation; the attacker just finds a perfect cube of the form 00 02 | PS | 00 | Hash (for a preselected value of Hash which happens to be odd). If Hash is 256 bits, then a modulus size of 1k should be more than sufficient. This allows him to trivially generate forgeries for about half of all possible messages. $\endgroup$
    – poncho
    Jul 10, 2012 at 12:10
  • $\begingroup$ I see: you are assuming the adversary can manipulate PS (or knows PS when he decides the message). I was seeing that another way, where the attacker can submit messages, but has no control over what PS will be. $\endgroup$
    – fgrieu ♦
    Jul 10, 2012 at 12:23
  • 1
    $\begingroup$ @fgrieu: you're thinking about this the wrong way. To attack a signature scheme, you attempt to generate a forgery. If he can find a perfect cube of the form 00 02 | PS | 00 | Hash, then the cube root of that value (easy to compute) is a valid signature of the message with that hash. If the modulus is long enough (and hence PS is long enough) and Hash is odd, it is easy to find a cube in the above form where PS doesn't contain any zero bytes. He does all this without submitting any messages; even if he doesn't even know the modulus (other than its size). $\endgroup$
    – poncho
    Jul 10, 2012 at 13:15
0
$\begingroup$

1) Yes, if you use standard schemes, the private key should remain safe.

2) The public key is always completely open, you give it to everybody. Knowledge of this public key or things it encrypted should not compromise the private key.

Both of these are basic foundations that PKI needs in order to work.

Improve this answer
$\endgroup$
3
  • $\begingroup$ but Paŭlo Ebermann said here its not safe : crypto.stackexchange.com/questions/2123/… $\endgroup$
    – Edward
    Jul 9, 2012 at 19:37
  • $\begingroup$ i herd somewhere else too that encryption doesn't matter apply by public or private key. it make the key compromise ... ! $\endgroup$
    – Edward
    Jul 9, 2012 at 19:38
  • $\begingroup$ Note how I said "if you use standard schemes", which was basically what he also said. Raw usage is not secure, but it's fine if you use the standard schemes for padding, signing a hash, etc. $\endgroup$
    – B-Con
    Jul 10, 2012 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.