# Encryption of large files RSA

I know that asymmetric cipher shouldn't be used for encryption large files because it is slow. It is better to use symmetric cipher. But, what worse, I've read that it is unsecure to encrypt a large file with a public key. But, why?

• "I've read", where? Nov 22, 2016 at 20:07
• Ok, maybe I missed some facts. So, is it unsecure?
– user41405
Nov 22, 2016 at 20:23
• @J.Doe, it depends on the specifics of how it is done. Nov 22, 2016 at 20:27
• This seems very similar to an earlier question asked here. If the answers to that question (or to the ones linked from it) don't answer yours, you may want to edit your question to explain how it differs from the earlier one. Nov 22, 2016 at 20:28

Safe encryption of large files with RSA is possible. One can split the file into suitably small blocks, and encipher these individually with a safe RSA-based encryption scheme. The receiver deciphers the ciphertext blocks, and concatenates the deciphered plaintext blocks. This demonstrably is safe (in the sense that it protects the confidentiality of the large file), if the RSA-based encryption scheme is (this requires random padding, and excludes textbook RSA encryption, which allows to verify a plaintext guess).

This is however rarely done in practice because:

1. RSA is slow/compute intensive compared to symmetric encryption, especially for decryption; and that slowness applies to the decryption of each of the many blocks, and becomes a computational bootleneck. We are talking like 4 decimal orders of magnitude or more compared to symmetric encryption. Making the modulus larger reduces the number of blocks but worsens the problem, because RSA's execution time grows much faster than linearly with the modulus size (even much faster than quadratically, for decryption).
2. Safe RSA-based encryption schemes expand the size of the ciphertext. For example RSA-OAEP with SHA-256, when using 2048-bit RSA, uses 2048-bit ciphertext blocks (256 bytes) which convey at most $2048-2\cdot256-16=1520$ bits (190 bytes), loosing over 25% of the bandwidth. This can only be improved to some degree (for $n$-bit security, there must be at least $n$ bits lost per block).
3. RSA with long-term keys does not offer forward secrecy.

Hybrid encryption solves 1 and 2. Negotiating a session key with an appropriate protocol can solve 3.

• Hybrid encryption also addresses re-ordering attacks which people tend to forget... Nov 23, 2016 at 11:47
• @SEJPM: RSA encryption (as any public-key encryption scheme) does not provides integrity of any kind: by principle, an adversary can create ciphertext that will decipher to any plaintext s/he chooses. Hybrid encryption does not change this. Further, far from all hybrid encryption schemes address re-ordering attacks (think of AES-CBC with key in an RSA-encrypted header: reordering ciphertext blocks will correspondingly reorder the plaintext, save for 16 bytes of garbage at the split; and then this can be largely controlled by splitting at known portions of the plaintext).
– fgrieu
Nov 23, 2016 at 13:06