Can a service that can only sign text, be used for encryption/decryption?

Question

This is somewhat a theoretical question, but I am also interested in whether this is possible in practice.

Assume, that there is a service that possesses a private RSA key, and can sign any data with that key, after the key is unlocked with a password. Something similar to the ssh agent. Once unlocked, you can talk to this service through a protocol, but don't have access to the (unlocked) private key in any way. You hand over the data to sign to the service, and it returns the signature. And you also have the corresponding public key.

Now, the question is, can this service be used for encryption and decryption? I am thinking of something like this for encryption:

1. You unlock the service with a password.
2. You have plaintext you want to encrypt.
3. You generate a random blob of data.
4. You ask the service to sign this data. You verify the signature using the public key.
5. You treat the signature (or some hash of it) as a key for symmetric encryption/decryption, e.g. as an AES key.
6. You encrypt the plaintext with this key, and get a secret.
7. You store
   • the secret, and
   • the random data you used to create the signature.

When you want to decrypt a secret:

1. You unlock the service with a password.
2. You take the stored random data.
3. You ask the service to sign it with its private key. You verify the signature using the public key.
4. You treat the signature (or some hash of it) as an AES key.
5. You decrypt the secret with the AES key.

I admit, that I don't know much about cryptography, but to me, this seems like a good (=secure) algorithm for solving the problem, at least in theory. Am I missing something? Is this already known/used somewhere in practice?

Answer 1

The signature algorithm would need to be deterministic. Only PKCS#1 v1.5 based RSA signatures are deterministic; most other modern (and popular) algorithms use random input for the signature. If the signature is random then your encryption and decryption key will be different and the protocol will fail.

The random blob of data isn't kept secret (if you could keep it secret between the two parties you would not need the signing service). Anybody can access the blob. So anybody with access to the service will be able to generate the signature used to derive the secret key.

So (after the edit) the scheme could be used to generate a symmetric key. But beware that whenever the private key changes or whenever the private key is used for a different, non-deterministic scheme it will fail. If the signature is deterministic you could however generate a static shared secret and use that for further communications.

It's kind of obvious, but remind your self that the owner of the private key service will also be able to generate the secret key. You might as well randomly generate a secret and put it somewhere in the service. Then you would not be dependent on the private key being available (using keys for different services is severely frowned upon when it comes to key management).