1
$\begingroup$

This is somewhat a theoretical question, but I am also interested in whether this is possible in practice.

Assume, that there is a service that possesses a private RSA key, and can sign any data with that key, after the key is unlocked with a password. Something similar to the ssh agent. Once unlocked, you can talk to this service through a protocol, but don't have access to the (unlocked) private key in any way. You hand over the data to sign to the service, and it returns the signature. And you also have the corresponding public key.

Now, the question is, can this service be used for encryption and decryption? I am thinking of something like this for encryption:

  1. You unlock the service with a password.
  2. You have plaintext you want to encrypt.
  3. You generate a random blob of data.
  4. You ask the service to sign this data. You verify the signature using the public key.
  5. You treat the signature (or some hash of it) as a key for symmetric encryption/decryption, e.g. as an AES key.
  6. You encrypt the plaintext with this key, and get a secret.
  7. You store
    • the secret, and
    • the random data you used to create the signature.

When you want to decrypt a secret:

  1. You unlock the service with a password.
  2. You take the stored random data.
  3. You ask the service to sign it with its private key. You verify the signature using the public key.
  4. You treat the signature (or some hash of it) as an AES key.
  5. You decrypt the secret with the AES key.

I admit, that I don't know much about cryptography, but to me, this seems like a good (=secure) algorithm for solving the problem, at least in theory. Am I missing something? Is this already known/used somewhere in practice?

$\endgroup$
2
$\begingroup$

The signature algorithm would need to be deterministic. Only PKCS#1 v1.5 based RSA signatures are deterministic; most other modern (and popular) algorithms use random input for the signature. If the signature is random then your encryption and decryption key will be different and the protocol will fail.

The random blob of data isn't kept secret (if you could keep it secret between the two parties you would not need the signing service). Anybody can access the blob. So anybody with access to the service will be able to generate the signature used to derive the secret key.

So (after the edit) the scheme could be used to generate a symmetric key. But beware that whenever the private key changes or whenever the private key is used for a different, non-deterministic scheme it will fail. If the signature is deterministic you could however generate a static shared secret and use that for further communications.

It's kind of obvious, but remind your self that the owner of the private key service will also be able to generate the secret key. You might as well randomly generate a secret and put it somewhere in the service. Then you would not be dependent on the private key being available (using keys for different services is severely frowned upon when it comes to key management).

$\endgroup$
  • $\begingroup$ The signature service seems to be public as well. This is not public, sorry for the misunderstanding. You only have access to it if you unlock it with the password. E.g. like the ssh agent or any keychain (=secret store) service. The signature would need to be deterministic. OK, this seems to be a tough one to fix. $\endgroup$ – Gabor Csardi Feb 9 '17 at 10:59
  • $\begingroup$ Please fix the fact that the signature service is not public either; that's more important. There is a lot of RSA/PKCS#1 v1.5 still out there, and although the scheme cannot be proven secure, it's not broken either. $\endgroup$ – Maarten Bodewes Feb 9 '17 at 11:03
  • $\begingroup$ the owner of the private key service will also be able to generate the secret key. Sure, I did not explain this well, but this is not a concern. I am running the service as well. I basically just want to use the ssh agent as a secret storage service. The ssh agent is the service that can sign a blob of data. $\endgroup$ – Gabor Csardi Feb 9 '17 at 11:22
  • $\begingroup$ Ok, thanks for bearing with me, my original description was quite misleading, because there is no communication here, really. I just want to use the ssh agent service (that can only sign a blob, after a key is unlocked, but cannot give you the unlocked private key or encrypt or decrypt), as a keychain. Anyway, I think have a good solution then. I can even generate the keypair myself, a different one for each "keyring". The RSA/PKCS#1 v1.5 bit does bother me a bit, though, what if it will be considered as obsolete in a couple of years? Hmmm. $\endgroup$ – Gabor Csardi Feb 9 '17 at 11:32
  • $\begingroup$ Basically your idea is theoretically feasible. If it is at all practical depends on the circumstances and you're probably better suited to answer that (given the conditions in my answer). $\endgroup$ – Maarten Bodewes Feb 9 '17 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.