2
$\begingroup$

I am planning to use the RSA for encryption my data and I am wondering - I've generated the keys pair with some limited expiration time and I will use this private and public keys for the purpose of encryption and decryption and in one time the certificate will be expired.

How can I use the new certificate? What is the best scenario if my old certificate is expired and I want to have an access to my old encrypted data - do I need to re-encrypted all my old data with new certificate or what is the best practice for that?

Improve this question
$\endgroup$
7
  • $\begingroup$ Encrypting with RSA means encrypting a symmetric key used to encrypt other (real) data. So maybe you will need to reencrypt only the symmetric keys, no all the data themselves. $\endgroup$
    – gusto2
    Nov 26, 2017 at 18:53
  • $\begingroup$ What do you mean with - reencrypt symetric keys? If I only have a private and public keys - which symetric key do you mean? Thank you. $\endgroup$
    – Jenan
    Nov 26, 2017 at 18:55
  • 1
    $\begingroup$ RSA has some limitations (you can encrypt only data shorter than the keysize, encrypted data, data with low entropy can leak some information, ..). How PKI (RSA) is used to encrypt data - usually a random symmetric key is generated to encrypt the data (with arbitrary length using a symmetric cipher) and RSA is used only to encrypt (wrap) the symmetric key. see the hybrid cryptosystyem $\endgroup$
    – gusto2
    Nov 26, 2017 at 18:59
  • $\begingroup$ I've seen that used in some CMS implementations, when you need to give access an encrypted content to multiple users, then the encryption key can be encrypted with public key of each users. I believe it could work with the PKI key rotations $\endgroup$
    – gusto2
    Nov 26, 2017 at 19:04
  • $\begingroup$ OK, that make sense. But I don't know - I can imagine situation where I have in database two columns - one column for string where is encrypted version of string and in second column I have encrypted symmetric key. If my RSA key pair is expired then I have to re-encrypt all symetric keys - is it right? Thank you. $\endgroup$
    – Jenan
    Nov 26, 2017 at 19:22

1 Answer 1

Reset to default
2
$\begingroup$

I've generated the keys pair with some limited expiration time and I will use this private and public keys for the purpose of encryption and decryption and in one time the certificate will be expired

First - do you have a particular reason why would use short lifetime for the keys? Often there is no reason for that. Still, there should be a way how to replace the PKI keys when needed.

From the comments seems you are designing a new system, what gives you more flexibility. I will try to build an answer from the comments

RSA has some limitations. You can encrypt only data shorter than the key size and as someone already mentioned in another answer - RSA is good at hiding random-looking data.

How PKI (RSA) is used to encrypt data - usually a random symmetric key is generated to encrypt the data (with arbitrary length using a symmetric cipher) and RSA is used only to encrypt (wrap) the symmetric key. see the hybrid cryptosystyem

what alg do you recommend for symmetric encryption?

you have plenty to choose... try to type openssl list-cipher-algorithms something standard would be good, just don't reinvent anything own. AES-128-CBC could be good start

Is it possible decrypt the symmetric key with expired certificate (private key)?

now - a homework for you. find out what is difference between a certificate and a public key..

nothing prevents you to use the public key to en(de)crypt even the certificate is expired.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Really good answer, I appreciate your effort to explain these details. Thanks for good points for next studying :) $\endgroup$
    – Jenan
    Nov 26, 2017 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.