Considering that a PKI has already been established, why can't we use RSA to send the One Time Pad instead of using AES?

It makes sense to me since:

  • A trusts the CA which is providing the identity of B and vice versa
  • A obtains the public key of B from the Certificate and uses it to encrypt the pad
  • B decrypts the message and obtains the pad

Is this possible?


The one time pad can be used to provide perfectly secure encryption, given fully random key stream. Of course this key stream needs to be kept perfectly secure for it to be considered fully random.

Nether RSA nor AES can be used to protect a one time pad, because the one time pad would rely on RSA and AES to be secure. Neither RSA nor AES are perfectly secure, and neither can even be proven to be secure - as far as we know.

This prohibits distributing a one time pad with either RSA or AES; you are better off just using RSA / AES directly, for instance using a hybrid cryptosystem with AES in counter mode or any authenticated mode.

  • $\begingroup$ What do you mean RSA cannot be proven to be secure? $\endgroup$ – Melab Dec 10 '17 at 1:04
  • $\begingroup$ @Melab Take for instance this Wikpedia quote : "Just as there are no proofs that integer factorization is computationally difficult, there are also no proofs that the RSA problem is similarly difficult. By the above method, the RSA problem is at least as easy as factoring, but it might well be easier." We don't know about any shortcuts that break the RSA problem itself, but we cannot proof that there aren't any. $\endgroup$ – Maarten Bodewes Dec 10 '17 at 1:06
  • 1
    $\begingroup$ It doesn't prohibit distributing a one-time pad, it only means that the system won't be more secure than the method used to distribute the OTP, which makes it pointless to use an OTP instead of a constant-size-key cipher. $\endgroup$ – Gilles Dec 10 '17 at 5:20
  • $\begingroup$ Basically, it's like asking whether putting an industrial strength safe together with the key inside a sturdy lockbox is any better than just using the lockbox alone. $\endgroup$ – Thomas Dec 10 '17 at 5:42

RSA can only encrypt data that's smaller than the key. The data, plus padding (as defined by the RSA encryption standard, OAEP, or by the deprecated PKCS#1 v1.5 method), must fit in fewer bits than the modulus.

It would be possible in principle to define encryption modes for RSA in the same way that is done for block ciphers, but nobody does it because it is a lot slower than using a hybrid cryptosystem and has zero security benefit. To transmit more data than fits in RSA, you use RSA to encrypt a secret key for a symmetric cipher and the symmetric cipher to encrypt the actual data.

Even using a symmetric cipher such as AES-GCM or AES-CBC to transmit a one-time pad would be pointless since the security of the whole system is bounded by the security of the AES-based transmission. You might as well transmit an AES key: it'll be less data to send, allows you to subsequently encrypt as much data as you like, and is just as secure.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.