# Would RSA-encrypting a private key for itself constitute a vulnerability?

I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either as an internal GnuPG file or an ASCII-armored exported key -- would this constitute a vulnerability?

The key in question is password-protected, but I'd be interested in both situations.

If there is a vulnerability in encrypting a RSA private key with the corresponding public key, when the private key is password-protected, then it mechanically implies a vulnerability in the password-based protection scheme: if an attacker gets a copy of the password-encrypted key (without the password), he can encrypt it with the public key himself; so an attack on the result (RSA encryption of the password-protected private key, leading to a private key compromise) is readily turned into an attack on the password-based encryption.

Without password encryption, things are a bit less clear. Consider the following hypothetical RSA-like cryptosystem:

• $n = pq$ is the public modulus, with public exponent $e$;
• private key is $p$ (knowing $p$, $n$ and $e$ is sufficient to recompute the private exponent $d$);
• encryption uses no padding (message $m$ is encrypted by computing $m^e \mod n$ directly).

Then the encryption of the private key yields $p^e \mod n$, an integer which is a multiple of $p$ (it is equal to $p^e-kpq$ for some integer $k$) but not of $q$. Therefore, a simple GCD between that value and $n$ reveals $p$.

Now, the real RSA has padding, and, more importantly (here), when used in GnuPG, is an hybrid encryption scheme: what RSA actually processes is a random value, from which is derived a symmetric encryption key, which is then used to encrypt the actual data. For RSA-encryption of the (unprotected) private key to be a vulnerability, it would require the symmetric encryption to somehow transport unscathed algebraic properties from the private key structure to the modular exponentiation. This is highly improbable and my gut feeling is that there is no problem here. But still, no formal proof.

Why would you want to do that, anyway ? To do anything with an encrypted message, you have to know the decryption key -- and if you already know the decryption key, why would you care about obtaining it again from the decryption ?

• Thank you for the analysis. Since I'm planning to encrypt and store my home directory, I'm a bit wary about what would happen if I've left my private key somewhere or ~/.gnupg keeps it. – user408 Sep 2 '11 at 10:51