I study cryptography as a hobby and I made a high school work (essay-like) about cryptography. When I was defending my work in front of a committee, one of the teachers confronted me about my suggestion of RSA usage.

I claimed that the public key can be freely available on a website for everyone to download it (and I've seen people do it that way). His argument was that what if someone was listening to my communication and as well was able to hack my website and change my public key to a different one. That way, he could decrypt at least one message encrypted with this key (before I would realise that I myself can't decrypt it).

Is it a correct argument or is it just my fault that I had my website hacked? I think that the latter is the right answer.

  • 1
    $\begingroup$ The attack is valid (that is, it will work if you don't detect the breach of the website before the next message to you is send). Of course, the premise ("the website is hacked AND you don't notice it") and the consequence ("at most one message can be maliciously intercepted") need to be evaluated within the context of your application. $\endgroup$ – SEJPM May 10 '18 at 11:01
  • $\begingroup$ Also I'm having a hard time understanding what you would want from an answer? Say "yes, you are right" or "no, the committee person is right" or "it depends on your risk analysis and whether you are willing to accept this (small?) risk"? $\endgroup$ – SEJPM May 10 '18 at 11:02

RSA and other public-key protocols assume that the keys are securely delivered. To quote "Introduction to Modern Cryptography" by Lindell and Katz:

Call the receiver Alice and the sender Bob. [...] We emphasize that the channel between Alice and Bob may be public, but is assumed to be authenticated, meaning that the adversary cannot modify the public key sent by Alice to Bob (and, in particular, cannot replace it with its own key). [...] An [...] approach is for Alice to generate her keys (pk, sk) in advance, independently of any particular sender. (In fact, at the time of key generation Alice need not even be aware that Bob wants to talk to her, or even that Bob exists.) Alice can widely disseminate her public key pk by, say, publishing it on her webpage, putting it on her business cars, or placing it in a public directory.

(Bold emphasis mine)

So, having said that, you're right that the system assumes the keys will be communicated in an authenticated manner. But also the committee member is right in that hacking the website would constitute a valid attack. When you define your threat model, it should be clear if an undetected hack of the website is within it and appropriate measures be taken. For example, if it is considered a reasonable threat, then the keys can be communicated by business cards handed in person or through a web-of-trust, among many key distribution mechanisms.

| improve this answer | |
  • 1
    $\begingroup$ What's sometime on a business card is the hash (also known as fingerprint) of the public key (along some ID). That is enough to verify the authenticity of a public key, found by other means like an insecure website or directory. In the case of RSA, the hash/fingerprint is much shorter and convenient than the public key itself (like 10 times shorter, or more). $\endgroup$ – fgrieu May 10 '18 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.