# What is the correct use of RSA

I study cryptography as a hobby and I made a high school work (essay-like) about cryptography. When I was defending my work in front of a committee, one of the teachers confronted me about my suggestion of RSA usage.

I claimed that the public key can be freely available on a website for everyone to download it (and I've seen people do it that way). His argument was that what if someone was listening to my communication and as well was able to hack my website and change my public key to a different one. That way, he could decrypt at least one message encrypted with this key (before I would realise that I myself can't decrypt it).

Is it a correct argument or is it just my fault that I had my website hacked? I think that the latter is the right answer.

• The attack is valid (that is, it will work if you don't detect the breach of the website before the next message to you is send). Of course, the premise ("the website is hacked AND you don't notice it") and the consequence ("at most one message can be maliciously intercepted") need to be evaluated within the context of your application. – SEJPM May 10 '18 at 11:01
• Also I'm having a hard time understanding what you would want from an answer? Say "yes, you are right" or "no, the committee person is right" or "it depends on your risk analysis and whether you are willing to accept this (small?) risk"? – SEJPM May 10 '18 at 11:02

Call the receiver Alice and the sender Bob. [...] We emphasize that the channel between Alice and Bob may be public, but is assumed to be authenticated, meaning that the adversary cannot modify the public key sent by Alice to Bob (and, in particular, cannot replace it with its own key). [...] An [...] approach is for Alice to generate her keys (pk, sk) in advance, independently of any particular sender. (In fact, at the time of key generation Alice need not even be aware that Bob wants to talk to her, or even that Bob exists.) Alice can widely disseminate her public key pk by, say, publishing it on her webpage, putting it on her business cars, or placing it in a public directory.