4
$\begingroup$

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution of choice e.g. c.f. Bouncy castle FAQ.

I know about the advantages of hybrid encryption considering

  • better performance
  • efficient handling of multiple and changig recipients

Are there any other reasons not to use only RSA?

Improve this question
$\endgroup$
6

1 Answer 1

Reset to default
7
$\begingroup$

We do not really know how to do RSA encryption of messages which span multiple blocks. At least not securely. The problem is already hard for block ciphers (see all the defined modes of operation).

Also, the worst performance issue with arithmetic cryptography like RSA is not about CPU, but about size. When you encrypt a piece of data with RSA, you get some overhead. E.g. with a 1024-bit RSA key, you can encrypt at most 117 bytes at a time, but this yields 128 bytes. When transmitting a long message, a fixed overhead of a few hundred bytes is much more tolerable than a +10% size increase.

CPU efficiency is often quoted as the reason we do hybrid encryption, but it is rarely as compelling as the two problems explained above.

(Additional point: since proper RSA encryption needs randomness, you must have a cryptographically strong PRNG -- also known as "a stream cipher". So even non-hybrid encryption does not avoid using symmetric primitives.)

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ One could probably construct modes that only need randomness for the first block in an IV like manned when using a chained mode. But there is little reason to put in the effort to design such a mode that still will be much worse than AES. $\endgroup$
    – CodesInChaos
    Jan 8, 2013 at 18:47
  • $\begingroup$ I understand the general problem of message overhead. $\endgroup$
    – Thomas Lieven
    Jan 9, 2013 at 12:25
  • $\begingroup$ As far as I know the gain of a cipher from plain text to cipher text is called stretch factor. For a probabilistic cipher this factor is compulsorily larger than 1, i.e. the cipher text of a probabilistic cipher will always be larger than the corresponding plain text. So a +10% size for a probabilistic cipher does not sound that much for me. $\endgroup$
    – Thomas Lieven
    Jan 9, 2013 at 12:34
  • 3
    $\begingroup$ @ThomasLieven For block ciphers with mode of operations using an initialization vector, we can get away with a fixed overhead (i.e. stretch factor converges to 0 for long messages), and still get a probabilistic cipher. $\endgroup$
    – Paŭlo Ebermann
    Jan 9, 2013 at 20:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.