Why encrypt symmetric keys first with RSA and then the private-key with a PW?

Question

In for example the Microsoft Encrypting File System, the SYM-Key is first encrypted with a RSA-Pub-key and its corresponding private-key is then encrypted using a users password. Why not encrypt the SYM-key directly with the PW?

Answer 1

There are a few likely, closely related reasons for this:

1. you need both a password and the encrypted private key to decrypt (i.e. you need two factors);
2. it is possible to attack the password for the encrypted symmetric key using an offline attack, even if it is using a key derivation function such as PBKDF2.
3. private keys can also be stored on smart cards that perform the private key operation, that way the decryption key can be stored even more securely, and protected against offline attacks.

Reason 2 is of course also possible for the encrypted private key, but generally we can assume that the encrypted private key is less accessible to an attacker.

---

Another possible advantage is that you may not need a password or private key to encrypt the symmetric key. If this is an actual advantage is of course dependent on the use case. For file systems it seems like a useful feature, but I don't think it will be the one that tips the balance.

---

The major drawback is of course that you cannot just remember a private key; you need some kind of connected computing or at least storage device for the encrypted private key. If you store the private key and leak it (e.g. copy it over and not securely delete it) then a lot of the advantages can be lost.