5
$\begingroup$

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.

To summarise, we generate a symmetric key and encrypt it using RSA. We would encrypt our data using the symmetric, and prefix it with the IV and encrypted key. You therefore need the private key from the RSA keypair to be able to decrypt the symmetric key and then decrypt the data using the symmetric key.

My question is about combining RSA with autheticated encryption, specifically AES in GCM mode. Are there any pitfalls, or any reasons this might be a bad idea?

Is it a good idea to include the IV and RSA-encrypted symmetric key in the additional data (to provide integrity for them), or should they simply be prefixed to the encrypted data?

Improve this question
$\endgroup$
8
  • $\begingroup$ What security properties do you want? Anyone who knows your public key can send you a message with a valid authentication tag. $\endgroup$
    – Paŭlo Ebermann
    Commented Apr 24, 2013 at 19:58
  • $\begingroup$ @PaŭloEbermann Are you sure that's correct, as I don't see how that would work? The symmetric key used by AES would be randomly generated. It is only stored with the encrypted data after being RSA-encrypted. $\endgroup$
    – MurrayA
    Commented Apr 24, 2013 at 21:09
  • $\begingroup$ "The symmetric key used by AES would be randomly generated" by anyone "who knows your public key". $\endgroup$
    – user991
    Commented Apr 24, 2013 at 21:25
  • $\begingroup$ @RickyDemer Ah, I see the problem now... doesn't the same problem exist for 'normal' hybrid cryposystems too? Is there a better way to do this? $\endgroup$
    – MurrayA
    Commented Apr 24, 2013 at 21:54
  • 1
    $\begingroup$ Yes, but these don't pretend to be "authenticated". We actually have a weak kind of authentication, knowing that whoever sent your message actually knew the whole message, not only part of that. The classic solution would be to add an (asymmetric) signature to your message. $\endgroup$
    – Paŭlo Ebermann
    Commented Apr 24, 2013 at 22:01

1 Answer 1

Reset to default
3
$\begingroup$

The main pitfall is possibly thinking that it provides authentication.
The result is still a public key scheme.

It won't help to include the IV in the associated data, since
that is already covered by the authenticated part of AEAD.

Including the RSA-encrypted symmetric key in the associated data would help by making the
resulting hybrid encryption CCA2 secure even if the core public key scheme is only RCCA secure.

RCCA: Relaxing Chosen-Ciphertext Security

Improve this answer
$\endgroup$
4
  • $\begingroup$ I need to make the IV available somehow, whether it is prefixed to the data or stored in the associated data - is there any reason not to store it in the associated data? $\endgroup$
    – MurrayA
    Commented Apr 24, 2013 at 18:45
  • $\begingroup$ That would take slightly more computation. $\:$ $\endgroup$
    – user991
    Commented Apr 24, 2013 at 19:07
  • $\begingroup$ So my understanding is that it is pointless to combine AEAD with RSA, because anyone with your public key can create data that will be verified as 'authentic'. Using a digital signature would prevent that, but then it is the signature providing the authenticity propery, not AE - so you gain nothing from combining the two. $\endgroup$
    – MurrayA
    Commented Apr 25, 2013 at 8:11
  • $\begingroup$ AEAD with some public key encryption is probably the best way to build $\hspace{2 in}$ public key encryption with associated data. $\:$ $\endgroup$
    – user991
    Commented Apr 25, 2013 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.