7
$\begingroup$

From the website of GNU Privacy Guard (GnuPG):

If an attacker could decrypt a session key it would only be useful for reading the one message encrypted with that session key. The attacker would have to start over and decrypt another session key in order to read any other message.

From my understanding, if an attacker is able to decrypt a session key which was encrypted through a public key, then the attacker practically has the corresponding private key pair.

Hence, it is not difficult to decrypt any further session keys encrypted by the public key.

How does a session key make this any more secure? I can only see this as redundant security.

Improve this question
$\endgroup$
2
  • $\begingroup$ Could you please clarify the sentence "How is a session key makes this any more secure?" $\endgroup$
    – Patriot
    Commented Jan 28, 2021 at 15:22
  • $\begingroup$ Don't just think about it as security; also think about it as performance. Your session key is symmetric (both sides use the same one, instead of one side having a public key and the other having a private key); using it is much faster than asymmetric encryption. $\endgroup$
    – Charles Duffy
    Commented Jan 28, 2021 at 18:32

1 Answer 1

Reset to default
12
$\begingroup$

From my understanding, if an attacker is able to decrypt a session key which was encrypted through a public key, then the attacker practically has the corresponding private key pair.

Effectively yes, however only for that single message. Note that session keys are chosen independently and so leaking one doesn't allow you to guess any others. The public key encryption is also independently randomized preventing efficient recovery from the known plaintext. Then, as soon as you consider more than one message, leaking a strict subset of session keys is not as powerful as leaking the private key once.

If you're looking for a scenario where recovery of the session key is sometimes possible but recovery of the private key is not consider the following:
Suppose you run on an old copy of Debian with a weak RNG. Further suppose that you want to send a message to somebody else running a modern copy of Debian who also generated their private key on that modern copy. Now because of the RNG bug, you accidentally pick a weak session key and encrypt it. You then send a message which gets observed by an adversary knowing you run old Debian and brute-forces the session key exploiting the bad RNG output. Now your message has leaked, but no messages from other parties using good RNGs leaked.

If this is "too far-fetched" replace the Debian RNG bug in the above explanation with say a Spectre side-channel leaking the session key.

Improve this answer
$\endgroup$
3
  • 4
    $\begingroup$ I suspect what OP means by their question is that they can't imagine how can a session key be decrypted without the knowledge of the private key. So, logically, once the attacker is in the possession of this private key - the attacker will then be able to decrypt any other session keys with no effort at all until a different private/public key pair is used. $\endgroup$
    – tum_
    Commented Jan 28, 2021 at 14:46
  • 2
    $\begingroup$ @tum_ I have added an example scenario which should (hopefully?) clarify that. Thanks for pointing it out! $\endgroup$
    – SEJPM
    Commented Jan 28, 2021 at 14:52
  • 1
    $\begingroup$ So from the linked gpg manual, given 'a hybrid cipher is no stronger than the public-key cipher or symmetric cipher it uses', the public key is not necessarily always the weaker. And your RNG bug scenario has clarified this. Thank you. $\endgroup$
    – Desmond Rhodes
    Commented Jan 28, 2021 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.