0
$\begingroup$

Short question:

If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security disadvantage to encrypting the blocks directly with the RSA asymmetric key rather than deriving a symmetric AES key using DH and using that?

I understand that hybrid encryption using an AES symmetric key is faster than encrypting every block with RSA. And I understand that using hybrid encryption with a DH-derived AES key might be more secure than pure RSA is if you also hash-ratchet the AES key to provide forward secrecy.

But if we ignore hash ratcheting and forward secrecy, for a given stream is DH-AES actually more secure than just encrypting every message with RSA? I don't think it is, but I want to confirm.

Longer question:

If we assume:

  1. A symmetric (such as AES) encryption function symEncrypt(K,M) that can encrypt M-byte blocks with key K, with a matching symDecrypt(K,M) function that decrypts the results, such that M = symDecrypt(K, symEncrypt(K, M))

  2. An asymmetric (such as RSA) encryption function asymEncrypt(K.pub,M) that can can also encrypt M-byte blocks with a public key K.pub, with a matching asymDecrypt(K.priv,M) function that decrypts the result with the private key K.priv, such that M = asymDecrypt(K.priv, asymEncrypt(K.pub, M))

  3. Two parties, Alice and Bob, each of whom have generated one-session-use asymmetric keypairs Alice.pub/priv and Bob.pub/priv respectively, and have exchanged those public keys with each other

  4. A plaintext message split up into a series of M-byte sized blocks, P[0]...P[n], that Alice wants to send Bob in a secure fashion, over an insecure network

Is there any security difference between:

Hybrid Encryption:

A ciphertext message constructed using CBC atop AES symmetric encryption using a Diffie-Hellman derived key:

  1. Alice derives a secret key from her private key and Bob's public key: K = Diffie-Hellman(Alice.priv,Bob.pub)
  2. Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = symEncrypt(K, P[0] ^ IV)
  3. Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = symEncrypt(K, P[1] ^ C[0])
  4. ... and so on for all n blocks
  5. Bob derives the same secret key that Alice did, using Bob's private key and Alice's public key: K = Diffie-Hellman(Bob.priv,Alice.pub)
  6. Bob decrypts the first block using the predetermined IV: P[0] = symDecrypt(K, C[0]) ^ IV
  7. Bob decrypts the second block using the first cipherblock: P[1] = symDecrypt(K, C[1]) ^ C[0]
  8. ... and so on for all n blocks

Pure Asymmetric Encryption:

A ciphertext message constructed using CBC atop RSA asymmetric encryption:

  1. Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = asymEncrypt(Bob.pub, P[0] ^ IV)
  2. Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = asymEncrypt(Bob.pub, P[1] ^ C[0])
  3. ... and so on for all n blocks
  4. Bob decrypts the first block using the predetermined IV: P[0] = asymDecrypt(Bob.priv, C[0]) ^ IV
  5. Bob decrypts the second block using the first cipherblock: P[1] = asymDecrypt(Bob.priv, C[1]) ^ C[0]
  6. ... and so on for all n blocks

I think in every practical sense they will be equivalently secure. (Sure, maybe one will take a thousand years to crack, and the other two thousand years, but both are effectively secure for real world use.)

It's not more secure to derive a shared AES symmetric session key using Diffie-Hellman and encrypt a message with that, than to just encrypt a message with a RSA public key and decrypt it with the corresponding private key, is it?

$\endgroup$
2
  • $\begingroup$ Short answer: Use TLS? $\endgroup$ – kelalaka Feb 4 at 8:40
  • 1
    $\begingroup$ What kind of RSA encryption does asymEncrypt use? Textbook RSA? RSAES-PKCS1-v1_5? RSAES-OAEP? Is the matching asymDecrypt secure against Bleichenbacher-style attacks? How secure is the generation of the "one-session use public RSA keypair" against side-channel and key-guessing attacks? How does the matching public key become trusted (there could be protocol attacks on that)? $\endgroup$ – fgrieu Feb 4 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.