0
$\begingroup$

Short question:

If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security disadvantage to encrypting the blocks directly with the RSA asymmetric key rather than deriving a symmetric AES key using DH and using that?

I understand that hybrid encryption using an AES symmetric key is faster than encrypting every block with RSA. And I understand that using hybrid encryption with a DH-derived AES key might be more secure than pure RSA is if you also hash-ratchet the AES key to provide forward secrecy.

But if we ignore hash ratcheting and forward secrecy, for a given stream is DH-AES actually more secure than just encrypting every message with RSA? I don't think it is, but I want to confirm.

Longer question:

If we assume:

  1. A symmetric (such as AES) encryption function symEncrypt(K,M) that can encrypt M-byte blocks with key K, with a matching symDecrypt(K,M) function that decrypts the results, such that M = symDecrypt(K, symEncrypt(K, M))

  2. An asymmetric (such as RSA) encryption function asymEncrypt(K.pub,M) that can can also encrypt M-byte blocks with a public key K.pub, with a matching asymDecrypt(K.priv,M) function that decrypts the result with the private key K.priv, such that M = asymDecrypt(K.priv, asymEncrypt(K.pub, M))

  3. Two parties, Alice and Bob, each of whom have generated one-session-use asymmetric keypairs Alice.pub/priv and Bob.pub/priv respectively, and have exchanged those public keys with each other

  4. A plaintext message split up into a series of M-byte sized blocks, P[0]...P[n], that Alice wants to send Bob in a secure fashion, over an insecure network

Is there any security difference between:

Hybrid Encryption:

A ciphertext message constructed using CBC atop AES symmetric encryption using a Diffie-Hellman derived key:

  1. Alice derives a secret key from her private key and Bob's public key: K = Diffie-Hellman(Alice.priv,Bob.pub)
  2. Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = symEncrypt(K, P[0] ^ IV)
  3. Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = symEncrypt(K, P[1] ^ C[0])
  4. ... and so on for all n blocks
  5. Bob derives the same secret key that Alice did, using Bob's private key and Alice's public key: K = Diffie-Hellman(Bob.priv,Alice.pub)
  6. Bob decrypts the first block using the predetermined IV: P[0] = symDecrypt(K, C[0]) ^ IV
  7. Bob decrypts the second block using the first cipherblock: P[1] = symDecrypt(K, C[1]) ^ C[0]
  8. ... and so on for all n blocks

Pure Asymmetric Encryption:

A ciphertext message constructed using CBC atop RSA asymmetric encryption:

  1. Alice encrypts the first block using a predetermined IV, and sends it to Bob: C[0] = asymEncrypt(Bob.pub, P[0] ^ IV)
  2. Alice encrypts the second block using the first cihperblock, and sends it to Bob: C[1] = asymEncrypt(Bob.pub, P[1] ^ C[0])
  3. ... and so on for all n blocks
  4. Bob decrypts the first block using the predetermined IV: P[0] = asymDecrypt(Bob.priv, C[0]) ^ IV
  5. Bob decrypts the second block using the first cipherblock: P[1] = asymDecrypt(Bob.priv, C[1]) ^ C[0]
  6. ... and so on for all n blocks

I think in every practical sense they will be equivalently secure. (Sure, maybe one will take a thousand years to crack, and the other two thousand years, but both are effectively secure for real world use.)

It's not more secure to derive a shared AES symmetric session key using Diffie-Hellman and encrypt a message with that, than to just encrypt a message with a RSA public key and decrypt it with the corresponding private key, is it?

$\endgroup$
2
  • $\begingroup$ Short answer: Use TLS? $\endgroup$
    – kelalaka
    Commented Feb 4, 2021 at 8:40
  • 1
    $\begingroup$ What kind of RSA encryption does asymEncrypt use? Textbook RSA? RSAES-PKCS1-v1_5? RSAES-OAEP? Is the matching asymDecrypt secure against Bleichenbacher-style attacks? How secure is the generation of the "one-session use public RSA keypair" against side-channel and key-guessing attacks? How does the matching public key become trusted (there could be protocol attacks on that)? $\endgroup$
    – fgrieu
    Commented Feb 4, 2021 at 9:17

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.