Short question:
If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security disadvantage to encrypting the blocks directly with the RSA asymmetric key rather than deriving a symmetric AES key using DH and using that?
I understand that hybrid encryption using an AES symmetric key is faster than encrypting every block with RSA. And I understand that using hybrid encryption with a DH-derived AES key might be more secure than pure RSA is if you also hash-ratchet the AES key to provide forward secrecy.
But if we ignore hash ratcheting and forward secrecy, for a given stream is DH-AES actually more secure than just encrypting every message with RSA? I don't think it is, but I want to confirm.
Longer question:
If we assume:
A symmetric (such as AES) encryption function
symEncrypt(K,M)
that can encryptM
-byte blocks with keyK
, with a matchingsymDecrypt(K,M)
function that decrypts the results, such thatM = symDecrypt(K, symEncrypt(K, M))
An asymmetric (such as RSA) encryption function
asymEncrypt(K.pub,M)
that can can also encryptM
-byte blocks with a public keyK.pub
, with a matchingasymDecrypt(K.priv,M)
function that decrypts the result with the private keyK.priv
, such thatM = asymDecrypt(K.priv, asymEncrypt(K.pub, M))
Two parties, Alice and Bob, each of whom have generated one-session-use asymmetric keypairs
Alice.pub/priv
andBob.pub/priv
respectively, and have exchanged those public keys with each otherA plaintext message split up into a series of
M
-byte sized blocks,P[0]...P[n]
, that Alice wants to send Bob in a secure fashion, over an insecure network
Is there any security difference between:
Hybrid Encryption:
A ciphertext message constructed using CBC atop AES symmetric encryption using a Diffie-Hellman derived key:
- Alice derives a secret key from her private key and Bob's public key:
K = Diffie-Hellman(Alice.priv,Bob.pub)
- Alice encrypts the first block using a predetermined IV, and sends it to Bob:
C[0] = symEncrypt(K, P[0] ^ IV)
- Alice encrypts the second block using the first cihperblock, and sends it to Bob:
C[1] = symEncrypt(K, P[1] ^ C[0])
- ... and so on for all n blocks
- Bob derives the same secret key that Alice did, using Bob's private key and Alice's public key:
K = Diffie-Hellman(Bob.priv,Alice.pub)
- Bob decrypts the first block using the predetermined IV:
P[0] = symDecrypt(K, C[0]) ^ IV
- Bob decrypts the second block using the first cipherblock:
P[1] = symDecrypt(K, C[1]) ^ C[0]
- ... and so on for all n blocks
Pure Asymmetric Encryption:
A ciphertext message constructed using CBC atop RSA asymmetric encryption:
- Alice encrypts the first block using a predetermined IV, and sends it to Bob:
C[0] = asymEncrypt(Bob.pub, P[0] ^ IV)
- Alice encrypts the second block using the first cihperblock, and sends it to Bob:
C[1] = asymEncrypt(Bob.pub, P[1] ^ C[0])
- ... and so on for all n blocks
- Bob decrypts the first block using the predetermined IV:
P[0] = asymDecrypt(Bob.priv, C[0]) ^ IV
- Bob decrypts the second block using the first cipherblock:
P[1] = asymDecrypt(Bob.priv, C[1]) ^ C[0]
- ... and so on for all n blocks
I think in every practical sense they will be equivalently secure. (Sure, maybe one will take a thousand years to crack, and the other two thousand years, but both are effectively secure for real world use.)
It's not more secure to derive a shared AES symmetric session key using Diffie-Hellman and encrypt a message with that, than to just encrypt a message with a RSA public key and decrypt it with the corresponding private key, is it?
asymEncrypt
use? Textbook RSA? RSAES-PKCS1-v1_5? RSAES-OAEP? Is the matchingasymDecrypt
secure against Bleichenbacher-style attacks? How secure is the generation of the "one-session use public RSA keypair" against side-channel and key-guessing attacks? How does the matching public key become trusted (there could be protocol attacks on that)? – fgrieu Feb 04 '21 at 09:17