Proof of public-key encryption

Question

Let us assume three entities: $A, B,$ and $C$, and let $[p_C, P_c]$ the private/public key pair of $C$. Assume that $A$ encrypts a message $m$ using the public key of $C$, $P_C$, and sends this encrypted message $c$ to $B$.

My question is: can $B$ somehow discriminate that the encrypted message $c$ is the result of the public-key encryption of a value with the public key $P_c$? (public keys are public, so known to everybody).

@JohnDeters actually an unclear question since the public key cryptosystem is not defined! — kelalaka, Dec 10 '21 at 18:49
To solve my problem, I am actually looking at the properties of the encrypted message itself, without considering any metadata. I left the public key cryptosystem intentionally general, just because I am looking for a public key cryptosystem which allows you to have this property (sort of proof that a specific public key has been used). — Transagonistica, Dec 10 '21 at 20:49

score 1 · Answer 1 · answered Dec 10 '21 at 16:48

If you encrypt the message using the public key of C entity (P_c) and send it on B through entity A, the entity B could not decrypt the m to understand it content because the encrypted key belongs to another entity and not in the entity of B. So when B receive the encrypted message, will try to decrypt it using private key of B but because the m is encrypted with public key of C, B will not manage to decrypt it and will drop it.

What happens if TextBook RSA is used? The PKC is not defined, so unclear question. — kelalaka, Dec 10 '21 at 18:51

score 1 · Answer 2 · answered Dec 10 '21 at 19:25

1

can B somehow discriminate that the encrypted message m is the result of the public-key encryption of a value with the public key P_c?

It depends on the public key algorithm. With RSA, for example, the encrypted session key value (which is public) is always less than the value of the RSA encryption modulus (which is also public) used to encrypt it.

If it is the case that key C's public RSA modulus is greater than keys A and B's, then a session key encrypted by key C could also be greater than A and B's public modulus. In such a case it would be known neither key A nor key B could have produced it.

answered Dec 10 '21 at 19:25

fuzzydrawrings

111
3

1

Have you ever heard RSA-KEM? – kelalaka Dec 10 '21 at 20:17
@kelalaka I don't see how RSA-KEM and (e.g.) RSA-OAEP are different for this answer. Either way, the possible range of RSA ciphertexts is different for different keys, and that can be a practical distinguisher if you have enough ciphertexts relative to the number of potential keys. – Gilles 'SO- stop being evil' Dec 11 '21 at 09:23

score 0 · Answer 3 · answered Dec 10 '21 at 16:55

No, it's not possible to B to know anything about the message itself, unless it contains metadata. The message itself is just a opaque block of binary data. It's possible to infer the algorithm used for encrypting, but not much more than that.

If the message have metadata describing it, things change. But they change only because there's a field somewhere saying "Encrypted by A using C public key", not because any intrinsic property of the message.

Proof of public-key encryption

3 Answers3