Short question:
If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security disadvantage to encrypting the blocks directly with the RSA asymmetric key rather than deriving a symmetric AES key using DH and using that?
I understand that hybrid encryption using an AES symmetric key is faster than encrypting every block with RSA. And I understand that using hybrid encryption with a DH-derived AES key might be more secure than pure RSA is if you also hash-ratchet the AES key to provide forward secrecy.
But if we ignore hash ratcheting and forward secrecy, for a given stream is DH-AES actually more secure than just encrypting every message with RSA? I don't think it is, but I want to confirm.
Longer question:
If we assume:
A symmetric (such as AES) encryption function
symEncrypt(K,M)that can encryptM-byte blocks with keyK, with a matchingsymDecrypt(K,M)function that decrypts the results, such thatM = symDecrypt(K, symEncrypt(K, M))An asymmetric (such as RSA) encryption function
asymEncrypt(K.pub,M)that can can also encryptM-byte blocks with a public keyK.pub, with a matchingasymDecrypt(K.priv,M)function that decrypts the result with the private keyK.priv, such thatM = asymDecrypt(K.priv, asymEncrypt(K.pub, M))Two parties, Alice and Bob, each of whom have generated one-session-use asymmetric keypairs
Alice.pub/privandBob.pub/privrespectively, and have exchanged those public keys with each otherA plaintext message split up into a series of
M-byte sized blocks,P[0]...P[n], that Alice wants to send Bob in a secure fashion, over an insecure network
Is there any security difference between:
Hybrid Encryption:
A ciphertext message constructed using CBC atop AES symmetric encryption using a Diffie-Hellman derived key:
- Alice derives a secret key from her private key and Bob's public key:
K = Diffie-Hellman(Alice.priv,Bob.pub) - Alice encrypts the first block using a predetermined IV, and sends it to Bob:
C[0] = symEncrypt(K, P[0] ^ IV) - Alice encrypts the second block using the first cihperblock, and sends it to Bob:
C[1] = symEncrypt(K, P[1] ^ C[0]) - ... and so on for all n blocks
- Bob derives the same secret key that Alice did, using Bob's private key and Alice's public key:
K = Diffie-Hellman(Bob.priv,Alice.pub) - Bob decrypts the first block using the predetermined IV:
P[0] = symDecrypt(K, C[0]) ^ IV - Bob decrypts the second block using the first cipherblock:
P[1] = symDecrypt(K, C[1]) ^ C[0] - ... and so on for all n blocks
Pure Asymmetric Encryption:
A ciphertext message constructed using CBC atop RSA asymmetric encryption:
- Alice encrypts the first block using a predetermined IV, and sends it to Bob:
C[0] = asymEncrypt(Bob.pub, P[0] ^ IV) - Alice encrypts the second block using the first cihperblock, and sends it to Bob:
C[1] = asymEncrypt(Bob.pub, P[1] ^ C[0]) - ... and so on for all n blocks
- Bob decrypts the first block using the predetermined IV:
P[0] = asymDecrypt(Bob.priv, C[0]) ^ IV - Bob decrypts the second block using the first cipherblock:
P[1] = asymDecrypt(Bob.priv, C[1]) ^ C[0] - ... and so on for all n blocks
I think in every practical sense they will be equivalently secure. (Sure, maybe one will take a thousand years to crack, and the other two thousand years, but both are effectively secure for real world use.)
It's not more secure to derive a shared AES symmetric session key using Diffie-Hellman and encrypt a message with that, than to just encrypt a message with a RSA public key and decrypt it with the corresponding private key, is it?