Score:1

Is combining hybrid encryption with OTP worthy?

pa flag

I'm considering a case when after hybrid encryption (AES Key encrypted via RSA) RSA key will be "splited" like in OTP. On the end one side gets encrypted AES key and "half" key RSA, and second side gets another "half" RSA and encrypted data what force to combine both sides to decrypt data.

But...

What in case when same data need to be decrypted multiple times ? As I undersand then OTP is vulnerable to TwoTimePad attack, but someone needs to get much more information than that. Maybe there is another option or standard to encrypt data (which need to be decrypted multiple times) and split keys to both sides ?

Score:1
kr flag

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

RSA, as well as elliptic curves, does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this public key really belongs to Bob. Alternatively, Bob tells the fingerprint of his public key to Alice. The fingerprint is not secret and can be shared easily. Bob provides his public key using any channel, even if it is insecure, e.g. he can publish it on any public web site or send via email.

Alice encrypts AES key with the Bob's RSA public key and sends it to Bob. Even insecure channel can be used for this, because nobody except Bob can decrypt it. Bob uses his RSA private key and decrypts the AES key. Using the same RSA key pair, they can exchange any number of AES keys.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with an RSA public key of Bob. Then sends this all together to Bob. Bob uses his RSA private key and decrypts the AES key. Then uses it to decrypt the message.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.