Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a stream that I want to encrypt for broadcast to 10,000 subscribers. I know I should encrypt this data using a symmetric key; and also intend that this symmetric key will be rotated every 30 days.

Assuming that I already have a Public key for each subscriber (private key only known to them), how should I encrypt the symmetric key and send it to the subscribers?

Or is this just obvious; I just encrypt the symmetric key with each public key? Are there any special considerations I need to take?

For example, how does the length of the symmetric key factor in to the solution? I am considering wrapping the symmetric key in a SOAP or JSON message which may alter the length of the final string to be encrypted.

share|improve this question
If you control the entire system, are you opposed to using existing command line software to do this? Like gpg, etc? –  barrycarter Mar 25 '11 at 17:14
I'd like to do this all within managed C# code if possible. –  makerofthings7 Mar 25 '11 at 17:32
If there's other features you might eventually want, like deterring people who might share keys, you should skim an overview of the Broadcast Encryption field such as this paper: math.scu.edu/~jhorwitz/pubs/broadcast.pdf –  user502 Mar 25 '11 at 19:58
fyi @user502 new URL is: xenon.stanford.edu/~horwitz/pubs/broadcast.pdf –  makerofthings7 Jul 19 '13 at 14:33
add comment

1 Answer

up vote 12 down vote accepted

You just encrypt the symmetric with the public key of each recipient. There is some research on how to do better than that (so that the size overhead is less than, say, a hundred bytes per recipient) but there is nothing directly applicable right now.

If you use RSA (that's the most probable), then here are the sizes: an encrypted message always has the same size than the modulus; for a 1024-bit RSA key, this means 128 bytes. The encryption process includes some padding, which adds an internal overhead of at least 11 bytes. Thus, the maximum size of a data blob which is to be encrypted with a 1024-bit RSA key is 128-11 = 117 bytes.

I am not sure why you would want to wrap the symmetric key in a SOAP or JSON message. If it is encrypted then the receiver must decrypt it; since an encrypted RSA message really looks like a bunch of random bytes with no visible structure, this means that the receiver already knows what to expect. What would SOAP or JSON add at that point ? Maybe you would like to do it the other way round, i.e. encrypt (with RSA) the symmetric key, and then wrap the result (the 128-byte encrypted message) into a SOAP or JSON message ?

share|improve this answer
Thank you.. I inverted my thinking and wrapping the results in JSON to provide metadata makes sense. How would you suggest I generate the symmetric key? Any algorithm? –  makerofthings7 Mar 25 '11 at 17:45
@makerofthings: a symmetric key is a bunch of arbitrary bits. To generate such a key, you need a cryptographically strong RNG (Random Number Generator), which is seeded with "true alea" from hardware sources. This is a job for the operating system, who has direct access to hardware. On Linux, FreeBSD and other unix-like systems, use /dev/urandom. On Windows, call CryptGenRandom(). With Java, use java.security.SecureRandom. –  Thomas Pornin Mar 25 '11 at 19:47
Is it correct that for a 1024 bit RSA key, the maximum size of a symmetric key I can use is 117 bytes? –  makerofthings7 Mar 18 at 17:00
With RSA PKCS#1 v1.5 encryption, the maximum size of that which is encrypted will be 11 bytes less than the modulus size. This does not depend on whether that which is encrypted is part of a "key" or something else; a byte is a byte. With RSA PKCS#1 "OAEP" (new in v2.0), the limit is actually even lower. Of course, most protocols which do "asymmetric encryption" only encrypt with RSA a random symmetric key (16 bytes are enough for most decent security), and then use that symmetric key to encrypt gigabytes of data; so the limit is not a true limitation. –  Thomas Pornin Mar 18 at 20:48
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.