Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a small security assignment and I was instructed to implement simple encryption/decryption of files using RSA in C#.

When attempting to encrypt/decrypt large files, I was informed by the compiler that the file size cannot exceed the key length. I can solve this problem by breaking the files into key-sized blocks and repeating the encryption, but would this jeopardize my RSA key? Why or why not?

share|improve this question
up vote 11 down vote accepted

RSA encryption works on messages which are no longer than the public key modulus size (actually the limit is slightly below that, e.g. 117 bytes for a 1024-bit RSA key). The usual method for encrypting things with RSA is to use a hybrid mode: you create a random symmetric key (a bunch of random bytes, with a cryptographically secure random number generator), you encrypt symmetrically your data with that key (using a symmetric cipher such as AES), and you encrypt the symmetric key with RSA. Symmetric ciphers can deal with arbitrary length data. A symmetric key is rather short, typically 16 or 32 bytes, so there is no problem in encrypting that with RSA.

Be warned that you are in the process of designing your own cryptographic protocol, which is a very bad idea. Actually the first and foremost of all cryptography-related bad ideas. Even for something as simple-looking as asymmetric encryption of a blob, people who have tried to design such a protocol have gone through years of multiple versions and security holes, painfully plugged one by one. You should really use an existing protocol for that. One such protocol is OpenPGP. Bouncy Castle is an opensource library which has a C# version, and which includes an OpenPGP implementation. Use it, and you will live longer and happier.

share|improve this answer
I definitely don't like the idea, but when I suggested (to the instructor) that I implement this by exchanging a symmetric key with RSA, then encoding with that symmetric key, he responded with the block solution. I was a bit suspect since the idea does not appear anywhere in practice. Guess I'll stick to the symmetric key approach! – Joshc1107 Apr 8 '11 at 17:49
@Joshc1107 Use 3 keys: RSA Key, AES key for large file enc, HMAC key for integrity protection. You'll need IV and 2x Nonce, too. Run AES CBC mode. Cryptext = Enc(Nonce1||K_AES||K_HMAC,K_RSA), Nonce2, HMAC(Nonce2||FILE,K_HMAC), IV, Enc(FILE,K_AES,IV). When decrypting, verify stored HMAC matches decrypted FILE HMAC. AES is a block cipher, it chunks the file into blocks. RSA is way too slow to run in a block mode. IV & Nonces stop plaintext attacks. You're in a class, do not worry about rolling own encryption; you're learning. HOWEVER, NEVER roll your own crypto for in real life! – Andrew Philips Nov 23 '15 at 12:39

One thing that you lose with this method is that an attacker can remove or replay any block that they want; there is no verification. This could be solved by encrypting a hash of the contents as the last block, but there will likely be other problems with this scheme as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.