# Encrypting multiple blocks with an asymmetric scheme

I have a general question how asymmetric schemes are usually implemented.

Typically, there is a parameter in an asymmetric scheme which limits the message length. For example the modulus in RSA.

I know that asymmetric encryption is usually used to encrypt a symmetric key and the actual message is encrypted with the latter.

But how are asymmetric schemes usually implemented? Only allowing small messages up to the limiting parameter (explicitly having symmetric keys in mind), or allowing arbitrary long messages (which would need some mode of operation, etc.)

-

Asymmetric encryption is indeed usually used as part of hybrid encryption: a random symmetric key K is generated by the sender; K is encrypted with the public key of the recipient, and the bulk of the data is encrypted with a symmetric encryption algorithm using K as key. This is basically using asymmetric encryption as a key exchange algorithm.

In fact this is not usually done that way; it is always done that way. There are several good reasons for that, namely that:

• We do not really know how to do "pure" asymmetric encryption securely. For symmetric encryption we have a lot of theory and practice on modes of operation; but for something like RSA we are still in the dark in that respect.

• Asymmetric encryption incurs size expansion; the encrypted text is necessarily larger than the source message ("necessarily" because of randomization, which is needed in order to defeat exhaustive search on the plaintext data). If asymmetric encryption is used throughout, then the size overhead for a big message becomes non-negligible. A contrario, with hybrid encryption the overhead is fixed even if you encrypt gigabytes of data.

• Asymmetric encryption and decryption is computationally more expensive than symmetric encryption.

These reasons feed each other: e.g. modes of operation for asymmetric encryption are not studied because it would be expensive anyway, for no clear gain.

A consequence is that a normal RSA implementation will accept to encrypt messages only up to the inherent size limit of the algorithm, and will not try to "split" the message into individually encrypted blocks or anything like that.

The only cases where asymmetric encryption is used without hybrid encryption are:

• Specialized cases where the data to encrypt is always short.
• Advanced protocols in which the sender must be able to prove some algebraic property about that which is encrypted, and/or homomorphic encryption (this is typical of electronic vote protocols). In these cases, the messages to encrypt are not just any sequence of bits; they have a lot of mathematical structure, and will again be short.
-