I always thought that the reason we couldn't use it was because it required too many CPU cycle. But an answer from @TomLeek indicated that this was not the case :


Most texts that talk about hybrid encryption say that we need to do that because asymmetric encryption is slow, but that's wrong. The real reason why hybrid encryption is used is because known asymmetric encryption algorithms cannot simply process messages of arbitrary length, and we have no real idea about how we could alter them in order to do so securely. Basically, the "chaining modes" for block ciphers do not have equivalents for asymmetric encryption that would be obviously safe.

Why is it so complicated to use RSA as a block cipher?

When you look at it quickly, RSA encrypt a block of text so we could call it a "block cipher" and then you just need to plug that into a good block cipher mode of operation and you would call it a day. BUT, it seems that RSA require some fancy padding to be secure. Would the security problem related to that padding issue?


  • 3
    Related: crypto.stackexchange.com/questions/14/… – StackzOfZtuff Oct 29 '15 at 20:18
  • Can you explain what part of Tom's answer you don't understand? Specifically he said it's hard to know how to properly chain the blocks together in a secure way. If you don't chain the blocks together using feedback from one to put into the next, you get the problems of ECB mode in block ciphers. – Steve Sether Oct 29 '15 at 21:18
  • @SteveSether I understand that part quite well but everything is in the details. Why can't you use the feedback from one block for the next one like in CBC. The answer of ThomasPornin on crypto SE give more clues to the reason. – Gudradain Oct 30 '15 at 1:51

There is no theoretical reason why asymmetric algorithms can't be optimized to handle larger length plain text messages, but symmetric algorithms have a few advantages for application level data bound to their symmetric nature.

  • Having a single secret shared between two peers for user (application level) messaging is conducive to simple and elegant protocols.
  • Less cryptographic innovation is required to provide speed and resistance to partial plain text and other attacks because the burden of having a public key that does not open a door to the discovery of the private key in any reasonable time frame is relieved.
  • Symmetric algorithms and software implementations of them have evolved over the historical use of SSL and TLS along the lines of high speed, stream-able frame handling, and resilience to attack for large messages.
| improve this answer | |
  • 1
    What about the 'arbitrary length' reason mentioned by Tom Leek in the question? What about the padding issue brought up in the question? – schroeder Jan 24 '17 at 11:39

Yes RSA can easily be used as a block cipher as you mentioned, but the real problem is speed. When you design a protocol you need it to work smoothly between all type of devices, you need to deliver a good quality of service to your clients, and what is better than block and stream ciphers to deliver good speed!

Google for example is is moving to CHACHA20 because it is faster than AES and uses CPU friendly instruction.

| improve this answer | |
  • Every part of this answer is the opposite of what was asked in the question. Is the question’s premise wrong? – Steve Oct 8 '18 at 15:23
  • Not much research is done on having RSA to work as block cipher with different mode of operations that insure security. Why? Because no body is going to use a slow block cipher. – daygoor Oct 8 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.