Lets say message A is encrypted with symmetric encryption. BUT before encrypting the message, it is asymmetrically encrypted (let's say to implement VPN ...).

Now if a man in the middle captures the message, and he knows the public key used to decrypt the message, I understand the message will be still encrypted via the symmetric encryption.

Can the man in the middle then brutre force the symmetrically encrypted message (that he/she has just decrypted with the public key )?

  • 1
    Hello and welcome to Information Security! To me it sounds like your question boils down to "can symmetric encryption be brute forced". Why do you bring the asymmetric encryption into the question? – Anders Jun 28 '16 at 15:48
  • @Anders Because I'm trying to related it to VPN. How secure is a VPN since a public key can be used to decrypt the message one time. Then the symmetric key will be somewhat brute forced.... – Kurt Miller Jun 28 '16 at 15:55
  • 3
    This question seems to have a misunderstanding how a VPN secures a connection. – d0nut Jun 28 '16 at 16:12
  • 2
    The public key is public (hence its name), knowing it does not provide any useful knowledge to a potential attacker (great brains have thoroughly checked this). The message is not ciphered two times, one time with asymmetric and one time with symmetric encryption: it is encrypted only once using symmetric encryption. Asymmetric encryption is used during the initial handshake to check identities and agree on a symmetric key (and depending on the cipher suite used, even an attacker able to decipher the handshake may still remain unable to find this symmetric key). – WhiteWinterWolf Jun 28 '16 at 16:32
  • 1
    @KurtMiller asymmetric and symmetric encryption are not stacked on top of each other as you described in the case of a VPN or in general. You do not have the proper understanding. – d0nut Jun 28 '16 at 16:38

VPN (and other secure communications in general) that are based on both asymmetric and symmetric encryption do not work as you describe.

You do NOT symmetrically encrypt the original data and then asymmetrically encrypt the data again. What you do is to use asymmetric crypto to agree on the symmetric key, and then use the symmetric key to encrypt the data. It is done that way mainly because symmetric ciphers are faster. Much faster. Therefore, you use asymmetric encryption only to send a small data: the symmetric key.

A very simple implementation could be the client chooses a symmetric key by himself, and encrypts it with the public key of the server. Note that the client has the key because he generated it, and the server has the key by using its private key to decrypt it. No one else will be able to decrypt it, because only the server owns the private key. Of course real schemes get a little more complicated to avoid more complex attacks, but this example already mitigates the attack you are describing.

So if you break the asymmetric cipher, you get not the data, but the symmetric key. And with the symmetric key you get the data. But that is fine, since it is not easy to break the asymmetric scheme.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.