14

Would having a large number (10^4) of RSA encrypted files make it easier for an attacker to find my private RSA key?

Update: These files would be available to the attacker, and perhaps the content of a few of them could be guessed. The GnuPG implementation with a 2048-bit RSA key would be used, and the public key would be public.

2
  • please clarify the question, what type of RSA are you using, where are these files stored, is your public key readily available, etc?
    – mrnap
    Mar 4 '11 at 20:19
  • @mmap: I updated the question.
    – user1633
    Mar 4 '11 at 20:40
19

Short answer: there is no issue in encrypting 104 files with the same key.

Longer answer: it is called public encryption for a reason: the public key is, well, public. This means that anybody can encrypt data with the public key (it is the decrypting part which is reserved for the private key owner). In particular, the attacker can encrypt millions of files with your public key, if he wishes so. Asymmetric encryption systems are specifically designed to not suffer from that. In the case of RSA, this implies that any decent RSA encryption protocol includes random padding bytes, as PKCS#1 describes; the protocol used by GnuPG to encrypt data is decent.

1
  • 1
    +1 -- Didn't have my head screwed on straight when I opened my mouth...
    – Jeff Ferland
    Mar 4 '11 at 21:33
4

No. As long as you're using 2048 RSA and padding, and your public key passphrase is long (I like 20+ characters), uses alphanumerical and special characters, you shouldn't have any problem. Just make sure your private key isn't compromised :)

4
  • Private key does not equal the password to protect the private key (which you most likely mean). Of course that password has to be good too. The length of the private key is a function of that of the public key (if you only store d, with n, it's about the same size). Mar 4 '11 at 22:01
  • @Henno Doh! Yep, meant to say "public key passphrase is long", not "private key is long" :)
    – mrnap
    Mar 4 '11 at 23:53
  • 2
    what is a "public key passphrase"? Public keys are normally not protected whatsoever.
    – Fixee
    Mar 5 '11 at 22:04
  • @Fixee what I'm trying to say is, when you generate your public/private keys, make sure to choose a suitably long, randomized, and alphanumeric+special char password. Is that clearer?
    – mrnap
    Mar 7 '11 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy