I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate another key Y, which using it anyone can decrypt messages encrypted with X, and only with it. Is such a cryptosystem possible, still being secure? If so, how?

Something like this:

An image illustrating the crytosystem

  • It is impossible to say whether this is secure, without knowing the context and the threat model. Secure against what?
    – Sjoerd
    Oct 21, 2020 at 13:25
  • Secure against someone getting x-keys, and being able to decrypt other x-s. Oct 21, 2020 at 13:27
  • Have you considered encrypting both symmetrically and asymetrically? E.g. encrypt=AES(x, RSA(pub, msg)).
    – Sjoerd
    Oct 21, 2020 at 14:04
  • But than what would be the X-key? It would have to be the RSA private key, and if someone got it he can decrypt all x-s Oct 21, 2020 at 15:26

1 Answer 1


Yes, there are ways to do this.


The sender

  1. RSA-KEM select a uniform random integer x between 2 and n-1, where n is the RSA modulus with at least n>=2^2048.
  2. Use HKDK to derive a 128, 192, or 256 it key k k = KDF(x)
  3. Encrypt the data with (c,tag) =AES-GCM_ENC(k, message)
  4. Encrypt the $x$ with the receivers public key K = RSA_enc(pk,x)
  5. Send (K,c,tag) pair to the receviver.

The receiver

  1. Decrypt the x with k = RSA_DEC(priv,K)
  2. Use HKDK to derive a 128, 192, or 256 it key k k = KDF(x)
  3. Decrypt the data with (message,tag) =AES-GCM_DEC(k, c)
    1. If the tag doesn't match, stop!!!

Some notes:


Use the existing libraries of the NaCl. This library has authenticated encryption with the public key; The Crypto-Box. Implemented for various languages.


This is Elliptic Curve Integrated Encryption Scheme (ECIES). After the key exchange use AES-GCM-SIV or Chacha20-Poly1305.

  • But then couldn't someone who has X and a message encrypted using it find its k and use it to decrypt? Oct 22, 2020 at 4:18
  • Find my private key to decrypt x? Life doesn't work in this way. RSA is based on the hardness of factoring... If everything is used properly, like using a good random number generator for the key generator, good RSA modulus size like > 2048 you will be fine. The current factoring recond is 829 bit. So, tell us who can do this to RSA-2048 other than hacking or the quantum computer ( long story).
    – kelalaka
    Oct 22, 2020 at 6:47
  • But if another person is getting a random x, can't they just decrypt the message with AES (using KDF(x))? Oct 22, 2020 at 9:19
  • The probability of hitting x by uniform random selection is 1/2^128 for 128-bit key. You have more chance of getting hit by lightning. Use AES 256 and far 1/2^256. You should check about big numbers. I can see that this area is not your subject, and you are asking simple questions that can only be understood if you know math and probability. Even AES-128 is secure after 20 years.
    – kelalaka
    Oct 22, 2020 at 9:41
  • 1
    Why do we need to publish our key material :). It is the most precious item in the Cryptography that must be kept secret and protected all the time and should be erased after use. These are common practices in Cryptography.
    – kelalaka
    Oct 22, 2020 at 10:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .