# Public key encryption with modified private key requried

I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate another key Y, which using it anyone can decrypt messages encrypted with X, and only with it. Is such a cryptosystem possible, still being secure? If so, how?

Something like this:

• It is impossible to say whether this is secure, without knowing the context and the threat model. Secure against what? Commented Oct 21, 2020 at 13:25
• Secure against someone getting x-keys, and being able to decrypt other x-s. Commented Oct 21, 2020 at 13:27
• Have you considered encrypting both symmetrically and asymetrically? E.g. `encrypt=AES(x, RSA(pub, msg))`. Commented Oct 21, 2020 at 14:04
• But than what would be the X-key? It would have to be the RSA private key, and if someone got it he can decrypt all x-s Commented Oct 21, 2020 at 15:26

Yes, there are ways to do this.

RSA-KEM

The sender

1. RSA-KEM select a uniform random integer `x` between `2` and `n-1`, where `n` is the RSA modulus with at least `n>=2^2048`.
2. Use HKDK to derive a 128, 192, or 256 it key `k` `k = KDF(x)`
3. Encrypt the data with `(c,tag) =AES-GCM_ENC(k, message)`
4. Encrypt the \$x\$ with the receivers public key `K = RSA_enc(pk,x)`
5. Send `(K,c,tag)` pair to the receviver.

1. Decrypt the `x` with `k = RSA_DEC(priv,K)`
2. Use HKDK to derive a 128, 192, or 256 it key `k` `k = KDF(x)`
3. Decrypt the data with `(message,tag) =AES-GCM_DEC(k, c)`
1. If the tag doesn't match, stop!!!

Some notes:

NaCl

Use the existing libraries of the NaCl. This library has authenticated encryption with the public key; The Crypto-Box. Implemented for various languages.

ECIES

This is Elliptic Curve Integrated Encryption Scheme (ECIES). After the key exchange use AES-GCM-SIV or Chacha20-Poly1305.

• But then couldn't someone who has X and a message encrypted using it find its k and use it to decrypt? Commented Oct 22, 2020 at 4:18
• Find my private key to decrypt `x`? Life doesn't work in this way. RSA is based on the hardness of factoring... If everything is used properly, like using a good random number generator for the key generator, good RSA modulus size like > 2048 you will be fine. The current factoring recond is 829 bit. So, tell us who can do this to RSA-2048 other than hacking or the quantum computer ( long story). Commented Oct 22, 2020 at 6:47
• But if another person is getting a random `x`, can't they just decrypt the message with AES (using KDF(x))? Commented Oct 22, 2020 at 9:19
• The probability of hitting `x` by uniform random selection is `1/2^128` for 128-bit key. You have more chance of getting hit by lightning. Use AES 256 and far `1/2^256`. You should check about big numbers. I can see that this area is not your subject, and you are asking simple questions that can only be understood if you know math and probability. Even AES-128 is secure after 20 years. Commented Oct 22, 2020 at 9:41
• Why do we need to publish our key material :). It is the most precious item in the Cryptography that must be kept secret and protected all the time and should be erased after use. These are common practices in Cryptography. Commented Oct 22, 2020 at 10:26