I want the encryptor to be able to choose a key X and using it and the public key, he will be able to encrypt a message m. Then I get the key X and using the matching private key I'm able to generate another key Y, which using it anyone can decrypt messages encrypted with X, and only with it. Is such a cryptosystem possible, still being secure? If so, how?

Something like this:

An image illustrating the crytosystem

  • It is impossible to say whether this is secure, without knowing the context and the threat model. Secure against what?
    – Sjoerd
    Oct 21 '20 at 13:25
  • Secure against someone getting x-keys, and being able to decrypt other x-s. Oct 21 '20 at 13:27
  • Have you considered encrypting both symmetrically and asymetrically? E.g. encrypt=AES(x, RSA(pub, msg)).
    – Sjoerd
    Oct 21 '20 at 14:04
  • But than what would be the X-key? It would have to be the RSA private key, and if someone got it he can decrypt all x-s Oct 21 '20 at 15:26

Yes, there are ways to do this.


The sender

  1. RSA-KEM select a uniform random integer x between 2 and n-1, where n is the RSA modulus with at least n>=2^2048.
  2. Use HKDK to derive a 128, 192, or 256 it key k k = KDF(x)
  3. Encrypt the data with (c,tag) =AES-GCM_ENC(k, message)
  4. Encrypt the $x$ with the receivers public key K = RSA_enc(pk,x)
  5. Send (K,c,tag) pair to the receviver.

The receiver

  1. Decrypt the x with k = RSA_DEC(priv,K)
  2. Use HKDK to derive a 128, 192, or 256 it key k k = KDF(x)
  3. Decrypt the data with (message,tag) =AES-GCM_DEC(k, c)
    1. If the tag doesn't match, stop!!!

Some notes:


Use the existing libraries of the NaCl. This library has authenticated encryption with the public key; The Crypto-Box. Implemented for various languages.


This is Elliptic Curve Integrated Encryption Scheme (ECIES). After the key exchange use AES-GCM-SIV or Chacha20-Poly1305.

  • But then couldn't someone who has X and a message encrypted using it find its k and use it to decrypt? Oct 22 '20 at 4:18
  • Find my private key to decrypt x? Life doesn't work in this way. RSA is based on the hardness of factoring... If everything is used properly, like using a good random number generator for the key generator, good RSA modulus size like > 2048 you will be fine. The current factoring recond is 829 bit. So, tell us who can do this to RSA-2048 other than hacking or the quantum computer ( long story).
    – kelalaka
    Oct 22 '20 at 6:47
  • But if another person is getting a random x, can't they just decrypt the message with AES (using KDF(x))? Oct 22 '20 at 9:19
  • The probability of hitting x by uniform random selection is 1/2^128 for 128-bit key. You have more chance of getting hit by lightning. Use AES 256 and far 1/2^256. You should check about big numbers. I can see that this area is not your subject, and you are asking simple questions that can only be understood if you know math and probability. Even AES-128 is secure after 20 years.
    – kelalaka
    Oct 22 '20 at 9:41
  • 1
    Why do we need to publish our key material :). It is the most precious item in the Cryptography that must be kept secret and protected all the time and should be erased after use. These are common practices in Cryptography.
    – kelalaka
    Oct 22 '20 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.