4

I am working on an application which has a requirement to send very small messages (<64 bits), asynchronously, and using secure asymmetric encryption. We've experimented with simple RSA + OAEP, and it is workable, but with the caveat that at recommended key sizes it is quite inefficient for our tiny messages.

My understanding is that this is just a fact of life for asymmetric algorithms in general, but maybe I'm wrong. Are there any standard asymmetric algorithms that are more efficient (in terms of ciphertext length) for very small message sizes, without sacrificing security?

2
  • 1
    Are you aware that some serious attacks exists against RSA when used for encrypting arbitrary messages (not just a random symmetric AES key) crypto.stackexchange.com/questions/2323/…
    – Robert
    Jan 16 at 21:07
  • This is not my area but why not use TOTP for data transfer after the handshake?
    – Konchog
    Jan 16 at 22:36

1 Answer 1

8

Probably the best you can do is to use Curve25519 to derive a secret and then use the secret to derive a key and IV which are used to encrypt the data symmetrically with an AEAD. That would expand your message about 48 bytes but would be smaller and more secure than trying use use RSA and OAEP.

Specifically, I would suggest you use the NaCl crypto_box transform because this is a well-known, secure library with many implementations and the algorithms are considered trusted. It uses Salsa20 and Poly1305 for the AEAD, which are secure for this use. It may expand your message slightly more than 48 bytes, but even if it expanded it 64 bytes, you'd end up with a 128-byte value for a 64-byte message, which is smaller than anything using a 3072-bit RSA key (which is the minimum for 128-bit security).

This is technically a hybrid approach, but in general, everybody uses hybrid approaches for asymmetric encryption because they're well known and secure, as well as being substantially faster than the alternatives.

I wouldn't recommend sending actual messages as the message in RSA-OAEP. That's larger than you want, and I wouldn't be surprised if there are potentially interesting attacks on that approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.