0

I have a key-value database that uses asymmetric RSA-OAEP encryption to encrypt the data. The data is stored in tuples of (public key, encrypted data). The user identifies their data by the public key, and decrypts it with their private key.

Are there any downsides to the encrypted data/public keys being stored publicly besides Harvest Now, Decrypt Later? The reasons the database is public is because it can be cheaper than private alternatives in a risk-cost-benefit analysis.

Improve this question

1 Answer 1

Reset to default
0

Think of defense in depth. When you store data privately, potential attackers need first to get access to your data. This can be a huge barrier to many potential attackers. Whereas when you store data publicly, you remove this barrier.

If the attacker obtains passwords to some of data sets using social engineering, fishing, malware or other ways, then it can be possible to obtain decrypted data.

because it can be cheaper than private alternatives in a risk-cost-benefit analysis

Calculate what would it cost you to store encrypted data privately. Estimate the probability of different attacks. Calculate, how much will it cost you, if the attacker decrypts some of your data. Then compare.

Improve this answer
2
  • Are there any vulnerabilities the encrypted data in the public dataset?
    – willuhmjs
    Apr 18 at 15:54
  • @willuhmjs: No. The strength of decryption does not change. But in one case the attacker needs to solve two problems, obtain encrypted data and obtain the keys. In another case the attacker gets encrypted data easily and have only one problem to solve, obtain the keys.
    – mentallurg
    Apr 18 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .