# RSA key exposure

Is there any limit to the number bytes that an RSA key can be used before it can be exposed. In Symmetric encryption a Key is not recommended to be used to encrypt more than specific amount of data then it has to be transformed into an inactive state. Is this the same with RSA or asymmetric encryption schemes I didn't found any references for this issue is anyone can help I would appreciate this

• I don't think there is a reachable limit with RSA. Even with typical AES modes of operation, the limit is around 2^68 bytes, which is pretty hard to reach. Feb 12, 2014 at 10:48
• Please not that unlike Block ciphers which depends on permutation substitution, and although might have weaknesses like AES which is far from a perfect block cipher, assymmetric encryption depends on mathematical property that ties two numbers (exponents or even curves together) Feb 13, 2014 at 21:42

With RSA, encryption uses only the public key, so everybody can take a RSA public key and encrypts trillions of messages with it. No limit there. RSA decryption uses the private key. If an attacker can send you "messages" of his choosing for you to decrypt, and he can work out the private key from your responses, then that is called a chosen ciphertext attack. RSA is supposed to resist CCA.

In 1998, Bleichenbacher published a CCA against RSA, as defined by PKCS#1 (the "v1.5 padding"). Namely, if you send random junk to a RSA decryption engine, that junk will turn out to "decrypt successfully" (syntactically correct padding) with probability 1/65536 or so; this information is sufficient to recover the private key in one million requests or so.

Frequent private key rotation (e.g. once every 100000 usages) could have been an answer, but it is impractical because a basic PC, used as a SSL server, can be made to use its private key 100000 times in much less than an hour. Instead, cryptographers began to think, and came up with two solutions:

• "Hide" the information about the decryption success. This is what SSL servers do: if the decryption does not yield a correct value, just use a random one and keep on; the SSL handshake will fail a couple messages later. This prevents the attack because the attacker cannot distinguish between "the decryption failed because the padding was incorrect" and "the decryption succeeded and obtained a pre-master secret that the attacker does not have".

• Use a better padding with a probability of "success on random junk" considerably smaller. This is called OAEP padding.

Bottom-line is: IF there is a practical maximum number of messages that you may process with RSA, beyond which the private key is somehow exposed, THEN you are doing it wrong.

Speaking of which, the usual mantras on key rotation for symmetric algorithms are often more wishful conjuring and traditional half-forgotten lore than rational security measures. As @CodesInChaos suggests, AES was designed with a 128-bit block size precisely so that it can be used on gigatons of data without leaking the secret key.

I just want to clarify some details first a cipher with 128-bit length is not 128-bit strong, AES has a lot of published attacks that surely verify that AES-128 is surely not a strong 128 bit. Even with improved number of rounds it is safe to say that AES -128 is about or less than 64-bit strong. Another problem you face with any block cipher is that your message itself, you have to talk a language, this language is structured a lot of collision may and will happen, if you have a collision free cipher and you alway send a "hello" text in each block with ECB your data is exposed and can be exposed Now back to my issue here, in RSA encryption and decryption method are the same but with different keys, if the key can be calculated "partially" after a number encryption "public key" The private key can be calculated as well after a number of operations. Though the main difference is that a signature uses hash output which improve the randomness of the input though regular hash functions SHA suffers from length extension weakness which is particularly important when we take about signature since usually data signed in RSA has specific structure. Another problem that also any hash function has is the birthday attack, ! I am concerned merely about the number of times that an RSA key can be used without exposure.