Is it safe to use private key encryption for lots of small blocks of data themselves?

Question

I currently handle small JSONs of sensitive information which are guaranteed to be smaller than 100 bytes. You can encrypt up to ~500 bytes with a 4096 RSA key.

Is it safe/secure to store these chunks of encrypted messages together? Let's say they get altogether stolen for cryptanalysis. Let's say you even have plaintext associated to some of them. Could you derive the private key or get knowledge about the rest of the encrypted messages?

Additional note: I need to encrypt without the requirement of the owner presence, but I need to guarantee the owner is present if that info is being read. That's the reason I'm using asymmetric encryption.

Answer 1

Yes, you can use RSA with a good padding scheme for this. I would recommend OAEP, even if it requires more overhead (up to 130 bytes for SHA-512).

No, your private key is safe. The contents of the cryptographic messages is safe as well, even if the plaintext is known (the random padding added before encryption will make sure that you cannot distinguish between cryptographic messages based on the contents of the plaintext).

If encryption with the public key would break this scheme then RSA encryption would be broken; an attacker has the ability to encrypt an arbitrary number of messages.

Please note that:

• a hybrid cryptosystem is still more flexible and should be preferred;
• encryption and especially decryption of many small messages is going to take a large amount of CPU time;
• the private key is only secure if side channel attacks do not apply (i.e. decrypt on a secure system);

Furthermore, RSA encryption only provides confidentiality of the messages (not authenticity of messages):

• anybody can encrypt, including attackers;
• messages can be re-ordered at will;
• messages can be left out at will;
• messages can be replaced at will;

You will of course also need some scheme to ensure that the private key is not used without the presence of the auditor/owner.