Wie in Verwenden RSA Verschlüsselung

问题

You brauchen in verschlüsseln Daten mit ein öffentlich Schlüssel also das nur der holder von der privat Schlüssel kann entschlüsseln it.

Voraussetzungen

• Understanding of public-key cryptography
• Knowledge of key sizes and padding

Schritte

1. 1. Generate or obtain a key pair

   Generate an RSA key pair of at least 2048 bits; 3072 or 4096 bits are recommended for long-term security. The public key can be shared freely; the private key must be kept secret. Alternatively, obtain the recipient's public key.

   Eingabe

   key size: 4096

   输出

   public key + private key

2. 2. Encrypt with OAEP padding

   Use OAEP (Optimal Asymmetric Encryption Padding) with a hash like SHA-256. Never use PKCS#1 v1.5 padding for encryption, as it is vulnerable to padding oracle attacks. RSA can only encrypt data smaller than the key size minus padding overhead.

   Eingabe

   small message + public key

   输出

   ciphertext

3. 3. Decrypt with the private key

   The private key holder decrypts the ciphertext using OAEP with the same hash. For large data, encrypt a symmetric key with RSA and encrypt the data with AES (hybrid encryption). This is how TLS and PGP work.

   Eingabe

   ciphertext + private key

   输出

   original message

Erwartetes Ergebnis

Daten encrypted mit ein öffentlich Schlüssel das nur der corresponding privat Schlüssel kann entschlüsseln.

Häufige Fehler

Message is too long for RSA

RSA can only encrypt data up to key_size - padding_overhead bytes. Use hybrid encryption: encrypt an AES key with RSA and the data with AES.

Using PKCS#1 v1.5 padding

PKCS#1 v1.5 is vulnerable to Bleichenbacher's padding oracle attack. Always use OAEP.

Troubleshooting指引

• If decryption fails, verify the padding scheme and hash match on both sides.
• For large files, use hybrid encryption rather than chunking with RSA directly.

Sicherheitsgrenzen

• RSA key sizes below 2048 bits are considered insecure. Use 3072+ bits for new applications.
• All operations are local. Private keys never leave your machine.