是否可以通过使用 2 个或更多 RSA 密钥加密消息来获得额外的安全性？
编辑： 一些说明：
我最感兴趣的上下文是加密随机生成的对称密钥。
我不想将问题限制为连续加密两次；目的是避免大型 RSA 密钥的高计算成本。应考虑使用不太直接的策略，例如将消息分成几部分并单独加密。
应该假设只获取消息的一部分是可以接受的。
如果您知道任何由专家专门讨论此问题的出版物，或使用多个 RSA 密钥的算法，请贡献。
Is it possible to get additional security by encrypting a message using 2 or more RSA keys?
EDIT: A few clarifications:
The context I am most interested in doing this for is encrypting a randomly generated symmetric key.
I don't want to limit the question to encrypting twice in a row; the purpose is to avoid the high computational cost of large RSA keys. Using less straightforward tactics such as breaking the message into parts and encrypting them separately should be considered as an option.
It should be assumed that getting only part of the message is acceptable.
If you know of any publications where this is discussed specifically by an expert, or algorithms that use multiple RSA keys, then please contribute.
发布评论
评论（5）
不。
进行有关密码学的思想实验是不安全的。建议您严格遵循专家走过的道路。
当专家想要更好地保护某些东西时，他们会使用更大的密钥大小（至少需要 2048 位，较小的证书不足以让您安心）或使用椭圆曲线 证书优先于 RSA。
顺便说一句，您还记得您的消息正文通常使用对称密码和随机密钥进行加密，并且只是使用收件人的公钥对这个随机密钥进行加密。对该密钥进行双重加密不会使该密钥更长，也不会影响攻击者对其进行暴力破解的能力。
量子密码学 - 我提到它只是作为一个令人兴奋的旁白，你不需要将其纳入你的选择 - 承诺密钥大小有趣的事情：RSA 密钥将被 Shor 的算法，但对称密钥 (Grover's）将只有一半长度（128 位将相当于 64 位，因此可以破解）。当然，关于这种量子机器是否可以实现等等还有争议:)
No.
It is not safe to do thought experiments regarding cryptography. You are advised to keep narrowly to the path trodden by the experts.
And when the experts want to protect something better, they use a bigger key-size (at least 2048 bits is required, smaller certificates are insufficient for any peace of mind) or use elliptic curve certificates in preference to RSA.
Incidentally, you're remember that your message body is typically encrypted with a symmetric cipher and a random key, and that just this random key is encrypted with the public key of the recipient. Double-encrypting this secret key won't make this secret key longer, and won't impact an attacker's ability to brute-force that.
Quantum cryptography - I mention it only as an exciting aside, you need not factor this into your choice - promises interesting things for the keysizes: the RSA keys will be wiped out by Shor's algorithm, but the symmetric keys (Grover's) will be only half-lengthed (128-bits will be equiv to 64-bits, so will be crackable). There is of course debate about whether such quantum machines can be implemented etc etc :)
不会。
如果密钥 A 被泄露，则使用 A+B 加密可以防止泄露，但在这种特殊情况之外，您不会获得任何额外好处。
No.
If Key A is compromised than encrypted with A+B will protect against the compromise, but outside that special case, you get no additional benefit.
组合密码
假设您有一个加密函数
E(M, K)，其中M是明文消息，K> 是关键。假设E中不存在已知漏洞。您生成两个完全不相关的密钥
K1和K2。可以保证，如果您以
E(E(M, K1), K2)的形式组合它们，实际上不可能以这种方式失去安全性。如果可能因加密E(M, K1)而失去安全性，无论是使用K2还是任何其他密钥，则密码已被破坏，因为攻击者可以执行E(E(M, K1), KF)，其中KF是攻击者希望选择的任何密钥。如需了解详情，请参阅此处。
使用不同的密钥加密每隔一个块
这里的含义是显而易见的。假设您使用正确组合的加密原语和
加密函数：密钥组合，如果您使用两个密钥集中的不同密钥加密每隔一个块，则攻击者只能解密他拥有的块的关键。Composing ciphers
Say you have an encryption function
E(M, K), whereMis the plaintext message andKis the key. Say no known vulnerabilities exist inE.You generate two completely unrelated keys
K1andK2.It is guaranteed that if you compose them in the form
E(E(M, K1), K2), it is impossible to actually lose security this way. If it was possible to lose security from encryptingE(M, K1), be it withK2or any other key, the is cipher broken, because an attacker could just doE(E(M, K1), KF)whereKFis any key the attacker wishes to choose.For more info see here.
Encrypting every second block with a different key
The implications here are obvious. Assuming you are using properly composed cryptographic primitives with both
encryption function:keycombinations, if you encrypt every second block with a different key out of the set of two keys, the attacker can only decrypt the blocks he has the key for.是的！
但不要使用原始加密。使用 RSA 加密方案。不要使用第二个密钥重新加密加密消息，这可能会削弱效果（我不知道），而是使用共享秘密算法将您的秘密一分为二。共享秘密算法可以将秘密分割成 n 个部分，并确保如果攻击者设法获得 n-1 个秘密，他对秘密一无所知。所以不要简单地将秘密一分为二。
然后您可以拥有 2 个以上的 RSA 密钥。共享秘密算法的另一个强大特性是可以将秘密分布在 n 个部分上，并且只需要 m 个部分（其中 m 小于 n）来恢复秘密。这使得秘密恢复对于碎片丢失更加稳健。
请在此处查看有关共享密钥的更多信息：http://en.wikipedia.org/wiki/Shared_secret
Yes!
But do not use raw encryption. Use RSA encryption schema. Instead of reencrypting the encrypted message with the second key, which might have weakening effet (I don't know), use the shared secret algorithm to split your secret in two. The shared secret algorithm make it possible to split a secret in n pieces and ensures that if an attacker manages to get n-1 pieces he knows nothing of the secret. So don't simply split the secret in two.
You can then have more then 2 RSA keys. Another powerful property of the shared secret algorithm is that it is possible to spread the secret over n pieces and require only m pieces, with m smaller than n, to recover the secret. This makes the secret recovery more robust to loss of pieces.
Look here for more information on shared secret: http://en.wikipedia.org/wiki/Shared_secret
除了给出的答案之外，除非您进行一些修补，否则它根本不起作用。非常简单，其中一个模数必须大于另一个。如果先对较大的模数进行 RSA mod，最后对较小的模数进行 RSA mod，则会丢失信息，并且不能保证成功解密。明显的补丁是始终首先使用较小的模数进行加密。当然，你必须按照相反的顺序进行解密。另一个简单的补丁是选择大小非常接近的模，这样遇到无法唯一解密的密文的概率就非常小。
In additional to the answers given, it also simply doesn't work unless you do some patching. Very simply, one of the moduli must be larger than the other. If you perform RSA mod the larger modulus first and mod the smaller last you lose information and cannot guarantee successful decryption. The obvious patch is to always encrypt with the smaller modulus first. Of course, you have to perform decryption in the opposite order. Another simple patch is choose moduli that a very close together in size, so that the probability that you encounter a ciphertext that cannot be uniquely decrypted is vanishingly small.