36

I am using rsa key to encrypt a long string which I will send to my server(will encrypt it with server's public key and my private key) But it throws an exception like `javax.crypto.IllegalBlockSizeException: Data must not be longer than 256 bytes`

I feel that I have not understood the working of rsa properly till now(using the inbuilt libraries are the cause for this).

Can some one please explain why this exception is being thrown. Is it not at all possible to send long string encrypted?

Just use HTTPS and the encryption will be done transparently - zaph 2016-07-19 04:50

58

The RSA algorithm can only encrypt data that has a maximum byte length of the RSA key length in bits divided with eight minus eleven padding bytes, i.e. number of maximum bytes = key length in bits / 8 - 11.

So basicly you divide the key length with 8 -11(if you have padding). For example if you have a 2048bit key you can encrypt 2048/8 = 256 bytes (- 11 bytes if you have padding). So, either use a larger key or you encrypt the data with a symmetric key, and encrypt that key with rsa (which is the recommended approach).

That will require you to:

- generate a symmetric key
- Encrypt the data with the symmetric key
- Encrypt the symmetric key with rsa
- send the encrypted key and the data
- Decrypt the encrypted symmetric key with rsa
- decrypt the data with the symmetric key
- done :)

Why is there a restriction like that, that you can encrypt data upto a certain length only - Ashwin 2012-04-07 01:17

The limitation

`key length in bits / 8 - 11`

is valid only when `PKCS1Padding`

is used. For example, with `NoPadding`

limitation will be `key length in bits / 8`

- divanov 2013-11-18 21:38
Both PKCS#1v1.5 padding and no padding are insecure. Use OAEP padding (which reduces the block size by more than 11 bytes - CodesInChaos 2014-08-13 10:22

Excellent. This answer helped me encrypting huge data.exampleWaleed Abdalmajeed 2017-10-19 11:15

22

Based on @John Snow answer, I did an example

Generate Symmetric Key (AES with 128 bits)

`KeyGenerator generator = KeyGenerator.getInstance("AES"); generator.init(128); // The AES key size in number of bits SecretKey secKey = generator.generateKey();`

Encrypt plain text using AES

`String plainText = "Please encrypt me urgently..." Cipher aesCipher = Cipher.getInstance("AES"); aesCipher.init(Cipher.ENCRYPT_MODE, secKey); byte[] byteCipherText = aesCipher.doFinal(plainText.getBytes());`

Encrypt the key using RSA public key

`KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA"); kpg.initialize(2048); KeyPair keyPair = kpg.generateKeyPair(); PublicKey puKey = keyPair.getPublic(); PrivateKey prKey = keyPair.getPrivate(); Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding"); cipher.init(Cipher.PUBLIC_KEY, puKey); byte[] encryptedKey = cipher.doFinal(secKey.getEncoded()/*Seceret Key From Step 1*/);`

Send encrypted data (byteCipherText) + encrypted AES Key (encryptedKey)

On the client side, decrypt symmetric key using RSA private key

`cipher.init(Cipher.PRIVATE_KEY, prKey); byte[] decryptedKey = cipher.doFinal(encryptedKey);`

Decrypt the cipher using decrypted symmetric key

`//Convert bytes to AES SecertKey SecretKey originalKey = new SecretKeySpec(decryptedKey , 0, decryptedKey .length, "AES"); Cipher aesCipher = Cipher.getInstance("AES"); aesCipher.init(Cipher.DECRYPT_MODE, originalKey); byte[] bytePlainText = aesCipher.doFinal(byteCipherText); String plainText = new String(bytePlainText);``

is there a mistake in step 3? I don't see "secKey" being encrypted intead Cipher initialized as RSA is encrypting the encrypted data - user482963 2018-04-05 13:01

@user482963, edited - Waleed Abdalmajeed 2018-05-24 11:56

11

You should not use RSA on your secret data directly. You should only ever use RSA on *pseudo-random* or *completely random* data, such as session keys or message authentication codes.

You've gotten the problem at 256 bytes -- that is because you're probably working with 2048 bit keys. The keys are able to encrypt any integer in the range `0`

to `2^2048 - 1`

into the same range, and that means your data must be 256 bytes or smaller.

If you intend to encrypt more than this, please use one RSA encryption to encrypt a session key for a symmetric algorithm, and use *that* to encrypt your data.

Why is there a restriction like that, that you can encrypt data upto a certain length only - Ashwin 2012-04-07 01:17

Because RSA is performed on a *finite ring*, the only numbers that exist are the integers in the range

`[0, 2^2048-1]`

, inclusive. Any message longer than 2048 bits represents a number outside this range, and must be encoded in either two blocks or -- if you want safety -- the entire message should be encrypted in a session key. Real-world deployed RSA must protect against multiple attacks, and never working on "raw" plaintext is one important part of using RSA safely - sarnold 2012-04-08 22:50
2

To follow on from John Snow's answer above I created a simple random-symmetric-crypt library that you can use to simply encrypt any length data using a private key.

You can find the library at GitHub - random-symmetric-crypto

```
final RandomSymmetricCipher cipher = new RandomSymmetricCipher();
// Encrypt the data and the random symmetric key.
final CryptoPacket cryptoPacket = cipher.encrypt(inputData, PRIVATE_KEY_BASE64);
// Convert the CryptoPacket into a Base64 String that can be readily reconstituted at the other end.
final CryptoPacketConverter cryptoPacketConverter = new CryptoPacketConverter();
final String base64EncryptedData = cryptoPacketConverter.convert(cryptoPacket);
System.out.println("Base64EncryptedData=" + base64EncryptedData);
// Decrypt the Base64 encoded (and encrypted) String.
final byte[] outputData = cipher.decrypt(base64EncryptedData, PUBLIC_KEY_BASE64);
```

I can't find where you specify which padding mode to use. You should explicitly specify OAEP padding, since other common paddings like PKCS#1v1.5 or no padding at all are insecure - CodesInChaos 2014-08-13 10:27

Happy to accept a pull request. Have you got a URL to support that no padding is insecure - William 2014-08-13 12:19

Boneh has written a good overview of attacks against RSA. Crypto.se has lots of questions about textbook RSA as well. I couldn't find a MAC in the symmetric part of your code. This means you'll be vulnerable to active attacks, such as padding oracles. The old and still popular PKCS#1v1.5 padding is vulnerable to active attacks as well (unless you work around the weakness *really* carefully), namely Bleichenbacher's attack - CodesInChaos 2014-08-13 12:34

The paddings are specified in the RandomSymmetricCipher class. It is using "DESede/CBC/PKCS5Padding" for the symmetric and "RSA/ECB/PKCS1Padding" for the public key cipher. It is trivial to change them. http://stackoverflow.com/a/10935308/493682 lists several options and links to more - William 2014-08-15 07:12

So if you have a server which receives messages and directly decrypts them, returning an error if it's invalid (a pretty common configuration), an attacker can use that server to decrypt the message. There are two relevant attacks, the standard padding oracle against unauthenticated CBC and Bleichenbacher against RSA with PKCS#1v1.5 padding - CodesInChaos 2014-08-15 07:47

Yes I understand the attack. I don't think either of the 2 padding configs I've used are subject to that. Though if you can show otherwise and provide a better alternative I'm all ears - William 2014-08-15 18:37

-4

you need split your data by the publicKey

```
int keyLength = publicKey.getModulus().bitLength() / 16;
String[] datas = splitString(data, keyLength - 11);
String mi = ""//the data after encrypted;
for (String s : datas) {
mi += bcd2Str(cipher.doFinal(s.getBytes()));
}
return mi;
public static String bcd2Str(byte[] bytes) {
char temp[] = new char[bytes.length * 2], val;
for (int i = 0; i < bytes.length; i++) {
val = (char) (((bytes[i] & 0xf0) >> 4) & 0x0f);
temp[i * 2] = (char) (val > 9 ? val + 'A' - 10 : val + '0');
val = (char) (bytes[i] & 0x0f);
temp[i * 2 + 1] = (char) (val > 9 ? val + 'A' - 10 : val + '0');
}
return new String(temp);
}
```

Just because you can do something does not mean you should. What is needed is hybrid encryption where the data is encrypted with a symmetric algorithm such as AES using a random key and the key is encrypted with RSA - zaph 2016-07-19 04:42

Notes: 1. "data" is the plural, "datum" is the singular form. 2. The

`bcd2Str`

method is really performing hexadecimal encoding [0-9A-Z]. 3. There may be no need to encode the binary output by the RSA encryption and if encoding is necessary, while hexadecimal is OK, the usual case is to use Base64 encoding, it is more compact - zaph 2016-07-19 04:54