Asymmetric RSA Encryption in Python with PyCrypto: A Step-by-Step Guide

In the world of cryptography, asymmetric encryption offers a robust way to secure data by using a pair of keys: a public key for encryption and a private key for decryption. This system enables secure communication without the need to exchange a secret key between the sender and the receiver. The recipient only needs to share their public key, while keeping the private key secure. This encryption method is widely used for tasks such as securing messages, signing digital certificates, and authenticating users.

In this article, we will focus on implementing RSA asymmetric encryption using Python’s pycryptodome library (a fork of the original PyCrypto library). Specifically, we will demonstrate how to encrypt and decrypt messages using RSA public and private keys, leveraging the PKCS#1 OAEP encryption scheme.

What is RSA Asymmetric Encryption?

RSA (Rivest-Shamir-Adleman) is one of the most widely used asymmetric encryption algorithms. It works by generating a pair of keys:

• Public Key: This key is shared openly and used by anyone to encrypt messages meant for the key’s owner.
• Private Key: This key is kept secret by the owner and is used to decrypt the messages encrypted with the corresponding public key.

RSA is based on the mathematical properties of large prime numbers and modular arithmetic, making it highly secure when proper key sizes are used (2048 bits or higher).

Why Use PKCS#1 OAEP?

PKCS#1 OAEP (Optimal Asymmetric Encryption Padding) is a padding scheme that provides additional security compared to other schemes like PKCS#1 v1.5. It ensures that the encryption is resistant to various attacks and is currently considered the best practice for RSA encryption.

Installing PyCryptodome

First, ensure you have the pycryptodome library installed. If not, you can install it using pip:

pip install pycryptodome

RSA Encryption and Decryption in Python

Let’s walk through an example of how to encrypt and decrypt messages using RSA and the PKCS#1 OAEP scheme.

Step 1: Generating RSA Keys

Before we can use RSA encryption, we need to generate a pair of keys (public and private). We’ll generate the keys using pycryptodome and save them to files (pubkey.pem for the public key and privkey.pem for the private key).

Here’s how to generate the RSA keys:

from Crypto.PublicKey import RSA
 
# Generate RSA key pair
key = RSA.generate(2048)
 
# Export the public key and private key
private_key = key.export_key()
public_key = key.publickey().export_key()
 
# Save the keys to files
with open('privkey.pem', 'wb') as priv_file:
    priv_file.write(private_key)
 
with open('pubkey.pem', 'wb') as pub_file:
    pub_file.write(public_key)

Explanation:

• RSA.generate(2048) generates a 2048-bit RSA key pair. This is considered secure for most use cases.
• The private key and public key are then exported in PEM format using the export_key() method.
• Finally, we save the keys to files (privkey.pem and pubkey.pem), which can be shared securely for encryption and decryption.

Step 2: Encrypting the Message Using the Public Key

Now that we have the public key, we can use it to encrypt a message. Only someone with the corresponding private key will be able to decrypt the message.

from Crypto.Cipher import PKCS1_OAEP
from Crypto.PublicKey import RSA
 
# The message to encrypt
message = b'This is a very secret message.'
 
# Load the public key
with open('pubkey.pem', 'rb') as f:
    public_key = RSA.import_key(f.read())
 
# Encrypt the message using the public key
cipher = PKCS1_OAEP.new(public_key)
encrypted = cipher.encrypt(message)
 
# Print the encrypted message (in bytes)
print("Encrypted message:", encrypted)

Explanation:

• We load the public key from the pubkey.pem file using the RSA.import_key() method.
• We use PKCS1_OAEP to create a cipher object and encrypt the message.
• The encrypted message is printed as bytes. It’s important to note that the encrypted data is not human-readable.

Step 3: Decrypting the Message Using the Private Key

The recipient, who has the private key, can decrypt the message back to its original form.

from Crypto.Cipher import PKCS1_OAEP
from Crypto.PublicKey import RSA
 
# Decrypt the message using the private key
with open('privkey.pem', 'rb') as f:
    private_key = RSA.import_key(f.read())
 
# Decrypt the message using the private key
cipher = PKCS1_OAEP.new(private_key)
decrypted = cipher.decrypt(encrypted)
 
# Print the decrypted message
print("Decrypted message:", decrypted.decode())

Explanation:

• We load the private key from the privkey.pem file.
• We create a cipher object using PKCS1_OAEP and decrypt the previously encrypted message.
• The decrypted message is returned in bytes, and we decode it to print the original plaintext message.

Security Considerations

When using RSA for encryption, keep the following points in mind:

1. Key Size: The security of RSA encryption depends on the key size. For modern systems, 2048-bit keys are a good balance between security and performance. For highly sensitive data, you may choose to use 3072 or 4096-bit keys.
2. Private Key Protection: The private key must be kept secure. If the private key is compromised, anyone can decrypt messages meant for you.
3. Avoid Using Deprecated Algorithms: As mentioned earlier, the PKCS#1 v1.5 padding scheme is not recommended for new protocols due to vulnerabilities. Always use PKCS#1 OAEP for better security.

Conclusion

RSA asymmetric encryption is a powerful tool for securely transmitting data without the need to share a secret key. By using pycryptodome and the PKCS#1 OAEP scheme, we can securely encrypt and decrypt messages using a public-private key pair.

In this tutorial, we demonstrated how to generate RSA keys, encrypt a message using the public key, and decrypt it with the corresponding private key. RSA encryption is widely used for securing communications, digital signatures, and protecting sensitive data in various applications.