The following take C programming language and Python as an example.
RSA's key is different from AES (or the block encryption algorithm).
Specifically, AES's key is byte by byte (unsigned characters), while RSA's key is operated in the long type.
When viewing the key in Python, you can see that the data form of the key is as follows.
# RSA - Python data
PublicKey(83263512511647620840626771691498251004604648594110197508580385953996828999497, 65537)
# AES - Python data
b'12345678901234567890123456789012'
# RSA - File data
-----BEGIN RSA PUBLIC KEY-----
MCgCIQC4FXpfXETC0us2BHofL2K7BE7t4de4j/xj0KprmbJ/SQIDAQAB
-----END RSA PUBLIC KEY-----
# AES - File data
12345678901234567890123456789012
I want to know how RSA converts this string of content that looks nothing like the PublicKey in Python into a key for use.
Because the key of the block encryption algorithm can obviously know that one byte of key corresponds to one byte of data. After the RSA key is decoded by Base64, it doesn't look like the following.
b'0(\x02!\x00\xb8\x15z_\\D\xc2\xd2\xeb6\x04z\x1f/b\xbb\x04N\xed\xe1\xd7\xb8\x8f\xfcc\xd0\xaak\x99\xb2\x7fI\x02\x03\x01\x00\x01'
PublicKey(83263512511647620840626771691498251004604648594110197508580385953996828999497, 65537)
Hmm. If I still haven't expressed clearly, I'll try to be more specific in my mind.
Because RSA key stores key data in long type (64 bit), while AES key stores key data in unsigned char (8 bit).
When reading the AES key, you can directly read bytes one by one to obtain the key.
RSA needs to convert the byte code in the file to long type data. What is the process like?
If the user enters a wrong key for AES decryption, some garbage data is generated. I want to verify the given decryption key and throw an error if the key is incorrect. How can I verify the key entered by the user?
Use an HMAC. The basic premise is that you run the plaintext through an HMAC, add the result to the plaintext and then encrypt. Then do the opposite when decrypting. If the plaintext and HMAC result match, then you know you've got the correct key.
OR, if you want to know prior to decryption, use the key material provided by the user to derive two further keys (using, say PBKDF2). Use one for encryption and another for an HMAC. In this case, encrypt first and then apply the HMAC using the second key. This way you can compute the HMAC and check if it matches before you decrypt.
Simplest approach is to add a magic number to the plaintext file data in a predictable location before encrypting; when decrypting, if the magic number is wrong, you used the wrong key. Downside to this approach is that it cannot validate the integrity/authenticity of the entire message.
To do that, use AES in an authenticated mode (e.g. AES-GCM) which gives stronger guarantees that the rest of the message was not tampered with.
One common way used to verify if a key is correctly entered, without revealing the actual key, is by use of a KCV (Key Check Value). When you create the key you would at the same time calculate the KCV, when the key is then entered manually, you can verify the entry by re-calcuylating the KCV. This is eg. used when entering keys manually into HSM's from physical key letters.
To calculate a KCV for an AES key you encrypt an empty (0x00) block with the key and the first 3 bytes of the resulting encrypted block is then the KCV.
Take a look here
I have a 1024 bits private key, and use it to generate a public key.
Does that automatically mean that my public key also has 1024 encryption? Or can it be of a lesser encryption size? (512, 256...)
PS: What i'm mostly interested in, and talking about, is the size of the modulus ("n") in RSA keys. The size is typically 1024 or 2048 bits. But I'm glad to see that this sparked a discussion, and all this is feeding my interest in cryptography.
This depends on the encryption algorithm and on what precisely you call public/private key. Sometimes it's possible to use a different size in RAM compared to serialization on disk or the network.
RSA
An RSA public key consists of a modulus n and a public exponent e. We usually choose a small value for e (3, or 65537 are common). The size of e has little influence on security. Since e is usually less than four bytes and n over a hundred, the total size is dominated by the modulus. If you really want to, you can fix e as part of your protocol specification so there is only n to store.
An RSA private key can be represented in different forms, but typically we store the values p, q, dp, dq, e, d, n, InvQ. Their combined size is larger than the public key. Most of these aren't strictly required, but it's convenient to have them available instead of regenerating them. Regenerating all of them given e, p and q is straight forward.
When we talk about key-size in the context of RSA we always mean the size of the modulus, ignoring all the other elements. This is a useful convention, since this is the only value that affects security. A typical size for n is 2048 bits.
Finite field crypto (Diffie-Hellman, DSA, etc.)
The private key is a scalar twice the size of the security level. A typical value is 256 bits.
The public key is a group element, which is much larger than the private key. A typical value is 2048 bits.
So with finite field crypto the public key is much larger than the private key.
Elliptic curves
The private key is a scalar twice the size of the security level. A typical value is 256 bits. This part is identical to finite field crypto.
The public key is a group element. There are two forms of serializing such an element. The compressed form is slightly larger than the private key (a couple of bits at most). The uncompressed form is about twice the size of the private key. A typical value for the compressed form is 256 bits and 512 bits for the uncompressed form.
Private key as seed
When you generate public/private key pairs yourself, you can always store them as seeds for a PRNG. That way they're quite small, 160 bits or so regardless of the scheme you use. The downside of this is that regenerating the natural form of the private key may be expensive. It is required that the method of creating the key pair remains constant.
Fingerprint of public key
Instead of storing the full public key, you can often store only a fingerprint, which is 160 bits or so in size. The downside of this is that it increases the size of the message/signature.
Summary
For some algorithms the size of public and private key are the same, for some they differ, and it is often possible to compress either or both of them at a cost (decompression time or message size).
No. The public key in a key pair always matches the private key size, in fact it is derived from the private key.
However, with some public key cryptographic implementations, such as OpenPGP, keys are created with subkeys assigned to different tasks. Those subkeys can be different sizes to each other and the master key used to create them. In those cases the public key data will indicate the key sizes for the master key and the subkey(s) which will match the corresponding private key data.
Whereas many other public key implementations do not utilise subkeys (e.g. TLS) so you will only ever see the single key size. Again that key size will be indicated in both the public and private key data.
The only variation in key sizes you will see is when asymmetric encryption is used in conjunction with symmetric encryption. The symmetric encryption (session key) will be smaller, but it uses entirely different algorithms (e.g. AES, TWOFISH, etc.) and is not part of the public key (except in OpenPGP, where symmetric cipher preferences can be saved because it does not utilise a live connection to establish the symmetrically encrypted communication and exchange session key data).
EDIT: More detail on the relationship between the public and private key data (also known as proving David wrong)
Pointing to RSA is all very well and good, but it depends on the key exchange protocol and for that we go to Diffie-Hellman key exchange and the original patent, which is now expired. Both of these have examples and explanations of the key exchange methods and the relationship between the public and private keys.
Algorithms implementing this relationship, including RSA and El-Gamal, all create both the public and private keys simultaneously. Specifically by creating a private key which then generates the public key. The public key inherits all the features of the private key which made it. The only way to get mis-matched details between the two components would be by somehow generating a public key independently of the private key. The problem there, of course, is that they would no longer be a key pair.
The key generation descriptions for both RSA and El-Gamal explain the common data between the public and private keys and specifically that all the components of the public key are a part of the private key, but the private key contains additional data necessary to decrypt data and/or sign data. In El-Gamal the public components are G, q, g and h while the private components are G, q, g, h and x.
Now, on to the lack of mention of the bit size of the key pairs in the algorithms, yes, that's true, but every practical implementation of them incorporates the selected key size as one of the constants when generating the private key. Here's the relevant code (after all the options are selected, including selecting the key size and specifying the passphrase) for generating keys in GnuPG:
static int
do_create( int algo, unsigned int nbits, KBNODE pub_root, KBNODE sec_root,
DEK *dek, STRING2KEY *s2k, PKT_secret_key **sk, u32 timestamp,
u32 expiredate, int is_subkey )
{
int rc=0;
if( !opt.batch )
tty_printf(_(
"We need to generate a lot of random bytes. It is a good idea to perform\n"
"some other action (type on the keyboard, move the mouse, utilize the\n"
"disks) during the prime generation; this gives the random number\n"
"generator a better chance to gain enough entropy.\n") );
if( algo == PUBKEY_ALGO_ELGAMAL_E )
rc = gen_elg(algo, nbits, pub_root, sec_root, dek, s2k, sk, timestamp,
expiredate, is_subkey);
else if( algo == PUBKEY_ALGO_DSA )
rc = gen_dsa(nbits, pub_root, sec_root, dek, s2k, sk, timestamp,
expiredate, is_subkey);
else if( algo == PUBKEY_ALGO_RSA )
rc = gen_rsa(algo, nbits, pub_root, sec_root, dek, s2k, sk, timestamp,
expiredate, is_subkey);
else
BUG();
return rc;
}
The slight differences between the three algorithms relate to the values for the items referred to in the published algorithms, yet in each case the "nbits" is a constant.
You'll find the same consistency relating to the key size in the code for generating keys in OpenSSL, OpenSSH and any other system utilising public key cryptography. In every implementation in order to have a matched public and private key pair the public key must be derived from the private key. Since the private key is generated with the key size as a constant, that key size must be inherited by the public key. If the public key does not contain all the correct shared information with the private key then it will be, by definition, not matched to that key and thus the encryption/decryption processes and the signing/verifying processes will fail.
I was looking from various sources, and my conclusion is that the modulus (n=p*q) used to RSA key generation, is the same for the public and the private key. The modulus determines the length of the key for both.
For RSA your public key can be as small as 2 bits. That is the number 3 can be your public key.
A popular choice for RSA public key is 17.
From what I understand, there is no requirement that both keys be the same size. Check below for how to generate keys:
http://en.wikipedia.org/wiki/RSA_algorithm#Key_generation
However I believe that if one key (or factor of the modulus) is significantly smaller it would weaken the strength against cryptanalysis.
Edit:
This discussion has largely become irrelevant since the OP clarified that they were most interested in the size of the modulus, which will naturally be the same for encryption and decryption (excluding any bizarre unknown cryptosystems).
Just to clarify my point, I am simply saying that if e << d (or d << e) you can distribute the keys as different key sizes. They would be generated by the same algorithm using the same bit-size mathematics (e.g. 256 bits), and similarly encryption and decryption would require the same number of bits. If you look at (for the sake of argument) the numbers 1 and 128, you have a range of choices in how to represent them. They could both be 8 bit, or 1 could be represented by any number of bits from 1-7 bits. This could be considered a cheap trick unless your key generation method guarantees that the magnitudes of d and e would be significantly different in a predictable way. However as stated, I don't see much point to doing this.
I am using open_ssl to create public and private keys to secure the transaction of a database and the server.
The problem is that the database's (sqllite) only have the input of a byte array of 16bits. The open ssl method that I'm using creates around 600 - 1024 bits, so using that is impossible.
Any idea of what I could do to the public key to use this 16bit encryption technique?
Thanks in advance!
Sounds like you're trying to use public / private key pairs when symmetric keys ought to be used.
I'd just generate a random string of 16 bytes and use that. You can get it from /dev/urandom on Linux.
Public / private key pairs are longer because they have special requirements that regular symmetric algorithm keys don't. The mudolo of an RSA key pair, for instance, needs to be a multiple of two primes, which excludes a lot of numbers / strings. eg. 60000 isn't a multiple of just two primes - it's factorization shows that it's a multiple of 5^4 * 2^5 * 3.