Avaliação de diferentes implementações do sistema de criptografia RSA

Abstract

With the increasing flow of information between different devices, encryption systems have become essential to ensure data authenticity, confidentiality, and integrity. A common approach is asymmetric encryption, which uses two keys: one for encrypting messages and another for decrypting them. In this context, the RSA algorithm emerges as one of the most widely adopted encryption systems. This study aims to evaluate RSA implementations, investigating the impact of adopting different approaches, including selecting libraries within the same programming language and using various programming languages. Experiments were conducted in C, C++, Java, JavaScript, Python, and Rust, using two libraries per language: OpenSSL and Libgcrypt (C), Botan and Crypto++ (C++), Bouncy Castle and Java Crypto (Java), Forge and Crypto (JavaScript), Cryptography and PyCryptodome (Python), and Rust OpenSSL and Rust Crypto (Rust). The analysis of average execution times demonstrated that Rust, C, and Python achieved the best performance in encryption and decryption processes, mainly due to their implementations’ use of OpenSSL as the foundation. Regarding key generation, C++ and Python obtained the shortest average times for 2048 and 4096-bit keys. Additionally, an analysis of confidential data storage structures revealed similar patterns used to store private keys across the studied languages. Finally, a memory dump analysis exposed fragments of private keys in various libraries. In the case of JavaScript, it was possible to recover the private key entirely in both tested implementations, highlighting a vulnerability that could compromise system security if an attacker gains access to the program’s core dump. The results provide a basis for selecting RSA implementations, considering performance and security.