Bulk encryption algorithm for use with RSA

The public-key cryptosystem known as RSA is widely judged to be secure, but in software implementations is slow, and even in hardware implementations encryption with a general 512-bit exponent runs only at tens of kilobits per second. Use of a small public exponent can speed encryption by up to 375-fold, but decryption speed can be increased only by four-fold in software or two-fold in hardware using the method of Quisquater and Couvreur (1982). It is therefore common to employ a second, fast, secret-key, cryptosystem such as the DES as the bulk encryption method, while the session key for that system is transferred using RSA. This however increases the security risk, as breaking either RSA or DES is sufficient to obtain knowledge of the plaintext, and DES in particular has been the subject of intense cryptanalytic activity in recent years. It is therefore desirable to use a fast secret-key bulk encryption algorithm whose security can be demonstrably related to that of RSA. The following proposed system, designated QS, goes some way to meeting this aim.<>