# Exchanging session keys over symmetric-key channel?

I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication

-
–  Ricky Demer Jun 24 '14 at 20:34
That might be exactly what I need ... will read it and post back. Thanks! –  mtahmed Jun 24 '14 at 20:37
What I was also asking about was the specific protocols for deriving session keys from symmetric keys ... –  mtahmed Jun 24 '14 at 20:44

## 1 Answer

With symmetric encryption, any key exchange protocol you run inside the encrypted channel must also be secure when run in plain text, if you want perfect forward secrecy. That means you can only rely on the previously established keys for authentication (you are using authenticated encryption, right?), but not for hiding the new keys.

Diffie–Hellman key exchange is probably the simplest option. Generate random keys, exchange the public parts inside the existing channel and derive the shared secret that you can use to derive any session keys you need. On its own it is vulnerable to MitM, but if you run it inside the authenticated channel you avoid that.

-
"... in plain text", unless the symmetric encryption is forward-secure. $\;$ –  Ricky Demer Jun 25 '14 at 10:38
@RickyDemer, I edited in 'perfect' instead. AFAICT, at least that construct allows someone who compromises a single state to decrypt all future sessions, not just the one. –  otus Jun 25 '14 at 10:45
Let's say I can ignore the perfect forward secrecy requirement (0_o) ... then exchanging session keys over a secret-key encryption channel (with authentication of course) should otherwise be "secure", correct? By secure, I mean avoids MitM and no one can learn the keys being exchanged over the channel? If so, are there already known protocols for doing so or is it sufficient to just auth-enc the keys and send them to the other party? –  mtahmed Jun 25 '14 at 21:39
@mtahmed, yes, if the idea is just to use session keys to avoid worries about key lifetime, you can have one party generate a random key and send it over. (D–H is simple, though, so if there's a usable implementation, I would use it.) –  otus Jun 25 '14 at 22:06
@mtahmed, yes, authentication would be enough, the D–H-derived keys would give you perfect forward secrecy. –  otus Jun 26 '14 at 6:09