Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication

share|improve this question
That might be exactly what I need ... will read it and post back. Thanks! – mtahmed Jun 24 '14 at 20:37
What I was also asking about was the specific protocols for deriving session keys from symmetric keys ... – mtahmed Jun 24 '14 at 20:44
up vote 3 down vote accepted

With symmetric encryption, any key exchange protocol you run inside the encrypted channel must also be secure when run in plain text, if you want perfect forward secrecy. That means you can only rely on the previously established keys for authentication (you are using authenticated encryption, right?), but not for hiding the new keys.

Diffie–Hellman key exchange is probably the simplest option. Generate random keys, exchange the public parts inside the existing channel and derive the shared secret that you can use to derive any session keys you need. On its own it is vulnerable to MitM, but if you run it inside the authenticated channel you avoid that.

Related: Why do we need asymmetric algorithms for key exchange?

share|improve this answer
"... in plain text", unless the symmetric encryption is forward-secure. $\;$ – Ricky Demer Jun 25 '14 at 10:38
@RickyDemer, I edited in 'perfect' instead. AFAICT, at least that construct allows someone who compromises a single state to decrypt all future sessions, not just the one. – otus Jun 25 '14 at 10:45
Let's say I can ignore the perfect forward secrecy requirement (0_o) ... then exchanging session keys over a secret-key encryption channel (with authentication of course) should otherwise be "secure", correct? By secure, I mean avoids MitM and no one can learn the keys being exchanged over the channel? If so, are there already known protocols for doing so or is it sufficient to just auth-enc the keys and send them to the other party? – mtahmed Jun 25 '14 at 21:39
@mtahmed, yes, if the idea is just to use session keys to avoid worries about key lifetime, you can have one party generate a random key and send it over. (D–H is simple, though, so if there's a usable implementation, I would use it.) – otus Jun 25 '14 at 22:06
@mtahmed, yes, authentication would be enough, the D–H-derived keys would give you perfect forward secrecy. – otus Jun 26 '14 at 6:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.