Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication

share|improve this question
2  
    
That might be exactly what I need ... will read it and post back. Thanks! –  mtahmed Jun 24 at 20:37
    
What I was also asking about was the specific protocols for deriving session keys from symmetric keys ... –  mtahmed Jun 24 at 20:44

1 Answer 1

up vote 3 down vote accepted

With symmetric encryption, any key exchange protocol you run inside the encrypted channel must also be secure when run in plain text, if you want perfect forward secrecy. That means you can only rely on the previously established keys for authentication (you are using authenticated encryption, right?), but not for hiding the new keys.

Diffie–Hellman key exchange is probably the simplest option. Generate random keys, exchange the public parts inside the existing channel and derive the shared secret that you can use to derive any session keys you need. On its own it is vulnerable to MitM, but if you run it inside the authenticated channel you avoid that.

Related: Why do we need asymmetric algorithms for key exchange?

share|improve this answer
    
"... in plain text", unless the symmetric encryption is forward-secure. $\;$ –  Ricky Demer Jun 25 at 10:38
    
@RickyDemer, I edited in 'perfect' instead. AFAICT, at least that construct allows someone who compromises a single state to decrypt all future sessions, not just the one. –  otus Jun 25 at 10:45
    
Let's say I can ignore the perfect forward secrecy requirement (0_o) ... then exchanging session keys over a secret-key encryption channel (with authentication of course) should otherwise be "secure", correct? By secure, I mean avoids MitM and no one can learn the keys being exchanged over the channel? If so, are there already known protocols for doing so or is it sufficient to just auth-enc the keys and send them to the other party? –  mtahmed Jun 25 at 21:39
    
@mtahmed, yes, if the idea is just to use session keys to avoid worries about key lifetime, you can have one party generate a random key and send it over. (D–H is simple, though, so if there's a usable implementation, I would use it.) –  otus Jun 25 at 22:06
1  
@mtahmed, yes, authentication would be enough, the D–H-derived keys would give you perfect forward secrecy. –  otus Jun 26 at 6:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.