Return to Answer

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

The advantage of RSA, as well as elliptic curves, is, that it does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this key really belongs to Bob. Alternatively, Bob tells the fingerprint of his public key to Alice. The fingerprint is not secret and thus can easily be shared. Bob provides his public key using any channel, even if it is insecure, e.g. it can publish it on any public web site or send via email.

Then Alice encrypts AES key with the Bob's public key and sends it to Bob. Since nobody except Bob can decrypt it, Alice can send it even via insecure channel. Bob uses his private key and decrypts the AES key.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with a public key of Bob. Then sends this all together to Bob. Bob uses his private key and decrypts the AES key. Then uses it to decrypt the message.

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

RSA, as well as elliptic curves, does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this public key really belongs to Bob. Alternatively, Bob tells the fingerprint of his public key to Alice. The fingerprint is not secret and can be shared easily. Bob provides his public key using any channel, even if it is insecure, e.g. he can publish it on any public web site or send via email.

Alice encrypts AES key with the Bob's RSA public key and sends it to Bob. Even insecure channel can be used for this, because nobody except Bob can decrypt it. Bob uses his RSA private key and decrypts the AES key. Using the same RSA key pair, they can exchange any number of AES keys.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with an RSA public key of Bob. Then sends this all together to Bob. Bob uses his RSA private key and decrypts the AES key. Then uses it to decrypt the message.

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

The advantage of RSA, as well as elliptic curves, is, that it does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this key really belongs to Bob. Then Bob makes the public key available to Alice. Even insecure channels can be used for this. E.g. Bob can post his certificate containing public key on some public web site or send via email. Public key can also be shared without certificate. Bob can send it via any channel and then tell the fingerprint to Alice. The fingerprint is not secret. That's why, to tell the fingerprint, the channel should just guarantee the integrity, i.e. that the message cannot be changed. But it is fine, if somebody else will know the fingerprint.

Then Alice encrypts AES key with the Bob's public key and sends it to Bob. Since nobody except Bob can decrypt it, Alice can send it even via insecure channel. Bob uses his private key and decrypts the AES key.

Thus they have shared the AES key without disclosing it to any other party. Unlike OTP, they can share later on further AES keys (e.g. if they believe the previous AES key was compromised) using the same pair of RSA keys.

After AES key is shared, they can use it to exchange messages.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with a public key of Bob. Then sends this all together to Bob. Bob uses his private key and decrypts the AES key. Then uses it to decrypt the message.

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

The advantage of RSA, as well as elliptic curves, is, that it does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this key really belongs to Bob. Alternatively, Bob tells the fingerprint of his public key to Alice. The fingerprint is not secret and thus can easily be shared. Bob provides his public key using any channel, even if it is insecure, e.g. it can publish it on any public web site or send via email.

Then Alice encrypts AES key with the Bob's public key and sends it to Bob. Since nobody except Bob can decrypt it, Alice can send it even via insecure channel. Bob uses his private key and decrypts the AES key.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with a public key of Bob. Then sends this all together to Bob. Bob uses his private key and decrypts the AES key. Then uses it to decrypt the message.

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

The advantage of RSA, as well as elliptic curves, is, that it does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this key really belongs to Bob. Then Bob makes the public key available to Alice. Even insecure channels can be used for this. E.g. Bob can post his certificate containing public key on some public web site or send via email. Public key can also be shared without certificate. Bob can send it via any channel and then tell the fingerprint to Alice. The fingerprint is not secret. That's why, to tell the fingerprint, the channel should just guarantee the integrity, i.e. that the message cannot be changed. But it is fine, if somebody else will know the fingerprint.

Then Alice encrypts AES key with the Bob's public key and sends it to Bob. Since nobody except Bob can decrypt it, Alice can send it even via insecure channel. Bob uses his private key and decrypts the AES key.

Thus they have shared the AES key without disclosing it to any other party. Unlike OTP, they can share later on further AES keys (e.g. if they believe the previous AES key was compromised) using the same pair of RSA keys.

After AES key is shared, they can use it to exchange messages.

In reality, usually a hybrid encryption is used.

OTP must be kept secret by both parties: That who encrypts the message and that who decrypts. To share OTP, parties must use a secure channel. OTP can be used only once.

RSA is an asymmetric cryptosystem. There is no single key, but a key pair that consists of a private key and a public key. Public key is used to encrypt messages sent to the owner of the key pair. Private key is used to decrypt them. Public key can be made available to anyone, this will not affect the strength of encryption. Private key must be kept secret by its owner.

If Alice and Bob can securely share OTP, they can use it directly to encrypt and share AES key. They don't need RSA for this.

The advantage of RSA, as well as elliptic curves, is, that it does not need a secure channel to share the key. Bob generates an RSA key pair and requests a certificate from CA that confirms that this key really belongs to Bob. Then Bob makes the public key available to Alice. Even insecure channels can be used for this. E.g. Bob can post his certificate containing public key on some public web site or send via email. Public key can also be shared without certificate. Bob can send it via any channel and then tell the fingerprint to Alice. The fingerprint is not secret. That's why, to tell the fingerprint, the channel should just guarantee the integrity, i.e. that the message cannot be changed. But it is fine, if somebody else will know the fingerprint.

Then Alice encrypts AES key with the Bob's public key and sends it to Bob. Since nobody except Bob can decrypt it, Alice can send it even via insecure channel. Bob uses his private key and decrypts the AES key.

Thus they have shared the AES key without disclosing it to any other party. Unlike OTP, they can share later on further AES keys (e.g. if they believe the previous AES key was compromised) using the same pair of RSA keys.

After AES key is shared, they can use it to exchange messages.

In reality, usually a hybrid encryption is used. For every message, before sending it, Alice generates a random AES key, and encrypts the message using this key. Then encrypts this AES key with a public key of Bob. Then sends this all together to Bob. Bob uses his private key and decrypts the AES key. Then uses it to decrypt the message.