Skip to main content
Cryptography

Return to Question

Tweeted twitter.com/StackCrypto/status/1290890298034458624
Bumped by Community user
Bumped by Community user
added 32 characters in body
Source Link
anotheruser
anotheruser
  • 41
  • 3

Separate How to use separate keys for signing and encryption

I read that the same key should not be used for both certificate signing and encryptingencryption.

I wonder if this mayis not be a problem with PKI/TLS/SSL because, the reason being asymmetric encryption is used to transmit the public key, which (via the certificate). The public key is used to encrypt a browser generated session key, which. The session key is then used for symmetric encryption of the actual traffic?.

Is that how it works and does that mean it is okay to sign both with the same key?

How would I go about using separate keys?

Separate keys for signing and encryption

I read that the same key should not be used for both signing and encrypting.

I wonder if this may not be a problem with PKI/TLS/SSL because asymmetric encryption is used to transmit the public key, which is used to encrypt a browser generated session key, which is then used for symmetric encryption of the actual traffic?

Is that how it works and does that mean it is okay to sign both with the same key?

How would I go about using separate keys?

How to use separate keys for signing and encryption

I read that the same key should not be used for both certificate signing and encryption.

I wonder if this is not a problem with PKI/TLS/SSL, the reason being asymmetric encryption is used to transmit the public key (via the certificate). The public key is used to encrypt a browser generated session key. The session key is used for symmetric encryption of the actual traffic.

Is that how it works and does that mean it is okay to sign both with the same key?

How would I go about using separate keys?

added 158 characters in body
Source Link
anotheruser
anotheruser
  • 41
  • 3

So,I read that the same key should not be used for both signing and encryptionencrypting. Is

I wonder if this may not applicable tobe a problem with PKI/TLS/SSL because a browser generated session key is used for symmetric traffic encryption? And asymmetric encryption is only used to transmit the public key, which is used to encrypt thea browser generated session key, which is then used for symmetric encryption of the actual traffic?

Is that how it works and does that mean it is okay to sign both with the same key?

How would I go about using separate keys?

So, the same key should not be used for both signing and encryption. Is this not applicable to PKI/TLS/SSL because a browser generated session key is used for symmetric traffic encryption? And asymmetric encryption is only used to transmit the public key which is used to encrypt the session key?

I read that the same key should not be used for both signing and encrypting.

I wonder if this may not be a problem with PKI/TLS/SSL because asymmetric encryption is used to transmit the public key, which is used to encrypt a browser generated session key, which is then used for symmetric encryption of the actual traffic?

Is that how it works and does that mean it is okay to sign both with the same key?

How would I go about using separate keys?

added 1 character in body
Source Link
anotheruser
anotheruser
  • 41
  • 3

So, the same key should not be used for both signing and encryption. Is this not applicable to PKI/TLS/SSL because a browser generated symmetric session key is used for symmetric traffic encryption? And asymmetric encryption is only used to transmit the public key which is used to encrypt the session key?

So the same key should not be used for both signing and encryption. Is this not applicable to PKI/TLS/SSL because a browser generated symmetric session key is used for traffic encryption? And asymmetric encryption is only used to transmit the public key which is used to encrypt the session key?

So, the same key should not be used for both signing and encryption. Is this not applicable to PKI/TLS/SSL because a browser generated session key is used for symmetric traffic encryption? And asymmetric encryption is only used to transmit the public key which is used to encrypt the session key?

Source Link
anotheruser
anotheruser
  • 41
  • 3