1
$\begingroup$

Two parties share a password. They need to now exchange some data. Is there a way where one party generates a public/private key pair from the data and password and shares just the public key with the other party. The other party should retrieve the data using the shared password and just the public key. Is this possible?

Basically, the communication between the two parties should happen via the shared password and the public key (that keeps changing with the data that they want to exchange).

Sorry if I am vague on what I intend to do.

$\endgroup$

2 Answers 2

1
$\begingroup$

If two parties have a shared secret, they can use that to encrypt the sent data symmetrically, e.g., using AES. There is no need for additional asymmetric encryption, if you want to use the pre-shared password/key. Public key cryptography is used when there is no pre-shared secret. If each party has a public/private key, they can generate as many shared secrets as they want. Those keys need to be generated randomly and I don't see why you would want to derive asymmetric keys from a common password.

$\endgroup$
1
$\begingroup$

Usage of public key in such scenario makes no sense. If you want to prevent that the same key is used for multiple data sets, then one party can each time generate a new password, encrypt data using it, and send the encrypted password to the other party. The other party will decrypt the key, then decrypt data.

A shared key has some risk on the long run, because if it is leaked, then the whole previous communication can be decrypted.

The more reliable scenario is, when both parties generate key pairs independently on each other and obtain certificates from some CA, which they both trust. Then they can use hybrid encryption for data exchange.

$\endgroup$
7
  • $\begingroup$ We could do what you said. But in my case, the only visible communication between the two parties is via the public key which gets posted on a web page. I want to masquerade sending data via the public key. $\endgroup$ Jan 8, 2023 at 15:50
  • $\begingroup$ @sandeepkiranp: See update. $\endgroup$
    – mentallurg
    Jan 8, 2023 at 17:21
  • $\begingroup$ as I said, this is not a new protocol that I can change. Is it mathematically possible to hide data in a public key (which is made public) such that the receiver can retrieve the data as well as recreate the corresponding private key? $\endgroup$ Jan 9, 2023 at 1:42
  • $\begingroup$ yes that is what I want to do. The public/private key pair should also be a legitimate one using which I should be able to do ECDSA signature generation and verification. The receiver only has the shared password and the resultant public key. From this he should be able to get back the data. $\endgroup$ Jan 9, 2023 at 9:31
  • $\begingroup$ @sandeepkiranp: Mathematically? No. Because mathematically a private key is a pair of two numbers. You cannot add any data, because you will modify these numbers. And one more point: Keys are generated in pairs. Mathematically, you cannot derive private key from public key. Otherwise TLS and thus communication security the modern Internet would be impossible, digital signatures would be impossible, etc. $\endgroup$
    – mentallurg
    Jan 9, 2023 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.