Assume the sender wants to share their ephemeral/long-term public key with intended receiver only and both share symmetric key.

Is it secure to encrypt the (full/partial) public key (of RSA, ECC) with the shared symmetric key?

Is there any chance of finding symmetric key from encrypted public key?

If not why?

  • $\begingroup$ If Alice & Bob already share a symmetric key, why can't they just use that for any traffic they wish? If the reason is because they want to limit traffic sent with their long term symmetric key, why not send over a short-term symmetric key? Sending a public key seems unnecessarily complex. $\endgroup$ Nov 22 '13 at 14:50

Is there any chance of finding symmetric key from encrypted public key?

The answer is no, assuming the symmetric key has sufficient entropy and a secure encryption algorithm and mode is used correctly.

Modern ciphers like AES with proper secret keys are not vulnerable to known plaintext attacks.


This has been answered in an earlier question: Why is AES resistant to known-plaintext attacks?


Is it ok to encrypt (full/partial) public key (of RSA, ECC) with shared symmetric key?

Definitely it is OK, but this is operation that is not often needed, though. In hybrid cryptosystems, it is common that the long-term secrets are private keys and public keys and those are used to establish per session symmetric keys. Doing it the other way around (having symmetric key and transporting public key) is somewhat less common.

Also, most usually public keys need some sort of authenticity or integrity protection, it rarely makes sense to try to encrypt them (confidentiality protection).

symmetric key (password)

This sounds suspect. It is rare for a password to contain sufficient entropy for this purpose. If a password is weak or it is used improperly to create a symmetric key, then it is possible that an attacker can indeed find the secret key (e.g. via a form of dictionary attack).

Do the peers share symmetric key or password?

want to share his ephemeral/long-term public key with intended receiver only

This is usually not possible. If the public key is ever used, somebody eavesdropping the communication will learn the public key. It is not possible to have only intended recipient knowing the public key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.