2
$\begingroup$

I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ en.wikipedia.org/wiki/Kerberos_(protocol) $\;$ $\endgroup$
    – user991
    Jun 24, 2014 at 20:34
  • $\begingroup$ That might be exactly what I need ... will read it and post back. Thanks! $\endgroup$
    – mmtauqir
    Jun 24, 2014 at 20:37
  • $\begingroup$ What I was also asking about was the specific protocols for deriving session keys from symmetric keys ... $\endgroup$
    – mmtauqir
    Jun 24, 2014 at 20:44

1 Answer 1

Reset to default
3
$\begingroup$

With symmetric encryption, any key exchange protocol you run inside the encrypted channel must also be secure when run in plain text, if you want perfect forward secrecy. That means you can only rely on the previously established keys for authentication (you are using authenticated encryption, right?), but not for hiding the new keys.

Diffie–Hellman key exchange is probably the simplest option. Generate random keys, exchange the public parts inside the existing channel and derive the shared secret that you can use to derive any session keys you need. On its own it is vulnerable to MitM, but if you run it inside the authenticated channel you avoid that.

Related: Why do we need asymmetric algorithms for key exchange?

Improve this answer
$\endgroup$
8
  • $\begingroup$ "... in plain text", unless the symmetric encryption is forward-secure. $\;$ $\endgroup$
    – user991
    Jun 25, 2014 at 10:38
  • $\begingroup$ @RickyDemer, I edited in 'perfect' instead. AFAICT, at least that construct allows someone who compromises a single state to decrypt all future sessions, not just the one. $\endgroup$
    – otus
    Jun 25, 2014 at 10:45
  • $\begingroup$ Let's say I can ignore the perfect forward secrecy requirement (0_o) ... then exchanging session keys over a secret-key encryption channel (with authentication of course) should otherwise be "secure", correct? By secure, I mean avoids MitM and no one can learn the keys being exchanged over the channel? If so, are there already known protocols for doing so or is it sufficient to just auth-enc the keys and send them to the other party? $\endgroup$
    – mmtauqir
    Jun 25, 2014 at 21:39
  • $\begingroup$ @mtahmed, yes, if the idea is just to use session keys to avoid worries about key lifetime, you can have one party generate a random key and send it over. (D–H is simple, though, so if there's a usable implementation, I would use it.) $\endgroup$
    – otus
    Jun 25, 2014 at 22:06
  • 1
    $\begingroup$ @mtahmed, yes, authentication would be enough, the D–H-derived keys would give you perfect forward secrecy. $\endgroup$
    – otus
    Jun 26, 2014 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.