I know session keys are exchanged (in SSL e.g.) over public-key cryptography channels but I was wondering if there are already known algorithms/methods for exchanging session keys over a symmetric-key channel? More specifically, is it possible/feasible to e.g. exchange 128-bit AES keys over a channel already using 128-bit AES keys?

If so, where can I read about them? IF not, why not? Is it not a good idea or can't be secured?

Possibly related: Deriving Keys for Symmetric Encryption and Authentication

  • 2
    $\begingroup$ en.wikipedia.org/wiki/Kerberos_(protocol) $\;$ $\endgroup$ – user991 Jun 24 '14 at 20:34
  • $\begingroup$ That might be exactly what I need ... will read it and post back. Thanks! $\endgroup$ – mmtauqir Jun 24 '14 at 20:37
  • $\begingroup$ What I was also asking about was the specific protocols for deriving session keys from symmetric keys ... $\endgroup$ – mmtauqir Jun 24 '14 at 20:44

With symmetric encryption, any key exchange protocol you run inside the encrypted channel must also be secure when run in plain text, if you want perfect forward secrecy. That means you can only rely on the previously established keys for authentication (you are using authenticated encryption, right?), but not for hiding the new keys.

Diffie–Hellman key exchange is probably the simplest option. Generate random keys, exchange the public parts inside the existing channel and derive the shared secret that you can use to derive any session keys you need. On its own it is vulnerable to MitM, but if you run it inside the authenticated channel you avoid that.

Related: Why do we need asymmetric algorithms for key exchange?

  • $\begingroup$ "... in plain text", unless the symmetric encryption is forward-secure. $\;$ $\endgroup$ – user991 Jun 25 '14 at 10:38
  • $\begingroup$ @RickyDemer, I edited in 'perfect' instead. AFAICT, at least that construct allows someone who compromises a single state to decrypt all future sessions, not just the one. $\endgroup$ – otus Jun 25 '14 at 10:45
  • $\begingroup$ Let's say I can ignore the perfect forward secrecy requirement (0_o) ... then exchanging session keys over a secret-key encryption channel (with authentication of course) should otherwise be "secure", correct? By secure, I mean avoids MitM and no one can learn the keys being exchanged over the channel? If so, are there already known protocols for doing so or is it sufficient to just auth-enc the keys and send them to the other party? $\endgroup$ – mmtauqir Jun 25 '14 at 21:39
  • $\begingroup$ @mtahmed, yes, if the idea is just to use session keys to avoid worries about key lifetime, you can have one party generate a random key and send it over. (D–H is simple, though, so if there's a usable implementation, I would use it.) $\endgroup$ – otus Jun 25 '14 at 22:06
  • 1
    $\begingroup$ @mtahmed, yes, authentication would be enough, the D–H-derived keys would give you perfect forward secrecy. $\endgroup$ – otus Jun 26 '14 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.