3
$\begingroup$

I am a beginner learning about encryption and I would like to ask a few questions, hoping this is the right place to ask, so please bear with me.

We have Alice and multiple clones of Bob. Only Alice can send messages to Bobs. Only Bobs can exchange messages with Alice, but not between each other. Alice and Bobs have met in person and exchanged keys and agreed upon the encryption algorithm. The amount of exchanged messages is small and they are small in size, so neither Alice nor Bobs care about the performance of encryption algorithm that much. Bob is a drunkard and might have revealed his key(s) to other parties at some point. If we assume that, in the worst case scenario, those other parties can impersonate Bob as well as interpret Alice's messages to Bobs, but not replay them or impersonate her, nor understand what other Bobs are sending Alice, the following questions come to my mind:

  1. Is it really necessary (and why) to exchange a symmetric session key, when neither Alice nor Bobs care about performance?
  2. Why don't they use public/private key pair for all of their communication?
  3. If the keys are shared beforehand, is it any less safe to use a single pair of keys instead of two (Alice in SSL land would have encrypted the message using her private key, and then encrypt the result of that with Bob's public key)?

Or, to put it simply, which functions from openssl libraries are best suited for this purpose, if we are aiming for the most lightweight solution?

$\endgroup$
  • $\begingroup$ By "Alice and Bobs have met in person and exchanged keys" do you imply that Bob(s) has a private key unknown to Alice, or not?; Also: you might want to write that "Alice in SSL land would have SIGNED the message using her private key, and then encrypted the result of that with Bob's public key". $\endgroup$ – fgrieu Mar 7 '17 at 7:28
  • 1
    $\begingroup$ 1 & 2. If you really don't care about performances, you can directly use asymmetric encryption (with proper authentication), without sharing a symmetric session key. But this means that you really really don't care about performances. $\endgroup$ – Geoffroy Couteau Mar 7 '17 at 10:10
  • 1
    $\begingroup$ You don't care about performance but you do want the most "lightweight" solution. Does that mean that the encryption needs to add a minimum of overhead in bytes? Code size is often not that important. $\endgroup$ – Maarten Bodewes Mar 7 '17 at 15:41
  • $\begingroup$ @fgrieu yes, I imply that Bob does not have a private key unknown to Alice, and that is the reason for my third question. $\endgroup$ – Ulrik Mar 7 '17 at 17:53
  • $\begingroup$ @MaartenBodewes by lightweight I mean code size is the most important, and minimizing traffic overhead comes second. $\endgroup$ – Ulrik Mar 7 '17 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.