# How to create and send a symmetric key using GPG

I want to communicate with a friend (he lives in another country so we can't exchange fingerprints or keys physically, I could post him a USB disk but I'm sure I can do it through the web).

I'm pretty familiar with public key cryptography but this is the first time I've decided to use a symmetric approach. There are a few things I'm wondering:

1. Do I need to generate a special type of key for this, or can I just generate a 4096 bit RSA key pair with gpg --full-gen-key like I usually would?
2. Does it make a difference whether I use my private key or public key? Is there any real difference between these two keys. meaning if I encrypted a file using my private key would it be the same quality as if I had used the public key?
3. So in addition to the password for the message I sent him, my friend needs a copy of the key I use to decrypt it so we then have a shared key. Would it be a good idea to send both keys (the private and public) so when a third party encrypts something with our public key, we can both decrypt it. Have I got the right idea there, or would that introduce any security risks to this symmetric communication system?

This is just a practice exercise, we're both interested in cryptography and want to make our online communications 100% encrypted and secure, in order to develop a practical understanding of cryptography, steganography and security. This is step 1, we will send exchange email addresses and secure IM service account details. And from there we can discuss how to step things up and gradually reach our goal of being 100% encrypted and secure. I would greatly appreciate any tips, insights, methods, pointing out flaws in my methods and things I haven't thought about yet.

One challenge which is a fun one is getting the key to him. I'm not gonna complicate it too heavily, but heres what I'm thinking:

• Compressing the key pair into a password protected zip archive, and embedding it into a PDF file or PNG, or whatever file type won't seem weird with the extra size.

A more secure way would be to post a USB key to him of course, but we wanna do this entirely via the web for now.

1. Yes you can generate your RSA keypair and your friend does the same. Then you can exchange your public keys. Exchanging them can be done in an unsecure environment. From now on you could use your friend's public key to encrypt the things you want to send him. He can decrypt them using his private key. On the other hand your friend uses your pulic key for encryption and you'd decrypt it with your private key. For this purpose it's best to use established standards such as PKCS1.
2. As both private key and public key have the same modulus, I assume you mean the public exponent for which we generally use the integer 65537 (of course you are not "forced" to use this). One of the reasons to utilize this short exponent is to speed up arithmetics on public-key operations such as signature verification or in your case encryption. If you encrypted your file using your private key everyone in possession of your public key could decrypt it. If you encrypted it using your public key only you would be able to decrypt it (assuming you're the only one possessing the corresponding private key).
3. As soon as parts / all of your private key is known your "secure system" is broken. Therefore it's not a good idea to send your private key in plaintext over the internet. But as stated in 1) you could use your friends public key to encrypt your private key and then send it to him (and vice versa). But this is not the way it's normally done in practice. Here you would use a key-agreement protocol built on RSA for example to exchange a symmetric key you would then use for symmetric ciphers such as AES. I suppose the amount of data you both need to encrypt is not that high (E-Mails, texts, etc.) which means that the relatively slower encryption /decryption process using a public-key scheme would not be your sytem's bottleneck.

1. No, generating a symmetric RSA key makes no sense. RSA is not symmetric. It is a public key algorithm.

2. There is a HUGE difference between the public and private key. The public one can only be used to encrypt and the private one is needed for decryption.

3. Usually in a public key setting you keep the private key private and don't send it anywhere.

I'm afraid I have to disagree with your statement that you are pretty familiar with public key cryptography. You should probably read up on the difference between symmetric crypto and public key crypto again.

Even if you use public key crypto, you need to somehow verify that the person whose public key you are using is actually the person you want to reach. Otherwise anybody could give you their public key and MitM your connection. If you know somebody only over the internet how do you know who they are anyway?

• What then is the purpose of symmetric encryption, what advantages does it give over public key encryption. I know that websites use it to encrypt HTTP and HTTPS protocol over SSL and this system uses symmetric encryption in which the website owner or organisation, if their identity is confirmed, is issued a certificate which they use to sign their key. Then all browsers know that the certificate used to decrypt and decrypt the traffic does indeed belong to the website/organisation. The part I don't understand is how the 2-way encryption/decryption occurs. What key does the end use use? – John Slotsky Apr 12 '17 at 16:39
• From what I read, the same key is used to encrypt and decrypt the traffic with symmetric encryption. In the case of a website, does the web browser receive an unsigned copy of the key which is can use to decrypt the data? What are some major examples are where symmetric key cryptography is a better option to public key encryption? – John Slotsky Apr 12 '17 at 16:42
• Usually public key crypto is used to set up a symmetric key and then symmetric crypto is used for the increased speed. Take a look at en.wikipedia.org/wiki/Hybrid_cryptosystem – Elias Apr 12 '17 at 16:49