About public / private key encryption

Question

Am I right with this assumption about the general idea of public key and private key?

1. The sender encrypts the data with a symmetric key. After that, he encrypts (using RSA algorithm) this symmetric key with the public asymmetric key of the receiver.

2. The receiver decrypts with his private asymmetric key, and gets the symmetric key used by the sender. With this key, he decrypts the data.

How does the sender know the public asymmetric key of the receiver? 2 options:

• Diffie Hellman.

• Digital certificate PKI, by querying a CA.

Is this right?

Answer 1

The sender encrypts the data with a symmetric key. After that, he encrypts (using RSA algorithm) this symmetric key with the public asymmetric key of the receiver.

That's one possible implementation of a hybrid cryptosystem for encryption/decryption. It is also quite common to derive the symmetric key using the asymmetric key pair. This is performed for instance by IES for Diffie-Hellman based cryptography but also by RSA-KEM.

How does the sender know the public asymmetric key of the receiver?

1. Diffie Hellman.

No, Diffie-Hellman is used to derive symmetric keys. It cannot be used to distribute public keys.

How does the sender know the public asymmetric key of the receiver?

2. Digital certificate PKI, by querying a CA.

An implementation of a PKI could certainly work.

But PKI doesn't necessarily mean that there are CA's (e.g. see how PGP operates).

And if they do exist - for instance in PKI-X used in e.g. browsers - then they generally are only needed to sign certificate requests and verify that certificates are not revoked. During operation the CA certificates can simply be send using a certificate chain. Quering a CA is not required at the time of verification.