-2
$\begingroup$

I feel like this question is specific enough to stand on its own. Say I have a set of clients each with a unique ID and already established pair of session keys for each client.

When a client receives ciphertext from any of the clients would it be better if the messages were marked with the senders' ID so the receiver knows which session key to decrypt with?

OR

Do not include the senders' ID but instead attempt to decrypt using each clients' session key till one works?

Which is more secure (assuming transport between clients is not secure)?

Which is more performent?

Which offers better readability / maintenance flexibility?

Example 1

  1. Alice sends Bob an encrypted message using Bob's key
  2. Bob receives the message and there is a sender identifier attached
  3. Bob decrypts using Alice's key and succeeds
  4. Bob knows he does not have to worry about Charlie or Eve in this case

Example 2

  1. Alice sends Bob an encrypted message using Bob's key
  2. Bob receives the message but there is no sender identifier attached
  3. Bob attempts to decrypt using Charlie's key and fails
  4. Bob attempts to decrypt using Eve's key and fails
  5. Bob attempts to decrypt using Alice's key and succeeds
  6. Bob now knows it was Alice who sent the message and not Charlie nor Eve
$\endgroup$
2
$\begingroup$

Note that you generally encrypt with the key of the receiver. If we presume symmetric session keys then this isn't an issue as encryption and decryption is the same. But your scheme would require at least one shared key for each combination, so there's the key for Bob-Alice, Bob-Charly, Bob-Eve etc.

Which is more secure (assuming transport between clients is not secure)?

They are both secure in the sense that the message stays confidential. Of course, the second method leaks the ID of the sender. That may be an issue, depending on the protocol and threat model.

If there is no message authenticity then the first one with the ID is more secure. You may otherwise accept a message using the wrong key.

Which is more performent?

Trying each key is of course less performent. I would expect anybody to answer that question themselves.

Which offers better readability / maintenance flexibility?

Again, you should be able to answer this yourself. You want a deterministic protocol; if there is no need to search for the right key, then don't.

$\endgroup$
  • 1
    $\begingroup$ Conceivably, in extreme environments, the communication cost of transmitting an additional session id might exceed the computation cost of just trying a few at the endpoint. $\endgroup$ – Squeamish Ossifrage Jul 17 '18 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.