Can you construct a key agreement system from public-key-encryption system?

Question

Can you construct a key agreement system from public-key-encryption system? If so, how?

What about vice versa?

Answer 1

Yes, you can create a key agreement system from a public key encryption system. Or at least you can create a key establishment scheme using RSA. The term "key agreement" is often used for schemes that are explicitly used for Diffie-Hellman (DH) type of key establishment where the keys are calculated rather than distributed.

The RSA based ciphersuites have been part of TLS up to version 1.2. In this scheme the RSA public key of the server is used to encrypt a random generated on the client. This random is decrypted at the server using the RSA private key and can then be used to derive the session keys from the established secret.

This is a very simple scheme, but it does have some drawbacks because RSA key pair generation is slow and may require a lot of random data. As such it is commonly not used to generate ephemeral (i.e. temporary) key pairs, as it commonly done for DH.

• Because of this, the RSA key pair of the server is the static key associated with the certificate of the server. This means that this key must be usable for decryption, while it is really there to perform authentication (signature generation). Generally we try to use the private key for one type of purpose.
• If the private key ever leaks then all stored TLS sessions generated with this key can be decrypted with it. In other words: it doesn't provide forward secrecy.

Because of above, the RSA based key establishment has been dropped from TLS 1.3.

---

And yes, you can also use DH-style key agreement to perform encryption / decryption. IES and - for Elliptic Curve cryptosystems - ECIES is probably the most well known scheme. Simply said, the sender creates a temporary key pair (which is quite fast for DH and ECDH) and uses the private key of it to derive a secret key together with the trusted public key of the receiver. It then sends the temporary / data public key together with the ciphertext to the receiver. The receiver can use this public key together with its own private key to establish the same secret key and decrypt the ciphertext.

As derivation and encryption with a secret key is always required, IES is by definition a hybrid cryptosystem: it mixes the asymmetric DH key agreement with symmetric encryption with the secret key.

---

Notes:

• Personally I use the term "key establishment" in favor of "key exchange" for the establishment of secret keys because it more clearly includes key agreement - where the keys are not distributed by value. Both terms are commonly used to mean the same though.
• IES is a description of a scheme rather than a specific protocol; it is not clearly specified how the public key and ciphertext are combined, nor should you take it for granted on how the secret key is used to encrypt the data.
• DH is only one form of key agreement: I'm not sure you can answer the question: "can you construct a public key encryption system from a key agreement system" in the generic form. I guess it depends on the key agreement scheme used.