Are ephemeral keys symmetric or asymmetric? [closed]

Question

My question is: Are ephemeral keys symmetric or asymmetric?

If symmetric, can ephemeral keys be created based on a (UserID || nonce)?

Answer 1

I think it is more common to explicitly name asymmetric key pairs ephemeral or static because it matters more on a generic, lower level algorithm description.

During key establishment, it matters a lot if keys are ephemeral or not. For instance, if you'd use static-static key agreement, then the agreed-upon key will always be the same, unless you explicitly mix in a random value. Only if the key is static will it also be able to provide entity authentication. Hence these schemes are described in a generic way of e.g. NIST Special Publication 800-56A Revision 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography which contains the following definition:

A key pair, consisting of a public key (i.e., an ephemeral public key) and a private key (i.e., an ephemeral private key) that is intended for a very short period of use. The key pair is ordinarily used in exactly one transaction of a cryptographic scheme. Contrast with a static key pair.

If the terms are commonly used for DH keys within key agreement, then it is more likely that this will seep through to higher level protocol specifications such as TLS as well.

---

The main thing about ephemeral keys and ephemeral key pairs is that they are not pre-established, they are only established when required, and then discarded. This can be true for both asymmetric and symmetric keys. This of course also means that public keys cannot be trusted in advance. Pre-established keys / key pairs are also called static keys / key pairs.

Commonly you would expect ephemeral keys to be destroyed after a single use - storing them on persistent media is not expected.

---

Typical ephemeral keys are keys that are tied to a session in TLS. In there the E in DHE and ECDHE is used to denote ephemeral Diffie-Hellman authentication. Within TLS the client (EC)DH key pair is always ephemeral, so that one does not contribute to the E being present or not within the TLS cipher suite. Commonly however, the server's key pair is also ephemeral, so you get ephemeral-ephemeral key agreement to establish the symmetric master key and session keys. This scheme does not authenticate the server by itself.

Rather uncommonly, the server may use a trusted, static DH key pair where the public key is embedded in a certificate and the private key stored in the server. This is called ephemeral-static DH key agreement. In that case the DH key agreement will also authenticate the server.

Sometimes the ephemeral DH keys are also cached in memory for multiple sessions. This is more or less cheating; it's a dangerous performance hack (deriving key pairs is relatively expensive operation), which will have security related consequences.

The symmetric session keys in TLS are probably ephemeral keys. They are not called that way because well, they are already called session keys as they encrypt and/or authenticate the data in the session. As Dave commented, the master key may or may not be ephemeral, it depends on the protocol. However, these keys are used over multiple messages, so they are less ephemeral than an ephemeral DH key, which is only used for one key establishment.

---

Finally, ephemeral is a word, and the common meaning of words is written down in dictionaries (which pretend, in their arrogance, to define them). Let's take a look at the Merriam-Webster definition:

Definition of ephemeral

1. lasting a very short time, e.g. ephemeral pleasures
2. lasting one day only, e.g. an ephemeral fever

When using these terms it is always a good idea to not deviate too much from the original meaning. However, it is of course possible that - for instance - a TLS session lasts longer than a day.

---

As for your question:

If symmetric, can ephemeral keys be created based on a UserID or nonce?

It would be strange to create an ephemeral key from just a UserID, because that would always result in the same key. In that case the key value would not be called ephemeral. You can certainly create an ephemeral key from a nonce or combination of UserID and nonce, presuming that the nonce itself is ephemeral.

Neither of UserID or nonce sounds like a secret value, so you would not get any security properties from such a key. You can however use a static key, the user ID and (ephemeral) nonce to derive an ephemeral key:

$$\tilde{K}_{user} = \operatorname{KDF}(K_{master}, \mathit{UserID} \mathbin \| \mathit{nonce})$$

Note that the tilde above the ephemeral key is one way of showing that it might be ephemeral - different documents may use different notations and a tilde does not always mean ephemeral.

Answer 2

‘Ephemeral’ describes for how long the key persists, not how it is used in a cryptosystem. You can generate a key pair, or you can generate a symmetric session key, and erase it shortly after you've used it; then it's ephemeral.

For example, if Alice and Bob use Diffie–Hellman key agreement to establish a session key for a conversation, Alice might generate a key pair $(a, g^a)$, and Bob might generate a key pair $(b, g^b)$, and the two might compute the common session key $k = H(g^{ab})$, and then after the conversation is done the two might erase all traces of $a$, $b$, $g^{ab}$, and $k$ so that all of these keys are ephemeral—both the asymmetric keys $a$ and $b$ and the symmetric shared secrets $g^{ab}$ and $k$.

If, however, Alice and Bob use long-term keys to authenticate the key agreement, the long-term keys they use are not ephemeral because they don't erase those keys immediately after the conversation.