I am currently trying to create a secure key exchange between two parties. I have a good implementation of PGP that works well for my app, but my DH is really slow and doesn't work well; so I was thinking that maybe I could perform the key exchange with PGP.

My idea is this:

Party 1 -> public key -> Party 2
Party 2 -> public key -> Party 1

Party 1 generates random bits and sends them to party 2 with the public key
Party 2 generates random bits and sends them to party 1 with the public key

Shared key = Sha256(Party 1 random concatenated with Party 2 random)

Would this be secure? (assuming that the implementations of Sha256, PGP, and the random generator are to par.

  • 1
    $\begingroup$ The public keys are the generated random bits? Then anyone intercepting the traffic can compute the shared key. Why can't you use X25519, the key exchange function based on Curve25519 (which have one of the most secure and fast implementation)? $\endgroup$
    – user69015
    Sep 12, 2019 at 6:49
  • 3
    $\begingroup$ but my DH is really slow – Don't write your own crypto code! Also, it's probably slow because you're doing modular exponentiation wrong. You don't need to exponentiate first and reduce second. Also, no. $\endgroup$
    – forest
    Sep 12, 2019 at 7:52

1 Answer 1



  • that in the question "with public key" describes encryption under the intended recipient's public key;
  • secrecy of the corresponding private keys;
  • that by some external mechanism public keys are securely bound to the legitimate parties;
  • the parties have some unstated convention to define which is Party 1, defining who transmits first and order in "concatenated"

then yes,

  • the "Shared key" is the same on both sides absent alteration by an active adversary
  • an adversary (even active) can't predict any characteristic of the "Shared key" that one of the legitimate party uses.

Notice undesirable characteristics:

  • There's no forward secrecy: from past communications passively eavesdropped, an adversary later learning the two private keys can find the "Shared key". Modern key exchange protocols are safe from this.
    [Edit: The simple/standard/best method for forward secrecy is DH, with some independent authentication mechanism (e.g. using the PGP keys in signature mode). I know no way to turn generic encryption or/and signature into forward secure key exchange without some other asymmetric crypto primitive.]
  • The party that transmits second can weaken the "Shared key" to some degree; e.g. choose it's random so that the top 32 bits of "Shared key" are zero, or some function of the other bits. However, each additional bit of weakening doubles the effort.
  • The parties have no insurance that their "Shared key" is shared with anyone; the only assurance is that it could be shared only with the legitimate holder of the private key matching the public key alleged by the other party.
  • $\begingroup$ How would I add forward secrecy to this implementation? $\endgroup$ Sep 13, 2019 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.