Key-Agreement & Key-Transport for Symmetric Authentication System

Question

Question: I want to know what kind of Master Key sharing process is pursuit on Symmetric encryption environments (strictly symmetric, also in the key sharing scheme).

As I am aware there are several ways to establish the Master Key transportation and storage between two entities. The processes can pursuit a Key-Agreement or a Key-Transport scheme.

In key transportation a key wrapping function is used to protect the shared secret, then I assume that we do not need any public-key system such as DHKE or ECDH.

In key agreement asymmetric encryption processes are used to transport master keys between entities, then this is not a full symmetric master key exchange, correct?

Thanks in advance.

Answer 1

For a full symmetric key key transport, the symmetric key is created from a random number generator. This is then signed with the owners static private key and then encrypted with the recipients static public key (key wrapping), and then sent to the recipient. The recipient will receive, decrypt and verify the signature, and the symmetric key is decided on. Whilst a key agreement algorithm like ECDH(E) or DH(E) isn't needed, an asymmetric cipher such as RSA is needed. This is referred to as a KEM system (key management), and requires an asymmetric cipher algorithm for the key wrapping.

For a key agreement or KEX (key exchange), then ECDH(E) or DH(E) is used, where both parties exchange bits of info and then calculate a shared secret, which goes through a HKDF to convert in into the format of a symmetric key.

So even for key wrapping, an asymmetric cipher must be used at some point, so that the key can be securely transported to the recipient, and it's authenticity verifiable.