If Alice is going to share a symmetric encryption key and a kmac key with Bob using asymmetric encryption (sign with static key, encrypt with ephemeral keys - an authenticated KEM), what are the advantages and/or disadvantages of sending 2 random keys (signed, encrypted assymetrically), compared to sending 1 master key (signed, encrypted assymetrically), where multiple keys can be derived from it using something like kmac or hkdf?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
If we put algorithmic details aside, the two have little to no difference.
But in reality, public-key encryption and key exchange algorithms are limited in the length of data they can directly exchange. For example, the size of the key that can be exchanged with ECC is directly related to the base-2 logarithm of the order of the curve being used.
Next, if we do exchange over-sized symmetric key with, say, bigger curves, we may not necessarily be able to use the entropy present in the exchanged key - the security of the whole cryptosystem is limited to its weakest component. Therefore, encrypting with a 256-bit key then MAC'ing it with another 256-bit key give you only 256-bit security, not 512-bit.
To summarize: Exchanging over-sized key is neither necessarily viable nor necessarily useful. Do use HKDF for saving communication overhead.
-
-
$\begingroup$ While reading,
Therefore, encrypting with a 256-bit key then MAC'ing it with another 256-bit key give you only 256-bit security, not 512-bit.I've felt that someone considers that they have 512-bit. $\endgroup$– kelalakaCommented Dec 28, 2019 at 11:58