Consider a connection protocol where, after jumping through several other hoops, Alice and Bob know each others' public keys; and they now want to do a RSA-handshake-kind-of-thing to come up with a symmetric key for subsequent communication.
- Alice randomly generates a 32-byte secret seed
s_a
, and Bob generatess_b
. - They use asymmetric encryption to send the keys to each other.
- Now both Alice and Bob want to independently generate a shared secret key
s
to symmetrically encrypt the rest of their conversation.
In this final step of deriving the shared secret, are there any pitfalls to look out for? I can think of several deterministic approaches - e.g.
- Multiply the two seeds and stretch the product:
s = hash(s_a ⨉ s_b)
- Concatenate the two seeds in ascending order, and stretch the result:
s = hash(concat(sort(s_a, s_b)))
- Use the smaller key as a hash key to hash the larger one.
s = hash(s_smaller, s_larger)
- Just use the smallest of the two keys.
Do we need to be careful here? Is there any reason to prefer one of these over the others?