How to securely share AES key between two remote devices (client and server) through UDP protocol?

Question

I have two separate system (client) and (server). I am having a problem which is to encrypt a message from the client and decrypt at the server. In order to do that, I am required to transmit my key along with the message through UDP packets. However, is there any possible ways to ensure the key is transmitted securely?

Answer 1

You don't transfer the key, not at least un-encrypted.

There are several ways to "establish a shared key" between authenticated systems.

Using key exchange schemes such as Diffie-Hellman, its elliptic-curve versions such as ECDH, X25519/X448, etc, as well as some schemes secure even if you attack it with a quantum computer such as NTRU (formerly NTRUEncrypt), Kyber, Saber.

Notice I said authenticated system. key exchange schemes require the public key of the peer - which is static if you just hard-code it into your application; a better way is to use a digital signature to sign an ephemeral key exchange public key and hard-code the digital signature verification key into the application.

All in all, there is a well-established protocol with existing free and open-source implementations called TLS, which you can use to exchange an initial key, then import that key into your UDP-based protocol.

The QUIC protocol does about just that: it doesn't design new key exchange or authentication handshake protocol, it imports the key from TLS handshake and use it in the en/de-crypting UDP packets.