3
$\begingroup$

This from Cryptography course from Coursera:

Key wrapping or encapsulation using a KEK can be accomplished using either symmetric or asymmetric cipher

For my information KEK solves the key distribution issues with symmetric keys, so only the involved party can decrypt the cypher with their private key, but doesn't using symmetric KEK for distributing symmetric session keys raises the same distribution issues?

$\endgroup$
1
  • $\begingroup$ There is type there, Kerberos uses only symmetric keys. $\endgroup$
    – kelalaka
    Oct 16, 2020 at 10:50

1 Answer 1

3
$\begingroup$

Yes, and Key-Encryption Keys often are symmetric. When they are, they do not bring the benefits of asymmetric cryptography; in particular, anyone with the KEK and passively eavesdropped ciphertext can decrypt the distributed keys. That does not make use of symmetric KEK pointless:

  • KEK would typically be distributed, stored and used with more precautions (procedural checks, maximum volume encrypted..) than the keys they encipher. Therefore, even if compromise of one of the distributed key was likely (e.g. because some attack has a low probability to recover a distributed key, and many keys are distributed), that won't compromise the other distributed keys or the material they protect, thanks to the key distribution under KEK.
  • KEK can be long-lived (year) when the keys it enciphers can be short-lived (day). Therefore, the serious inconvenience of secure distribution of the KEK (e.g. by trusted courier) needs to occur only seldom, and other keys can be distributed electronically, and frequently. Frequent change of keys not only reduces the impact of a key leak (see above), it might drastically reduce it's probability to occur (e.g. in attack scenarios that requires many uses of a given key to succeed).
$\endgroup$
1
  • $\begingroup$ First point doesn't seem to be a pros to the KEK than the storage procedure itself, How can the second point be a pros to the KEKs? $\endgroup$
    – mshwf
    Oct 16, 2020 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.