Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1
to encrypt a 256-bit key kaes1
and sends it to Bob. From there, Alice and Bob exchange a lot of messages back and forth, using AES-256 to symmetrically encrypt the data with the key kaes1
.
Then, Charlie comes along and wants to participate, so Alice and Charlie complete a key exchange and Alice then uses that key k2
to encrypt the same original kaes1
and sends it over to Charlie. From there, Alice and Bob and Charlie now exchange a bunch of messages symmetrically encrypted with AES-256.
Eve has been listening in this whole time, and she has all the data, but none of the keys. Does Eve gain an advantage if she knows that kaes1 was the payload for 2 different messages encrypted with 2 different keys k1
and k2
?
k1
andk2
is secure Eve won't be able to learnkaes1
. But there are two risks here: 1) Charlie will be able to decrypt messages sent before he joined the group 2) If Eve ever learns kaes1 she can decrypt all messages. I prefer shorter lived keys to limit the window of exposure. $\endgroup$