Is there a safe way to uniquely identify a symmetric key? I know with asymmetric keys you typically use a hash of the public key, but I assume that using a hash of a symmetric key would reveal too much information. Would you simply have to assign a GUID to each key and ensure that those GUID/key pairs never get lost or mixed up?

I'm just wondering, because if you have hundreds of keys stored someplace, how do you know which one to use?

  • $\begingroup$ Could you make your use case a bit clearer? Is it something like the PSK (pre-shared key) cipher suites for TLS, which have an identity hint? $\endgroup$ Commented Oct 17, 2011 at 2:22
  • $\begingroup$ Ah, I was unaware of PSK Identities. This is pretty much exactly what mikeazo indicated below, so I will mark this answered as it doesnt sound like I can do any better. $\endgroup$
    – senecaso
    Commented Oct 17, 2011 at 2:28
  • 1
    $\begingroup$ Hashing is meant to be secure in this case. If the key is actually generated from randomness (and not a password or something similar), reversing the hash is the classical pre-image attack and well covered by hash function security. $\endgroup$
    – Nakedible
    Commented Oct 21, 2011 at 5:22
  • $\begingroup$ @Nakedible, thanks! I was hoping to hear something like that. $\endgroup$
    – senecaso
    Commented Oct 21, 2011 at 6:29
  • $\begingroup$ @senecaso Do you find any better approach to do this? $\endgroup$
    – sg777
    Commented Sep 30, 2022 at 13:59

1 Answer 1


Any unique identifier would do the trick, including using a hash of the key (assuming you are using a good hash function). Personally I would not use a hash of the key though as it makes an offline attack theoretically possible. If the ID has nothing to do with the key, however, and an attacker steals the ID, there is no advantage gained by the adversary. A simple counter would do the trick. If you indeed need the ID to be globally unique though, simply having everyone generate a random 128 bit number would also work.

  • $\begingroup$ Ya, I said "GUID" because it was short and sweet :) I agree any UID would do. My concern is that the UID is then not tied to key, like a fingerprint, so its easier to get things muddled up somewhere down the line. Your statement about offline attack is exactly what I was worried about though. I was hoping there was some magic way to prevent the hash from being useful in an offline attack by salting it or something, to make it more expensive to calculate than simply trying to brute force the key. $\endgroup$
    – senecaso
    Commented Oct 17, 2011 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.