Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm new to cryptography. While reading about symmetric key encryption, it was mentioned that it requires secret key exchange so that 2 parties can decrypt the ciphertext.

Now, using some encryption software like GPG, we can use symmetric encryption by gpg --symmetric abc.txt It asks for password there.

Is the key generated using the password?

Can I actually see the secret key if I want to?

Symmetric key cryptography requires secure key exchange. But in real world the 'key' itself is not exchanged right? Instead the password should be securely exchanged right?

Also, is the key actually present in the ciphertext & unlocked by the password or is it generated on-the-spot when we give our password?

Thank you!

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Is the key generated using the password?

Yes. In this sort of scenario, the password is run through a key derivation function (KDF) such as PBKDF2 to generate the key.

Can I actually see the secret key if I want to?

AFAIK, the symmetric key in this case is not stored anywhere. Instead, the key is derived from the password each and every time you want to encrypt or decrypt something. If you really want to obtain the key, you can run your password through the KDF assuming you know the salt and iteration count.

Symmetric key cryptography requires secure key exchange. But in real world the 'key' itself is not exchanged right? Instead the password should be securely exchanged right?

This is quite a complex topic. In the case of GPG in symmetric mode, the key is not transferred by any means. Knowledge of the password is required to decrypt the encrypted data.

If you want to "share" the encrypted data with another entity, you usually make use of a hybrid cryptosystem. In the case of GPG, you will be encrypting the file without the --symmetric flag. What this does is encrypt the data with a randomly generated symmetric key. This randomly generated key is then encrypted with the public key of your target (the recipient in GPG-speak). The encrypted symmetric key is appended with the encrypted blob and sent to your target. Your target will then decrypt the encrypted symmetric key with his private key and use the decrypted symmetric key to decrypt the encrypted blob.

share|improve this answer
    
Thank you for the answer! –  Sean Sep 9 '13 at 12:44

1) Yes, --symmetric does derive a 128bit key from the password and a salt prepended to the encrypted output. It uses a function called Password Based Key Derivation Function 2 (PBKDF2) to do this. Infact, this is also how gpg encrypts the private key so that only your passphrase can use the file.

2) Well, you could run the password and salt yourself through the function to generate the key.

3) In real life asymmetric cryptography is usually used to exchange symmetric keys generated for that session. Then those symmetric keys are used for the actual encryption of the data/message.

share|improve this answer
    
Thanks a lot for the answer! –  Sean Sep 9 '13 at 12:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.