Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption?

  1. Server sends PGP public key
  2. Client generates (uses as AES key for networking) and encrypts random 128 byte key with PGP public key
  3. Server decrypts data with PGP private key and uses as AES key for networking

Obviously current standards such as SSL/TLS would work better, and the keys would need to be checked at some sort of CA (perhaps a public PGP key server)

share|improve this question

2 Answers 2

When a SSL/TLS client and server talk to each other, the client needs to know the server's public key. In some dedicated applications the client already knows it (hardcoded in the client); but the normal method is for the server to send the key as an X.509 certificate. However, it is conceivable to use another kind of vessel for the server's key, for instance OpenPGP. There is even a RFC for that; GnuTLS is an SSL/TLS library that purportedly supports that usage.

share|improve this answer
In what situation would you recommend using this? Is it just as simple as when the parties prefer WoT instead of PKI? – LamonteCristo Jan 3 at 15:04
I would not recommend using a WoT because I don't believe that WoT actually provide any substantial guarantee. It is more a ritual dance by which WoT users try to propitiate the Crypto Gods, than a really effective method for thwarting attacks. What really works against attacks is public key pinning, by which clients remember server keys. In OpenPGP, the WoT is so cumbersome to use that clients invariably use key pinning after having appeased the WoT deity, and that provides security. – Tom Leek Jan 7 at 14:55
thank you... that is helpful – LamonteCristo Jan 7 at 15:00

That method is not protected against man-in-the-middle attacks unless the public key can be trusted (using the normal PGP trust model). Otherwise yes, it should be a good method of sharing an AES key.

It would be identical to the method that SSL uses to share keys using RSA (unless the safer method that deploys Ephemeral Diffie-Hellman with RSA authentication is applied). Note that your scheme does therefore not provide perfect forward secrecy.

share|improve this answer
Of course, you can then also mess up the networking part, by forgetting the authentication tag or padding oracle attacks. – Maarten Bodewes May 10 '14 at 14:52
Assuming I understand perfect forward secrecy, could I not just sign a randomly generated public key with the server's real public key, so that way we know who it is. – Hector Mongoose May 10 '14 at 15:04
Given the rest of your comment, I'm not sure that the first assumption is correct... Then again, I may have misunderstood. – Maarten Bodewes May 10 '14 at 15:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.