2

Would PGP work as a method of sharing the AES key, as shown below, and what would be the flaws with this method of encryption?

  1. Server sends PGP public key
  2. Client generates (uses as AES key for networking) and encrypts random 128 byte key with PGP public key
  3. Server decrypts data with PGP private key and uses as AES key for networking

Obviously current standards such as SSL/TLS would work better, and the keys would need to be checked at some sort of CA (perhaps a public PGP key server)

Improve this question

2 Answers 2

Reset to default
1

When a SSL/TLS client and server talk to each other, the client needs to know the server's public key. In some dedicated applications the client already knows it (hardcoded in the client); but the normal method is for the server to send the key as an X.509 certificate. However, it is conceivable to use another kind of vessel for the server's key, for instance OpenPGP. There is even a RFC for that; GnuTLS is an SSL/TLS library that purportedly supports that usage.

Improve this answer
2
  • In what situation would you recommend using this? Is it just as simple as when the parties prefer WoT instead of PKI?
    – makerofthings7
    Commented Jan 3, 2015 at 15:04
  • I would not recommend using a WoT because I don't believe that WoT actually provide any substantial guarantee. It is more a ritual dance by which WoT users try to propitiate the Crypto Gods, than a really effective method for thwarting attacks. What really works against attacks is public key pinning, by which clients remember server keys. In OpenPGP, the WoT is so cumbersome to use that clients invariably use key pinning after having appeased the WoT deity, and that provides security.
    – Tom Leek
    Commented Jan 7, 2015 at 14:55
0

That method is not protected against man-in-the-middle attacks unless the public key can be trusted (using the normal PGP trust model). Otherwise yes, it should be a good method of sharing an AES key.

It would be identical to the method that SSL uses to share keys using RSA (unless the safer method that deploys Ephemeral Diffie-Hellman with RSA authentication is applied). Note that your scheme does therefore not provide perfect forward secrecy.

Improve this answer
3
  • Of course, you can then also mess up the networking part, by forgetting the authentication tag or padding oracle attacks.
    – Maarten Bodewes
    Commented May 10, 2014 at 14:52
  • Assuming I understand perfect forward secrecy, could I not just sign a randomly generated public key with the server's real public key, so that way we know who it is.
    – Hector Mongoose
    Commented May 10, 2014 at 15:04
  • Given the rest of your comment, I'm not sure that the first assumption is correct... Then again, I may have misunderstood.
    – Maarten Bodewes
    Commented May 10, 2014 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .