I am trying to understand how encryption works.

My understanding is that the key is sent with the cipher text. If this is true, I do not understand how an attacker could not get the key. If it is not true, I do not understand how the intended recipient could get the key they need to decrypt it.

Can you please explain?

  • You are going to need an awful lot more context in here to get any answers. What cipher? How is the secret key "included in the cipher text"?
    – crovers
    Nov 30 '16 at 16:57
  • A key is not included it, or sent along with a ciphertext. Can you clarify the scenario you're describing?
    – Xander
    Nov 30 '16 at 16:59
  • then please explain me how key is sent?? Nov 30 '16 at 17:00
  • I am beginner in cryptology. In today lecture my teacher told me that secret key is sent with cipher text. Nov 30 '16 at 17:01
  • 3
    You are going to have to ask your teacher for a clarification. Perhaps you heard incorrectly.
    – schroeder
    Nov 30 '16 at 18:01

In no encryption I'm aware of is the secret key sent alongside the cipher text. In symmetric encryption, both sides need the key - generally sent out of band (sometimes with the use of asymmetric encryption if there is a published public key). In asymmetric encryption, public keys are published, but messages encrypted with them cannot be decrypted without the private keys, which are kept by one side. Each side can use the other party's public key to encrypt a message, which the receiver can decrypt with its own private key. (Note that in practice - for example SSL/TLS - the public/private key pair is only used to establish a one-time-use key for a symmetric cipher, as symmetric ciphers tend to be much faster and more suitable for streaming situations).

If there is no public/private key to set up a symmetric encryption, the key is sent out of band - literally, it is sent through another means that is not susceptible to interception. This may be literally walking a USB stick over to a different computer or using a separate channel that is already encrypted or using a secure telephone line to pass the key or any other method of transporting a key that is secure.

  • 2
    Great edit to the question! You proved that a confusing question can indeed be cleared up and answered, instead of just down voted. Keep up the good work.
    – Anders
    Nov 30 '16 at 20:55
  • Thanks :) @Anders - trying to get the hang of this place and contribute
    – crovers
    Nov 30 '16 at 21:06
  • Thank you sir Crovers.. I am new in the course so I don't have the sense to ask the question. Dec 1 '16 at 14:40
  • "In asymmetric encryption, public keys are published, but cannot be decrypted without the private keys, which are kept by one side." This sentence is so wrong it cannot be right. I presume you wanted to write something entirely different (secret key instead of public key maybe?). There are many other ways of establishing keys which are not mentioned by this answer. Dec 2 '16 at 2:17
  • Besides that, there were encrypted USB sticks that were sent with the secret key in plaintext (probably because the manufacturer got tired of questions about restoring data). Snakeoil product of course, but it did happen. Dec 2 '16 at 2:19

Sometimes a symmetric secret key that was used to generate the ciphertext is send with a ciphertext. In that case it is wrapped (encrypted) by the public key of the receiver. The sender must trust that this key is of the receiver, otherwise the sender may be encrypting the key with the public key of an adversary.

The secret key is called a session or data key and is usually randomly generated. The receiver uses it's private key to unwrap (decrypt) the data key, which in turn can be used to decrypt the message. This data key usually has a 1:1 relation with the message; it is not used for any other message.

There are however many other ways of establishing session or data keys:

  • key agreement
  • key agreement with IES
  • key derivation using a master key
  • key derivation using RSA-KEM
  • key derivation from a password
  • out of band key establishment
  • secret key sharing
  • ...

Well, you get the point, there are a few options here.

There are actually instances where the secret key was send together with the ciphertext in plain. As this doesn't offer any security you should consider those kind of protocols utterly broken.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.