Context assumption and aim: Using asymmetric crypto to help Alice and Bob (members belonging to the same basketball club. The club has its own servers) to communicate together without the conversation being intercepted/modified by Eve (not belonging to the basketball club).
On Wikipedia (key generation article) I found out that there are two kinds of key generations
- long-term key pair only
- key session (new key for each session)
On the key exchange article (Wikipedia) I found the following categories
- Diffie-Hellman key exchange
- Public Key Infrastructure (PKI)
- Web of trust (WoT)
- Password-Authenticated Key Agreement (PAKE)
- Quantum key exchange
It seems obvious that the key exchange can work only if the key pair is generated.
Can I mix key session and long-term key?
If so, can I use all combination (i.e. Cartesian product: "key generation" X "key exchange") ?
Which kind of combinations (key generation and key protocols) do companies use in real lie [assuming the company use asymmetric crypto]