- A have CertA and secret key KsA
- B have CertB and secret key KsB
A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must be done by symmetric encryption.
How do A and B do that to achieve all the requirements?
To solve this problem a common solution is using a Hybrid Cryptosystem.
key = generate_random_key() encrypted_data = AES(k, data)
Now, A encrypts the session key with the B's public key.
encrypted_key = Encrypt(key, B_private_key)
Finally, A digitally sign everything
sign = Sign(Hash(encrypted_key || encrypted_data)
Send(encrypted_data, encrypted_key, sign)
In this way;
- data encrypted with a symmetric algorithm which is much faster than asymmtrical encryption.
- data is confidential since encrypted with a key.
- data is authenticated since A uses his secret key to sign, and B can verify this with A's public certificate.
2x Async certs/keys are used to create a shared secret which is used as a symmetric key for the lions share of the communication.
In step 6/7 of this diagram, is where the Symmetric key is created and both sides
ChangeCipherSpec to make use of this newly established shared key.