Assuming that:
- A have CertA and secret key KsA
- B have CertB and secret key KsB
A need to transfer data M to B with the requirement of confidentiality and authenticity, BUT Data encryption must be done by symmetric encryption.
How do A and B do that to achieve all the requirements?


To solve this problem a common solution is using a Hybrid Cryptosystem.

Create a new random session key (ephemeral key) for the symmetric encryption (AES) then encrypt the data with this key with a proper mode of operation with an appropriate padding scheme as pkcs#5

key = generate_random_key()
encrypted_data = AES(k, data)

Now, A encrypts the session key with the B's public key.

encrypted_key = Encrypt(key, B_private_key)

Finally, A digitally sign everything

sign = Sign(Hash(encrypted_key || encrypted_data)

and send

Send(encrypted_data, encrypted_key, sign)

In this way;

  • data encrypted with a symmetric algorithm which is much faster than asymmtrical encryption.
  • data is confidential since encrypted with a key.
  • data is authenticated since A uses his secret key to sign, and B can verify this with A's public certificate.
  • 1
    thank you so much, very straightforward and easy to understand !!!! – Việt Dũng Lê Dec 21 '18 at 9:54

This is how all HTTPS and TLS communications work.

2x Async certs/keys are used to create a shared secret which is used as a symmetric key for the lions share of the communication.

enter image description here

In step 6/7 of this diagram, is where the Symmetric key is created and both sides ChangeCipherSpec to make use of this newly established shared key.

  • thanks you so much, your answer is also very straightforward and give me lots of information :like: – Việt Dũng Lê Dec 21 '18 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.