# Handshake without asymmetric encryption

One of my teacher said "Without asymmetric encryption, we would be forced to use third-party to initiate any connection".

I don't understand how it can be possible, what if an attack occur during the communication with the third-party?

Maybe my teacher was speaking about a physical third-party? (i thought about an initialized physical authentication key like YubiKey) Or is there something I didn't understand?

How is it possible to start a symmetric encryption without asymmetric one?

• We can't tell you what someone else meant. – schroeder Nov 8 '19 at 12:41
• Taken out of any context this statement does not make much sense. It might make more sense within a larger context but this is unknown to us. "Maybe my teacher was speaking about a physical third-party?" - how should we know? Ask your teacher what he was speaking about. – Steffen Ullrich Nov 8 '19 at 12:46
• well it was more like a comment beside the course than an important part (so it had 0 significative context), but i didn't know if he was correct – MrHeliose Nov 8 '19 at 12:48

Symmetric Cryptography means that the key used for encryption is identical to the one used for decryption. This means that in order for two parties (Alice and Bob, as an example) to communicate, they need to share this key somehow.

Using purely symmetric cryptography, this is not possible. In order to send the key, one would need to encrypt it. For that, a key is necessary, and the problem begins anew.

# How can symmetric keys be exchanged?

One way would be to use asymmetric encryption. This can either mean using an algorithm which generates a shared key, or by simply encrypting a key and sending it to the other.

Another possibility is out-of-band exchange, meaning that keys are exchanged through a different method than is used for communication. This could mean in person, via letter, on the phone, over the radio, etc...

None of these would be practical for certain ways of communication. For example, communication with a web-server would be completely impractical if I had to call them beforehand for them to transmit a 128-bit AES key to me over the phone, and it would suffer from the same problems as we had initially, since that call would not be encrypted.

• thanks for the explanation, it was what i thought, but was not 100% sure – MrHeliose Nov 8 '19 at 13:05

You start a symmetric encrypted communication by already having the symmetric keys. You are correct that the key exchange process needs to be secure, and that's why we use asymmetric protocols.

• And there is no other way to get this symmetric key? as he said, using a third party? – MrHeliose Nov 8 '19 at 12:46
• There are lots of ways to transfer keys. You could even mail/fax/sky write them. As I said, I'm not sure what he meant by using a 3rd party, but it's possible. – schroeder Nov 8 '19 at 12:52
• but by what you know there is no 'non-physic' way to transfer a key secretely without asymetric encryption? Thx a lot – MrHeliose Nov 8 '19 at 12:55