How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and decryption?

How do they share these two keys securely?


The common way is using the Public-Key to exchange keys. We assume both parties have public-private keys and they shared and verified their public keys before any other communication.

  1. Diffie-Hellman Key Exchange (DHKE); after the key exchange, you can use a KDF two derive encryption and MAC key. DHKE has also a variant that uses Elliptic Curves, ECDH.

    To mitigate the man-in-the-middle attack the DHKE needs a signature on the exchanged information. The TLS naming indicates this


    Key exchange with ECDHE and sign the exchange information with ECDSA. Without the signature, the DHKE becomes anonymous Diffie-Hellman.

  2. RSA-KEM in which RSA can be used to encrypt a uniform random value and this value can be used in the KDF to derive both keys.

You did not mention any encryption mode of operation for symmetric encryption. Actually, we have a modern encryption mode; Authenticated encryption with Associated Data (AEAD). Examples are AES-GCM, Chacha20-Poly1305. AEAD can provide confidentiality, integrity, and authentication. This authentication should not be confused with non-repudiation since both parties know the key you cannot prove that the message is produced only by one party.

  • 1
    One additional point of note: DH exchanges must themselves be signed, otherwise they're considered "anonymous" (ADH), which is unsafe against man-in-the-middle attacks. In SSL/TLS this is done by signing the public DH parameters with the long-term RSA key from the certificate. – Polynomial Jan 1 at 23:42
  • @Polynomial yes, you are absolutely right. – kelalaka Jan 1 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.