I am currently working in security in mobile ad-hoc networks I have several clusters, and I want from the cluster head to send some data encrypted with its public key ,to the cluster members. I assume that each member has its own private key so it can decrypt the data

I ask about how to get a single public key and multiple private keys for this public key? what is the solution for this case?

  • If information sharing over untrusted media is your only issue, you should take a look at Diffie-Hellman key exchange. – DarkLighting Feb 25 '15 at 14:08
  • But the cluster members number may reach to 20 or 30 in the single cluster – yomna Mar 1 '15 at 15:38
  • I'm sorry, but there is no such thing as what you are asking. This would mean that we'd have multiple keys to the same lock and the whole thing is designed to be unique. Collisions, in this concept, are flaws that CANNOT exist. Your only option is sharing the same private key to your cluster members (what would be a huge vulnerability in my opinion), creating a priv-pub key pair to each member or sticking to a symmetric encryption model using the mentioned Diffie-Hellman key exchange. – DarkLighting Mar 2 '15 at 14:18

What you can do in this situation is to use hybrid cryptography, in which you encrypt the message with a symmetric algorithm and encrypt the symmetric key with the recipient's public key. You can easily adapt that to send a message to many clients, each with their own public key. What you do is encrypt the symmetric key with client A's public key, and with client B's public key, and with client C's public key, and so on; you then stick all of these "symmetric key encrypted with client X's public key" tags on the front of the message, and each client can then decrypt the symmetric key and then the message. This way, you don't have to send 20 copies of the message, just 20 copies of the symmetric key.

| improve this answer | |

If you want to securely send data to your recipient, you encrypt the data using the recipient's public key, not your own.

Is there a specific requirement to use asymmetric keypairs? Can you use symmetric keys instead? Or you can even combine it, i.e. protect the tranport using TLS but data going through is actually encrypted using a pre-shared AES key.

| improve this answer | |
  • Actually, I need from The cluster head to send certain symmetric key to his cluster members, but we need to send this symmetric key hidden.afterwards after sending this symmetric key to the members, some encryption phases will be done by this key. so my goal is to hide the symmetric key that will be sent to the members so I think about public/private systems . – yomna Feb 25 '15 at 13:09
  • I see. The way asymmetric keys work is as I have explained above. One possibility is to have all the member nodes use the same private key so whatever you encrypted is accessible by each of the member. – Ken Feb 25 '15 at 14:42

If you want to use asymmetric cryptography, you cannot have multiple private key and one public key. These keys work as a pair of key.

What is encrypted using the public key can only be decrypted by the private key and this key only.

To solution your problem, if you have perfect control over your cluster clients, you could share the same private key among all the cluster clients. Then the head cluster can encrypt data that can be decrypted by any and all cluster client. Of course, if any cluster client gets compromised, the key is compromised for all.

You can also manage a single key pair by cluster client. Then the cluster head would have to keep track of which public key is associated to which cluster client before communicating, otherwise the request will not be deciphered.

You would also have to issue a private/public key pair for the cluster head if you want to send encrypted answers (unless you negotiate some other protocol key).

| improve this answer | |

If each member has its own private key, then each member must have a corresponding public key. None of these public keys can be identical.

If you want to distribute data from one system to one or more other systems using encryption, please use an existing protocol to do this, like TLS or SSL, as these techniques have been tried and tested and are proven to be secure when configured correctly.

Data decryption for asymmetric ciphers is computationally difficult - the method for distributing large quantities of encrypted data is to only use an asymmetric cipher to negotiate and share a symmetric cipher key. The asymmetric cipher can then be replaced with a symmetric cipher - as both parties now have the shared key. Symmetric cryptography is computationally cheaper and faster than asymmetric.

All your setup requires is that the cluster head maintains a list of public keys for each of your cluster nodes, and when you want to distribute encrypted data to each of them, you encrypt your data for each node separately, using each node's public key. Each node then has access to its own encrypted data block which each can decrypt using its own private key.

To use symmetric crypto in the above example (for each client), you have to generate a new symmetric key, encrypt the data with it, then encrypt the symmetric key itself using the client's public key, and store the encrypted key with the message for the client to download.

This is basically the definition of PKI. Public Key Infrastructure is simply a structured method of managing keys and keypairs to allow secure communication to be performed between systems.

| improve this answer | |


You have to use one pair for each client!

Ideally, each client have to produce it's own pair and send to you his public key with a certificate request.

So you could work as a certificate authority and validate, then publish all public keys.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.