Key exchange (also key establishment) is a method in
cryptography
Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adver ...
by which
cryptographic keys
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...
are exchanged between two parties, allowing use of a cryptographic
algorithm
In mathematics and computer science, an algorithm () is a finite sequence of rigorous instructions, typically used to solve a class of specific Computational problem, problems or to perform a computation. Algorithms are used as specificat ...
.
![Public key shared secret](https://upload.wikimedia.org/wikipedia/commons/4/4c/Public_key_shared_secret.svg)
If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. The nature of the equipping they require depends on the
encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decip ...
technique they might use. If they use a
code
In communications and information processing, code is a system of rules to convert information—such as a letter, word, sound, image, or gesture—into another form, sometimes shortened or secret, for communication through a communication ...
, both will require a copy of the same
codebook
A codebook is a type of document used for gathering and storing cryptography codes. Originally codebooks were often literally , but today codebook is a byword for the complete record of a series of codes, regardless of physical format.
Crypto ...
. If they use a
cipher
In cryptography, a cipher (or cypher) is an algorithm for performing encryption or decryption—a series of well-defined steps that can be followed as a procedure. An alternative, less common term is ''encipherment''. To encipher or encode i ...
, they will need appropriate keys. If the cipher is a
symmetric key cipher, both will need a copy of the same key. If it is an
asymmetric key cipher with the public/private key property, both will need the other's public key.
Channel of exchange
Key exchange is done either in-band or out-of-band.
The key exchange problem
The key exchange problem describes ways to exchange whatever keys or other information are needed for establishing a secure communication channel so that no one else can obtain a copy. Historically, before the invention of
public-key cryptography
Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic alg ...
(asymmetrical cryptography),
symmetric-key cryptography
Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext. The keys may be identical, or there may be a simple transformation to go between th ...
utilized a single key to encrypt and decrypt messages. For two parties to communicate confidentially, they must first exchange the secret key so that each party is able to encrypt messages before sending, and decrypt received ones. This process is known as the key exchange.
The overarching problem with symmetrical cryptography, or single-key cryptography, is that it requires a secret key to be communicated through trusted
courier
A courier is a person or organisation that delivers a message, package or letter from one place or person to another place or person. Typically, a courier provides their courier service on a commercial contract basis; however, some couriers are ...
s,
diplomatic bags, or any other
secure communication channel. If two parties cannot establish a secure initial key exchange, they won't be able to communicate securely without the risk of messages being intercepted and decrypted by a third party who acquired the key during the initial key exchange.
Public-key cryptography uses a two-key system, consisting of the public and the private keys, where messages are encrypted with one key and decrypted with another. It depends on the selected cryptographic algorithm which key—public or private—is used for encrypting messages, and which for decrypting. For example, in
RSA, the private key is used for decrypting messages, while in the
Digital Signature Algorithm
The Digital Signature Algorithm (DSA) is a Public-key cryptography, public-key cryptosystem and Federal Information Processing Standards, Federal Information Processing Standard for digital signatures, based on the mathematical concept of modular e ...
(DSA), the private key is used for authenticating them. The public key can be sent over non-secure channels or shared in public; the private key is only available to its owner.
Known as the Diffie-Hellman key exchange, the encryption key can be openly communicated as it poses no risk to the confidentiality of encrypted messages. One party exchanges the keys to another party where they can then encrypt messages using the key and send back the cipher text. Only the decryption key—in this case, it's the private key—can decrypt that message. At no time during the Diffie-Hellman key exchange is any sensitive information at risk of compromise, as opposed to symmetrical key exchange.
Identification
In principle, the only remaining problem was to be sure (or at least confident) that a public key actually belonged to its supposed owner. Because it is possible to '
spoof
Spoof, spoofs, spoofer, or spoofing may refer to:
* Forgery of goods or documents
* Semen, in Australian slang
* Spoof (game), a guessing game
* Spoofing (finance), a disruptive algorithmic-trading tactic designed to manipulate markets
__NOTOC__ ...
' another's identity in any of several ways, this is not a trivial or easily solved problem, particularly when the two users involved have never met and know nothing about each other.
Diffie–Hellman key exchange
In 1976, Whitfield Diffie and Martin Hellman published a
cryptographic protocol
A security protocol (cryptographic protocol or encryption protocol) is an abstract or concrete protocol that performs a security-related function and applies cryptographic methods, often as sequences of cryptographic primitives. A protocol describe ...
called the
Diffie–Hellman key exchange
Diffie–Hellman key exchangeSynonyms of Diffie–Hellman key exchange include:
* Diffie–Hellman–Merkle key exchange
* Diffie–Hellman key agreement
* Diffie–Hellman key establishment
* Diffie–Hellman key negotiation
* Exponential key exc ...
(D–H) based on concepts developed by Hellman's PhD student
Ralph Merkle
Ralph C. Merkle (born February 2, 1952) is a computer scientist and mathematician. He is one of the inventors of public-key cryptography, the inventor of cryptographic hashing, and more recently a researcher and speaker on cryonics.
Contribution ...
. The protocol enables users to securely exchange secret keys even if an opponent is monitoring that communication channel. The D–H key exchange protocol, however, does not by itself address authentication (i.e. the problem of being sure of the actual identity of the person or 'entity' at the other end of the communication channel). Authentication is crucial when an opponent can both monitor ''and alter'' messages within the communication channel (AKA
man-in-the-middle
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
or MITM attacks) and was addressed in the fourth section of the paper.
Public key infrastructure
Public key infrastructure
A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facilit ...
s (PKIs) have been proposed as a workaround for the problem of identity authentication. In their most usual implementation, each user applies to a “
certificate authority
In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This ...
” (CA), trusted by all parties, for a
digital certificate
In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a Key authentication, public key. The certificate includes information about the key, i ...
which serves for other users as a non-tamperable authentication of identity. The infrastructure is safe, unless the CA itself is compromised. In case it is, though, many PKIs provide a way to revoke certificates so other users will not trust them. Revoked certificates are usually put in
certificate revocation lists which any certificate can be matched against.
Several countries and other jurisdictions have passed
legislation
Legislation is the process or result of enrolled bill, enrolling, enactment of a bill, enacting, or promulgation, promulgating laws by a legislature, parliament, or analogous Government, governing body. Before an item of legislation becomes law i ...
or issued regulations encouraging PKIs by giving (more or less) legal effect to these digital certificates (see
digital signature
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very high confidence that the message was created b ...
). Many commercial firms, as well as a few government departments, have established such certificate authorities.
This does nothing to solve the problem though, as the trustworthiness of the CA itself is still not guaranteed for any particular individual. It is a form of
argument from authority
An argument from authority (''argumentum ab auctoritate''), also called an appeal to authority, or argumentum ad verecundiam, is a form of argument in which the opinion of an authority on a topic is used as evidence to support an argument. Some con ...
fallacy. For actual trustworthiness, personal verification that the certificate belongs to the CA and establishment of trust in the CA are required. This is usually not possible.
There are known cases where
authoritarian
Authoritarianism is a political system characterized by the rejection of political plurality, the use of strong central power to preserve the political ''status quo'', and reductions in the rule of law, separation of powers, and democratic votin ...
governments proposed establishing so-called “national CAs” whose certificates would be mandatory to install on citizens’ devices and, once installed and trusted, could be used for monitoring, intercepting, modifying, or blocking the encrypted internet traffic.
For those new to such things, these arrangements are best thought of as electronic
notary
A notary is a person authorised to perform acts in legal affairs, in particular witnessing signatures on documents. The form that the notarial profession takes varies with local legal systems.
A notary, while a legal professional, is disti ...
endorsements that “this public key belongs to this user”. As with notary endorsements, there can be mistakes or misunderstandings in such vouchings. Additionally, the notary itself can be untrusted. There have been several high-profile public failures by assorted certificate authorities.
Web of trust
At the other end of the conceptual range is the
web of trust
In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centr ...
system, which avoids central Certificate Authorities entirely. Each user is responsible for getting a certificate from another user before using that certificate to communicate with the user.
PGP
PGP or Pgp may refer to:
Science and technology
* P-glycoprotein, a type of protein
* Pelvic girdle pain, a pregnancy discomfort
* Personal Genome Project, to sequence genomes and medical records
* Pretty Good Privacy, a computer program for the ...
and
GPG (an implementation of the
OpenPGP
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitio ...
Internet Standard) employ just such a web of trust mechanism.
Password-authenticated key agreement
Password-authenticated key agreement In cryptography, a password-authenticated key agreement method is an interactive method for two or more parties to establish cryptographic keys based on one or more party's knowledge of a password.
An important property is that an eavesdropper or m ...
algorithms can perform a cryptographic key exchange utilizing knowledge of a user's
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
.
Quantum key exchange
Quantum key distribution
Quantum key distribution (QKD) is a secure communication method which implements a cryptographic protocol involving components of quantum mechanics. It enables two parties to produce a shared random secret key known only to them, which can then be ...
exploits certain properties of quantum physics to ensure its security. It relies on the fact that observations (or
measurements
Measurement is the quantification of attributes of an object or event, which can be used to compare with other objects or events.
In other words, measurement is a process of determining how large or small a physical quantity is as compared t ...
) of a quantum state introduces perturbations in that state. Over many systems, these perturbations are detectable as noise by the receiver, making it possible to detect
man-in-the-middle attacks. Beside the
correctness and
completeness of quantum mechanics, the protocol assumes the availability of an
authenticated channel between Alice and Bob.
See also
*
Key (cryptography)
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...
*
Key management
Key management refers to management of cryptographic keys in a cryptosystem. This includes dealing with the generation, exchange, storage, use, crypto-shredding (destruction) and replacement of keys. It includes cryptographic protocol design, ...
*
Diffie–Hellman key exchange
Diffie–Hellman key exchangeSynonyms of Diffie–Hellman key exchange include:
* Diffie–Hellman–Merkle key exchange
* Diffie–Hellman key agreement
* Diffie–Hellman key establishment
* Diffie–Hellman key negotiation
* Exponential key exc ...
*
Elliptic-curve Diffie–Hellman Elliptic-curve Diffie–Hellman (ECDH) is a key agreement protocol that allows two parties, each having an elliptic-curve public–private key pair, to establish a shared secret over an insecure channel. This shared secret may be directly used as ...
*
Forward secrecy
In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key ...
References
The possibility of Non-Secret digital encryptionJ. H. Ellis, January 1970.
Non-Secret Encryption Using a Finite FieldMJ Williamson, January 21, 1974.
Thoughts on Cheaper Non-Secret EncryptionMJ Williamson, August 10, 1976.
New Directions in CryptographyW. Diffie and M. E. Hellman, IEEE Transactions on Information Theory, vol. IT-22, Nov. 1976, pp: 644–654.
* Martin E. Hellman, Bailey W. Diffie, and Ralph C. Merkle, U.S. Patent #4,200,770, 29 April 1980
The First Ten Years of Public-Key CryptographyWhitfield Diffie, Proceedings of the IEEE, vol. 76, no. 5, May 1988, pp: 560–577 (1.9MB PDF file)
*
Menezes, Alfred;
van Oorschot, Paul;
Vanstone, Scott (1997). ''
Handbook of Applied Cryptography
A handbook is a type of reference work, or other collection of instructions, that is intended to provide ready reference. The term originally applied to a small or portable book containing information useful for its owner, but the ''Oxford Engl ...
'' Boca Raton, Florida: CRC Press. .
Available online
*
Singh, Simon
Simon Lehna Singh, (born 19 September 1964) is a British popular science author, theoretical and particle physicist. His written works include ''Fermat's Last Theorem'' (in the United States titled ''Fermat's Enigma: The Epic Quest to Solve t ...
(1999) ''
The Code Book: the evolution of secrecy from Mary Queen of Scots to quantum cryptography'' New York: Doubleday
Cambodia
Cambodia (; also Kampuchea ; km, កម្ពុជា, UNGEGN: ), officially the Kingdom of Cambodia, is a country located in the southern portion of the Indochinese Peninsula in Southeast Asia, spanning an area of , bordered by Thailand t ...
{{DEFAULTSORT:Key Exchange
Cryptographic primitives
Cryptographic protocols
Public-key cryptography