Contents

Key encapsulation mechanism

Example using RSA encryption[edit]

Using the same notation employed in the RSA article, say Alice has transmitted her public key (n, e)toBob, while keeping her private key secret, as usual. Bob then wishes to send symmetric key M to Alice. M might be a 128- or 256-bit AES key (suitably padded for security reasons), for example. The key modulus n is typically 2048 bits or more in length, thus much larger than typical symmetric keys. Without suitable padding, if e is small enough that M^e < n, then the encryption can be quickly broken using ordinary integer arithmetic.^[2]

To avoid such potential weakness, Bob first maps M to a larger integer m, where 1 < m < n, by using an agreed-upon reversible protocol known as a padding scheme, such as OAEP. He then computes the ciphertext c corresponding to:

${\displaystyle c\equiv m^{e}{\pmod {n}}.}$

Alice can recover m from c by using her private key exponent d by the following computation:

${\displaystyle m\equiv c^{d}{\pmod {n}}.}$

Given m, she recovers the original key M by reversing the padding scheme.

With KEM the process is simplified as follows:^[3]

Instead of generating a random symmetric key M, Bob first generates a random m with 1 < m < n. He derives his symmetric key MbyM = KDF(m), where KDF is a key derivation function, such as a cryptographic hash. He then computes the ciphertext c corresponding to m:

${\displaystyle c\equiv m^{e}{\pmod {n}}.}$

Alice then recovers m from c by using her private key exponent d by the same method as above:

${\displaystyle m\equiv c^{d}{\pmod {n}}.}$

Given m, she can recover the symmetric key MbyM = KDF(m).

The KEM eliminates the complexity of the padding scheme and the proofs needed to show that the padding is secure.^[1] Note that while M can be calculated from m in the KEM approach, the reverse is not possible, assuming the key derivation function is a secure one-way function. An attacker who somehow recovers M cannot get the plaintext m. With the padding approach, he can. Thus KEM is said to encapsulate the key.

Note that if the same m is used to encapsulate keys for e or more recipients, and the receivers share the same exponent e, but different p, q and n, then one can recover m via the Chinese remainder theorem. Thus, if key encapsulations for several recipients need to be computed, independent values m should be used.

Earlier versions of Transport Layer Security used RSA for key exchange, before they were deprecated in favour of the more efficient elliptic-curve cryptography.^[4]

Similar techniques are available for Diffie–Hellman key exchange and other public key methods.^[5]

References[edit]

See also[edit]

• Key Wrap
• Optimal Asymmetric Encryption Padding
• Hybrid Cryptosystem