1

I understand the Symmetric process but want I wasn't sure on is the below:

When does the sender and receiver decide on what algorithm to us? is this around the same time they exchange the key? do programs automatically pick up what type of algorithm has been used?

Matt
  • 19
  • 1
  • 2
    Well, how the cipher is negotiated depends on the protocol. You can read [here](https://security.stackexchange.com/questions/94799/how-do-browsers-negotiate-ssl-tls-connection-parameters) about the parameter negotiation for TLS. – Arminius May 28 '17 at 19:58

2 Answers2

3

No, ciphertext of modern ciphers is supposed to be indistinguishable from random. That means that the algorithm cannot be automatically detected.

Generally the algorithm is preset (hardcoded) or it is a configuration parameter, established ahead of time. It may be established at runtime or saved with the ciphertext, but note that adversaries could possibly also change the algorithm before it is used.

Note that for instance AES is a block cipher, it is not a general purpose cipher by itself. For that a mode of operation of the block cipher is also required. In other words, just specifying the block cipher is not enough. There may be other parameters that need to be established.

As already mentioned in the comments, the protocol defines when the algorithm is selected.

Maarten Bodewes
  • 4,602
  • 15
  • 29
2

Symmetric encryption by itself does not neither include key exchange nor a decision which algorithm to use. These choices are done in an outside protocol layer.

For example in TLS the algorithm depends on the cipher suite chosen inside the TLS handshake. And the key exchange is also done inside the TLS handshake, but after the cipher suite is chosen since the cipher suite also contains the kind of key exchange to use. For more details on this process in TLS see How do browsers negotiate SSL/TLS connection parameters?.

But in PGP this process is different. Here the sender simply decides on the algorithm, maybe guided by a users configuration or by implementation defaults. And the key is not exchanged either but a random key is generated and encrypted with the recipients public key. The encrypted key and the choice of algorithm is then send together with the encrypted data to the recipient which can extract the symmetric key by using its own private key.

Steffen Ullrich
  • 190,458
  • 29
  • 381
  • 434