Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

Question

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. The details are:

Bob generates a public/private key pair.
Bob upload his public key to a key server.
Alice download Bob's public key from the key server.
Alice chooses a symmetric key, uses Bob's public key to encrypt the symmetric key, and sends it to Bob.
Bob decrypts Alice's symmetric key.
Bob and Alice communicate with the symmetric key.

In step 4, it seems only Alice can decide the symmetric key. And it must be Alice to send it to Bob. Because if Bob chose and sent the symmetric key to Alice, any eavesdropper can decrypt it.

Is this right?

And who is Tom in a given context? – Crypt32 Sep 05 '18 at 04:25 — Crypt32, Sep 05 '18 at 04:25
@Crypt32 lol... that's a typo. Should be Bob. Thanks. – smwikipedia Sep 05 '18 at 05:19 — smwikipedia, Sep 05 '18 at 05:19

score 2 · Answer 1 · answered Sep 05 '18 at 04:35

In your very specific scenario this is true. Asymmetric encryption is used in a lot of cases primarily to secure a key transfer because it is really slow in comparision to symmetric encryption.

The problem with symmetric encryption on the other hand is that the key exchange cannot be protected in an automated way when only using symmetric encryption. In your case the only person with a assymetric keypair is bob so if one wanted to send a key in a secure way, the only recipient can be bob.

score 2 · Answer 2 · answered Sep 05 '18 at 05:30

Short answer is yes.

In your scenario, Alice is the one who is initiating the communication using the other party's public key. In case bob wants to start the communication, he may use Alice's public key to share a chosen symmetric key.

For most cases, one of the parties would act as a client and the other as a server. Generally the client would use the server's public key to verify its authenticity and initiate communication. I suggest reading up on how SSL works to better understand how this workflow is used for practical purposes. SSL/TLS is the most commonly found application of this workflow.

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

2 Answers2