Search code examples
sslencryptionaesrsa

AES, how are keys distributed?

I have been trying to understand AES encryption, I have a basic understanding of the process and how it works but one thing I cant find is, if the Key is secret, how is it securely distributed?

I saw a post that said “Using SSL” but having had a look it seems that it still requires both parties to have access to a key.

I thought I might be possible to use RSA? But was looking to find how its done in the real world.

Solution

  • This is the simplest version that will work, but it's not quite how it really works. The server must have an RSA key that the client can confirm belongs to the server. Typically, this is done with a certificate signed by a trusted authority.

    1. The client generates a random AES key.
    2. The client encrypts the random AES key with the server's RSA public key.
    3. The client sends the encrypted AES key to the server.
    4. The server decrypts the AES key with its RSA private key.
    5. The server and client now have a shared AES key.