My question is fairly simple. I have more than two nodes which needs to communic

Question

My question is fairly simple. I have more than two nodes which needs to communicate very efficiently from computational point of view. One of the nodes can become a coordinator between the nodes. Nodes do have certificate and private keys. To let the nodes communicate with eachother effieciently I plan to use a symmetric key therefore key-exchange must be done.

The scheme to key exchange that comes to mind is to share DH's prime and primitive root among all so every one can have the shared secret key after a ring communication. Ofcourse to prevent MITM the parameters are encrypted with each party public key.

Another scheme that comes to mind is to let coordinator generate a secret key and distbute it to nodes using their public keys.

I tend to the 2nd scheme since it's easier to implement and needs less communication in handshake phase.

Would be a compromise to distrbute the secret key encrypted with public keys? or it's always recommended to use scheme like diffe-hellman to avoid explicity sending the shared secert key even encrypted.

Explanation / Answer

If efficiency and speed is an issue, you might want to have a look at protocols based on symmetric schemes and a trusted server for key exchange and authentication, e.g. Kerberos or Needham-Schroeder.

Key exchange with DH is only required, if you want the coordinator node not to be able to listen in the other communications. But usually public key operations (let's count DH key exchange to that, too) are quite a bit slower than symmetric operations.

A few other apsects, which you should not forget:

- nonces (or timestamps) in challenge-response mechanisms to prevent replay attacks
- always authenticate both communication parties
- how are keys generated/revoked/become invalid/updated/...

Related Questions

Navigate

• Browse (All)
• Browse M
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.