6

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security.

They're also used in SSL to go from using RSA to using a faster symmetric encryption.

Why else are ephemeral keys used? In particular, if I don't care about Perfect Forward Security, and I already have two machines that have a shared symmetric key, is there any reason to use ephemeral keys?

In AES-GCM, is a 96-bit IV sufficient to not require temporary keys?

theicfire
  • 161
  • 1
  • 1
  • 4

2 Answers2

5

Why else are ephemeral keys used?

Ephemeral keys are not a specific form of keys, they are just short lived keys within a key establishment protocol. Usually they are not directly trusted as they are generated on the fly.

ECIES may also use an ephemeral private key, to name a single other usage.

In particular, if I don't care about Perfect Forward Security, and I already have two machines that have a shared symmetric key, is there any reason to use ephemeral keys?

You may want to generate symmetric session keys that can only be used for a specific session. Ephemeral-ephemeral DH key agreement would work fine for that, although other schemes are also possible. You may also want to use separate keys for different senders and for different purposes (such as encryption and MAC).

Otherwise you could for instance replay messages encrypted with the masterkey. Again, there would be other methods that protect against such a situation, but establishing session keys is a common way to do this.

In AES-GCM, is a 96-bit IV sufficient to not require temporary keys?

Unless you define ephemeral simply as short lived keys the AES keys themselves are not really ephemeral. They are generally used for multiple messages, not just during key establishment.

AES-GCM can, within reasonable bounds, be used with one key for multiple messages. And yes, the nonce can help with that. The bounds have been defined in NIST SP800-38D which specifies the GCM mode for use in US Federal Agencies.

There are good reasons to use session keys within a transport protocol regardless of the security of the cipher, as already mentioned in the second paragraph.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
3

It's often about the storage of state associated with the key. If you use your long term shared key to encrypt and send messages then you either should be sending notably less than $2^{48}$ messages for random 96 bit GCM IVs or you'll need to store the IV if it's based on a counter. Failure to do so will likely result in the system re-using the same key and IV thus causing catastrophic compromise of authentication and notable confidentiality issues. Ephemeral keys, generated properly based on KE with the long term secret, protect us from these issues.

Thomas M. DuBuisson
  • 1,894
  • 15
  • 20