example: if Alice has a public key of Bob but Bob has now public key of Alice due to some privacy reasons. So Alice send their public key for every transmission. So my question is that is it a suitable and possible way for key sharing?
Alice must send her public key to everyone that she wants to be able to read her digitally signed or encrypted emails. When she sends a signed or encrypted email, she sends her private key, only known to her, and people open the private key with her public key that they already have. So if she never sends her public key to Bob, then he will never be able to read her signed or encrypted emails.
Joseph is right. Why do not you consider a third party concepts for the distribution of public keys . Everyone who wants to communicate with Alice must have her public key. to make sure this and consistancy in the key you need to accomodate third party conepts .
Joseph has completely misunderstood the concept of signing messages. Yes, Alice uses her private key to sign the message, but Bob uses Alice's PUBLIC key to verify the signature. The private key is NEVER disclosed to anyone!
Adnan makes a valid point in that we usually consider this in a Public Key Infrastructure (PKI) setting, where a third party (known as a Certificate Authority or CA) trusted by "everyone" signs Alice's public key, creating a PKI certificate. This certificate can be placed in a repository, or even attached to every transmission as you say.
NOTE: Simply sending an unsigned public key as part of every session will not provide the desired level of security, as a man-in-the-middle could replace Alice's public key with his own.
Public key is for everyone see this link https://security.stackexchange.com/questions/406/how-should-i-distribute-my-public-key
There are various key sharing protocol for secure communication. Both parties have common secret key that they use for the encryption/decryption purpose. Some of the protocols for key sharing are
1. Definitely Hellman protocol
2. MQV protocol
3. HMQV protocol
4. Lattice version of HMQV protocol, secure against quantum computers
It depends on the cryptpgraphic method that you use. For now all the public key method are secure because its' based on some hard mathematical problems and sharing the public key doesn't divulgate any information about the secret key.
And about the privacy concern if your public key doesn't contain any information about you there is non privacy concern then, there also some cryptpgraphic method for key exchange that are suitible for your situation i suggest that you take a look on al gamal key exchange method.
Public key, as the name suggests, is to be made public (to be seen and used by all) so, Alice must have to share the public key with Bob. Public key sharing do not require any secure communication channel so, can be shared though any insecure channel, if I am not wrong.
On the one hand, Alice's disseminated public key can be used for the verification of message fingerprints that Alice signed with her private key. On the other hand, her communication partners can apply her public key to encrypt messages for her or to stipulate sessions keys with her.
Many explanations of asymmetric key encryption are very confusing, certainly to me. So let me try this:
Symmetric key encryption is straightforward. I use a secret key to encrypt something, and the only way anyone can decrypt the message is if they have a copy of that secret key in their possession. Simple. And efficient.
Asymmetric key encryption is used if you must avoid having everyone securely store a copy of your secret key. This would be possible, of course, but quite inconvenient. So this less efficient asymmetric protocol is used. (And parenthetically, it can then become a convenient way to distribute copies of secret keys securely, allowing one to proceed with a more speedy symmetric key algorithm afterwards.)
So the person wanting to receive secret messages from you sends you their public key. This person can send that public key to any number of other people, not just you. Now you send back your message, encrypted with that public key, to the person who sent you that public key.
Here's the important point: The only person who can decrypt the message you sent back, encrypted with his public key, is the person who originally sent you that public key! Only with the correct private key can one decrypt the message you encrypted, using this person's public key.
This means that if you want to use asymmetric key protocol, to receive encrypted messages from other people, first you must send them your public key. And by the way, if you want to send encrypted messages to other people, using an asymmetric key protocol, you must first obtain their public keys.
Once you have each others' public keys, and are able to exchange encrypted messages back and forth, you can of course use this scheme also to transmit secret keys to people, for use with symmetric key protocols. Note, I said secret keys, not private keys (which refer to private keys for asymmetric protocols). You might do this if you have a large volume of secret data to transfer, and therefore intend to use an efficient symmetric key protocol.
One point to add..assymetric key cryptography not inefficient rather is a very very efficient method as this avoids the private keysharing. No fear if the key getting hacked during transit by an adversary. There are many other advantages as well.
Minati, I'm referring here to computational efficiency. You can find any number of sources that make this point, and that support use of asymmetric protocols to exchange secret keys, and symmetric protocols for the "heavy lifting," when massive amounts of data must be sent securely.
In fact, the most efficient ciphers, in terms of both speed and small software footprint, tend to be symmetric key stream protocols, even though I do not believe that the US NIST has approved any such yet. But such protocols are easy enough to write and test, just to get a better idea of how ciphers work. Nothing like writing your own to get a good idea of the issues.