In
cryptography
Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adver ...
, a shared secret is a piece of data, known only to the parties involved, in a
secure communication
Secure communication is when two entities are communicating and do not want a third party to listen in. For this to be the case, the entities need to communicate in a way that is unsusceptible to eavesdropping or interception. Secure communication ...
. This usually refers to the
key of a
symmetric cryptosystem. The shared secret can be a
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
, a
passphrase
A passphrase is a sequence of words or other text used to control access to a computer system, program or data. It is similar to a password in usage, but a passphrase is generally longer for added security. Passphrases are often used to control ...
, a big number, or an array of randomly chosen bytes.
The shared secret is either shared beforehand between the communicating parties, in which case it can also be called a
pre-shared key, or it is created at the start of the communication session by using a
key-agreement protocol, for instance using
public-key cryptography
Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic alg ...
such as
Diffie–Hellman or using
symmetric-key cryptography
Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext. The keys may be identical, or there may be a simple transformation to go between th ...
such as
Kerberos.
The shared secret can be used for authentication (for instance when logging into a remote system) using methods such as
challenge–response or it can be fed to a
key derivation function to produce one or more
keys to use for encryption and/or
MACing of messages.
To make unique
session and message keys the shared secret is usually combined with an
initialization vector
In cryptography, an initialization vector (IV) or starting variable (SV) is an input to a cryptographic primitive being used to provide the initial state. The IV is typically required to be random or pseudorandom, but sometimes an IV only needs to ...
(IV). An example of this is the
derived unique key per transaction method.
It is also often used as an authentication measure in
web API
A web API is an application programming interface for either a web server or a web browser. It is a web development concept, usually limited to a web application's client-side (including any web frameworks being used), and thus usually does not ...
s.
See also
*
Key stretching
In cryptography, key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the resources (time and possibly space) it takes to test each possible ke ...
– a method to create a stronger key from a weak key or a weak shared secret
*
Security question
A security question is form of shared secret used as an authenticator. It is commonly used by banks, cable companies and wireless providers as an extra security layer.
History
Financial institutions have used questions to authenticate custome ...
– implementation method
References
*
Handbook of Applied Cryptography' by Menezes, van Oorschot and Vanstone (2001), chapter 10 and 12.
{{Cryptography navbox
Key management