The risk of sharing a symmetric key

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Alice sends her symmetric key to Bob over the same network she uses to send the encrypted messages. Is this safe?

A Yes, the key is encrypted by the network automatically

B No, an attacker could intercept the key as well as the data

2. An attacker intercepts a symmetric key while it is being shared. What can they do?

A Only decrypt the one message that was sent with the key

B Decrypt every message that uses that key

3. Which statement about symmetric encryption is correct?

A The encryption is defeated if the key is intercepted

B The encryption stays secure even if the key is intercepted

4. Why is sharing a symmetric key a weakness?

A The key must be sent to the receiver, so it could be intercepted

B The key is too short to be used for encryption

5. An attacker has intercepted the shared key but has not yet seen any messages. What happens when messages are sent later?

A The attacker can decrypt them using the stolen key

B The attacker cannot read them because they missed the key exchange

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1send(key) over the same network as the data		Aplaintext = decrypt(ciphertext, stolenKey)
2attacker.copy(key)		BThe key is sent along the same route as the encrypted messages, so an attacker watching the network could capture both
3The weakness of sharing a symmetric key leads to asymmetric encryption, where the public key can be shared openly		CWrong: the key itself is not protected by encrypting the data, so an attacker who intercepts it can still decrypt the messages
4If the key is intercepted, the attacker can decrypt the intercepted data		DAn attacker intercepts the shared key, so they can decrypt every message that uses it and the encryption is defeated
5send(key) openly; "The key is safe because the data is encrypted"		EWrong: the same key is used for every message, so an intercepted key lets the attacker decrypt all of them
6attacker steals key; "Only one message is at risk"		Fencrypt(message, publicKey)

Definitions

key interception

Fill in the Blanks

Complete each line of code by filling in the missing parts.

ciphertext ← ENCRYPT(message, ___) SEND key OVER network SEND ciphertext OVER network

SEND key OVER network attacker ← INTERCEPT(_______)

message ← _______(ciphertext, stolenKey) OUTPUT message

IF attackerHasKey = TRUE ____ encryptionDefeated ← TRUE ENDIF

SEND publicKey OVER network KEEP __________ ON recipientDevice

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A key ← 'K42'

B SEND(key, network)

C SEND(cipher, network)

D attacker: CANNOT READ cipher

Question 2

A key ← 'K42'

B cipher ← DECRYPT(msg, key)

C SEND(cipher, network)

D SEND(key, network)

Question 3

A key ← 'K42'

B SEND(key, network)

C attackerKey ← NULL

D OUTPUT attackerKey = key

Question 4

A sharedKey ← 'K42'

B SEND(sharedKey, network)

C risk ← 'key cannot be seen'

D fix ← 'use asymmetric keys'

Question 5

A pubKey ← SHARE(network)

B cipher ← ENCRYPT(msg, privKey)

C SEND(cipher, network)

Answer Key

The risk of sharing a symmetric key

Section A: Quick Questions

B — No, an attacker could intercept the key as well as the data

B — Decrypt every message that uses that key

A — The encryption is defeated if the key is intercepted

A — The key must be sent to the receiver, so it could be intercepted

A — The attacker can decrypt them using the stolen key

Section B: Match the Pairs

send(key) over the same network as the data → The key is sent along the same route as the encrypted messages, so an attacker watching the network could capture both

attacker.copy(key) → An attacker intercepts the shared key, so they can decrypt every message that uses it and the encryption is defeated

The weakness of sharing a symmetric key leads to asymmetric encryption, where the public key can be shared openly → encrypt(message, publicKey)

If the key is intercepted, the attacker can decrypt the intercepted data → plaintext = decrypt(ciphertext, stolenKey)

send(key) openly; "The key is safe because the data is encrypted" → Wrong: the key itself is not protected by encrypting the data, so an attacker who intercepts it can still decrypt the messages

attacker steals key; "Only one message is at risk" → Wrong: the same key is used for every message, so an intercepted key lets the attacker decrypt all of them

Section C: Definitions

key interception — If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.

Section D: Fill in the Blanks

ciphertext ← ENCRYPT(message, key)
SEND key OVER network
SEND ciphertext OVER network

SEND key OVER network
attacker ← INTERCEPT(network)

message ← DECRYPT(ciphertext, stolenKey)
OUTPUT message

IF attackerHasKey = TRUE THEN
   encryptionDefeated ← TRUE
ENDIF

SEND publicKey OVER network
KEEP privateKey ON recipientDevice

Section E: Spot the Error

D — The key was sent over the same network as the cipher, so the attacker has intercepted it. They can decrypt the cipher with it. The line should be attacker: DECRYPT(cipher, key).

B — The sender must ENCRYPT the plaintext msg to make the cipher. DECRYPT is for turning ciphertext back into plaintext.

C — The key travels over the network, so an attacker can copy it. The line should be attackerKey ← COPY(network). Setting it to NULL ignores the risk.

C — Sending the key over the network means it can be intercepted and copied. That is the risk of sharing a symmetric key. The line should say the key can be copied.

B — Asymmetric encryption avoids the key-sharing risk. The sender encrypts with the recipient's public key. The private key is never shared. The line should use pubKey.