Keystore communication?

Question

Hi,
I am not an expert in cryprography, but have experience in working with encryption using BouncyCastle and keytool.
I have a basic question on the standard practices used with a keystore. Can someone please explain me how two parties communicate regarding Java encryption. Assume both the parties are using AES 128 encryption and decryption and both have their own keystores. How does one party communicate the secret key used for ecryption to the other party so that the other party can decrypt it using the same key? Please note that I am only talking about Symmetric Key encryption here (not shared key).
Thanks,
vijay.

Answer 1

If both parties have (securely) exchanged their secret keys ahead of time they'd each simply store it in their respective key store or wherever is convenient. The trick, of course, is exchanging the secret key securely. That's where a public/private key pair can be quite handy but there are issues with that, too, mainly trust: When two parties exchange their respective public keys how do they guard against a man-in-the-middle attack, for example? Enter certificates, which involve a third party who is trusted by both sides to have verified their identity so that the cryptographic certificate on the public keys assure each side that they're really talking to the right party. Once that channel is established you can exchange secret keys digitally.
Note: self-signed certificates on public keys really certify nothing but they're good enough to satisfy the mere mechanics of the process, generally for testing, but certainly not the trust aspect. Also, public/private keys are computationally expensive compared to secret keys, which is why public/private keys tend to be used only for the exchange of a secret key (which can be generated on the fly by one of the parties and discarded after the session).
Disclaimer: I'm no expert on cryptography, either.