Shared Secret


Shared Secret is a piece of data, known only to the parties involved, in a secure connection.

Shared Secret can be a:

Shared Secret is either shared beforehand between the communicating parties, in which case it can also be called a Pre-Shared Key, or it is created at the start of the communication session by using a Key-Exchange protocol, for instance using Public Key cryptography such as Diffie-Hellman or using Symmetric Key cryptography such as Kerberos.

Shared Secret can be used for authentication using methods such as challenge-response or it can be fed to a Key Derivation Function to produce one or more keys to use for encryption and/or MACing of messages.

Shared Secret is often provisioned as a QR-code or preprogrammed into a hard token.

Shared Secret is usually combined with an Initialization Vector (IV) to make unique session and Shared Secret. An example of this is the derived unique key per transaction method.

Shared Secret is also often used as an authentication measure in APIs.

Shared Secret is a secret value that has been computed using a key agreement algorithm and is used as input to a Key Derivation Function. (NIST.SP.800-107)

More Information#

There might be more information for this subject on one of the following: