Non-repudiation-free public key authentication protocols

1 . A method comprising:

establishing, between a first device and a second device, a communication session based on a plurality of ephemeral keys;

computing, by the first device, a shared session key for the communication session as a function of a second static public key of the second device and a sum of a first static private key of the first device and a first private ephemeral key of the plurality of ephemeral keys, the computing comprising multiplying the second static public key of the second device by the sum of the first static private key and the first private ephemeral key;

computing, by the second device, the shared session key for the communication session as a function of a second private key of the second device and a sum of a first public key of the first device and a second ephemeral key of the plurality of ephemeral keys; and

exchanging one or more messages securely between the first device and the second device using the shared session key.

2 . The method of claim 1 , wherein the first device comprises an access control reader; and

wherein the second device comprises a user device.

3 . The method of claim 2 , wherein the one or more messages comprise a credential for accessing a protected asset associated with the access control reader.

4 . The method of claim 1 , wherein establishing the communication session comprises performing Diffie-Hellman key exchange to exchange the first and second public keys.

5 . The method of claim 1 , further comprising:

generating, by the first device, a first ephemeral key pair of the plurality of ephemeral keys, the first ephemeral key pair comprising a first public ephemeral key and a first private ephemeral key; and

generating, by the second device, a second ephemeral key pair of the plurality of ephemeral keys, the second ephemeral key pair comprising a second public ephemeral key and a second private ephemeral key.

6 . The method of claim 5 , wherein the first ephemeral key comprises the first private ephemeral key; and

wherein the second ephemeral key comprises the first public ephemeral key.

7 . The method of claim 1 , wherein the first and second ephemeral keys correspond to a pair of private and public ephemeral keys of the first device.

8 . The method of claim 1 , further comprising:

generating a digital signature using the first and second public keys and the first private key.

9 . The method of claim 8 , wherein the digital signature is generated based on a certificate of the first device or an identifier of the first device, the second device authenticating the first device based on the digital signature.

10 . The method of claim 1 , further comprising:

generating an authentication message by the second device using the shared session key.

11 . The method of claim 1 , wherein the shared session key, computed by the first and second devices, is of a same value.

12 . The method of claim 1 , wherein the second device computes the shared session key by:

multiplying the second private key by the sum of the first public key and the second ephemeral key.

13 . The method of claim 1 , further comprising:

deriving a further shared session key based on one or more of the plurality of ephemeral keys and the first public key or the second public key.

14 . The method of claim 13 , wherein the second device generates an authentication message for transmission to the first device based on the further shared session key.

15 . The method of claim 1 , wherein the plurality of ephemeral keys are stored on a remote server.

16 . The method of claim 3 , the access control reader comprising a physical access control system (PACS) that searches a list of credentials stored in an authorization system to determine whether the credential matches one or more credentials from a list of authorized credentials for accessing the protected asset; comprising:

in response to determining that the credential matches an individual credential in the list of credentials, the access control reader performs an operation granting access by instructing an access control device to unlock a physical lock associated with the protected asset.

17 . A system comprising:

one or more processors coupled to a memory comprising non-transitory computer instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

establishing, between a first device and a second device, a communication session based on a plurality of ephemeral keys;

computing, by the first device, a shared session key for the communication session as a function of a second static public key of the second device and a sum of a first static private key of the first device and a first private ephemeral key of the plurality of ephemeral keys, the computing comprising multiplying the second static public key of the second device by sum of the first static private key and the first private ephemeral key;

computing, by the second device, the shared session key for the communication session as a function of a second private key of the second device and a sum of a first public key of the first device and a second ephemeral key of the plurality of ephemeral keys; and

exchanging one or more messages securely between the first device and the second device using the shared session key.

18 . A non-transitory computer readable medium comprising non-transitory computer-readable instructions that, when executed by one or more processors, configure the one or more processors to perform operations comprising:

establishing, between a first device and a second device, a communication session based on a plurality of ephemeral keys;

computing, by the first device, a shared session key for the communication session as a function of a second static public key of the second device and a sum of a first static private key of the first device and a first private ephemeral key of the plurality of ephemeral keys, the computing comprising multiplying the second static public key of the second device by the sum of the first static private key and the first private ephemeral key;

computing, by the second device, the shared session key for the communication session as a function of a second private key of the second device and a sum of a first public key of the first device and a second ephemeral key of the plurality of ephemeral keys; and

exchanging one or more messages securely between the first device and the second device using the shared session key.

19 . The non-transitory computer readable medium of claim 18 , wherein the first device comprises an access control reader; and

wherein the second device comprises a user device.

20 . The non-transitory computer readable medium of claim 18 , wherein the operations further comprise:

establishing the communication session without requiring the second device to generate a digital signature for authentication to avoid creating of non-repudiable proof that a user associated with the second device has accessed the first device, wherein the operations provide security communication between the first and second devices without requiring generation of the digital signatures through vector or scalar multiplication operations.