Secure authenticated channel
View Patent ↗A protocol (i.e. method) and corresponding apparatuses for calculating a session key. Two peers with knowledge of a common Diffie-Hellman permanent key, K perm , and the identity and public key of the other peer. A first peer chooses a first ephemeral private key x and calculates the first corresponding ephemeral public key g x , which is sent to the second peer. The second peer calculates a second ephemeral public key g y in the same manner, and an ephemeral shared key K eph , hashes g y , K eph , K perm , and its identity, and sends g y and the hash to the first peer. The first peer calculates K eph , verifies the hash, and hashes g x , K eph , K perm , and its identity, and sends it to the second peer that verifies this hash. Thereafter, both peers obtain a session key by hashing K eph . The apparatuses may then use the session key to establish a secure authenticated channel (SAC).
1. A first device adapted to verify a hash value, the first device having a certificate (C a ) comprising a public key (g a ) and an identity corresponding to itself (ID a ), and knowledge of the identity corresponding to itself (ID a ), a private key (a), and the public key (g a ), the first device comprising a processor for:
choosing an ephemeral private key (x);
calculating a first ephemeral public key (g x );
sending its certificate (C a ) and the first ephemeral public key (g x ) to a second device;
receiving a certificate of the second device (C b ), a second ephemeral public key (g y ) and a first hash value (H(g y , K eph , K perm , ID b )) from the second device, the certificate (C b ) comprising a public key (g b ) and an identity of the second device (ID b ), and the first hash value (H(g y , K eph , K perm , ID b )) being calculated from the second ephemeral public key (g y ), an ephemeral shared key (K eph ), a permanent key (K perm ), and the identity corresponding to the second device (ID b );
verifying the certificate of the second device (C b );
calculating the ephemeral shared key (K eph ) from the second ephemeral public key (g y ) and the ephemeral private key (x);
calculating the permanent key (K perm ) from the public key of the second device (g b ) and its own private key (a); and
verifying the first hash value (H(g y , K eph , K perm , ID b )).
2. The first device of claim 1 , wherein the processor is further for:
calculating a second hash value (H(g x , K eph , K perm , ID a )) from the first ephemeral public key (g x ), the ephemeral shared key (K eph ), the permanent key (K perm ), and the identity corresponding to itself (ID a ); and
sending the second hash value (H(g x , K eph , K perm , ID a )) to the second device.
3. A second device adapted to verify a hash value, the second device having a certificate (C b ) comprising a public key (g b ) and an identity corresponding to itself (ID b ), and knowledge of the identity corresponding to itself (ID b ), a private key (b), and the public key (g b ), the second device comprising a processor for:
receiving from a first device a certificate of the first device (C a ) and a first ephemeral public key (g x ), the certificate comprising a public key (g a ) and an identity of the first device (ID a );
verifying the certificate of the first device (C a );
choosing an ephemeral private key (y);
calculating a second ephemeral public key (g y );
calculating an ephemeral shared key (K eph ) from the first ephemeral public key (g x ) and the ephemeral private key (y);
calculating a permanent key (K perm ) from the public key of the first device (g a ) and its own private key (b);
calculating a first hash value (H(g y , K eph , K perm , ID b )) from the second ephemeral public key (g y ), the ephemeral shared key (K eph ), the permanent key (K perm ), and the identity corresponding to itself (ID b );
sending its certificate (C b ), the second ephemeral public key (g y ) and the first hash value (H(g y , K eph , K perm , ID b )) to the first device;
receiving a second hash value (H(g x , K eph , K perm , ID a )) from the first device, the second value being calculated from the first ephemeral public key (g x ), the ephemeral shared key (K eph ), the permanent key (K perm ), and the identity corresponding to the first device (ID a ); and
verifying the second hash value (H(g x , K eph , K perm , ID a )).
4. A method for verifying a hash value, the method being performed by a first device having a certificate (C a ) comprising a public key (g a ) and an identity corresponding to itself (ID a ), and knowledge of the identity corresponding to itself (ID a ), a private key (a), and the public key (g a ), the method comprising the steps of:
choosing an ephemeral private key (x);
calculating a first ephemeral public key (g x );
sending its certificate (C a ) and the first ephemeral public key (g x ) to a second device;
receiving a certificate of the second device (C b ), a second ephemeral public key (g y ) and a first hash value (H(g y , K eph , K perm , ID b )) from the second device, the certificate (C b ) comprising a public key (g b ) and an identity of the second device (ID b ), and the first hash value (H(g y , K eph , K perm , ID b )) being calculated from the second ephemeral public key (g y ), an ephemeral shared key (K eph ), a permanent key (K perm ), and the identity corresponding to the second device (ID b );
verifying the certificate of the second device (C b );
calculating the ephemeral shared key (K eph ) from the second ephemeral public key (g y ) and the ephemeral private key (x);
calculating the permanent key (K perm ) from the public key of the second device (g b ) and its own private key (a); and
verifying the first hash value (H(g y , K eph , K perm , ID b )).
5. A method for verifying a hash value, the method being performed by a second device having a certificate (C b ) comprising a public key (g b ) and an identity corresponding to itself (ID b ), and knowledge of the identity corresponding to itself (ID b ), a private key (b), and the public key (g b ), the method comprising the steps of:
receiving from a first device a certificate of the first device (C a ) and a first ephemeral public key (g x ), the certificate comprising a public key (g a ) and an identity of the first device (ID a );
verifying the certificate of the first device (C a );
choosing an ephemeral private key (y);
calculating a second ephemeral public key (g y );
calculating an ephemeral shared key (K eph ) from the first ephemeral public key (g x ) and the ephemeral private key (y);
calculating a permanent key (K perm ) from the public key of the first device (g a ) and its own private key (b);
calculating a first hash value (H(g y , K eph , K perm , ID b )) from the second ephemeral public key (g y ), the ephemeral shared key (K eph ), the permanent key (K perm ), and the identity corresponding to itself (ID b );
sending its certificate (C b ), the second ephemeral public key (g y ) and the first hash value (H(g y , K eph , K perm , ID b )) to the first device;
receiving a second hash value (H(g x , K eph , K perm , ID a )) from the first device, the second value being calculated from the first ephemeral public key (g x ), the ephemeral shared key (K eph ), the permanent key (K perm ), and the identity corresponding to the first device (ID a ); and
verifying the second hash value (H(g x , K eph , K perm , ID a )).