Public key out-of-band transfer for mutual authentication
Methods for key exchange and mutual authentication are provided that allow for inherent authentication and secret key derivation of parties communicating through an unsecured medium. These methods allow for greater security than existing key exchange and authentication methods while requiring little or no additional energy or time compared with a basic Diffie-Hellman key exchange. These methods allow for secure communication with small, low-power devices and greater security for any devices communicating through an unsecured medium.
1. A network device comprising
a transceiver;
a processor;
a machine readable medium; and
a private key,
wherein said network device performs a key exchange and authentication method with a second network device, said method comprising:
revealing a unique identifier to said second network device;
receiving a revelation of a key associated with said second network device from said second network device which used said unique identifier of said network device to obtain a key associated with said network device; and
said network device using its private key, said key associated with said second network device, and known parameters to generate a shared secret,
said method further comprising:
each network device using said shared secret and other information known to both devices to compute two distinct verification numbers;
each network device sharing one of said verification numbers while keeping the other secret; and
each network device accepting the identity of the other network device if the verification number kept secret by the network device is identical to the verification number received from the other network device.
2. The network device of claim 1 , wherein said second network device obtains said key associated with said network device by accessing a local machine readable medium.
3. The network device of claim 1 , wherein said second network device obtains said key associated with said network device by connecting to a remote database.
4. The network device of claim 1 , wherein said key associated with said network device is transferred to said second network device via a removable machine readable medium.
5. The network device of claim 1 , wherein said second network device obtains said key associated with said network device by directly accessing a machine readable medium of said network device.
6. The network device of claim 1 , wherein said distinct verification numbers are computed using a standardized one-way cryptographic hash function.
7. A network device comprising
a transceiver;
a processor;
a machine readable medium; and
a private key,
wherein said network device performs a key exchange and authentication method with a second network device, said method comprising:
revealing a unique identifier to said second network device;
receiving a revelation of a key associated with said second network device from said second network device which used said unique identifier of said network device to obtain a key associated with said network device; and
said network device using its private key, said key associated with said second network device, and known parameters to generate a shared secret,
said method additionally comprising:
each network device using said shared secret and other information known to both devices to compute a shared secret master key; and
each network device using said shared secret master key to secure subsequent communication with the other device.
8. The network device of claim 7 , wherein said shared secret master key is computed using a standardized one-way cryptographic hash function.
9. A system comprising:
a first network device comprising:
a transceiver;
a processor;
a machine readable medium; and
a private key,
a second network device comprising:
a transceiver;
a processor;
a machine readable medium; and
a private key,
wherein said first network device performs a key exchange and authentication method with said second network device, said method comprising:
first network device revealing a unique identifier of said first network device to said second network device;
second network device revealing a unique identifier a unique identifier of said second network device to said first network device;
first network device using said second network device's said unique identifier to obtain a key associated with said second network device;
second network device using said second network device's said unique identifier to obtain a key associated with said first network device; and
each said network device using its private key, said key associated with said other network device, and known parameters to generate a shared secret,
said method further comprising:
each said network device using said shared secret and other information known to both of said network devices to compute two distinct verification numbers;
each said network device sharing one of said verification numbers while keeping the other secret; and
each said network device accepting the identity of said other network device if the verification number kept secret by said network device is identical to the verification number received from said other network device.
10. The system of claim 9 , wherein one of said network devices obtains said key associated with said other network device by accessing a machine readable medium.
11. The system of claim 9 , wherein one of said network devices obtains said key associated with said other network device by connecting to a remote database.
12. The system of claim 9 , wherein said key associated with one of said network devices is transferred to said other network device via a removable machine readable medium.
13. The system of claim 9 , wherein one of said network devices obtains said key associated with said other network device by directly accessing a machine readable medium of said other network device.
14. The system of claim 9 , wherein said distinct verification numbers are computed using a standardized one-way cryptographic hash function.
15. A system comprising:
a first network device comprising:
a transceiver;
a processor;
a machine readable medium; and
a private key,
a second network device comprising:
a transceiver;
a processor;
a machine readable medium; and
a private key,
wherein said first network device performs a key exchange and authentication method with said second network device, said method comprising:
first network device revealing a unique identifier of said first network device to said second network device;
second network device revealing a unique identifier a unique identifier of said second network device to said first network device;
first network device using said second network device's said unique identifier to obtain a key associated with said second network device;
second network device using said second network device's said unique identifier to obtain a key associated with said first network device;
and
each said network device using its private key, said key associated with said other network device, and known parameters to generate a shared secret;
said method additionally comprising:
each said network device using said shared secret and other information known to both said network devices to compute a shared secret master key; and
each said network device using said shared secret master key to secure subsequent communication with said other network device.
16. The system of claim 15 , wherein said shared secret master key is computed using a standardized one-way cryptographic hash function.
17. A method for key exchange and authentication between a first network device and a second network device, each said network device having a private key, said method comprising:
first network device revealing a unique identifier to said second network device;
first network device obtaining a key associated with said second network device, said key created using said unique identifier of said first network device; and
first network device using its private key, said key associated with said second network device, and known parameters to generate a shared secret,
said method further comprising:
each said network device using said shared secret and other information known to both said network devices to compute two distinct verification numbers;
each said network device sharing one of said verification numbers while keeping the other secret; and
each said network device accepting the identity of said other network device if the verification number kept secret by said network device is identical to the verification number received from said other network device.
18. The method of claim 17 , wherein said first network device obtains said key associated with said second network device by accessing a machine readable medium.
19. The method of claim 17 , wherein said first network device obtains said key associated with said second network device by connecting to a remote database.
20. The method of claim 17 , wherein said key associated with said second network device is transferred to said second network device via a removable machine readable medium.
21. The method of claim 17 , wherein one of said first network device obtains said key associated with said second network device by directly accessing a machine readable medium of said second network device.
22. The method of claim 17 , wherein said distinct verification numbers are computed using a standardized one-way cryptographic hash function.
23. A method for key exchange and authentication between a first network device and a second network device, each said network device having a private key, said method comprising:
first network device revealing a unique identifier to said second network device;
first network device obtaining a key associated with said second network device, said key created using said unique identifier of said first network device; and
first network device using its private key, said key associated with said second network device, and known parameters to generate a shared secret,
said method additionally comprising:
each said network device using said shared secret and other information known to both devices to compute a shared secret master key; and
each said network device using said shared secret master key to secure subsequent communication with the other device.
24. The method of claim 23 , wherein said shared secret master key is computed using a standardized one-way cryptographic hash function.