Confidential provisioning of secret keys over the air

1. A method for personalizing a smart card coupled with a communication device of a user being a subscriber of a first telecommunication network and wishing to become a subscriber of a second telecommunication network, a first authentication key being stored in the smart card and in an first application server included in the first telecommunication network, the method comprising the following steps in the smart card:

establishing a secure session with a second application server included in the second telecommunication network via the first telecommunication network;

negotiating with the first application server and the second application server in order that the smart card and the second application server agree on an second authentication key, by exchanging messages referring to shared values and shared functions by means of a secure multiparty computation protocol involving the smart card, the first application server and the second application server, and computing the second authentication key depending on at least a shared value and a shared function; and

replacing the first authentication key by the second authentication key.

2. A method according to claim 1 , wherein the smart card replaces the first authentication key by the second authentication key after that the second application server has authenticated the smart card by means of a challenge-response authentication using the second authentication key.

3. A method according to claim 2 , wherein the second authentication key depends on the first authentication key.

4. A method according to claim 1 , wherein the step of negotiating with the first application server and the second application server comprises the following steps:

negotiating with the second application server to agree on a random secret,

negotiating with the first application server to agree on a first function,

negotiating with the second application server to agree on a second function,

after the first application server having sent a message to the second application server, the message comprising the value of the result of the first function applied to the first authentication key, computing the second authentication key depending on the value of the result of the second function applied to the random secret and to the value of the result of the first function applied to the first authentication key.

5. A method according to claim 1 , wherein the step of negotiating with the first application server and the second application server comprises the following steps:

negotiating with the second application server to agree on a random secret,

after the first application server having sent a message to the second application server, the message comprising the value of the result of a first function applied to the first authentication key, computing the second authentication key depending on the value of the result of a second function applied to the random secret and to the value of the result of the first function applied to the first authentication key;

wherein the first function is part of a public method beforehand known from the smart card and the first application server, and the second function is part of a public method beforehand known from the smart card and the second application server.

6. A method according to claim 4 , wherein the first function is a cryptographic hash function which output space is the same as the space of the first authentication key.

7. A method according to claim 4 , wherein the second function is a combination mixing function which takes one input from the space of the first authentication key and another input from the space of the random secret.

8. A method according to claim 1 wherein the smart card interrogates the second application server in order to validate the second authentication key, the second application server authenticating the smart card by means of the second authentication key.

9. A method according to claim 1 , wherein the smart card receives a message comprising a personalization command and an admin code sent from a manufacturer server triggered by the second application server,

and interprets the personalization command to delete the first authentication key and replace it by the second authentication key if the admin code is valid.

10. A method according to claim 9 , wherein an application in the smart card checks if the admin code received in said message is compatible with an admin code initially stored in the smart card in order to determine if the received admin code is valid.

11. A method according to claim 1 , wherein the messages exchanged during the step of negotiating are short messages.

12. A method according to claim 1 , wherein the messages exchanged during the step of negotiating contain data packets and are sent through a service node and a gateway node of the first telecommunication network.

13. A smart card coupled with a communication device of a user being a subscriber of a first telecommunication network and wishing to become a subscriber of a second telecommunication network, a first authentication key being stored in the smart card and in a first application server included in the first telecommunication network, the smart card comprising:

means for establishing a secure session with a second application server included in the second telecommunication network via the first telecommunication network,

means for negotiating with the first application server and the second application server in order that the smart card and the second application server agree on an second authentication key, by exchanging messages referring to shared values and shared functions by means of a secure multiparty computation protocol involving the smart card, the first application server and the second application server, and computing the second authentication key depending on at least a shared value and a shared function,

means for replacing the first authentication key by the second authentication key.

14. An application server for personalizing a smart card coupled with a communication device of a user being a subscriber of a first telecommunication network and wishing to become a subscriber of a second telecommunication network, a first authentication key being stored in the smart card and in another application server included in the first telecommunication network, the application server being included in the second telecommunication network and comprising:

means for establishing a secure session with the smart card via the first telecommunication network,

means for negotiating with the smart card and said another application server in order that the smart card and the application server agree on an second authentication key, by exchanging messages referring to shared values and shared functions by means of a secure multiparty computation protocol involving the smart card, said another application server and the application server, and computing the second authentication key depending on at least a shared value and a shared function.

15. A computer program product embodied on a non-transitory computer readable medium capable of being executed in an application server for personalizing a smart card coupled with a communication device of a user being a subscriber of a first telecommunication network and wishing to become a subscriber of a second telecommunication network, a first authentication key being stored in the smart card and in another application server included in the first telecommunication network, the application server being included in the second telecommunication network, said computer program product comprising instructions which, when said program is executed in said application server, execute the following steps:

establishing a secure session with the smart card via said the first telecommunication network,

negotiating with the smart card and said another application server in order that the smart card and the application server agree on an second authentication key, by exchanging messages referring to shared values and shared functions by means of a secure multiparty computation protocol involving the smart card, said another application server and the application server, and computing the second authentication key depending on at least a shared value and a shared function.

16. A method according to claim 5 , wherein the first function is a cryptographic hash function which output space is the same as the space of the first authentication key.

17. A method according to claim 5 , wherein the second function is a combination mixing function which takes one input from the space of the first authentication key and another input from the space of the random secret.