Method and system for exchanging cryptographic keys with an unauthenticated device
The present teaching relates to exchanging a key with a device. In one example, a secret value is generated. A message is transmitted to the device. The message includes information related to the secret value based on which the device is to create a cryptographic key. A visual code displayed on the device is captured. The visual code includes a first piece of information and a second piece of information. A key value is generated based on the first piece of information and the secret value. A test value is calculated based on the key value. It is determined whether the device is securely connected based on the test value.
1. A method, implemented on a machine having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the method comprising:
generating a secret value;
transmitting a message to the device, wherein the message includes information related to the secret value based on which the device is to create a cryptographic key;
capturing a visual code displayed on the device, wherein the visual code includes a first piece of the information and a second piece of the information;
generating a key value based on the first piece of the information and the secret value;
calculating a test value based on the key value; and
determining whether the device is securely connected based on the test value.
2. The method of claim 1 , wherein the message is transmitted over an insecure channel on the network.
3. The method of claim 1 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode.
4. The method of claim 1 , wherein capturing the visual code comprises scanning the visual code with a camera.
5. The method of claim 1 , wherein calculating the test value comprises:
calculating a parameter based on a key derivation function and the key value; and
calculating the test value based on the parameter and a pseudorandom function.
6. The method of claim 1 , wherein determining whether the device is securely connected comprises:
extracting a check value from the second piece of the information;
comparing the test value with the check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
7. The method of claim 1 , further comprising:
providing an indication regarding whether the device is securely connected to a user who has access to the device.
8. The method of claim 1 , further comprising:
extracting a first check value from the second piece of the information;
calculating a coded value based on the first check value and the secret value;
transmitting the coded value to the device over an insecure channel on the network; and
receiving a third piece of the information from the device over the insecure channel on the network.
9. The method of claim 8 , wherein determining whether the device is securely connected comprises:
extracting a second check value from the third piece of the information;
comparing the test value with the second check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
10. A system, having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the system comprising:
a secret value generator configured for generating a secret value;
a communication unit configured for transmitting a message to the device, wherein the message includes information related to the secret value based on which the device is to create a cryptographic key;
a scanning unit configured for capturing a visual code displayed on the device, wherein the visual code includes a first piece of the information and a second piece of the information;
a key value generator configured for generating a key value based on the first piece of the information and the secret value;
a function value generator configured for calculating a test value based on the key value; and
a key exchange accomplishment examiner configured for determining whether the device is securely connected based on the test value.
11. The system of claim 10 , wherein:
the visual code is a one-dimensional barcode or two-dimensional barcode; and
the scanning unit includes a camera configured for scanning the visual code.
12. The system of claim 10 , further comprising:
an input/output unit configured for providing an indication regarding whether the device is securely connected to a user who has access to the device.
13. The system of claim 10 , further comprising:
an information extractor configured for extracting a check value from the second piece of the information; and
a code value generator configured for calculating a coded value based on the check value and the secret value, wherein the communication unit is further configured for:
transmitting the coded value to the device over an insecure channel on the network, and
receiving a third piece of the information from the device over the insecure channel on the network.
14. A machine-readable tangible and non-transitory medium having instructions for exchanging a key with a device, wherein the instructions, when read by a machine, causes the machine to perform the following:
generating a secret value;
transmitting a message to the device, wherein the message includes information related to the secret value based on which the device is to create a cryptographic key;
capturing a visual code displayed on the device, wherein the visual code includes a first piece of the information and a second piece of the information;
generating a key value based on the first piece of the information and the secret value;
calculating a test value based on the key value; and
determining whether the device is securely connected based on the test value.
15. The system of claim 10 , wherein the function value generator is further configured for:
calculating a parameter based on a key derivation function and the key value; and
calculating the test value based on the parameter and a pseudorandom function.
16. The system of claim 10 , wherein the key exchange accomplishment examiner is further configured for:
extracting a check value from the second piece of the information;
comparing the test value with the check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
17. The system of claim 13 , wherein the key exchange accomplishment examiner is further configured for:
extracting a second check value from the third piece of the information;
comparing the test value with the second check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
18. The machine-readable tangible and non-transitory medium of claim 14 , wherein the message is transmitted over an insecure channel on the network.
19. The machine-readable tangible and non-transitory medium of claim 14 , wherein the visual code is a one-dimensional barcode or two-dimensional bar code.
20. The machine-readable tangible and non-transitory medium of claim 14 , wherein the instructions comprising capturing the visual code, when read by the machine, causes the machine to perform the following:
scanning the visual code with a camera.
21. The machine-readable tangible and non-transitory medium having of claim 14 , wherein the instructions comprising calculating the test value, when read by the machine, causes the machine to perform the following:
calculating a parameter based on a key derivation function and the key value; and
calculating the test value based on the parameter and a pseudorandom function.
22. The machine-readable tangible and non-transitory medium of claim 14 , wherein the instructions comprising determining whether the device is securely connected, when read by the machine, causes the machine to perform the following:
extracting a check value from the second piece of the information;
comparing the test value with the check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
23. The machine-readable tangible and non-transitory medium of claim 14 , wherein the instructions, when read by the machine, further causes the machine to perform the following:
providing an indication regarding whether the device is securely connected to a user who has access to the device.
24. The machine-readable tangible and non-transitory medium of claim 14 , wherein the instructions, when read by the machine, further causes the machine to perform the following:
extracting a first check value from the second piece of the information;
calculating a coded value based on the first check value and the secret value;
transmitting the coded value to the device over an insecure channel on the network; and
receiving a third piece of the information from the device over the insecure channel on the network.
25. The machine-readable tangible and non-transitory medium of claim 24 , wherein the instructions comprising determining whether the device is securely connected, when read by the machine, causes the machine to perform the following:
extracting a second check value from the third piece of the information;
comparing the test value with the second check value to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.