Apparatus and method for exchanging cryptographic information with reduced overhead and latency
A method implemented by computers includes exchanging a key between a first user and a second user. Ephemeral session keys are generated. The ephemeral session keys are generated by a first computer associated with the first user and a second computer associated with the second user. An encrypted key generation response is exchanged between the first computer and the second computer. A new session request is received. It is determined that there is a valid session state. It is confirmed that there is a valid user. It is determined that there is a valid session identification. Information between the first computer and the second computer is cryptographically exchanged in response to the valid session state, the valid user and the valid session identification.
1. A method implemented by computers, comprising:
exchanging a key between a first user and a second user;
generating ephemeral session keys, wherein the ephemeral session keys are generated by a first computer associated with the first user and a second computer associated with the second user, the first computer and the second computer each using the key and a common key derivation function to form the ephemeral session keys;
exchanging between the first computer and the second computer an encrypted key generation response;
receiving a new session request;
determining that a session between the first user and the second user is still valid and therefore there is a valid session state;
confirming that the new session request is from a valid user and therefore there is a valid user;
determining whether the new session request has a valid session identification and therefore there is a valid session identification; and
cryptographically exchanging information between the first computer and the second computer in response to the valid session state, the valid user and the valid session identification, wherein the cryptographically exchanging information is in response to the new session request and is implemented without exchanging keys between the first computer and the second computer and wherein all operations are performed by the first computer or the second computer without input from an additional computer.
2. The method of claim 1 wherein the valid session identification is a valid message sequence number.
3. The method of claim 2 wherein the valid session identification is the valid message sequence number plus a shared secret value.
4. The method of claim 1 further comprising reporting a terminated session when the new session request does not result in confirming the valid session state.
5. The method of claim 1 further comprising terminating the new session request when the new session request does not result in confirming the valid user.
6. The method of claim 1 further comprising terminating the new session request when the new session request does not result in determining that there is a valid session identification.