Two-way handshake for key establishment for secure communications
The present application describes a method, system, and non-transitory computer-readable medium for end-to-end encryption during a secure communication session. According to the present disclosure, a first device initializes a secure communication session with at least one second device. Initializing the secure communication session includes transmitting an invitation to a secure communication session to the at least one second device. The at least one second device may generate a transmission root key, which may be used to derive a first key for encrypting data transmitted to the first device and a second key for decrypting received data from the first device. The at least one second device may transmit the transmission root key to the first device, which may use the transmission root key to derive a first key to encrypt data transmitted to the at least one second device and a second key to decrypt data received from the at least one second device.
1. A method comprising:
initializing, by a first device, a secure communication session with at least one second device;
receiving, by the first device, a transmission root key from the at least one second device;
deriving, by the first device, a first encryption key by inputting the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function, wherein the first encryption key is configured to encrypt data transmitted by the first device;
deriving, by the first device, a second encryption key, wherein the second encryption key is configured to decrypt data received from the at least one second device;
encrypting, by the first device and using the first encryption key, first data;
transmitting, from the first device to the at least one second device, the encrypted first data;
receiving, by the first device from the at least one second device, encrypted second data;
decrypting, by the first device and using the second encryption key, the encrypted second data;
providing, by the first device, the second data to a user of the first device; and
updating the first encryption key and the second encryption key during the secure communication session.
2. The method of claim 1 , wherein initializing the secure communication session includes transmitting, from the first device, an invitation to a secure communication session to the at least one second device.
3. The method of claim 1 , wherein the key derivation function comprises a hash-based key derivation function.
4. The method of claim 1 , wherein deriving the second encryption key further comprises: inputting the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function to derive the second encryption key.
5. The method of claim 4 , wherein the key derivation function comprises a hash-based key derivation function.
6. The method of claim 1 , wherein the encrypted first data comprises at least one of voice data, video data, or videoconference data.
7. A method comprising:
receiving, by a first device, an invitation to a secure communication session from a second device;
generating, by the first device, a transmission root key;
transmitting, by the first device and to the second device, the transmission root key;
deriving, by the first device, a first encryption key by inputting the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function, wherein the first encryption key is configured to encrypt data transmitted by the first device;
deriving, by the first device, a second encryption key, wherein the second encryption key is configured to decrypt data received from the at least one second device;
encrypting, by the first device and using the first encryption key, first data;
transmitting, from the first device to the at least one second device, the encrypted first data;
receiving, by the first device from the at least one second device, encrypted second data;
decrypting, by the first device and using the second encryption key, the encrypted second data;
providing, by the first device, the second data to a user of the first device; and
updating the first encryption key and the second encryption key during the secure communication session.
8. The method of claim 7 , wherein the key derivation function comprises a hash-based key derivation function.
9. The method of claim 7 , wherein deriving the second encryption key further comprises: inputting the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function to derive the second encryption key.
10. The method of claim 9 , wherein the key derivation function comprises a hash-based key derivation function.
11. The method of claim 7 , wherein the encrypted first data comprises at least one of voice data, video data, or videoconference data.
12. A system comprising:
a first device comprising:
one or more first processors;
memory storing first instructions, that when executed by the one or more first processors, cause the first device to:
transmit a request to initialize a secure communication session to a second device;
receive a transmission root key from the second device;
derive a first encryption key by inputting the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function, wherein the first encryption key is configured to encrypt data transmitted by the first device;
derive a second encryption key, wherein the second encryption key is configured to decrypt data received from the second device;
encrypt, using the first encryption key, first data;
transmit the encrypted first data to the second device;
receive encrypted second data from the second device;
decrypt, using the second encryption key, the encrypted second data;
provide the second data to a first user of the first device; and
update the first encryption key and the second encryption key during the secure communication session
the second device comprising:
one or more second processors;
memory storing second instructions, that when executed by the one or more second processors, cause the second device to:
receive the request to initialize the secure communication session from the first device;
generate a transmission root key;
transmit the transmission root key to the first device;
derive the first encryption key;
derive the second encryption key;
encrypting the second data using the second encryption key;
transmit the encrypted second data to the first device;
receive the encrypted first data;
decrypt the encrypted first data using the first encryption key;
provide the first data to a second user of the second device; and
update the first encryption key and the second encryption key during the secure communication session.
13. The system of claim 12 , wherein the key derivation function comprises a hash-based key derivation function.
14. The system of claim 12 , wherein the first instructions cause the first device to:
input the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function to derive the second encryption key.
15. The system of claim 14 , wherein the key derivation function comprises a hash-based key derivation function.
16. The system of claim 12 , wherein the second instructions cause the second device to:
input the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function to derive the first encryption key.
17. The system of claim 16 , wherein the key derivation function comprises a hash-based key derivation function.
18. The system of claim 12 , wherein the second instructions cause the second device to:
input the transmission root key, a first seed value, a second seed value, and a third seed value into a key derivation function to derive the second encryption key.
19. The system of claim 18 , wherein the key derivation function comprises a hash-based key derivation function.
20. The system of claim 12 , wherein the encrypted first data comprises at least one of voice data, video data, or videoconference data.