Public key exchange with authenticated ECDHE and security against quantum computers
View Patent ↗Elliptic Curve Cryptography (ECC) can provide security against quantum computers that could feasibly determine private keys from public keys. A server communicating with a device can store and use PKI keys comprising server private key ss, device public key Sd, and device ephemeral public key Ed. The device can store and use the corresponding PKI keys, such as server public key Ss. The key use can support all of (i) mutual authentication, (ii) forward secrecy, and (iii) shared secret key exchange. The server and the device can conduct an ECDHE key exchange with the PKI keys to mutually derive a symmetric ciphering key K 1 . The device can encrypt a device public key PK.Device with K 1 and send to the server as a first ciphertext. The server can encrypt a server public key PK.Network with at least K 1 and send to the device as a second ciphertext.
1. A method for a server to exchange a first device public key and a network public key, the method performed by the server, the method comprising:
a) storing, in a nonvolatile memory, a first set of cryptographic parameters, a server static private key, a second device public key, and identification information for a device;
b) receiving, at a first network interface, (i) a device ephemeral public key for the first set of cryptographic parameters, (ii) the identification information, and (iii) a first ciphertext;
c) conducting at least one elliptic curve Diffie Hellman (ECDH) key exchange using the first set of cryptographic parameters, the server static private key, the second device public key, and the device ephemeral public key in order to derive a shared secret point;
d) deriving a symmetric ciphering key using at least the derived shared secret point, wherein the symmetric ciphering key comprises a first portion and a second portion;
e) decrypting, with the first portion of the symmetric ciphering key, the first ciphertext comprising the first device public key, a second set of cryptographic parameters for the first device public key supporting an algorithm for post-quantum cryptography, and a first random number;
f) receiving, at a second network interface, a network public key for the second set of cryptographic parameters supporting the algorithm for post-quantum cryptography;
g) generating a second ciphertext comprising the network public key and the first random number by encrypting with the second portion of the symmetric ciphering key; and
h) sending, from the first network interface, the second ciphertext to the device.
2. The method of claim 1 , wherein the first random number comprises a nonce.
3. The method of claim 1 , wherein the first network interface comprises a first server IP address, and the second network interface comprises a second server IP address, wherein the second server IP address uses a private IP address.
4. The method of claim 1 , wherein the server conducts the at least one ECDH key exchange by conducting (i) an elliptic curve (EC) point addition of at least the second device public key and the device ephemeral public key to derive a point, and (iii) an EC point multiplication of at least the point and the server static private key.
5. The method of claim 1 , wherein the device conducts a second ECDH key exchange using at least (i) a server static public key for the server static private key, (ii) a device private key for the second device public key, and (iii) a device ephemeral private key for the device ephemeral public key in order to mutually derive the shared secret point.
6. The method of claim 1 , further comprising receiving the network public key and a second random number, wherein the server encrypts the second random number with the second portion of the symmetric ciphering key to generate the second ciphertext.
7. The method of claim 1 , wherein the second device public key comprises a device static public key.
8. A server system to securely exchange a first device public key and a network public key, the server system comprising:
a first nonvolatile memory to store a first set of cryptographic parameters, a server static private key, a second device public key, and identification information for a device;
a first network interface to:
a) receive, from the device, a first message comprising (i) a device ephemeral public key for the first set of cryptographic parameters, (ii) the identification information, and (iii) a first ciphertext; and
b) send, to the device, a second message comprising a second ciphertext;
a random access memory to store computer executable instructions for conducting at least one elliptic curve Diffie Hellman (ECDH) key exchange using the (i) first set of cryptographic parameters, (ii) the server static private key, (iii) the second device public key, and (iv) the device ephemeral public key in order to derive a shared secret point;
a processor to:
a) derive a symmetric ciphering key using at least the derived shared secret point, wherein the symmetric ciphering key comprises a first portion and a second portion;
b) decrypt, with the first portion of the symmetric ciphering key, the first ciphertext, wherein the first ciphertext includes the first device public key, and a second set of cryptographic parameters for the first device public key supporting an algorithm for post-quantum cryptography; and
c) encrypt, with the second portion of the symmetric ciphering key, a network public key for the second set of cryptographic parameters supporting the algorithm for post-quantum cryptography;
a second network interface to:
a) establish a secure session with a network;
b) send, to a network via the secure session, the first device public key, the identification information for the device, and the second set of cryptographic parameters; and
c) receive, from the network via the secure session, the network public key.
9. The server system of claim 8 , wherein the algorithm for post-quantum cryptography comprises one of a lattice-based algorithm, a code-based algorithm, and a supersingular elliptic curve isogeny algorithm.
10. The server system of claim 8 , wherein the first network interface comprises a first server IP address, and the second network interface comprises a second server IP address, and wherein the second server IP address uses a private IP address.
11. The server system of claim 8 , wherein the server system conducts the at least one ECDH key exchange by conducting (i) an elliptic curve (EC) point addition of at least the second device public key and the device ephemeral public key to derive a point, and (iii) an EC point multiplication of at least the point and the server static private key.
12. The server system of claim 8 , wherein the device conducts a second ECDH key exchange using at least (i) a server static public key for the server static private key, (ii) a device private key for the second device public key, and (iii) a device ephemeral private key for the device ephemeral public key in order to mutually derive the shared secret point.
13. The server system of claim 8 , wherein the second device public key comprises a device static public key.