Generating new encryption keys during a secure communication session
The present application describes a method, system, and non-transitory computer-readable medium for generating new keys during a secure communication session. A key derivation function is operatively connected to both a counter and a memory. The key derivation function generates new key material from a first input and a second input in response to a signal provided by the counter. The key derivation function generates the new key material and outputs it to the memory.
1. A method performed by a first device, the method comprising:
detecting, during a secure communication session, a trigger;
in response to the trigger, performing a three-way handshake with at least one second device to establish a first encryption key and a second encryption key for a communication channel during the secure communication session, wherein the first encryption key is configured to encrypt communication data transmitted by the first device and the second encryption key is configured to decrypt communication data received from the at least one second device;
deriving a first key-encrypting key and a second key-encrypting key;
encrypting first communication data using the first encryption key;
encrypting the first encryption key using the first key-encrypting key and the second encryption key using the second key encrypting-key to secure the communication channel; and
transmitting, over the secured communication channel, the encrypted first communication data to the at least one second device.
2. The method of claim 1 , further comprising:
receiving, by the first device from the at least one second device, second communication data; and
decrypting the second communication data using the second encryption key.
3. The method of claim 1 , wherein the trigger comprises a predetermined number of data exchanged between the first device and the at least one second device.
4. The method of claim 1 , wherein the trigger comprises a predetermined amount of time.
5. The method of claim 1 , wherein the trigger comprises one of the at least one second device joining the secure communication session.
6. The method of claim 1 , wherein the trigger comprises one of the at least one second device leaving the secure communication session.
7. The method of claim 1 , further comprising, prior to detecting the trigger:
encrypting communication data to be transmitted using a third encryption key; and
decrypting received communication data using a fourth encryption key.
8. A first device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the first device to:
detect, during a secure communication session, a trigger;
in response to the trigger, perform a three-way handshake with at least one second device to establish a first encryption key and a second encryption key for a communication channel during the secure communication session, wherein the first encryption key is configured to encrypt communication data transmitted by the first device and the second encryption key is configured to decrypt communication data received from the at least one second device;
derive a first key-encrypting key and a second key-encrypting key;
encrypt first communication data using the first encryption key;
encrypt the first encryption key using the first key-encrypting key and the second encryption key using the second key encrypting-key to secure the communication channel; and
transmit by the first device, over the secured communication channel, the encrypted first communication data to the at least one second device.
9. The first device of claim 8 , wherein the instructions, when executed by the one or more processors, further cause the first device to:
receive, from the at least one second device, second communication data; and
decrypt the second communication data using the second encryption key.
10. The first device of claim 8 , wherein:
the three-way handshake is performed via a control channel; and
the communication channel is different from the control channel.
11. The first device of claim 8 , wherein the first communication data comprises at least one of: a text message, a chat room message, an e-mail, a document, an audiovisual file, a Short Message Service message (SMS), a Multimedia Messages Service message (MMS), a voice call, a video call, a video conference, screen sharing, or application sharing.
12. The first device of claim 8 , further comprising:
an input device configured to receive the first communication data.
13. The first device of claim 12 , wherein the input device comprises at least one of:
a microphone; or
a camera.
14. A method performed by a first device, the method comprising:
detecting, during a secure communication session, a trigger;
performing, based on the detecting the trigger, a key advancement algorithm to generate a second encryption key based on a first encryption key and a first nonce;
deriving a key-encrypting key;
encrypting first communication data using the second encryption key;
encrypting the second encryption key using the key-encrypting key to secure the communication channel; and
transmitting the encrypted first communication data to at least one second device over the secured communication channel.
15. The method of claim 14 , wherein:
a different encryption key from the second encryption key was used to encrypt communication data prior to detecting the trigger.
16. The method of claim 14 , wherein the trigger comprises at least one of:
a predetermined number of data exchanged between the first device and the at least one second device;
a predetermined amount of time;
one of the at least one second device joining the secure communication session; or
one of the at least one second device leaving the secure communication session.
17. The method of claim 14 , wherein the key advancement algorithm comprises a key derivation function.
18. The method of claim 14 , wherein the key advancement algorithm comprises a three-way handshake.
19. The method of claim 14 , further comprising:
generating a second nonce as part of the key advancement algorithm, wherein the second nonce is used to calculate a third encryption key to provide to the at least one second device.
20. The method of claim 14 , wherein the first communication data comprises at least one of: a text message, a chat room message, an e-mail, a document, an audiovisual file, a Short Message Service message (SMS), a Multimedia Messages Service message (MMS), a voice call, a video call, a video conference, screen sharing, or application sharing.