Quantum safe key exchange scheme
Aspects of the invention include a computer-implemented method of executing a hybrid quantum safe key exchange system. The computer-implemented method includes initially retrieving an authenticated random value from a trusted source, generating a first Z value using a first elliptic curve (EC) private key and a first certified form of an EC public key with an EC Diffie-Hellman (ECDH) algorithm, deriving a shared key using the authenticated random value and the first Z value with a key derivation function, decrypting the authenticated random value using a quantum safe algorithm (QSA) private key, generating a second Z value using a second EC private key and a second certified form of the EC public key with the ECDH algorithm and deriving the shared key using the authenticated random value and the second Z value with the key derivation function.
1. A computer-implemented method of executing a hybrid quantum safe key exchange system, the computer-implemented method comprising:
generating a quantum safe algorithm (QSA) key pair for key encryption management and first and second elliptic curve cryptography (ECC) key pairs for key agreement;
generating a random value;
generating a first Z value using a private key of the first ECC key pair and a certified form of a public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm;
deriving a shared key using the random value and the first Z value with a key derivation function;
encrypting the random value using a public key of the QSA key pair to produce an encrypted random value;
decrypting the encrypted random value using a private key of the QSA key pair to produce the random value;
generating a second Z value using a private key of the second ECC key pair and a certified form of a public key of the first ECC key pair with the ECDH algorithm; and
deriving the shared key using the random value produced by the decrypting and the second Z value with the key derivation function.
2. The computer-implemented method according to claim 1 , wherein the generating of the random value at the trusted source, the generating of the first Z value using the private key of the first ECC key pair and the certified form of the public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm, the deriving of the shared key using the random value and the first Z value with the key derivation function and the encrypting of the random value using the public key of the QSA key pair to produce the encrypted random value are executed separately from the decrypting of the encrypted random value using the private key of the QSA key pair to produce the random value, the generating of the second Z value using the private key of the second ECC key pair and the certified form of the public key of the first key pair with the ECDH algorithm and the deriving of the shared key using the random value produced by the decrypting and the second Z value with the key derivation function are executed at a second computer.
3. The computer-implemented method according to claim 1 , wherein:
the encrypting of the random value comprises a call of a first cryptographic architecture (CA) programming interface, and
each instance of the deriving of the shared key comprises a call of a second CA programming interface.
4. The computer-implemented method according to claim 1 , wherein the key derivation function comprises hashing.
5. A computer program product for executing a hybrid quantum safe key exchange system, the computer program product comprising:
a computer-readable medium having program instructions embodied therewith, the program instructions being readable by a processing system to cause the processing system to execute a method comprising:
generating a quantum safe algorithm (QSA) key pair for key encryption management and first and second elliptic curve cryptography (ECC) key pairs for key agreement;
generating a random value;
generating a first Z value using a private key of the first ECC key pair and a certified form of a public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm;
deriving a shared key using the random value and the first Z value with a key derivation function;
encrypting the random value using a public key of the QSA key pair to produce an encrypted random value;
decrypting the encrypted random value using a private key of the QSA key pair to produce the random value;
generating a second Z value using a private key of the second ECC key pair and a certified form of a public key of the first ECC key pair with the ECDH algorithm; and
deriving the shared key using the random value produced by the decrypting and the second Z value with the key derivation function.
6. The computer program product according to claim 5 , wherein the generating of the random value at the trusted source, the generating of the first Z value using the private key of the first ECC key pair and the certified form of the public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm, the deriving of the shared key using the random value and the first Z value with the key derivation function and the encrypting of the random value using the public key of the QSA key pair to produce the encrypted random value are executed separately from the decrypting of the encrypted random value using the private key of the QSA key pair to produce the random value, the generating of the second Z value using the private key of the second ECC key pair and the certified form of the public key of the first key pair with the ECDH algorithm and the deriving of the shared key using the random value produced by the decrypting and the second Z value with the key derivation function are executed at a second computer.
7. The computer program product according to claim 6 , wherein:
the encrypting of the random value comprises a call of a first cryptographic architecture (CA) programming interface, and
each instance of the deriving of the shared key comprises a call of a second CA programming interface.
8. The computer program product according to claim 6 , wherein the key derivation function comprises hashing.