Quantum safe key exchange scheme
Aspects of the invention include a computer-implemented method of executing a hybrid quantum safe key exchange system. The computer-implemented method includes initially retrieving an authenticated random value from a trusted source, generating a first Z value using a first elliptic curve (EC) private key and a first certified form of an EC public key with an EC Diffie-Hellman (ECDH) algorithm, deriving a shared key using the authenticated random value and the first Z value with a key derivation function, decrypting the authenticated random value using a quantum safe algorithm (QSA) private key, generating a second Z value using a second EC private key and a second certified form of the EC public key with the ECDH algorithm and deriving the shared key using the authenticated random value and the second Z value with the key derivation function.
1. A method of executing a hybrid quantum safe key exchange system, the method comprising:
generating a quantum safe algorithm (QSA) key pair for key encryption management and first and second elliptic curve cryptography (ECC) key pairs for key agreement;
generating a first Z value using a private key of the first ECC key pair and a certified form of a public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm;
deriving a shared key using a random value, generated at a trusted source, and by using the first Z value with a key derivation function;
encrypting the random value using a public key of the QSA key pair to produce an encrypted random value, which is retrievable from the trusted source;
decrypting the encrypted random value using a private key of the QSA key pair to produce the random value;
generating a second Z value using a private key of the second ECC key pair and a certified form of a public key of the first ECC key pair with the ECDH algorithm; and
deriving the shared key using the random value produced by the decrypting and the second Z value with the key derivation function.
2. The method according to claim 1 , wherein:
the generating of the first Z value using the private key of the first ECC key pair and the certified form of the public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm, the deriving of the shared key using the random value and the first Z value with the key derivation function and the encrypting of the random value using the public key of the QSA key pair to produce the encrypted random value are executed at a first computer, and
the decrypting of the encrypted random value using the private key of the QSA key pair to produce the random value, the generating of the second Z value using the private key of the second ECC key pair and the certified form of the public key of the first ECC key pair with the ECDH algorithm and the deriving of the shared key using the random value produced by the decrypting and the second Z value with the key derivation function are executed at a second computer.
3. The method according to claim 1 , wherein:
the encrypting comprises a call of a first cryptographic architecture (CCA) programming interface, and
each instance of the deriving of the shared key comprises a call of a second CCA programming interface.
4. The method according to claim 1 , wherein the key derivation function comprises hashing.
5. A computer-implemented method of executing a hybrid quantum safe key exchange system, the computer-implemented method comprising:
generating a quantum safe algorithm (QSA) key pair for key encryption management and first and second elliptic curve cryptography (ECC) key pairs for key agreement;
generating a first Z value using a private key of the first ECC key pair and a certified form of a public key of the second ECC key pair with an EC Diffie-Hellman (ECDH) algorithm;
deriving a shared key using a random value, generated at a trusted source, and by using the first Z value with a key derivation function;
encrypting the random value using a public key of the QSA key pair to produce an encrypted random value, which is retrievable from the trusted source;
decrypting the encrypted random value using a private key of the QSA key pair to produce the random value;
generating a second Z value using a private key of the second ECC key pair and a certified form of a public key of the first ECC key pair with the ECDH algorithm; and
deriving the shared key using the random value produced by the decrypting and the second Z value with the key derivation function.