Ecdhe key exchange for server authentication and a key server
A server can receive a device public key and forward the device public key to a key server. The key server can perform a first elliptic curve Diffie-Hellman (ECDH) key exchange using the device public key and a network private key to derive a secret X1. The key server can send the secret X1 to the server. The server can derive an ECC PKI key pair and send to the device the server public key. The server can conduct a second ECDH key exchange using the derived server secret key and the device public key to derive a secret X2. The server can perform an ECC point addition using the secret X1 and secret X2 to derive a secret X3. The device can derive the secret X3 using (i) the server public key, a network public key, and the device private key and (ii) a third ECDH key exchange.
1. A method for a device to authenticate with a server over a wireless network, the method performed by the device, the method comprising:
a) storing, in a memory, (i) a first point on an elliptic curve, and (ii) a shared key, wherein the shared key is received by the server;
b) generating a value from a secure hash of at least the shared key;
c) selecting a first integer as a first subset of the value;
d) receiving, from the server via a radio connected to the wireless network, (i) a random number and (ii) a second point on the elliptic curve, the second point comprising a public key for the server;
e) deriving a device private key and corresponding device public key for the elliptic curve;
f) deriving a shared secret comprising an elliptic curve point addition of (i) the first integer multiplied by the first point and (ii) the device private key multiplied by the public key for the server;
g) deriving a symmetric ciphering key from a key derivation function with the shared secret;
h) generating a ciphertext by encrypting with the symmetric key (i) a device digital signature for at least the random number, and (ii) a device certificate; and
i) transmitting, to the server via the radio connected to the wireless network, the ciphertext.
2. The method of claim 1 , wherein the elliptic curve comprises a named curve secp256r1 (p256).
3. The method of claim 1 , wherein the first integer comprises a second value N2.
4. The method of claim 1 , wherein the symmetric ciphering key comprises a third value K1.
5. The method of claim 1 , wherein the server mutually derives the shared secret and the symmetric ciphering key using the first point, the shared secret, the first integer, the device public key, and a server private key corresponding to the server public key.
6. The method of claim 1 , further comprising after step e) and before step i), transmitting, to the server via the radio connected to the wireless network, the device public key.
7. The method of claim 1 , further comprising in step f) deriving a message authentication code (MAC) key from the key derivation function with the shared secret and in step h) generating a MAC value for the ciphertext with the MAC key.
8. The method of claim 1 , further comprising step j) receiving, from the server via the radio connected to the wireless network, a second ciphertext comprising a server certificate, wherein the device decrypts the second ciphertext using the symmetric key.
9. The method of claim 1 , further comprising in step h), generating the device digital signature using an elliptic curve digital signature algorithm (ECDSA).
10. The method of claim 1 , wherein the server verifies the digital signature using the device certificate.
11. The method of claim 1 , wherein multiplication in step f) comprises elliptic curve point multiplication.
12. The method of claim 1 , wherein the device comprises the radio.
13. The method of claim 1 , wherein the wireless network comprises a Wi-Fi network.