Methods and apparatus for quantum-resistant network communication

1. A method, comprising:

sending to a compute device and via a private channel, a public key of an asymmetric key pair for asymmetric encryption;

concurrently authenticating the compute device and generating a traffic key, the concurrently authenticating and generating both based at least in part on the public key and in accordance with a Diffie-Hellman key exchange, the concurrently authenticating and generating includes sending to the compute device a request including a first set of Diffie-Hellman key parameters and a nonce, the request being encrypted by a private key of the asymmetric key pair, the first set of Diffie-Hellman key parameters encrypted by a temporary key, the concurrently authenticating and generating including receiving from the compute device a reply including a second set of Diffie-Hellman key parameters and the nonce, the reply being encrypted at least by the public key, the second set of Diffie-Hellman key parameters being encrypted by the temporary key, the authenticating the compute device based on the nonce, the generating the traffic key based on the second set of Diffie-Hellman key parameters; and

sending a message to the compute device, the message being encrypted using the traffic key via symmetric encryption.

2. The method of claim 1 , wherein:

the Diffie-Hellman key exchange includes the first set of Diffie-Hellman key parameters, the second set of Diffie-Hellman key parameters, and the nonce.

3. The method of claim 1 , wherein:

sending the public key includes sending the public key to the compute device via a management compute device, and

concurrently authenticating the compute device and generating the traffic key includes communicating with the compute device without using the management compute device.

4. The method of claim 1 , wherein sending the public key includes:

sending the public key to a management compute device; and

sending the public key to the compute device via a local cable between the management compute device and the compute device.

5. The method of claim 1 , wherein the asymmetric encryption includes an asymmetric RSA encryption.

6. The method of claim 1 , wherein concurrently authenticating the compute device and generating the traffic key includes communicating with the compute device via a public channel.

7. The method of claim 1 , further comprising

discarding the temporary key before sending the message to the compute device.

8. The method of claim 1 , wherein:

the asymmetric key pair is a first asymmetric key pair,

the public key is a first public key of the first asymmetric key pair;

the private key is a first private key,

the request is encrypted at least by the first private key,

a second public key of a second asymmetric key pair is associated with the compute device, and

the reply is encrypted at least by the first public key and by a second private key in the second asymmetric key pair.

9. The method of claim 1 , wherein:

the asymmetric key pair is a first asymmetric key pair,

the public key is a first public key of the first asymmetric key pair,

the private key is a first private key,

the request is encrypted at least by the first private key and by a second public key of a second asymmetric key pair associated with the compute device,

the nonce is a first nonce,

the reply is encrypted at least by the first public key and by a second private key in the second asymmetric key pair,

the reply includes the first nonce and a second nonce, and

the method further comprises:

decrypting the reply using the first private key and the second public key; and

sending a status message, encrypted by the traffic key, to the compute device, the status message including the second nonce.

10. An apparatus, comprising:

a communication interface; and

a processor configured to be operably coupled to the communication interface, the processor configured to:

concurrently authenticate a compute device and generate a traffic key, the concurrently authenticating and generating both based at least in part on a public key of an asymmetric key pair and in accordance with a Diffie-Hellman key exchange,

the processor is configured to concurrently authenticate and generate by sending to the compute device a request including a first set of Diffie-Hellman key parameters and a nonce, the request being encrypted by a private key of the asymmetric key pair, the first set of Diffie-Hellman key parameters encrypted by a temporary key, the concurrently authenticating and generating including receiving from the compute device a reply including a second set of Diffie-Hellman key parameters and the nonce, the reply being encrypted at least by the public key, the second set of Diffie-Hellman key parameters being encrypted by the temporary key, the authenticating the compute device based on the nonce, the generating the traffic key based on the second set of Diffie-Hellman key parameters; and

send a message to the compute device, the message being encrypted using the traffic key via symmetric encryption.

11. The apparatus of claim 10 , wherein:

the Diffie-Hellman key exchange includes the first set of Diffie-Hellman key parameters, the second set of Diffie-Hellman key parameters, and the nonce.

12. The apparatus of claim 10 , wherein:

the processor is configured to send, prior to concurrently authenticating and generating, the public key to the compute device via a management compute device, and

the processor is configured to concurrently authenticate the compute device and generate the traffic key by communicating with the compute device without using the management compute device.

13. The apparatus of claim 10 , wherein:

the processor is configured to send, prior to concurrently authenticating and generating, the public key to a management compute device, and

the processor is configured to send, prior to concurrently authenticating and generating, the public key to the compute device via a local cable between the management compute device and the compute device.

14. The apparatus of claim 10 , wherein:

the processor is configured to send, prior to concurrently authenticating and generating, the public key to the compute device via a private channel, and

the processor is configured to concurrently authenticate the compute device and generate the traffic key by communicating with the compute device via a public channel.

15. The apparatus of claim 10 , wherein the asymmetric key pair is associated with an asymmetric RSA encryption.

16. A method, comprising:

sending, to a compute device, a public key of an asymmetric key pair for asymmetric encryption via a private channel;

concurrently authenticating the compute device and generating a traffic key for symmetric encryption, the concurrently authenticating and generating both based at least in part on the public key and a nonce and in accordance with a Diffie-Hellman key exchange,

the concurrently authenticating and generating includes:

sending to the compute device a request including the nonce and a first set of Diffie-Hellman key parameters, the request being encrypted by a private key of the asymmetric key pair, the first set of Diffie-Hellman key parameters encrypted by a temporary key; and

receiving from the compute device a reply including at least the nonce and a second set of Diffie-Hellman key parameters, the reply being encrypted at least by the public key, the second set of Diffie-Hellman key parameters being encrypted by the temporary key, the authenticating the compute device based on the nonce, the generating the traffic key based on the second set of Diffie-Hellman key parameters; and

sending a message to the compute device, the message being encrypted using the traffic key via symmetric encryption.