Method for key agreement for a cryptographic secure point—to—multipoint connection

1. A method for key agreement for a cryptographically secured point-to-multipoint connection between a server and a plurality of clients, comprising:

altering, as a function of an identifier included in a first server message, a sequence of messages in a handshake initiating a secure socket layer protocol session, the identifier identifying the connection as an IP multicast connection;

generating a MasterKey using the server, the MasterKey being used to generate a session key for encrypting application data;

transmitting the MasterKey to a first client of the plurality of clients;

wherein the first server message is a CertificateRequest message used to request a ClientCertificateType;

and further comprising receiving the CertificateRequest message by the first client, and wherein, after the receiving, the altering is performed so that:

a generation of the MasterKey by the first client is not performed and the first client transmits a client certificate to the server without sending a client ChangeCipherSpec message;

the first client switches to encrypted transmission immediately after transmitting the client certificate to the server;

the transmitting is performed by the server using a ServerMasterKeyExchange message, the MasterKey being encrypted with a public key of the first client;

the server, after transmitting the ServerMasterKeyExchange message and after transmitting a server ChangeCipherSpec and a server Finished message, switches to a mode for encrypted data transmission; and

the first client, after the server switches to the mode for encrypted data transmission, acknowledges the ServerMasterKeyExchange message received from the server by sending the client ChangeCipherSpec message and a client Finished message and switches to the mode for encrypted data transmission.

2. A method for key agreement for a cryptographically secured point-to-multipoint connection between a server and a plurality of clients, comprising:

altering, as a function of an identifier included in a first server message, a sequence of messages in a handshake initiating a secure socket layer protocol session, the identifier identifying the connection as an IP multicast connection;

generating a MasterKey using the server, the MasterKey being used to generate a session key for encrypting application data;

transmitting the MasterKey to a first client of the plurality of clients;

wherein the first server message is a CertificateRequest message used to request a ClientCertificateType; and

wherein the altering is performed so that:

the sequence of messages in the handshake follows the handshake according to a standard SSL protocol until the server transmits a first server ChangeCipherSpec message;

then, instead of a Finished message, the server transmits a modified ServerMasterKeyExchange message so as to perform the transmitting of the MasterKey, the MasterKey being encrypted;

then, the server transmits a second server ChangeCipherSpec message;

the first client, as an acknowledgement of a receipt of the MasterKey and the second server ChangeCipherSpec message, sends a client ChangeCipherSpec message and a client Finished message; and

then the first client switches to an encryption mode that uses the MasterKey.

3. The method as recited in claim 2 wherein the altering is performed so that:

the server transmits a ClientAuthRequest message prior to the transmitting of the modified ServerMasterKeyExchange message, the server, using the ClientAuthRequest message, requesting the first client to authenticate itself; and

the first client transmits, prior to transmitting of the modified ServerMasterKeyExchange message, a ClientAuthResponse message acknowledging the requesting of the server for the first client to authenticate itself.

4. The method as recited in claim 3 wherein the server requests, using the ClientAuthRequest message, the first client to authenticate itself using at least one of a password and a PIN.

5. The method as recited in claim 3 wherein the altering is performed so that after the transmitting respective ChangeCipherSpec messages, the server and the first client use, for encryption, a same CipherSuite agreed upon during an initiation of the handshake using a ClientHello message and a ServerHello message.

6. The method as recited in claim 2 wherein the altering is performed so that after the transmitting the respective ChangeCipherSpec messages, the server and the first client use, for encryption, a same CipherSuite agreed upon during an initiation of the handshake using a ClientHello message and a ServerHello message.

7. A method for key agreement for a cryptographically secured point-to-multipoint connection between a server and a plurality of clients, comprising:

altering, as a function of an identifier included in a first server message, a sequence of messages in a handshake initiating a secure socket layer protocol session, the identifier identifying the connection as an IP multicast connection;

generating a MasterKey using the server, the MasterKey being used to generate a session key for encrypting application data;

transmitting the MasterKey to a first client of the plurality of clients;

wherein the transmitting is performed using the first server message, the first server message being a modified ServerMasterKeyExchange message and wherein the MasterKey is configured for later derivation of at least one session key; and

wherein the altering is performed so that:

the sequence of messages in the handshake follows the handshake according to a standard SSL protocol until the server transmits a first server ChangeCipherSpec message;

then, instead of a Finished message, the server transmits a modified ServerMasterKeyExchange message so as to perform the transmitting of the MasterKey, the MasterKey being encrypted;

then, the server transmits a second server ChangeCipherSpec message;

the first client, as an acknowledgement of a receipt of the MasterKey and the second server ChangeCipherSpec message, sends a client ChangeCipherSpec message and a client Finished message; and

then the first client switches to an encryption mode that uses the MasterKey.

8. The method as recited in claim 7 wherein the altering is performed so that:

the server transmits a ClientAuthRequest message prior to the transmitting of the modified ServerMasterKeyExchange message, the server, using the ClientAuthRequest message, requesting the first client to authenticate itself; and

the first client transmits, prior to transmitting of the modified ServerMasterKeyExchange message, a ClientAuthResponse message acknowledging the requesting of the server for the first client to authenticate itself.

9. The method as recited in claim 8 wherein the altering is performed so that after the transmitting the respective ChangeCipherSpec messages, the server and the first client use, for encryption, a same CipherSuite agreed upon during an initiation of the handshake using a ClientHello message and a ServerHello message.

10. The method as recited in claim 7 wherein the altering is performed so that after the transmitting the respective ChangeCipherSpec messages, the server and the first client use, for encryption, a same CipherSuite agreed upon during an initiation of the handshake using a ClientHello message and a ServerHello message.