Method and system for secure communication using hash-based message authentication codes
View Patent ↗A system and method for secure communication is provided. A first hash-based message authentication code is generated from a shared secret and a first counter value stored in storage of a computing device. A second hash-based message authentication code is generated from such shared secret and a second counter value. An encryption key is derived from a function of the first hash-based message authentication code and the second hash-based message authentication code. A message is encrypted using the encryption key, and communicated via a network interface of the computing device.
1. A method for secure communication using hash-based message authentication codes, comprising:
generating by a server a shared secret, a first counter value and a second counter value;
generating by an encryption module executed on a computing device a first hash-based message authentication code from said shared secret and said first counter value stored in storage of said computing device;
generating by said encryption module executed on said computing device a second hash-based message authentication code from said shared secret and said second counter value;
deriving by said encryption module executed on said computing device an encryption key from a first function of said first hash-based message authentication code and said second hash-based message authentication code; wherein said first function includes at least a portion of a concatenation of said first and second hash-based message authentication codes; and
encrypting by said encryption module executed on said computing device a message using said encryption key; and communicating said encrypted message via a network interface of said computing device.
2. The method of claim 1 , further comprising:
generating a one-time password using one of said first and second hash-based message authentication codes.
3. The method of claim 2 , further comprising:
communicating said one-time password to enable determination of one of said first and second counter values.
4. The method of claim 1 , further comprising:
combining said encryption key with an initialization vector for decrypting said message.
5. The method of claim 1 , wherein said encrypting comprises:
generating an initialization vector as a second function of at least one of said first and second hash-based message authentication codes; and
encrypting said message using said encryption key concatenated with said initialization vector.
6. The method of claim 5 , wherein said generating comprises setting said initialization vector as a portion of said second hash-based message authentication code.
7. The method of claim 1 , further comprising:
communicating an identifier for said shared secret and said counter with said encrypted message.
8. The method of claim 1 , further comprising:
receiving an encrypted response; and
decrypting said encrypted response using said encryption key.