Challenge-response authentication using a masked response value
Challenge-response authentication protocols are disclosed herein, including systems and methods for a first device to authenticate a second device. In one embodiment, the following operations are performed by the first device: (a) sending to the second device: (i) a challenge value corresponding to an expected response value known by the first device, and (ii) a hiding value; (b) receiving from the second device a masked response value; (c) obtaining an expected masked response value from the expected response value and the hiding value; and (d) determining whether the expected masked response value matches the masked response value received from the second device. The operations from the perspective of the second device are also disclosed, which in some embodiments include computing the masked response value using the challenge value, the hiding value, and secret information known to the second device.
1. A method for a first device to authenticate a second device, the method performed by the first device and comprising:
the first device sending to the second device a challenge value and a hiding value, wherein the challenge value corresponds to an expected response value known by the first device, and the challenge value and the expected response value are loaded into memory of the first device at a time of manufacture of the first device;
the first device receiving from the second device a masked response value, wherein the masked response value is computed by the second device from the challenge value, the hiding value, and secret information known to the second device and unknown to the first device;
the first device computing an expected masked response value from the expected response value and the hiding value;
the first device determining whether the expected masked response value matches the masked response value received from the second device; and
repeating the sending, receiving, computing, and determining, when authentication of the second device is to be performed again, using a different hiding value and the same challenge value.
2. The method of claim 1 , wherein said computing the expected masked response value from the expected response value and the hiding value comprises computing the expected masked response value by performing a cryptographic hash of a message that comprises the expected response value and the hiding value.
3. The method of claim 2 , wherein the expected masked response value is computed as xmaskres=cryptographic hash(xres∥h), where xmaskres is the expected masked response value, cryptographic hash(•) is the cryptographic hash, xres is the expected response, h is the hiding value, and ∥ represents concatenation.
4. The method of claim 2 , wherein the cryptographic hash is one that is progressively computed and is the same as a cryptographic hash used by the second device to compute the masked response value.
5. The method of claim 4 , wherein the cryptographic hash does not incorporate a value representing a length of the message into the input of the cryptographic hash.
6. The method of claim 1 , wherein the first device is a mobile device and the second device is a battery.
7. A device comprising:
a memory configured to store a challenge value and an expected response value corresponding to the challenge value; and
an interface configured to send to another device the challenge value and a hiding value, and to receive a masked response value from the another device, the masked response value is computed by the another device from the challenge value, the hiding value, and secret information known to the another device and unknown to the device;
the device configured to compute an expected masked response value from the expected response value and the hiding value, and to determine whether the expected masked response value matches the masked response value received from the another device, wherein the challenge value corresponds to the expected response value, the challenge value and the expected response value are loaded into memory of the device at a time of manufacture of the first device;
wherein, when authentication of the another device is to be performed again, the interface is further configured to send to the another device a different hiding value and the same challenge value, and the device is configured to compute another expected masked response value from said expected response value and said different hiding value.
8. The device of claim 7 , further comprising a processor configured to compute the expected masked response value from the expected response value and the hiding value and to determine whether the expected masked response value matches the masked response value.
9. The device of claim 7 , wherein the device is a mobile device and the another device is a battery.
10. The device of claim 7 , wherein the device is configured to compute the expected masked response value by performing a cryptographic hash of a message that comprises the expected response value and the hiding value.
11. A non-transitory processor readable medium having stored thereon processor readable instructions that, when executed, cause a first device to authenticate a second device by performing operations comprising:
sending to the second device a challenge value and a hiding value, wherein the challenge value corresponds to an expected response value known by the first device, and the challenge value and the expected response value are loaded into memory of the first device at a time of manufacture of the first device;
receiving from the second device a masked response value, wherein the masked response value is computed by the second device from the challenge value, the hiding value, and secret information known to the second device and unknown to the first device;
computing an expected masked response value from the expected response value and the hiding value;
determining whether the expected masked response value matches the masked response value received from the second device;
repeating the sending, receiving, computing, and determining, when authentication of the second device is to be performed again, using a different hiding value and the same challenge value.