VPN authentication with forward secrecy

1. An apparatus comprising:

a processor;

a network interface; and

a memory that stores code executable by the processor, the code comprising:

code that receives signed keys from a computing device over a network via the network interface, wherein the signed keys include a key signed by a mobile device associated with the computing device and wherein the signed keys were generated responsive to a first key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration;

code that authenticates the received signed keys responsive to prior knowledge of public keys associated with at least one of the computing device and the mobile device according to a second key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration; and

code that initiates a communication between the processor and the computing device responsive to the received signed keys being authenticated.

2. The apparatus of claim 1 , wherein the code further comprising:

code that receives encrypted session data; and

code that decrypts the encrypted session data,

wherein the session data was signed based on the second key agreement protocol.

3. The apparatus of claim 1 , wherein the first key agreement protocol is configured to provide forward secrecy protection and time-based expiration, and the second key agreement protocol configured to provide one of forward secrecy protection and time-based expiration.

4. The apparatus of claim 1 , wherein the first and second key agreement protocols include extended triple Diffie-Hellman protocol.

5. The apparatus of claim 1 , wherein the first and second key agreement protocols include elliptical curve Diffie-Hellman protocol.

6. The apparatus of claim 1 , wherein the first and second key agreement protocols include hashing cryptographic ratcheting.

7. The apparatus of claim 5 , wherein the hashing cryptographic ratcheting includes double ratcheting.

8. The apparatus of claim 1 , wherein the initiated communication includes communication over a virtual private network (VPN).

9. A method comprising:

at a server apparatus,

receiving signed keys from a computing device over a network via the network interface, wherein the signed keys include a key signed by a mobile device associated with the computing device and wherein the signed keys were generated responsive to a first key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration;

authenticating the received signed keys responsive to prior knowledge of public keys associated with at least one of the computing device and the mobile device according to a second key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration; and

initiating a communication between the processor and the computing device responsive to the received signed keys being authenticated.

10. The method of claim 9 , further comprising:

at the server apparatus,

receiving encrypted session data; and

decrypting the encrypted session data,

wherein the session data was signed based on the second key agreement protocol.

11. The method of claim 9 , wherein the first key agreement protocol is configured to provide forward secrecy protection and time-based expiration, and the second key agreement protocol configured to provide one of forward secrecy protection and time-based expiration.

12. The method of claim 9 , wherein the first and second key agreement protocols include extended triple Diffie-Hellman protocol.

13. The method of claim 9 , wherein the first and second key agreement protocols include elliptical curve Diffie-Hellman protocol.

14. The method of claim 9 , wherein the first and second key agreement protocols include hashing cryptographic ratcheting.

15. The method of claim 9 , wherein the hashing cryptographic ratcheting includes double ratcheting.

16. The method of claim 9 , wherein the initiating a communication includes initiating communication over a virtual private network (VPN).

17. A program product comprising a non-transitory computer readable storage medium that stores code executable by a processor, the executable code comprising code to perform:

receiving signed keys from a computing device over a network via the network interface, wherein the signed keys include a key signed by a mobile device associated with the computing device and wherein the signed keys were generated responsive to a first key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration;

authenticating the received signed keys responsive to prior knowledge of public keys associated with at least one of the computing device and the mobile device according to a second key agreement protocol configured to provide one of forward secrecy protection, post-compromise protection, and reply attack protection in the form of time-based expiration; and

initiating a communication between the processor and the computing device responsive to the received signed keys being authenticated.

18. The program product of claim 17 , the code to further perform:

receiving encrypted session data; and

decrypting the encrypted session data,

wherein the session data was signed based on the second key agreement protocol.

19. The program product of claim 17 , wherein the first and second key agreement protocols include one of extended triple Diffie-Hellman protocol or elliptical curve Diffie-Hellman protocol with a double ratcheting algorithm.

20. The program product of claim 17 , wherein the initiating a communication includes initiating communication over a virtual private network (VPN).