Method for securely negotiating a symmetric key between two communicating participants - Patents.com

Abstract

The invention relates to a method for securely negotiating a symmetric key between at least two participants of a communication, in which the participants are either given a common secret for each of them or can be given a common secret indirectly via another participant who shares the common secret with each of them, characterized in that the participants are either given at least one common key derivation function for each of them or can be given at least one common key derivation function indirectly via another participant, in which when a symmetric key is needed or when an update of the symmetric key is needed, the symmetric key is derived on the basis of the common secret and one of the key derivation functions according to a derivation rule, the derivation rule comprising at least the key derivation function to be used and at least one parameter for the key derivation function and communicated to one of the participants by the other of the participants.

Description

[Technical field]

[0001] The present invention relates to a method for securely negotiating a symmetric key between two communication participants as more precisely defined in the preamble of claim 1. [Background technology]

[0002] Modern vehicles are characterized by their increasing networking, where the vehicle is not only connected to systems such as the World Wide Web, but also to systems and servers operated by the vehicle manufacturer or OEM, such as manufacturer-specific servers and manufacturer-specific applications, often referred to as the Vehicle Backend, which are developed, marketed, and operated by the manufacturer specifically for their own vehicles. All of this together is also referred to as the vehicle ecosystem.

[0003] Indeed, the diversity of communication relationships between the individual system components in such a vehicle ecosystem gives rise to a multitude of new interfaces and applications, all of which must be protected by appropriate cryptographic methods, e.g. mechanisms, protocols, etc. This protection serves, on the one hand, to safeguard the privacy of the vehicle user and, on the other hand, to prevent external intervention in the data traffic, which could be used by hackers to attack the vehicle and manipulate important functions, in particular when transmitting data related to vehicle control.

[0004] Common practice is to use asymmetric keys or methods based on asymmetric cryptography, typically in the form of the so-called Transport Layer Security (TLS) and sometimes in the form of Internet Protocol Security (IPSec), which themselves make use of traditional asymmetric methods such as RSA or Elliptic Curve Cryptography (ECC) based on prime factorization.

[0005] Commonly used asymmetric cryptosystems, such as ECC or RSA, have the advantage that they provide relatively secure protection according to today's standards with minimal effort. However, all these methods are based on cryptographic algorithms whose security is considered not robust against quantum computers. A quantum computer, by means of its calculation methods, can break the asymmetric cryptosystems and decrypt the protected data in a very short time. In this case, the methods for cryptographic protection, i.e. in particular for encryption and / or authentication, commonly used today for communication between the vehicle and the backend, are no longer secure. This so-called post-quantum threat was previously rather a theoretical threat, since quantum computers were still considered purely research instruments and were only realized with enormous effort. However, in recent years, the progress of quantum computers has accelerated significantly. Therefore, the confident prediction that quantum computers with sufficient performance will not be commercially available within the next ten years can no longer be guaranteed from today's point of view.

[0006] Vehicles on the market today usually remain on the road for a period of 10 to 15 years. This means that the post-quantum threat, i.e. the potential for the protection of conventional asymmetric cryptography to be easily broken in the future by easily available or especially commercially available quantum computers, is already relevant for vehicles delivered today. That is, the communication between the vehicle's communication device and an external server, which today is often protected by cryptographic protocols based on RSA or ECC, is no longer secure due to the emergence of this post-quantum threat, and therefore from today's point of view, a secure communication cannot be guaranteed over the entire expected service life of the vehicle. The impact of this threat is particularly severe for systems that cannot be easily updated or renewed. An example of such a system is the electronic control unit (ECU) integrated in the car. The threat is more obvious for servers, smartphones, etc., which, also in terms of their hardware, are usually expected to expand much faster than the vehicle and have a service life that is assumed to be shorter than the vehicle.

[0007] To address the post-quantum threat, asymmetric algorithms that are resistant to the post-quantum threat have been generally studied for several years. This approach is generally referred to as post-quantum cryptography or PQC. However, these approaches are not yet very mature and are not suitable to replace conventional asymmetric methods today. Therefore, vehicles today cannot be designed to use post-quantum cryptographic protection methods, since such technologies are not yet mature enough to provide a final assessment of the expected security. Furthermore, there is currently no standardization and the above approaches require a lot of resources. In other words, a rapid switch to such quantum-resistant cryptographic methods is not meaningful or easy at the moment. Even if there were already standardized PQC methods that were considered sufficiently secure, it would not be meaningful to implement such methods in today's communication devices of vehicles, because the higher cost burden and high resource consumption would hinder the economic efficiency of the current vehicle ecosystem.

[0008] Furthermore, symmetric methods such as the Advanced Encryption Standard (AES), hashing methods such as the Secure Hash Algorithm (SHA-512), or symmetric authentication methods such as the Hashed Message Authentication Code (HMAC), are essentially insensitive to post-quantum threats according to what is known today. Although their security would certainly be halved by the advent of post-quantum threats according to what is known today, a 128-bit key would still provide 64-bit security, even subject to the availability of quantum computers. However, such a weakening can be relatively easily compensated for by increasing the key length.

[0009] In comparison with asymmetric methods, such symmetric methods have a major problem in that in symmetric cryptography, the handling of key distribution and negotiation is difficult, especially since their number is potentially very large. This concerns in particular the provisioning of the initial symmetric keys to the components involved. Furthermore, it concerns the negotiation, especially on a demand-driven basis, of a common symmetric key or session key between two or more communication partners that do not have a common symmetric key, i.e. do not "know" or "yet" know each other. Furthermore, for each component where a communication relationship already exists and where a common symmetric key has already been agreed upon, this must be persisted accordingly. Due to the typically very large number of communication relationships that arise, the management of the symmetric keys in the components is very cumbersome.

[0010] For this reason, for example, in TLS, certificate-based asymmetric cryptography is used to negotiate symmetric keys between communication partners. If symmetric keys are negotiated via such methods, then TLS also performs exclusively symmetric authentication and encryption. As explained above, negotiation via asymmetric cryptography is not post-quantum resistant in itself.

[0011] Patent document 1 describes a method for the distribution and negotiation of keying material within a vehicle ecosystem, in which a central trust authority is established, which initially grants the involved participants individual secrets by means of which the participants can communicate in a protected manner with the trust authority, and, if necessary, the trust authority can collect in a protected manner the keys shared for the group of participants. The drawback of this method is that all negotiated and shared secrets must be generated by the trusted authority and then transmitted to the individual participants, who must implement both authentication and encryption methods together with the trusted authority for securely transmitting these secrets. However, it may not be feasible for participants with few resources to implement both secure authentication and secure encryption methods and make meaningful use of them. This is especially the case for control devices in vehicles, which often have few resources in terms of computing power and memory capacity at their disposal. [Prior art documents] [Patent documents]

[0012] [Patent Document 1] DE102020003739A1 Summary of the Invention [Problem to be solved by the invention]

[0013] It is an object of the present invention to provide an improved method for distribution and negotiation of keying material, especially within a vehicle ecosystem. [Means for solving the problem]

[0014] According to the invention, this problem is solved by a method having the features of claim 1. Further advantageous configurations and developments of the method are described in the dependent claims which are dependent on claim 1.

[0015] The method according to the invention is substantially based on the above-mentioned US Pat. No. 5,999,333 and in particular involves the step of connecting all participant pairs TN of a communication system which may be part of a vehicle ecosystem. i , T.N. j requires a shared, and therefore common, secret SEC of sufficient length and entropy. TNi TNj Here, the common secret SEC TNiTNj The first secret shared by SEC TNi TNj However, this can be used as a participant TN i A very large number of SECs can quickly become very resource intensive. Instead, a common secret SEC TNi TNj , two participants TN i , T.N. j Between them, there is another participant TN that is known to both parties and that both parties trust, or with which both parties have already communicated before. k According to a very advantageous development of the method, this other participant may be a trusted institution or trust authority TA according to the patent document 1. The communication can be carried out via one participant TN i and the trusted authority TA directly, using an initially shared secret SEC TNi TA will be necessary.

[0016] In the method according to the invention, unlike the prior art of the type of US Pat. No. 5,993,536, the TN i and T.N. j For the protection of communications between those participants TN i , T.N. j All secrets used by the SEC, e.g., symmetric keys, are shared by this common secret SEC as necessary. TNi TNj Therefore, this shared secret SEC TNi TNj is the number of participants TN i , T.N. j It plays a central, if not the only, "secret entropy source" for protecting communications between the

[0017] For this purpose, each participant TN i The other participants in the communication TN j known to other participants TN kImplement at least one secure key derivation function KDF, known to the trusted authority TA if applicable. This key derivation function KDF may in particular be based only on secure one-way functions such as hash functions. This key derivation function KDF may also be implemented initially or provided or shared via another participant, like a shared secret.

[0018] 2 Participants TN i and T.N. j Between or TN i When a new key is required to protect communications between a TN and a TA, whether for a new purpose, e.g. for a first communication, or to replace an expired key for a known purpose, one of the participants, TN, i The other participant TN j or from the Trusted Authority TA (or vice versa) j Or the trusted institution TA has one participant TN i From the , a Derivation Rule DR is communicated, which at least contains information on which of the key derivation functions, if any, should be used, and also hands over at least one parameter of the key derivation function itself.

[0019] Based on this, we can easily and efficiently derive a symmetric key for cryptographic protection from a shared secret SEC. TNi TNj This symmetric key can then be used for authentication and / or encryption. If a secret is initially shared, the negotiation of this key takes place by means of a message that is sent only once. According to a highly advantageous development of the method according to the invention, which will be explained in more detail below, this can include the contents of the message (but not the derivation rule DR) in encrypted form. However, the entire message can be authenticated.

[0020] The advantages of the method according to the invention are in particular: -Easily and efficiently negotiate symmetric keys and therefore post-quantum safe keys according to today's knowledge; The method can be used particularly advantageously already in today's vehicle control devices, since more and more vehicle control devices are equipped with secure hardware modules (HSM) in which the shared secret can be securely stored, and since the secure initial introduction of an individual secret into the control device by the control device manufacturer is already commonplace today.

[0021] According to a highly preferred configuration of the method according to the invention, the key derivation function KDF can utilize as parameters a key base KDF-Key, a salt KDF-Salt and an output length KDF-Length, where the key base KDF-Key is a secret that is directly introduced into the key derivation function KDF to derive the key, the salt KDF-Salt is a random or pseudorandom bit string of a predefined length and the output length KDF-Length is a natural number representing the length of the symmetric key to be created.

[0022] Through the derivation rules, common secrets SEC TNi TNj Which bits of are used to form the key-based KDF-Key and in what order those bits should be arranged for the key-based KDF-Key are then determined by the appropriate participant TN i (or T.N. j The key-based KDF-Key thus obtained is then used to generate new keys using the KDF. i (or T.N. j ) is informed which salt should be used for key generation and what length KDF-Length the output of the key derivation function KDF should have.

[0023] In an advantageous development of the method according to the invention, the derivation rule DR comprises the key derivation function KDF to be used, the salt KDF-Salt, the output length KDF-Length and also one input selection function SeqPosIn and / or one output selection function SeqPosOut respectively. The input selection function SeqPosIn is used to determine the key base KDF-Key from the secret SEC by "bit selection". Since the key base is secret and the derivation rule DR is transmitted unencrypted, the key base KDF-Key itself is not part of the derivation rule DR.

[0024] Therefore, one participant TN i The other participant TN j , or the trusted authority TA, if it corresponds to the second participant, may inform the derivation rule DR for the new key, taking into account the aforementioned parameters and one or both of the selection functions SeqPosIn, SeqPosOut. This derivation rule may include at least the following information: the key derivation function KDF to be used, which depends on the parameters KDF-Key, KDF-Salt and KDF-Length; -Secret SEC TNi TNj SEC by indicating an input selection function SeqPosIn that defines which bits of should form the KDF-Key, and in what order. TNi TNj Define the bit string KDF-Key depending on ; - a bit string KDF-Salt; -Natural number KDF-Length; - Which bits of the output of the key derivation function KDF, in what order, are used to generate the newly derived key DR(SEC TNi TNj ) is formed, depending on the output of the key derivation function KDF. TNi TNj )

[0025] Thus, a derivation rule DR is uniquely described by a tuple of the form, for example: DR=(KDF,SeqPosIn,KDF-Salt,KDF-Length,SeqPosOut).

[0026] The derivation rule DR and the shared secret SEC defined in this way TNi TNj The key uniquely defined by DR(SEC TNi TNj ) and DR(SEC TNi TNj ):=SeqPosOut(KDF(SeqPosIn(SEC TNi TNj ),KDF-Salt,KDF-Length) It is defined by:

[0027] Here, the input selection function SeqPosIn has length L(SEC TNi TNj (In this specification, L(bf) represents the bit length of the bit string bf.) Similarly, the output selection function SeqPosOut is a function that selects a specific bit from a bit string of length KDF-Length and rearranges the selected bit as necessary.

[0028] Here, the selection function can either permute the bits selected from the input bit string or maintain their original relative order with respect to one another. The first permute variation of the selection function offers more flexibility in the definition of the selection function, which allows more selection functions to be defined, however the description of the selection function which perms the bits thereby contains more information and requires more space in the derivation rule DR. The second variation, which omits the permute of the selected bits, is less flexible and powerful, however it requires less space in the derivation rule DR. SHARED SECRET SEC TNi TNj Since the length of SEC is fixed, TNiTNj Assuming that each bit from is selected at most once by the input selection function SeqPosIn, we can use the input selection function SeqPosIn to TNi TNj Since the number of KDF-Keys that can be selected from is limited, in some cases, all possible KDF-Keys of a given length are checked using SeqPosIn. TNi TNj Therefore, especially in the case of SeqPosIn, it is considered meaningful to realize the rearrangement of the selected bits by SeqPosIn. Since SeqPosOut selects bits from the output of the key derivation function KDF, the length of which is determined by the freely selectable parameter KDF-Length, for each key derivation function KDF and each desired output chosenKey, the DR parameter KDF-Length is selected so that chosenKey can be defined by the order-preserving selection function SeqPosOut, so that chosenKey=DR(SEC TNi TNj )

[0029] Here, the selection function can be defined in various ways. In the following, several possible variations are described.

[0030] Variation 1 It is proposed that the reordering selection function is described by a sequence of bit positions (pos_0,...,pos_(n-1)), where n is the length of the output of the selection function and each position pos_j is smaller than the length of the input and pairwise distinct from each other, e.g. for an input bit sequence 00001111 and n=4, the selection function (0,5,2,7) defines or encodes the output bit sequence 0101.

[0031] Variation 2.1 We propose to describe an order-preserving selection function by a sequence of distances (dist_0,...,dist_(n-1)), where n is the length of the output of the selection function, dist_0 >= 0, and the remaining distances, i.e. 0 <j<nについては、dist_j> 0 and the sum of all distances is less than the length of the input. For example, if the input bit sequence is 00001111 and n=4, then the choice function (0,3,2,2) defines or encodes the output bit sequence 0011. Note that for the same input bit sequence, the bit sequence 0101 cannot be defined by a choice function that preserves order.

[0032] Variation 2.2 As an extension of this, it is proposed to describe the order-preserving selection function by a set of intervals, where an interval is described by a single distance dist_j or by a distance pair (dist_j,dist_k). A single distance represents an interval consisting of one bit position, while a distance pair (dist_j,dist_k)(dist_k+1) represents the associated bit position. In this case, dist_0 >= 0 and the remaining distances, i.e. 0 <j<nについては、dist_j> 0, and the sum of all distances is less than the length of the input; for example, if the input bit string is 00001111, then the choice function (0,(3,2),2) defines or encodes the output bit string 00111.

[0033] Variation 3 Furthermore, we propose to describe the order-preserving selection function by a bit string (bit_0,...,bit_(le-1)), where le does not exceed the length of the input of the selection function. That is, for SeqPosIn, le ≤ L(SEC TNi TNj), and for SeqPosOut, le≦KDF-Length, where bit_j=1 (for 0≦j≦le-1) indicates that the bit at position bit_j of the input of the selection function belongs to its output, and bit_j=0 indicates that the bit at position bit_j of the input of the selection function does not belong to its output.

[0034] The above mentioned variations may be combined with each other and may be combined with the SEC TNi TNj may be combined by selecting individual bits from the relevant regions using either Variation 1 or Variation 3, with the exception that in the case of Variation 1, the selected bits are permuted as necessary.

[0035] Each variation in the definition of the selection function has its own advantages and disadvantages. In particular, it may be beneficial to use different definitions for SeqPosIn and SeqPosOut.

[0036] In a highly preferred configuration of the method, the derivation rule DR can further be transmitted without the input selection function SeqPosIn and / or the output selection function SeqPosOut, in which case instead of transmitting at least one of the selection functions SeqPosIn, SeqPosOut a reference to the commonly known input selection function SeqPosIn and / or the output selection function SeqPosOut is transmitted.

[0037] That is, the selection functions SeqPosIn, SeqPosOut do not always need to be fully described as part of the derivation rule DR. Rather, the derivation rule DR may be written such that, instead of a full description, a unique name of the selection function to be used is represented together with the values ​​of parameters possibly required by this selection function, so that both participants TN of the communication can easily understand the selection function. i , T.N. j may contain references to known selection functions SeqPosIn, SeqPosOut.

[0038] In an advantageous embodiment of the method according to the invention, different input selection functions can be used to exploit different regions of the common secret, so that the derivation rule can exploit the shared secret optimally and over its entire length using different input selection functions.

[0039] That is, for every foreseeable purpose, the secret SEC TNi TNj The secret SEC TNi TNj Since the derived key is used, even if it is possible to obtain information about the underlying key-based KDF-Key, the secret SEC provided for this purpose can be used. TNi TNj Only one area of ​​the SEC will be destroyed. TNi TNj This allocation of to the divided regions can be realized particularly efficiently using the selection function described above in Variation 2.2, here as the input selection function SeqPosIn.

[0040] Furthermore, at any time, the secret SEC TNi TNj A participant-specific secret SEC in the sense that each bit of is used by roughly as many derivation rules as have ever been used for key derivation. TNi TNj The individual bits of those secret SEC TNi TNj It is considered meaningful that the input selection function SeqPosIn_j of the derivation rule DR_j is always selected so that it is used in an "evenly distributed" manner by the derivation rules DR_j that use the private key SEC. TNi TNj If the bit at position u of KDF-Key_j represents the number of derivation rules or selection functions that contribute to the formation of KDF-Key_j, then at any point in time, two arbitrary bit positions u,k (where 0≦u <k<L(SEC TNiTNj )), |#u-#k|≦1, where |.| represents the absolute distance between the two numbers.

[0041] Furthermore, the secret SEC is constructed such that the key bases KDF-Key_l of each derivation rule DR_l overlap pairwise in roughly the same number of positions. TNi TNj It is considered meaningful that the input selection function SeqPosIn_l of the derivation rule DR_l using the above is always selected. In other words, if DR_1,...,DR_n are individual derivation rules and SeqPosIn_1,...,SeqPosIn_n are input selection functions belonging to them, and for two selection functions SeqPosIn_l, SeqPosIn_k#∩(SeqPosIn_l,SeqPosIn_k), the number of bit positions selected by both SeqPosIn_l and SeqPosIn_k, it is desirable that |#∩(SeqPosIn_l1,SeqPosIn_k1)-#∩(SeqPosIn_l2,SeqPosIn_k2)|≦1 is always satisfied for any l1, k1, l2, k2 (where l1≠k1, l2≠k2).

[0042] The above two properties are always well achieved in the long run, i.e. for large n, with a probability that increases with n, if a random or pseudorandom number generator is used for the selection of the bit positions selected by the input selection function SeqPosIn_l, which randomly prescribes the bit positions described by SeqPosIn_l for each derivation rule DR_l.

[0043] The output selection function SeqPosOut selects the derived key DR(SEC TNi TNj ) explicitly. This also allows the user to select the output length KDF-Length and the adapted output selection function SeqPosOut to select the bit sequence bf * Confidentially DR (SEC TNi TNj) to the receiver. To achieve this, we select a prescribed bit string bf from the sufficiently long bit string bf that is the result of the derivation rule DR before the application of the output selection function SeqPosOut. * The derivation rules are therefore chosen so that, if desired, the derivation rules can also be used as an encryption method (secure, though not particularly efficient in terms of the space required in the message), even if traditional encryption methods are not used. This encryption method is inspired by the previously known book cipher, where a pre-agreed string of pages, words and symbols of a book is encoded as a "shared secret". Again, despite the two different secrets for different participants, the participants can still read the same prescribed bit sequence bf * This means that for each secret bf * The length description KDF-Length and bf * We only need an output selection function that is adapted to

[0044] Since the KDF is a secure one-way function, this encryption method is secure against passive eavesdropping. The uniqueness of the salt value ensures that for each use of the KDF where KDF-Length is sufficiently large, KDF(SeqPosIn(SEC TNi TNj ), KDF-Salt, KDF-Length) are generated, which allows the same secret DR (SEC TNi TNj ), a different selection function SeqPosOut will be used.

[0045] When defining the derivation rule DR, it is possible to completely omit one or both of the selection functions SeqPosIn and SeqPosOut. If the description of SeqPosIn is omitted, the shared secret SEC TNi TNj The whole is used as input to the key derivation function KDF. If the description of SeqPosOut is omitted, all the KDF length bits of the output of the key derivation function KDF are used as the result DR(SEC TNiTNj ) is used.

[0046] The above method is implemented by two participants TN i and T.N. j However, there are "known common" partners, e.g., participants TN, with whom they each share at least one common key. k or 2 participants TN with TA i and T.N. j To, T.N. k or TA can provide an arbitrary common key, which allows TN i and T.N. j can continue to communicate securely with each other without utilizing traditional encryption methods at any point.

[0047] This achieves the following advantages: - the method allows the secure transmission of any information of any size over a channel that is not secure with respect to confidentiality; The method does not require traditional encryption methods and is based exclusively on a secure key derivation function KDF, which is usually based exclusively on secure one-way functions (hash functions).

[0048] Instead of a prior key negotiation according to the above-mentioned method, according to an advantageous development of the method according to the invention, the key derivation rule DR can also be sent directly together with the message, the part of which is protected by the newly negotiated key. Before the message is read or analyzed, this key must first be generated by the other party according to the accompanying derivation rule. It should be noted here that the key derivation rule used when encrypting the message or parts of it, if necessary, must not be sent unencrypted.

[0049] Therefore, any key DR_ENCR(SEC) derived using the derivation rule DR_ENCR TNiTNj )teeth, TIFF2025507418000001.tif7145 may be used to encrypt any data dat of the same bit length. In this case, DR_ENCR(SEC TNi TNj ), a message containing data dat encrypted by TIFF2025507418000002.tif7138 In other words, here, the data dat and the derivation rule DR_ENCR may be transmitted in one message.

[0050] Since the derivation rules do not contain any secrets, there is no need to encrypt the messages containing the derivation rules, and therefore, unlike the method described in the above-mentioned patent document 1, a secure encryption method ENCR is generated by each participant TN i However, it is not necessary to implement it.

[0051] Participant TN i The secret is that the participant TN i If we assume that the derivation rule DR is known only to the trusted authority TA, strictly speaking, authentication of the message containing the derivation rule DR is not necessary either. This is because an attacker can send the derivation rule DR′ defined by the attacker to the participant TN. i , the derivation rule DR is not disclosed or destroyed by the possible derivation and subsequent use of a false key. i A key already agreed upon for a specific purpose between the TA and the SEC may be overwritten by a fake key "newly negotiated" by the attacker. However, the attacker cannot obtain the secret SEC that is used by the SEC. TNi TNj, and sends only a false derivation rule DR', thereby initiating the derivation and use of a new key, the attacker would not be able to subsequently read secure, e.g. encrypted, data using the false key. Nevertheless, for reasons of system robustness, authentication AUTH of messages containing the derivation rule DR for negotiating keys may be desirable.

[0052] If the communication channel used is not protected against manipulation of the transmitted data, for example, an additional authentication key of sufficient length DR_AUTH(SEC TNi TNj ) and send the derivation rule DR_AUTH for the authentication key TN i By TN j The second part of the message sent to the DR(SEC TNi TNj ) is used to authenticate using a symmetric method AUTH, e.g. HMAC, where AUTH uses the symmetric key symKey to compute an authentication stamp AUTH(symKey,dat) for the data dat. A message so protected against tampering can then look for example like this: (DR,DR_AUTH,AUTH(DR_AUTH(SEC TNi TNj ),DR)), or (DR,DR_AUTH,AUTH(DR_AUTH(SEC TNi TNj ),(DR,DR_AUTH)))

[0053] Another data dat is DR_AUTH(SEC TNi TNj ), these other data dat can be included together, for example as follows: (DR,DR_AUTH,dat,AUTH(DR_AUTH(SEC TNi TNj ),(DR,DR_AUTH,dat)))

[0054] According to a particularly preferred embodiment of the method according to the invention, the derived key DR(SEC TNi TNj ) itself can also be used to directly authenticate the derivation rule DR when sending it using symmetric AUTH. In this case, a message so protected against manipulation might look like this, for example: (DR,AUTH(DR(SECTNj),DR))

[0055] Another data dat is DR(SEC TNi TNj ), then the further data dat can be included together, for example as follows: (DR,dat,AUTH(DR(SEC TNi TNj ),(DR,dat)))

[0056] To prevent replay attacks and other attacks, other data can be authenticated in addition to the derivation rule DR, for example the destination partner, e.g. TN i or the TA's identifier and / or a timestamp to prove that the derivation rule DR is up-to-date. A challenge-response method can also be used, based on which the receiving side, e.g. the TA or TN i can check whether the generated key is "freshly generated".

Claims

1. 1. A method for securely negotiating a symmetric key between hardware security modules in vehicle control devices of at least two communication participants, comprising: wherein the hardware security modules of the two participants are initially populated with a common secret for each of the two participants, or are provided with the common secret indirectly via the hardware security module of another participant that shares a common secret with each of the hardware security modules of the two participants; the hardware security modules of the two participants are initially implemented with at least one common key derivation function for each of the two participants or are provided with the at least one common key derivation function indirectly via the hardware security module of the other participant; When a symmetric key is needed or when a symmetric key needs to be updated, one of the hardware security modules of the two participants notifies the other of the hardware security modules of the two participants of a derivation rule that includes at least a key derivation function to be used and at least one parameter for the key derivation function, and the other of the hardware security modules of the two participants derives the symmetric key based on the common secret and one of the key derivation functions in accordance with the derivation rule.

2. 2. The method of claim 1, wherein the key derivation function utilizes a key base, a salt, and an output length as parameters, wherein the key base is a secret known to two of the participants or a secret derivable from a secret known to two of the participants, the salt is a random or pseudorandom bit string of a predetermined length, and the output length is a natural number representing the length of the output of the key derivation function.

3. 3. The method of claim 2, wherein the derivation rules include the key derivation function to be used, the salt, the output length, and an input selection function for defining input bits and an output selection function for defining output bits, respectively.

4. 4. The method of claim 3, wherein the key base for the key derivation function is determined using the input selection function, which selects particular bits of the common secret, and the selected bits are either left in their existing order or their order is changed, and the result is used as the key base for the key derivation function.

5. 5. The method of claim 3, wherein the symmetric key is created by the derivation rule based on the output selection function by the output selection function selecting particular bits from the output of an output length of the key derivation function and arranging the bits in the selected order or a new order.

6. 5. A method according to claim 3 or 4, characterized in that the input selection function and / or the output selection function are described by a sequence of bit positions as permutation selection functions.

7. 5. A method according to claim 3 or 4, characterized in that the input selection function and / or the output selection function are described as order-preserving selection functions by a series of bit intervals and / or by bit intervals and associated number of bits.

8. 5. The method according to claim 3, wherein the input selection function and / or the output selection function are described by bit strings as order-preserving selection functions.

9. 5. The method of claim 3, wherein the derivation rules are transmitted without including at least one of the input selection functions and / or the output selection functions, and instead of transmitting at least one of the input selection functions and the output selection functions, a reference to a commonly known input selection function and / or output selection function is transmitted.

10. 5. A method according to claim 3 or 4, characterized in that different regions of the common secret are utilized by different said input selection functions.

11. 11. The method of claim 10, wherein the corresponding input selection functions are selected for a plurality of the derivation rules such that the selection of individual bit positions of the secret by the input selection functions is approximately evenly distributed, or such that the number of bit positions of the secret selected by two input selection functions is approximately evenly distributed for any two different input selection functions.

12. 11. The method of claim 10, wherein the bit positions of the secret selected by each of the input selection functions are defined by a random or pseudo-random number generator, and the bit positions are selected from the entire secret or from a predetermined range of the secret.

13. 3. The method according to claim 1, wherein the transmitted data is symmetrically authenticated by the symmetric key defined by the derivation rule that is transmitted with it.

14. 3. The method of claim 1, wherein the derivation rule is transmitted as an unencrypted part of a message encrypted with the symmetric key defined by the derivation rule transmitted therewith.

15. 14. The method of claim 13, wherein the accompanying derivation rule is part of data authenticated by the symmetric key defined by the accompanying derivation rule.

16. 3. Method according to claim 1 or 2, characterized in that a central trusted authority is used as one of the participants or as the further participant.