Method for securely negotiating a symmetric key between two communicating participants - Patent Application 20070122967

Abstract

The invention relates to a method for securely negotiating a symmetric key between at least two participants of a communication, in which the participants are either given a common secret for each of them or can be given a common secret indirectly via another participant who shares the common secret with each of them, characterized in that the participants are either given at least one common key derivation function for each of them or can be given at least one common key derivation function indirectly via another participant, in which when a symmetric key is needed or when an update of the symmetric key is needed, the symmetric key is derived on the basis of the common secret and one of the key derivation functions according to a derivation rule, the derivation rule comprising at least the key derivation function to be used and at least one parameter for the key derivation function and communicated to one of the participants by the other of the participants.

Description

[Technical Field]

[0001] The present invention relates to a method for securely negotiating a symmetric key between two communication participants, as more precisely defined in the preamble of claim 1. [Background technology]

[0002] A defining feature of modern vehicles is their increasing connectivity. Connected vehicles are not only connected to systems like the World Wide Web, but also to systems and servers operated by the vehicle manufacturer or OEM, such as manufacturer-specific servers and applications, often referred to as the vehicle backend. These are developed, marketed, and operated by the manufacturer specifically for their own vehicles. Collectively, these systems are referred to as the vehicle ecosystem.

[0003] In fact, the variety of communication relationships between the individual system components in such a vehicle ecosystem gives rise to a large number of new interfaces and applications, all of which must be protected by appropriate cryptographic methods, e.g. mechanisms, protocols, etc. This protection serves, on the one hand, to protect the privacy of the vehicle user and, on the other hand, to prevent external interference with the data traffic, in particular when transmitting data related to vehicle control, which could be used by hackers to attack the vehicle and manipulate important functions.

[0004] Common practice is to use asymmetric keys or methods based on asymmetric cryptography, typically in the form of so-called Transport Layer Security (TLS) and sometimes Internet Protocol Security (IPSec), which themselves make use of traditional asymmetric methods such as RSA or Elliptic Curve Cryptography (ECC), which are based on prime factorization.

[0005] Commonly used asymmetric cryptography methods, such as ECC or RSA, have the advantage of providing relatively secure protection according to today's standards with minimal effort. However, these methods are based on cryptographic algorithms, and their security is not considered robust against quantum computers. A quantum computer, using its computational methods, could break asymmetric cryptography and decrypt the protected data in a very short time. In this case, the cryptographic protection methods commonly used today for communication between the vehicle and the backend, especially for encryption and / or authentication, would no longer be secure. Until now, this so-called post-quantum threat was rather theoretical, since quantum computers were still considered purely research instruments and could only be realized with enormous effort. However, progress in quantum computers has accelerated significantly in recent years. Therefore, confident predictions that sufficiently powerful quantum computers will not be commercially available within the next decade are no longer warranted from today's perspective.

[0006] Vehicles on the market today typically remain on the road for 10 to 15 years. This means that the post-quantum threat—the potential for conventional asymmetric cryptography to be easily broken by readily available, or especially commercially available, quantum computers—is already relevant for vehicles delivered today. Communications between the vehicle's communications device and external servers, currently protected by cryptographic protocols based on RSA or ECC, are no longer secure due to the emergence of this post-quantum threat. Therefore, secure communications cannot be guaranteed over the vehicle's expected lifetime. The impact of this threat is particularly severe for systems that cannot be easily updated or renewed. An example of such a system is the electronic control unit (ECU) embedded in a car. This threat is even more obvious for servers, smartphones, and other devices. Their hardware, too, is typically expected to expand much faster than that of the vehicle and have a shorter expected lifetime.

[0007] To address post-quantum threats, researchers have been researching asymmetric algorithms resistant to post-quantum threats for several years. This approach is commonly referred to as post-quantum cryptography or PQC. However, these approaches are not yet mature enough to replace conventional asymmetric methods. Therefore, current vehicles cannot be designed to use post-quantum cryptographic protection methods because such technologies are not yet mature enough to provide a definitive assessment of their expected security. Furthermore, there is currently no standardization, and these approaches require significant resources. This means that a rapid switch to such quantum-safe cryptographic methods is neither meaningful nor easy at this time. Even if a standardized PQC method that is considered sufficiently secure already existed, it would not be meaningful to implement such a method in current vehicle communication devices because its higher cost burden and resource consumption would hinder economic efficiency in the current vehicle ecosystem.

[0008] Furthermore, symmetric methods such as the Advanced Encryption Standard (AES), hashing methods such as the Secure Hash Algorithm (SHA-512), and symmetric authentication methods such as the Hashed Message Authentication Code (HMAC) are essentially immune to post-quantum threats, based on current knowledge. While their security would certainly be halved by the advent of post-quantum threats, a 128-bit key would still provide 64-bit security, even with the availability of quantum computers. However, such weaknesses can be relatively easily compensated for by increasing the key length.

[0009] Compared to asymmetric methods, such symmetric methods have a major problem in that handling key distribution and negotiation in symmetric cryptography is difficult, especially since their number is potentially very large. This particularly concerns the provisioning of the initial symmetric keys to the components involved. Furthermore, this particularly concerns the demand-driven negotiation of a common symmetric key or session key between two or more communication partners who do not have a common symmetric key, i.e., do not "know" or "not yet know" each other. Furthermore, for each component where a communication relationship already exists and a common symmetric key has already been agreed upon, this must be persisted accordingly. Due to the typically large number of communication relationships that arise, the management of symmetric keys in the components is extremely cumbersome.

[0010] For this reason, for example, TLS uses certificate-based asymmetric cryptography to negotiate symmetric keys between communication partners. When symmetric keys are negotiated via such methods, TLS also uses exclusively symmetric authentication and encryption. As explained above, negotiation via asymmetric cryptography is not itself post-quantum safe.

[0011] Patent document 1 describes a method for the distribution and negotiation of key material within a vehicle ecosystem, in which a central trust authority is established, which initially grants individual secrets to the participants involved, using which the participants can communicate in a protected manner with the trust authority, and which, if necessary, can collect in a protected manner shared keys for a group of participants. A drawback of this method is that all negotiated and shared secrets must be generated by the trusted authority and then transmitted to the individual participants, and therefore each participant, together with the trusted authority, must implement both authentication and encryption methods for securely transmitting those secrets. However, it may not be feasible for participants with limited resources to implement and meaningfully utilize both secure authentication and secure encryption methods. This is particularly the case for control devices in vehicles, which often have limited resources in terms of computing power and memory capacity at their disposal. [Prior art documents] [Patent documents]

[0012] [Patent Document 1] DE102020003739A1 Summary of the Invention [Problem to be solved by the invention]

[0013] It is an object of the present invention to provide an improved method for distribution and negotiation of keying material, especially within a vehicle ecosystem. [Means for solving the problem]

[0014] According to the invention, this problem is solved by a method having the features of claim 1. Further advantageous configurations and developments of the method are described in the dependent claims which are dependent on claim 1.

[0015] The method according to the invention is essentially based on the above-mentioned patent application WO 02 / 04799 and in particular involves the step of connecting all pairs of participants TN of a communication system which may be part of a vehicle ecosystem. i , T.N. j is a shared, and therefore common, secret SEC that has sufficient length and entropy. TNi TNj Here, the common secret SEC TNiTNj The first secret shared by SEC TNi TNj However, this can be used as i A very large number of SECs can quickly become very resource intensive, so instead, a common secret SEC TNi TNj , two participants TN i , T.N. j Between them, there is another participant TN that is known to both parties and that both parties trust, or with which both parties have already communicated before. k According to a very advantageous development of the method, this other participant may be a trusted institution or trust authority TA according to the patent document 1. The communication can be carried out by one participant TN i and the trusted authority TA, where the first shared secret SEC TNi TA will be necessary.

[0016] In the method according to the invention, unlike the prior art of the type of US Pat. No. 5,649,549, the TN i and TN j For the protection of communications between those participants TN i , T.N. j All secrets used by the SEC, e.g., symmetric keys, are shared with this common secret SEC as needed. TNi TNj Therefore, this shared secret SEC TNi TNj is the number of participants TN i , T.N. j It plays a central, if not the only, "secret entropy source" for securing communications between the public and private networks.

[0017] For this purpose, each participant TN i The other participants in the communication TN j known to other participants TN kImplement at least one secure key derivation function (KDF) known to the trusted authority (TA) if applicable. This key derivation function (KDF) may in particular be based solely on secure one-way functions such as hash functions. This key derivation function (KDF) may also be implemented initially or provided or shared via another participant, like a shared secret.

[0018] 2 participants TN i and TN j Between or TN i When a new key is needed to protect communications between a TN and a TA, whether for a new purpose, e.g., for a first communication, or to update an expired key for a known purpose, one of the participants, TN, i The other participant TN j or from the Trusted Authority TA (or vice versa, from the other Participant TN j Or the trusted institution TA has one participant TN i From the key derivation function, a derivation rule DR is communicated, which contains at least information on which of the key derivation functions, if any, should be used, and also passes at least one parameter of the key derivation function itself.

[0019] Based on this, we can easily and efficiently convert symmetric keys for cryptographic protection into shared secrets. TNi TNj , which can be derived from the derivation rule DR. This symmetric key can then be used for authentication and / or encryption. If a secret is initially shared, this key negotiation is carried out using a message that is sent only once. According to a very advantageous development of the method according to the invention, which will be explained in more detail below, this can include the contents of the message (but not the derivation rule DR) in encrypted form. However, the entire message can be authenticated.

[0020] The advantages of the method according to the invention are in particular that: -Easily and efficiently negotiate symmetric keys, and therefore post-quantum safe keys according to today's knowledge; The method can be used particularly advantageously in vehicle control devices already today, since more and more vehicle control devices are , Ha Hardware Security It has a hardware module (HSM) Security This is because the shared secret can be securely stored on the module and the secure initial installation of individual secrets into the control devices by the control device manufacturer is already common practice today.

[0021] According to a highly preferred configuration of the method according to the invention, the key derivation function KDF may utilize as parameters a key base KDF-Key, a salt KDF-Salt and an output length KDF-Length, where the key base KDF-Key is a secret that is directly introduced into the key derivation function KDF to derive the key, the salt KDF-Salt is a random or pseudo-random bit string of a predetermined length, and the output length KDF-Length is a natural number representing the length of the symmetric key to be created.

[0022] Through derivation rules, common secrets SEC TNi TNj The appropriate participant TN determines which bits of the KDF-Key are used to form the key-based KDF-Key and in what order those bits should be arranged for the key-based KDF-Key. i (or TN j The key-based KDF-Key thus obtained is then used to generate a new key using the KDF. i (or TN j ) is told what salt should be used for key generation and what length KDF-Length the output of the key derivation function KDF should have.

[0023] In an advantageous development of the method according to the invention, the derivation rule DR comprises the key derivation function KDF to be used, the salt KDF-Salt, the output length KDF-Length and also one input selection function SeqPosIn and / or one output selection function SeqPosOut respectively. The input selection function SeqPosIn is used to determine the key base KDF-Key from the secret SEC by "bit selection". Since the key base is secret and the derivation rule DR is transmitted unencrypted, the key base KDF-Key itself is not part of the derivation rule DR.

[0024] Therefore, one participant TN i The other participant TN j , or the trusted authority TA, if it is a second participant, can communicate a derivation rule DR for the new key, taking into account the aforementioned parameters and one or both of the selection functions SeqPosIn, SeqPosOut. This derivation rule may contain at least the following information: The key derivation function KDF to be used, which depends on the parameters KDF-Key, KDF-Salt and KDF-Length; -Secret SEC TNi TNj SEC by indicating an input selection function SeqPosIn that defines which bits of should form the KDF-Key and in what order. TNi TNj Define the bit string KDF-Key depending on -bit string KDF-Salt; -Natural number KDF-Length; - Which bits of the output of the key derivation function KDF, in what order, are used to generate the newly derived key DR(SEC TNi TNj ) should be formed. TNi TNj ) bit string definition

[0025] Thus, a derivation rule DR is uniquely described by a tuple of the form: DR=(KDF,SeqPosIn,KDF-Salt,KDF-Length,SeqPosOut).

[0026] The derivation rule DR and the shared secret SEC defined in this way TNi TNj The key uniquely defined by DR(SEC TNi TNj ) and DR(SEC TNi TNj ):=SeqPosOut(KDF(SeqPosIn(SEC TNi TNj ),KDF-Salt,KDF-Length)) is defined by

[0027] Here, the input selection function SeqPosIn is a function of length L(SEC TNi TNj ) and rearranges the selected bits as needed (in this specification, L(bf) represents the bit length of the bit string bf). Similarly, the output selection function SeqPosOut is a function that selects specific bits from a bit string of length KDF-Length and rearranges the selected bits as needed.

[0028] Here, the selection function can either permute the bits selected from the input bit string or maintain their original relative order with respect to each other. The first permute variation of the selection function provides more flexibility in the definition of the selection function, allowing more selection functions to be defined, but the description of the selection function that perms the bits thereby contains more information and requires more space in the derivation rule DR. The second variation, which omits the permute of the selected bits, is less flexible and powerful, but requires less space in the derivation rule DR. Shared Secret SEC TNi TNj Since the length of SEC is fixed, TNiTNj Assuming that each bit from is selected at most once by the input selection function SeqPosIn, the secret SEC TNi TNj Since the number of KDF-Keys that can be selected from is limited, in some cases, all possible KDF-Keys of a given length can be found using SeqPosIn. TNi TNj Therefore, it is considered to be meaningful to realize the permutation of the selected bits by SeqPosIn, especially in the case of SeqPosIn. Since SeqPosOut selects bits from the output of the key derivation function KDF, and the length of this output is determined by the freely selectable parameter KDF-Length, for each key derivation function KDF and each desired output chosenKey, the DR parameter KDF-Length is selected so that chosenKey can be defined by the order-preserving selection function SeqPosOut, so chosenKey=DR(SEC TNi TNj )

[0029] Here, the selection function can be defined in various ways, and several possible variations are described below.

[0030] Variation 1 It is proposed that the reordering selection function be described by a sequence of bit positions (pos_0,...,pos_(n-1)), where n is the length of the output of the selection function and each position pos_j is smaller than the length of the input and pairwise distinct from each other, e.g., for an input bit sequence of 00001111 and n=4, the selection function (0,5,2,7) defines or encodes the output bit sequence 0101.

[0031] Variation 2.1 It is proposed to describe an order-preserving selection function by a sequence of distances (dist_0,...,dist_(n-1)), where n is the length of the output of the selection function, dist_0 ≥ 0, and the remaining distances, i.e., 0 <j<nについては、dist_j> 0, and the sum of all distances is less than the length of the input. For example, if the input bit string is 00001111 and n=4, then the choice function (0,3,2,2) defines or encodes the output bit string 0011. Note that for the same input bit string, the bit string 0101 cannot be defined by an order-preserving choice function.

[0032] Variation 2.2 As an extension of this, we propose to describe the order-preserving selection function by a set of intervals, where an interval is described by a single distance dist_j or by a distance pair (dist_j, dist_k). A single distance represents an interval consisting of one bit position, while a distance pair (dist_j, dist_k)(dist_k+1) represents the associated bit position. In this case, dist_0 ≥ 0 and the remaining distances, i.e., 0 <j<nについては、dist_j> 0, and the sum of all distances is less than the length of the input, so for example, if the input bit string is 00001111, the output bit string 00111 is defined or encoded by the selection function (0,(3,2),2).

[0033] Variation 3 Furthermore, we propose to describe the order-preserving selection function by a bit string (bit_0,...,bit_(le-1)), where le does not exceed the length of the input of the selection function. That is, for SeqPosIn, le ≤ L(SEC TNi TNj), and for SeqPosOut, le≦KDF-Length, where bit_j=1 (for 0≦j≦le−1) indicates that the bit at position bit_j of the input of the selection function belongs to its output, and bit_j=0 indicates that the bit at position bit_j of the input of the selection function does not belong to its output.

[0034] The above variations may be combined with each other and may be combined with the SEC defined using variation 2.2. TNi TNj Individual bits from the relevant regions may be selected and combined using Variation 1 or Variation 3, with the selected bits being permuted as necessary in the case of Variation 1.

[0035] Each variation in the definition of the selection function has its own advantages and disadvantages. In particular, it may be beneficial to use different definitions for SeqPosIn and SeqPosOut.

[0036] In a highly preferred configuration of the method, the derivation rules DR can further be transmitted without the input selection function SeqPosIn and / or the output selection function SeqPosOut, in which case instead of transmitting at least one of the selection functions SeqPosIn, SeqPosOut, a reference to a commonly known input selection function SeqPosIn and / or output selection function SeqPosOut is transmitted.

[0037] That is, the selection functions SeqPosIn, SeqPosOut do not always need to be fully described as part of the derivation rule DR; rather, the derivation rule DR may, instead of a full description, express a unique name of the selection function to be used together with the values ​​of parameters possibly required by this selection function, thereby allowing both communication participants TN i , T.N. j may contain references to known selection functions SeqPosIn, SeqPosOut.

[0038] In an advantageous embodiment of the method according to the invention, different input selection functions can be used to exploit different regions of the common secret, so that the derivation rules can use different input selection functions to optimally exploit the shared secret over its entire length.

[0039] That is, for each foreseeable purpose, the secret SEC TNi TNj The secret SEC TNi TNj Therefore, even if it is possible to obtain information about the underlying key-based KDF-Key when the derived key is used, the secret SEC provided for this purpose can be used. TNi TNj Only one area of ​​the SEC will be destroyed. TNi TNj This distribution of SeqPosIn into the divided regions can be realized particularly efficiently using the selection function described above in Variation 2.2, here as the input selection function SeqPosIn.

[0040] Furthermore, at any point in time, the secret SEC TNi TNj A participant-specific secret SEC in the sense that each bit of is used by roughly as many derivation rules as have been used for key derivation so far. TNi TNj Individual bits of those secret SEC TNi TNj It is considered meaningful that the input selection function SeqPosIn_j of a derivation rule DR_j is always selected so that it is used "evenly distributed" by the derivation rules DR_j that use the private key SEC. TNi TNj If the bit at position u represents the number of derivation rules or selection functions that contribute to the formation of KDF-Key_j, then at any point in time, two arbitrary bit positions u, k (where 0≦u <k<L(SEC TNiTNj )), |#u-#k|≦1, where |.| represents the absolute distance between the two numbers.

[0041] Furthermore, the secret SEC is constructed so that the key-based KDF-Key_l of each derivation rule DR_l overlaps pairwise in roughly the same number of positions. TNi TNj It is considered meaningful that the input selection function SeqPosIn_l of the derivation rule DR_l that uses the above formula is always selected. That is, if DR_1,...,DR_n are individual derivation rules, and SeqPosIn_1,...,SeqPosIn_n are input selection functions belonging to them, and for two selection functions SeqPosIn_l, SeqPosIn_k#∩(SeqPosIn_l,SeqPosIn_k), the number of bit positions selected by both SeqPosIn_l and SeqPosIn_k is represented, it is desirable that |#∩(SeqPosIn_l1,SeqPosIn_k1)-#∩(SeqPosIn_l2,SeqPosIn_k2)|≦1 for any l1, k1, l2, k2 (where l1≠k1, l2≠k2).

[0042] The above two properties are always well achieved in the long run, i.e. for large n, with a probability that increases with n, if a random or pseudo-random number generator is used for the selection of the bit positions selected by the input selection function SeqPosIn_l, which randomly defines the bit positions described by SeqPosIn_l for each derivation rule DR_l.

[0043] The output selection function SeqPosOut selects the derived key DR(SEC TNi TNj ) can be explicitly constructed or formed. This also means that by appropriately choosing the output length KDF-Length and the adapted output selection function SeqPosOut, it is possible to construct or form the value of each arbitrary predefined bit sequence bf * Confidentially DR (SEC TNi TNj) to the receiver. For this purpose, the specified bit string bf is selected from the sufficiently long bit string bf that is the result of the derivation rule DR before the application of the output selection function SeqPosOut. * The bits that give rise to the derivation rule are chosen precisely to give the same result. The derivation rule can therefore also be used as an encryption method (secure, but not particularly efficient in terms of the space required in the message) if desired, even if traditional encryption methods are not used. This encryption method is inspired by the previously known book cipher, in which a pre-agreed string of pages, words, and symbols from a book is encoded as a "shared secret." Again, despite the two different secrets held by different participants, the participants can still share the same prescribed bit string bf * This means that each secret bf * The length description KDF-Length and bf * only requires an output selection function adapted to

[0044] Since the KDF is a secure one-way function, this encryption method is secure against passive eavesdropping. The uniqueness of the salt value ensures that for each use of the KDF where KDF-Length is sufficiently large, KDF(SeqPosIn(SEC TNi TNj ), KDF-Salt, KDF-Length) are generated, which allows the same secret DR (SEC TNi TNj ), a different selection function SeqPosOut will be used.

[0045] When defining a derivation rule DR, it is possible to completely omit one or both of the selection functions SeqPosIn and SeqPosOut. If the description of SeqPosIn is omitted, the shared secret SEC TNi TNj The whole is used as input to the key derivation function KDF. If the description of SeqPosOut is omitted, all the KDF length bits of the output of the key derivation function KDF are used as the result DR(SEC TNiTNj ) is used as

[0046] The above method is implemented by two participants TN who do not know each other, i.e., do not have a shared key. i and TN j However, there are "known common" partners, e.g., participants TN, who share at least one common key with each other. k or two participants TN with TA i and TN j To, TN k Or it can be used to have the TA provide any common key, which allows the TN i and TN j can continue to communicate securely with each other without utilizing traditional encryption methods at any point.

[0047] This achieves the following advantages: - the method allows the secure transmission of any information of any size over a channel that is not secure with respect to confidentiality; The method does not require traditional encryption methods and is based exclusively on a secure key derivation function KDF, which is usually based exclusively on secure one-way functions (hash functions).

[0048] Instead of a prior key negotiation according to the method described above, in an advantageous development of the method according to the invention, a key derivation rule DR can also be sent directly together with the message, the part of which is protected by the newly negotiated key. Before the message can be read or analyzed, this key must first be generated by the other party according to the accompanying derivation rule. It should be noted here that the key derivation rule used when encrypting a message or parts of it, if necessary, must not be sent unencrypted.

[0049] Therefore, any key DR_ENCR(SEC) derived using the derivation rule DR_ENCR TNiTNj )teeth, TIFF0007815462000001.tif7145 may be used to encrypt any data dat of the same bit length. In this case, DR_ENCR(SEC TNi TNj ), a message containing data dat encrypted by TIFF0007815462000002.tif7138 In other words, here, the data dat and the derivation rule DR_ENCR may be transmitted in one message.

[0050] Since the derivation rules do not contain any secrets, there is no need to encrypt the messages containing the derivation rules. Therefore, unlike the method described in the above-mentioned patent document 1, the secure encryption method ENCR is encrypted by each participant TN. i However, it is not necessary to implement it.

[0051] Participant TN i The secret is that participants TN i If we assume that the derivation rule DR is known only to the trusted authority TA, strictly speaking, authentication of the message containing the derivation rule DR is not necessary either. This is because an attacker can send the derivation rule DR' defined by the attacker to the participant TN. i Even if the derivation rule DR could be transmitted to the participant TN, the derivation and subsequent use of the false key would not reveal or destroy the derivation rule DR. i A key already agreed upon for a specific purpose between the TA and the SEC may be overwritten by an attacker with a "newly negotiated" false key. However, an attacker may not be able to use the shared secret SEC. TNi TNj, and sends only a false derivation rule DR', thereby initiating the derivation and use of a new key, the attacker would not be able to subsequently use the false key to read secure, e.g., encrypted, data. Nevertheless, for reasons of system robustness, authentication AUTH of messages containing the derivation rule DR for negotiating keys may be desirable.

[0052] If the communication channel used is not protected against manipulation of the transmitted data, e.g., an additional authentication key of sufficient length, DR_AUTH(SEC TNi TNj ) can be created and sent, and this authentication key is i By TN j The second part of the message sent to DR(SEC TNi TNj ) is used to authenticate using a symmetric method AUTH, e.g., HMAC, where AUTH uses the symmetric key symKey to calculate an authentication stamp AUTH(symKey, dat) for the data dat. In this case, a message so protected against manipulation may look, for example, like this: (DR,DR_AUTH,AUTH(DR_AUTH(SEC TNi TNj ),DR)), or (DR,DR_AUTH,AUTH(DR_AUTH(SEC TNi TNj ),(DR,DR_AUTH)))

[0053] Another data dat is DR_AUTH(SEC TNi TNj ), these other data dat can be included together, for example: (DR,DR_AUTH,dat,AUTH(DR_AUTH(SEC TNi TNj ),(DR,DR_AUTH,dat)))

[0054] According to a particularly preferred configuration of the method according to the invention, the derived key DR(SEC TNi TNj ) itself can also be used to directly authenticate the derivation rule DR when sending it using symmetric AUTH. In this case, a message so protected against manipulation might look like this: (DR,AUTH(DR(SECTNiTNj),DR))

[0055] Another data dat is DR(SEC TNi TNj ), then the other data dat can be included together, for example: (DR,dat,AUTH(DR(SEC TNi TNj ),(DR,dat)))

[0056] To prevent replay and other attacks, other data can be authenticated in addition to the derivation rule DR, for example the destination partner, e.g., TN i Alternatively, the TA's identifier and / or the timestamp can be authenticated to prove that the derivation rule DR is up-to-date. A challenge-response method can also be used, based on which the receiving party, e.g., the TA or the TN, can verify the identity of the TA and / or the timestamp to prove that the derivation rule DR is up-to-date. i can check whether the generated key is "freshly generated".

Claims

1. 1. A method for securely negotiating a symmetric key between hardware security modules in vehicle control devices of at least two communication participants, comprising: wherein the hardware security modules of the two participants are initially populated with a common secret for each of the two participants, or are provided with the common secret indirectly via the hardware security module of another participant that shares a common secret with each of the hardware security modules of the two participants; the hardware security modules of the two participants are initially implemented with at least one common key derivation function for each of the two participants or are provided with the at least one common key derivation function indirectly via the hardware security module of the other participant; When a symmetric key is needed or when a symmetric key needs to be updated, one of the hardware security modules of the two participants notifies the other of the hardware security modules of the two participants of a derivation rule that includes at least a key derivation function to be used and at least one parameter for the key derivation function, and the other of the hardware security modules of the two participants derives the symmetric key based on the common secret and one of the key derivation functions in accordance with the derivation rule.

2. 2. The method of claim 1, wherein the key derivation function utilizes a key base, a salt, and an output length as parameters, wherein the key base is a secret known to two of the participants or a secret derivable from a secret known to two of the participants, the salt is a random or pseudorandom bit string of a predetermined length, and the output length is a natural number representing the length of the output of the key derivation function.

3. 3. The method of claim 2, wherein the derivation rules include the key derivation function to be used, the salt, the output length, and an input selection function for defining input bits and an output selection function for defining output bits, respectively.

4. 4. The method of claim 3, wherein the key base for the key derivation function is determined using the input selection function, which selects particular bits of the common secret, and the selected bits are either left in their existing order or their order is changed, and the result is used as the key base for the key derivation function.

5. 5. The method of claim 3, wherein the symmetric key is created by the derivation rule based on the output selection function by the output selection function selecting particular bits from the output of an output length of the key derivation function and arranging the bits in the selected order or a new order.

6. 5. A method according to claim 3 or 4, characterized in that the input selection function and / or the output selection function are described by a sequence of bit positions as permutation selection functions.

7. 5. A method according to claim 3 or 4, characterized in that the input selection function and / or the output selection function are described as order-preserving selection functions by a series of bit intervals and / or by bit intervals and associated number of bits.

8. 5. The method according to claim 3, wherein the input selection function and / or the output selection function are described by bit strings as order-preserving selection functions.

9. 5. The method of claim 3, wherein the derivation rules are transmitted without including at least one of the input selection functions and / or the output selection functions, and instead of transmitting at least one of the input selection functions and the output selection functions, a reference to a commonly known input selection function and / or output selection function is transmitted.

10. 5. A method according to claim 3 or 4, characterized in that different regions of the common secret are utilized by different said input selection functions.

11. 11. The method of claim 10, wherein the corresponding input selection functions are selected for a plurality of the derivation rules such that the selection of individual bit positions of the secret by the input selection functions is approximately evenly distributed, or such that the number of bit positions of the secret selected by two input selection functions is approximately evenly distributed for any two different input selection functions.

12. 11. The method of claim 10, wherein the bit positions of the secret selected by each of the input selection functions are defined by a random or pseudo-random number generator, and the bit positions are selected from the entire secret or from a predetermined range of the secret.

13. 3. The method according to claim 1, wherein the transmitted data is symmetrically authenticated by the symmetric key defined by the derivation rule that is transmitted with it.

14. 3. The method of claim 1, wherein the derivation rule is transmitted as an unencrypted part of a message encrypted with the symmetric key defined by the derivation rule transmitted therewith.

15. 14. The method of claim 13, wherein the accompanying derivation rule is part of data authenticated by the symmetric key defined by the accompanying derivation rule.

16. 3. Method according to claim 1 or 2, characterized in that a central trusted authority is used as one of the participants or as the further participant.

Images