Derived PSK Key Management for Quantum-Resistant Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The transition from legacy cryptographic algorithms to Post Quantum Cryptography (PQC) poses challenges due to cryptanalysis by Cryptographically Relevant Quantum Computers (CRQC), especially in asymmetric key management systems like RSA and Elliptic Curve Cryptography, which are complex, time-consuming, and costly.
Innovation Solution
Implementing a Derived Unique Key Per Transaction (DUKPT) scheme to derive Pre-Shared Keys (PSKs) using a Base Derivation Key (BDK) and Terminal Identifier (TID), ensuring quantum-resistant symmetric algorithms for protocols like TLS, EAP, IKE, and DTLS, without modifying existing IETF protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If legacy asymmetric key management algorithms (RSA, ECC) are used, then current cryptographic systems can operate, but they become vulnerable to quantum computer attacks and require complex migration to PQC
Solution Approach 1:
The patent changes the cryptographic parameter from asymmetric key algorithms to symmetric key algorithms specifically for PQC. By using symmetric encryption with derived keys, the system achieves quantum resistance while maintaining compatibility with existing infrastructure, thus resolving the contradiction between quantum resistance and implementation complexity
Solution Approach 2:
The patent segments the key management into separate components: a master key stored securely, derived keys generated per terminal, and session keys generated per transaction. This segmentation allows the system to maintain security against quantum attacks while simplifying the overall key management architecture through hierarchical key derivation
2Reliability
If multiple terminals are managed with unique keys, then security is improved, but key management becomes complex and time-consuming
Solution Approach 1:
The patent performs preliminary key derivation by pre-computing and storing master keys and terminal identifiers before actual transactions occur. When a terminal needs to communicate, the system quickly derives the appropriate session key from the pre-stored master key and terminal identifier, eliminating the need for time-consuming key generation and distribution during transactions
Solution Approach 2:
The patent creates a universal key derivation mechanism where a single master key can derive unique session keys for multiple different terminals. This universal approach allows one master key to serve multiple terminals securely, reducing the overall key management burden while maintaining individual terminal security
3Reliability
If PQC algorithms are implemented, then quantum resistance is achieved, but migration from legacy systems becomes complex and costly
Solution Approach 1:
The patent introduces symmetric key algorithms as an intermediary layer between legacy asymmetric systems and quantum-resistant requirements. By using symmetric encryption with derived keys, the system provides quantum resistance without requiring direct migration to complex PQC algorithms, thus easing the transition while maintaining security
Solution Approach 2:
The patent creates derived keys that are copies or transformations of the master key, tailored for specific terminals and transactions. These derived keys function as independent cryptographic entities that provide quantum resistance, allowing the system to adopt PQC principles without replacing the entire key management infrastructure
Data Source
AI summary
The arrangements disclosed herein relate to systems, apparatus, methods, and non-transitory computer readable media for receiving, by a client from a terminal, an External Pre-Shared Key (EPKS) package comprising a transaction key, wherein the transaction key is derived by the terminal using an Initial Key (IK) and a counter, sending, by the client to a server, a first message comprising the TID and the counter, receiving, by the client from the server, a second message in response to the first message, determining, by the client, a session key using the EPKS package, and communicating by the client with the server via a communication session using the session key.