Post-Quantum Key Distribution via EAP and McEliece Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in distributing and managing post-quantum secure pre-shared keys, particularly due to difficulties in key deployment, compromise detection, and refreshment, especially with the emergence of quantum computers that can break existing public-key cryptography algorithms like RSA and elliptic curve cryptography.
Innovation Solution
The method employs the Extensible Authentication Protocol (EAP) to establish and distribute post-quantum pre-shared keys using McEliece public keys, enabling secure key exchange and refreshment without the need for out-of-band communication, and allows for central control of key refreshment through an authentication server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional public-key cryptography (RSA, ECC) is used for key distribution, then key exchange is simplified, but security is compromised by quantum computer attacks
Solution Approach 1:
The patent transitions from classical cryptographic parameters (RSA moduli, ECC key pairs) to post-quantum cryptographic parameters (McEliece public keys, binary Goppa codes). This parameter change enables quantum-resistant security while maintaining the public-key infrastructure paradigm, resolving the contradiction between security and complexity by adopting a different cryptographic family rather than attempting to strengthen existing systems.
2Reliability
If pre-shared secret keys are deployed for post-quantum security, then quantum resistance is achieved, but key management complexity increases
Solution Approach 1:
The patent introduces an authentication server as an intermediary that generates and distributes pre-shared keys to multiple parties. This mediator eliminates the need for direct key exchange between endpoint systems, simplifying deployment. The server acts as a trusted third party that handles the complexity of key generation and distribution, allowing endpoints to simply receive and use the provided keys.
Solution Approach 2:
The system enables automated key refreshment where the authentication server can remotely update pre-shared keys without requiring manual intervention at endpoint systems. This self-service capability allows keys to be rotated and refreshed automatically, reducing operational complexity despite the security requirements.
3Reliability
If pre-shared keys are used, then post-quantum security is achieved, but key refreshment and compromise detection become difficult
Solution Approach 1:
The authentication server serves as a centralized intermediary that manages the entire key lifecycle including generation, distribution, refreshment, and revocation. When a key needs to be refreshed or compromised keys need to be revoked, the server can push new keys to all relevant parties simultaneously, making key management operations simple despite the security-critical nature of these tasks.
Solution Approach 2:
The system implements monitoring and notification mechanisms where the authentication server can detect potential key compromises and initiate refreshment procedures. The server receives feedback from the network environment about security conditions and automatically responds by updating keys, creating a closed-loop system that maintains security while simplifying operations.
4Reliability
If QKD is used for key distribution, then information-theoretic security is achieved, but deployment complexity and distance limitations increase
Solution Approach 1:
Instead of deploying expensive, fragile QKD hardware infrastructure with strict distance limitations, the patent uses software-based post-quantum cryptographic algorithms that can be deployed over existing standard communication infrastructure. The McEliece cryptosystem provides sufficient security for the application while being much cheaper and more flexible to deploy than QKD systems, effectively replacing expensive long-lived infrastructure with more adaptable solutions.
Data Source
AI summary
Systems and methods are provided for quantum-resistant secure key distribution between a peer and an EAP authenticator by using an authentication server. The systems and methods include receiving requests for a COMMON-SEED and a quantum-safe public key from a peer and an EAP authenticator. The COMMON-SEED is encrypted using the quantum-safe public key of the peer and the quantum-safe public key of the EAP authenticator, and the encrypted COMMON-SEED is sent to the peer along with a request for a PPK_ID from the peer to complete authentication of the peer. The PPK_ID is received from the peer, and the encrypted COMMON-SEED and PPK_ID is sent to the EAP authenticator. A quantum-resistant secure channel is established between the peer and the EAP authenticator when the peer and the EAP authenticator share the same COMMON-SEED and the same PPK-ID.