Ephemeral Diffie-Hellman Keys for Wi-Fi Forward Secrecy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In Wi-Fi networking, the 4-way handshake mechanism lacks perfect forward secrecy, allowing an attacker to decrypt transmissions if the pair-wise master key is compromised, as derived keys remain valid for the key's lifetime.

Innovation Solution

Implementing perfect forward secrecy by generating ephemeral Diffie-Hellman keys, which are used to derive additional keys that are then deleted, ensuring that even if the pair-wise master key is exposed, past or future keys cannot be determined.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the 4-way handshake mechanism uses a pair-wise master key for authentication, then authentication between station and access point can be established, but if the master key is compromised, an attacker can decrypt all transmissions during the key's lifetime

Engineering Contradiction:

Improveauthentication reliabilityVSAvoidsecurity vulnerability to key compromise

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by generating ephemeral Diffie-Hellman key pairs before the 4-way handshake authentication process. These preliminary ephemeral keys are used to create session-specific encryption keys that are independent of the master key, so that even if the master key is later compromised, past session keys cannot be derived

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses disposable ephemeral Diffie-Hellman key pairs that are generated for each authentication session and then discarded. These short-lived ephemeral keys provide perfect forward secrecy because they are destroyed after use, preventing any future compromise of the master key from revealing past session keys

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

2Device complexity

If derived keys remain valid for the entire lifetime of the pair-wise master key, then key management is simplified, but security is weakened because compromise of the master key exposes all derived keys

Engineering Contradiction:

Improvekey management complexityVSAvoidsecurity reliability

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent segments the key hierarchy by introducing ephemeral session keys that are separate from the master key. Instead of having all derived keys depend on the master key's lifetime, the master key is segmented into multiple independent session keys, each with its own limited validity period tied to specific authentication events

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent makes the key validity dynamic by generating fresh ephemeral Diffie-Hellman keys for each authentication session. The derived session keys are dynamically created and invalidated after each session, rather than remaining static and valid for the entire master key lifetime, providing adaptive security

Inventive Principle:

Principle #15Dynamics

Data Source

PatentEP2756696B1Systems and methods for encoding exchanges with a set of shared ephemeral key data

Publication Date: 2017.01.11 QUALCOMM INC

AI summary

A method includes generating a shared master secret. The method also includes generating a set of shared ephemeral key data. The set of shared ephemeral key data is generated independent of the shared master secret. A validity duration of the set of shared ephemeral key data is less than a validity duration of the shared master secret. The method further includes encrypting at least one message that is to be transmitted to at least one station based on at least the shared master secret and the set of shared ephemeral key data.