Identical Device–Server Private Key Generation from Shared Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing asymmetric ciphers are computationally complex and vulnerable to brute force attacks, especially in a post-quantum computing world, and IoT devices lack sufficient entropy for secure key generation and distribution, making them susceptible to physical attacks and data breaches.
Innovation Solution
A system for secure communication between devices using a first and second party device that generates identical session-dependent private keys based on user-selected entropy stores, host factors, and unique PINs, ensuring secure key exchange without reliance on high computational power or initial secure channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric ciphers are used for secure communication setup, then key distribution security is improved, but computational complexity increases
Solution Approach 1:
The system segments the key generation process into two parts: a random component generated by the server and a deterministic component generated locally by the IoT device using entropy from user-selected images and PINs. This segmentation allows the device to perform simpler local computations while the server handles the random key material distribution, reducing overall computational complexity while maintaining security.
Solution Approach 2:
The IoT device generates its own deterministic portion of the cryptographic key using locally available entropy sources (user-selected images and PINs), rather than relying entirely on the server for key generation. This self-service approach reduces the computational burden on the server and enables devices with limited processing power to participate in secure communication.
2Ease of operation
If traditional key generation methods are used, then key distribution is simplified, but vulnerability to brute force attacks increases
Solution Approach 1:
The cryptographic key is constructed as a composite of two distinct components: a random component from the server and a deterministic component derived from user-selected images and PINs through entropy extraction. This composite structure maintains the simplicity of key distribution (the device can reproduce its component) while significantly increasing resistance to brute force attacks, as an attacker would need to compromise both the random component and the entropy-derived component.
3Reliability
If high computational power is required for key generation, then security strength is improved, but device resource requirements increase
Solution Approach 1:
The IoT device leverages its own resources (user-selected images and PINs) to generate the deterministic portion of the cryptographic key through entropy extraction and hashing. This self-service approach eliminates the need for high computational power during key generation, as the device simply processes pre-existing data through standard cryptographic hash functions, thereby reducing energy consumption and device resource requirements while maintaining security strength.
Data Source
AI summary
A secure communication system is disclosed for communication between first and second party devices. An input interface is provided for receiving from an external host a unique host factor in addition to a user input interface for receiving from a user a unique PIN for a user and a selection input for selecting one of the plurality of stored entropy stores as a user selected entropy store A first private key generator is operable for generating a private key using a key generation algorithm requiring the selected entropy store, the host factor and the unique user PIN. The second party device includes a second storage device for storing a plurality of entropy stores. An input interface is provided for receiving the same unique host factor as received by the first party device. A communication interface facilitates communication with the first party device to receive from the first party device a user PIN and an indication of the user selected entropy store. A second private key generator is operable for generating a private key using the predetermined key generation algorithm with the received user PIN, the received host factor, and an extracted entropy store corresponding to user selected entropy store, wherein the private key generated by both the first and second private key generators are identical. The session is initiated to cause the generation of the identical private keys at both of the first and second private key generators and allow secure communication between the first and second devices. The private key at least one of the first and second devices is deleted at the end of the session.