Mobile-Mediated Key Exchange for Quantum-Resilient Browser Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rise of quantum computing has compromised the security of secure connections between end-users and remote hosts, as some computational assumptions underlying public key cryptographic handshakes have been proven false.
Innovation Solution
A method for mobile-mediated secure key exchange involves a webserver establishing a shared secret key with a client device, encoding an encrypted browser secret key in a machine-readable code, and using it to authenticate and establish end-to-end encryption without further authentication, leveraging classical key exchange and secure key material.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public key cryptographic handshake is used for secure connections, then security is provided under current computational assumptions, but security is compromised when quantum computing capabilities are available
Solution Approach 1:
The patent performs key exchange and authentication actions in advance before the actual secure communication is needed. The client application establishes authentication with the webserver and obtains authentication data beforehand, so that when quantum computing capabilities become available or are attempted, the security breach cannot compromise the already-established secure session. This preliminary authentication creates a security buffer that is resistant to future computational advances.
Solution Approach 2:
The patent divides the authentication and key exchange process into separate phases: initial authentication phase where the client application proves identity to the webserver, and subsequent secure communication phase where authenticated data is used. This segmentation allows the system to use different cryptographic assumptions for different phases, with the initial phase providing quantum-resistant authentication that secures the subsequent communication without requiring quantum-resistant cryptography throughout the entire communication process.
2Reliability
If additional authentication steps are implemented to enhance security, then resistance to attacks improves, but user convenience and operation simplicity deteriorate
Solution Approach 1:
The patent combines the authentication and key exchange operations into a single integrated process. The client application authenticates with the webserver and simultaneously establishes the secure communication channel, obtaining authentication data that serves both purposes. This merging eliminates the need for separate authentication steps that would otherwise be required, providing enhanced security without adding user burden.
Solution Approach 2:
The system performs authentication and key establishment automatically without requiring user intervention beyond the initial connection. The client application and webserver handle the cryptographic handshake, authentication verification, and secure channel establishment autonomously, so users benefit from enhanced security without having to understand or participate in the additional authentication steps.
Data Source
AI summary
A method may include: receiving, by a webserver computer program, shared key material shared with a client application; receiving from a browser, a request for a secure connection; establishing a session with the browser over a first secure connection; establishing a shared secret key with the browser, wherein the browser creates a browser secret key encrypted with the shared secret key, encrypts the browser secret key with the shared secret key, and provides the browser secret key encrypted with the shared secret key and session information the client application over a second secure connection that is protected with the shared key material; decrypting the browser secret key encrypted with the shared secret key using the shared secret key; identifying the session with the browser from the session information; and establishing, end-to-end encryption on top of the second secure connection using the browser secret key or a derivation thereof.