Verifiable Key Exchange Against Invalid Public Key DoS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing key exchange protocols, such as Diffie-Hellman and Elgamal encryption, are vulnerable to denial-of-service attacks where malicious clients can send incorrect public keys, leading to computational waste and potential security breaches.
Innovation Solution
Implement a verification mechanism during key exchange where each party checks the integrity of the other party's public key by generating and exchanging additional values based on random numbers and private keys, ensuring only valid public keys are accepted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key exchange protocols (Diffie-Hellman, Elgamal) are used, then key exchange can be performed, but the system is vulnerable to denial-of-service attacks where malicious clients send incorrect public keys causing computational waste and potential security breaches
Solution Approach 1:
The patent applies preliminary action by performing verification of the public key's validity before using it for key exchange. The verifier checks whether the received public key is properly generated (i.e., is a valid quadratic residue) before proceeding with the Diffie-Hellman protocol. This prevents malicious actors from sending invalid public keys that would cause computational waste or security breaches, thereby resolving the contradiction between enabling key exchange and preventing denial-of-service attacks.
2Reliability
If public key verification is added to key exchange protocols, then denial-of-service attacks are prevented, but the protocol complexity increases
Solution Approach 1:
The patent applies self-service by having the verifier perform self-verification of the public key's validity. The verifier checks whether the received public key is a valid quadratic residue using a simple modular arithmetic operation (computing whether the key is a square modulo p). This self-service verification mechanism is computationally inexpensive and does not require complex additional protocols or third-party involvement, thus protecting against denial-of-service attacks while minimizing the increase in protocol complexity.
3Reliability
If verification values C and D are exchanged during key exchange, then public key integrity is verified, but additional communication rounds are required
Solution Approach 1:
The patent applies skipping by performing the verification of public key integrity in parallel with other key exchange operations. The verifier computes verification values and checks public key validity during the same time period as the main key exchange protocol executes, rather than performing verification as a separate sequential step. This allows the verification process to be rushed through concurrently with the key exchange, minimizing the additional time required while still ensuring public key integrity.
Data Source
AI summary
Embodiments establish, at a first entity, a common secret key (“k”) for encrypted data communication during a key exchange between the first entity and a second entity. Embodiments select a first private key of the first entity and receive, from the second entity, a second public key (“A”) of the second entity. Embodiments receive from the second entity a first verification value (“C”). Embodiments generate a first random number (“e”) and send e to the second entity and receive from the second entity a second verification value (“D”) in response to the first random number, where D, when properly generated, is based at least on r, e and the second private key. Embodiments determine, based on C and D, whether A is properly generated and when A is not properly generated, end the key exchange.