What both parties have:
Master Secret (MS)
Server supported versions (Svers)
Agreed upon version (ver)
Master Secret (MS)
Client supported versions (Cvers)
Agreed upon version (Ver)
What I am planning on doing:
Cvers to Server.
Server checks what version to use (the highest version the 2 share will be selected)
Rand = Generate crypto random number SessionID = SHA256(MS, ver, Rand) "<- though the hash will most likely be dependable on the selected version" SessionKey = KDF(MS, SessionID) EncryptionKey = KDF(SessionKey, Rand) IV/nonce = Generate crypto random number
Server sends message to client: SessionID, Ver, Rand, IV/nonce
Client checks if the returned version he got from the server is actually a version he has (just to be sure). Then the client computes:
SessionKey = KDF(MS, SessionID) EncryptionKey = KDF(SessionKey, Rand)
If we were to need an extra key (for HMAC) we would simply send over an other random number.
Then finally the client would create a random message and encrypt this message in the propper way according to the selected version. It would send this random message and the ciphertext to the server, the server will either decrypt it or do the same as the client and compare the results. If the results match it will send an OK message back to the client and the communication can commence.
I have a few questions regarding this:
- Obviously, is this secure?
- Do i need the session key or can i derive the encryption key directly from the MS? (provided the Rand is different each time)
- Is the generation of the SessionID ok this way or should a simple random number suffice?
- Should the client create a random message and send this over in plain text or should both the server and the client have a message which is 'hard coded' and always use that (it will be the same every session).
I hope it is ok to ask these kind of questions here.
Lets start of by saying, yes i know making an own protocol is bad mkay. I have discussed this (at length) with my supervisors but (they made a 'fair' point) there is no TLS implementation small enough that can fit on our devices (not much remaining code space). So here I am implementing (it hurts saying this) my own small TLS-ish protocol.
Also, the versions do not correspond to TLS, version 1 might be AES-CBC version 2 might be AES-GCM version 3 might met TDES-CBC (etc.)