Let me try to reformulate the problem, as it might help a bit. The requirements are the following:
- At the beginning of their connection, the two end-points perform a Diffie-Hellman to derive with a common key $K$.
- Then EP1 needs to generate a random 48-bit value $R$ and send it to EP2. This random value needs to have the following two properties: (a) an attacker is not able to guess the next random values that EP1 generates and (b) EP2 is able to verify that $R$ is indeed coming from EP1.
- The two end-points also share a timing information value $T$, which is like a timing counter and is 64-bits. I don't know more, I just know that this value is unique in each association and is known by both EPs.
- By association I mean the full sequence of steps 1-4 above. If the EPs disconnect they run those messages from the beginning but both EPs delete the key $K$ and establish a new one in the next association.
So, to modify a bit my answer above, I was thinking of the following solution:
EP1 EP2 -----------------------------------------| 1.s1 = AES-CTR(K,T||counter,K) --------->| 2.R1 = s1 XOR K------------------------->| | 3. s1' = AES-CTR(K,T||counter,K) | 4. R1' = s1' XOR K | Verify R1' == R1
In step 1, EP1 uses AES in CTR mode, with key $K$, the nonce/counter field to be a concatenation of $T||counter$, and the message to be encrypted is again $K$.
In step 2, the random-looking value $s_1$ from step 1 is xored with the same key $K$ and the last 48-bits are sent to EP2. I am reusing $K$ as the input message simply because it is a known value to EP2 and so it can check the encrypted value. But do let me know if this is a bad practice.
In steps 3 and 4, EP2 performs the same computations since all values are common and in step 5 checks whether $R_1'==R_1$. If so, this means that EP1 is authenticated because it must be using the correct key $K$, and also $R_1$ values should not be predictable.
Do you see any flaws or redundancies in my scheme? Would it achieve the requirements mentioned at the beginning of my post?