3
$\begingroup$

There is a device that uses a secret key Sk to encrypt data. Assume this Sk is compromised.

Could the following scheme be considered safe, in case we want to change the compromised Sk:

We store some secret random number in the device- SRN. The new secret key would be equal to Sk = SRN xor RN, where SRN is the stored in the device secret random number (we know this number), RN is some random number that we send to the device when we want to change the Sk.

Improve this question
$\endgroup$
4
$\begingroup$

What's proposed is unsafe if used more than once: assume $\text{Sk}_1$ is (re-)established this way by sending $\text{RN}_1$; then, after compromise of $\text{Sk}_1$, $\text{Sk}_2$ is re-established this way by sending $\text{RN}_2$. The adversary can find $\text{Sk}_2$ as $\text{Sk}_1\oplus\text{RN}_1\oplus\text{RN}_2$.

Also, $\text{RN}$ does not seem integrity protected, allowing the adversary to play nasty tricks.

A better practice is to send a fresh $\text{Sk}$ protected by authenticated encryption with a dedicated Key Enciphering Key (having the role of $\text{SRN}$ here).

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks! Sending protected Sk is an option, but it would require having extra secrets that might be compromised too, if I understand correctly. I think if we hash the the resulting (SRN xor RN) and use the hash as the new key, it might resolve the mentioned weakness? $\endgroup$ – uduck Nov 1 '18 at 16:53
  • $\begingroup$ @igotca: you already have an extra secret used only for key transfer, namely $\text{SRN}$. Your $\text{Sk}=H(\text{SRN}\oplus\text{RN})$ seems to solve the first mentioned issue; but not the second (in particular, an active adversary can force reusing a previous $\text{Sk}$). $\endgroup$ – fgrieu♦ Nov 1 '18 at 17:36
  • $\begingroup$ right. Then the authenticated encryption should be the way. Thank you. $\endgroup$ – uduck Nov 2 '18 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.