Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
There is a device that uses a secret key Sk to encrypt data. Assume this Sk is compromised.
Could the following scheme be considered safe, in case we want to change the compromised Sk:
We store some secret random number in the device- SRN. The new secret key would be equal to Sk = SRN xor RN, where SRN is the stored in the device secret random number (we know this number), RN is some random number that we send to the device when we want to change the Sk.
What's proposed is unsafe if used more than once: assume $\text{Sk}_1$ is (re-)established this way by sending $\text{RN}_1$; then, after compromise of $\text{Sk}_1$, $\text{Sk}_2$ is re-established this way by sending $\text{RN}_2$. The adversary can find $\text{Sk}_2$ as $\text{Sk}_1\oplus\text{RN}_1\oplus\text{RN}_2$.
Also, $\text{RN}$ does not seem integrity protected, allowing the adversary to play nasty tricks.
A better practice is to send a fresh $\text{Sk}$ protected by authenticated encryption with a dedicated Key Enciphering Key (having the role of $\text{SRN}$ here).
