# Change a secret key in an embedded device

There is a device that uses a secret key Sk to encrypt data. Assume this Sk is compromised.

Could the following scheme be considered safe, in case we want to change the compromised Sk:

We store some secret random number in the device- SRN. The new secret key would be equal to Sk = SRN xor RN, where SRN is the stored in the device secret random number (we know this number), RN is some random number that we send to the device when we want to change the Sk.

## 1 Answer

What's proposed is unsafe if used more than once: assume $$\text{Sk}_1$$ is (re-)established this way by sending $$\text{RN}_1$$; then, after compromise of $$\text{Sk}_1$$, $$\text{Sk}_2$$ is re-established this way by sending $$\text{RN}_2$$. The adversary can find $$\text{Sk}_2$$ as $$\text{Sk}_1\oplus\text{RN}_1\oplus\text{RN}_2$$.

Also, $$\text{RN}$$ does not seem integrity protected, allowing the adversary to play nasty tricks.

A better practice is to send a fresh $$\text{Sk}$$ protected by authenticated encryption with a dedicated Key Enciphering Key (having the role of $$\text{SRN}$$ here).

• Thanks! Sending protected Sk is an option, but it would require having extra secrets that might be compromised too, if I understand correctly. I think if we hash the the resulting (SRN xor RN) and use the hash as the new key, it might resolve the mentioned weakness? – uduck Nov 1 '18 at 16:53
• @igotca: you already have an extra secret used only for key transfer, namely $\text{SRN}$. Your $\text{Sk}=H(\text{SRN}\oplus\text{RN})$ seems to solve the first mentioned issue; but not the second (in particular, an active adversary can force reusing a previous $\text{Sk}$). – fgrieu Nov 1 '18 at 17:36
• right. Then the authenticated encryption should be the way. Thank you. – uduck Nov 2 '18 at 8:57