I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total.

Alice wants to prove to Bob that she is legitimate and establish a new communication session. She doesn't want to always use her primary PSK.

  1. Alice can take the pre-shared key, use it to encrypt the key she would like to use for this session as well as some other meta data. The original key is used once to make this packet only (unique nonce of course). Bob receives it, sees it came from Alice and that the AEAD checks out. This could only have come from Alice and Bob now has the temp/session key would like to use.

  2. Alice can instead sign a packet that contains a derivation/modifier that she would like Bob to apply to their PSK. Bob receives this, verifies that only Alice could have made it, and applies the modifier to the existing/old PSK to create a session key. Bob and Alice now share what the session key is and have never used the PSK directly.

I think #2 is better because nothing with the PSK was ever used. We used PKI to generate a temporary key to be used symmetrically and only in this session. But, I'll need to include PKI on both sides and now need to now only store a PSK but also the public key for each side.

I don't know if #1 is flawed besides something used the PSK directly once.

I also am not entirely sure what key derivation function makes the most sense here.

EDIT: ... I think the right answer might actually be #3 which is to combine them use the PBKDF on Alice PSK and include that in the AEAD that the new key wrapped the whole packet in. This actually seems like a great place for AEAD. I'd be included the key derivation I used, and wrapping that up in the "additional data" that the new key "locked in". This immediately gets me the cleartext modifier to feed into the derivation function, and something I can verify with that new key, like encrypting the salt/modifier and confirming it as AE just incase I wanted to be really sure. It "use" the old PSK, but never in a direct form that is sent over the internet.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.