1
$\begingroup$

I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP). I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF and do not take advantage of more advanced hardware like smartphones (the device I will use to produce OTPs)

The main idea is to use entropy from both server and client to generate the KEY_TOKEN. My question. Is it a good idea to use Curve25519 to share a master key between client and server, to derive a key with HKDF to use ash K_TOKEN of RFC 6238 HMAC-SHA256 hash algorithm? I'm not a specialist, and I can't see that the resulting key is not secure in this scenario.

PS(I Will use different algorithms to store the key in both server and client, I need to understand the risks of using this key exchange flow) Thanks

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.