Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the server.

What patent free protocols exist for securely distributing an authenticated session key using the existing symmetric key? (with no trusted third party)

Janson-Tsudik 2PKDP looks ideal, but appears to be patented.

share|improve this question
up vote 5 down vote accepted

Key exchange protocols break up into two major categories. Server-Based key Establishment and server-less key establishment (I think I'm going to buy that book.). Within these two categories you'll find protocols that use symmetric or asymmetric ciphers or both. There are lage number of Key exchange protocols documented on Security Protocol Open Repository(SPORE), which is a very cool resource.

A good choice for server-based key Establishment is the Needham-Schroeder Symmetric Protocol which can be performed entirely with AES and is used in Kerberos.

For server-less key establishment you should look at Lowe modified BAN concrete Andrew Secure RPC. It is old, however I do not believe this protocol has been compromised.

You should use SSL/TLS whenever possible, but it will require more than 1kb of memory.

share|improve this answer
"networked embedded device with AES-128 and no public key cryptography" - I am looking for a session key exchange protocol using a symmetric cipher, like 2PKDP. SSL is not an option (this device has 1KB RAM and 8KB flash) – Joby Taffey Apr 13 '11 at 5:35
As I understand it, DH like RSA requires operations on large primes making it unsuitable for a small device – Joby Taffey Apr 13 '11 at 7:55
@Joby Taffey updated – rook Apr 13 '11 at 8:34

Diffie Hellman key exchange. The patent has expired and it is free to use.

share|improve this answer
This is public key, so does not apply. – Henno Brandsma Apr 13 '11 at 8:19

A simple protocol: server picks N (128 bits), a nonce, only used once. Then he sends E_K(N), E_K(N+1) to the client (using the device key K that the server knows). The client device decrypts them, checks they differ by 1 (mod 2^128), and computes H(N) (a hash with output 128 bits, say MD5) and sends E_K(H(N)) and E_K(H(N)+1). The server decrypts them, does the difference check, and then client and serves use H(H(N)) as their common key for that session. I assume you want a 2 way protocol, but this can be adapted to more parties as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.