Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the communicating party initiates contact and does not have a key/secret/password known by the listening listening party; but the listener needs to somehow verify that the communicating party is trustworthy in order to return some sensitive information without interrogating a 3rd party. Personally, this sounds near impossible, but I have tasked with investigating the feasibility. The problem we are trying to solve is provisioning devices into an environment where the devices need zero initial configuration other than being pointed at the proper remote endpoint.
Consider a situation where we have a Device (D) and a Server (S):
- D sends initial Message M to S containing D's alleged identity (name)
- S verifies D identity using (???) and returns Key K to D
- D uses K for all subsequent messages M[1..N-1].
The majority of this problem is in <2> where (???) occurs. Device may be as small as an 8-bit micro with limited storage options.