Assume that a server has a random secret
key, uses it to generate
<id = random(), secret = hmac(id, key)> credential tuples, and hands these
<id, secret> tuples out to clients freely (over a secured connection).
Are there any weaknesses in a client using its
secret to symmetrically encrypt messages directed at the server?
1. Server setup
- Server is loaded with random secret
2. Credential given to client
- Client requests credential over secure channel
- Server generates a random
- Server generates a
- Server responds (over secure channel) with
3. Client sends message to server
- Client creates a message
Mto send to the server
- Client generates
M'by symmetrically encrypting
Mand then MACing with its
- Client sends
<id, M'>tuple to server over unsecure channel
4. Server gets message from client
- Server receives
<id, M'>tuple over unsecure channel
- Server derives
- Server authenticates and decrypts
To me, this provides the benefit of the server not needing to persist IDs or secrets, and is also fast (compared to generating RSA key pairs).
But I'm eager to hear downsides of using HMAC like this to generate secret keys?
I tried Googling this scheme but my Google-fu must not be strong enough (this question and answer seem sort of close, but this isn't "Key Derivation" proper, is it?). There must be a good reason why this isn't more common.
Also, is there a name for this?