I saw this design recently in an infotainment product. The goal is mutual authentication between two ECUs, E1 and E2. They only care about each other. The basic idea is to keep both keys secret and let each ECU have one. Let's call the keys k1 and k2, instead of public key and secret key, or E and D. Both keys are large.
Suppose E1 has k1, and E2 has k2. To perform mutual authentication in a cost efficient way:
- E1 generates random data D of a fix length, and encrypts hash(D) with k1, resulting in S1. D and S1 are sent to E2.
- E2 decrypts S1 with k2, and check if it matches hash(D).
- If OK, E2 calculates the binary complement of D, denoted D'. Then it encrypts hash(D') with k2, resulting in S2. S2 is sent to E1.
- E1 calculate D', decrypts S2 with k1, and check if it matches hash(D').
I have a hunch this design is risky, but fail to find the weakness. Is it secure enough in the real world?
Edit: I see there is replay attack again E2, but the "master" node, E1, can never be fooled, right? I guess the use of D' may leak some chance of MITM attack, but it's complicated to find any.