I am working with a networked embedded device with AES-128 and no public key cryptography (1KB RAM, 8KB flash). At install, the device is pre-loaded with a longterm AES-128 key known also to the server.

What patent free protocols exist for securely distributing an authenticated session key using the existing symmetric key? (with no trusted third party)

Janson-Tsudik 2PKDP looks ideal, but appears to be patented.

  • So, why not just use the key to encrypt messages, with an appropriate IV? The messages will be garbled if the key is wrong. Or are you asking about how to get the key onto the client in the first place when you cannot just put it there? – Tuntable Jun 26 '19 at 2:28

Key exchange protocols break up into two major categories. Server-Based key Establishment and server-less key establishment (I think I'm going to buy that book.). Within these two categories you'll find protocols that use symmetric or asymmetric ciphers or both. There are lage number of Key exchange protocols documented on Security Protocol Open Repository(SPORE), which is a very cool resource.

A good choice for server-based key Establishment is the Needham-Schroeder Symmetric Protocol which can be performed entirely with AES and is used in Kerberos.

For server-less key establishment you should look at Lowe modified BAN concrete Andrew Secure RPC. It is old, however I do not believe this protocol has been compromised.

You should use SSL/TLS whenever possible, but it will require more than 1kb of memory.


Diffie Hellman key exchange. The patent has expired and it is free to use.

  • 2
    This is public key, so does not apply. – Henno Brandsma Apr 13 '11 at 8:19

A simple protocol: server picks N (128 bits), a nonce, only used once. Then he sends E_K(N), E_K(N+1) to the client (using the device key K that the server knows). The client device decrypts them, checks they differ by 1 (mod 2^128), and computes H(N) (a hash with output 128 bits, say MD5) and sends E_K(H(N)) and E_K(H(N)+1). The server decrypts them, does the difference check, and then client and serves use H(H(N)) as their common key for that session. I assume you want a 2 way protocol, but this can be adapted to more parties as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.