I'm not keen on encryption and security overall, so please forgive my ignorance. Let's assume the following:
We have two nodes which are constrained devices (resources not sufficient for asymmetric encryption), and we want to securely establish a shared key for symmetric encryption.
My solution is the following: save a key K(0) in the devices at deployment program the devices to automatically generate a new key of a new session based on:
- the previous key
- a random number generation function installed in the two devices, with the same epoch
So a session k(i+1) is generated based on the information of the session k(i) that the only two participants have.
Please, now tell me what are weaknesses of this solution.
Thank's in advance.