US 12,284,270 B2
Systems and methods for providing signatureless, confidential and authentication of data during handshake for classical and quantum computing environments
Chris Cap, Bayville, NJ (US); Barry Van Hooser, Pleasanton, CA (US); Sarah McCarthy, Carrickfergus (GB); and Louie Gasparini, San Mateo, CA (US)
Assigned to QuSecure, Inc, Petaluma, CA (US)
Filed by QuSecure, Inc., San Mateo, CA (US)
Filed on Jan. 24, 2022, as Appl. No. 17/583,150.
Claims priority of provisional application 63/180,504, filed on Apr. 27, 2021.
Claims priority of provisional application 63/180,650, filed on Apr. 27, 2021.
Prior Publication US 2022/0345298 A1, Oct. 27, 2022
Int. Cl. H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/0825 (2013.01) [H04L 9/0863 (2013.01); H04L 9/0869 (2013.01); H04L 63/0869 (2013.01)] 58 Claims
OG exemplary drawing
 
1. A method comprises:
providing direct communication between a server and an initiator client, indirect communication between the server and a recipient client, and direct communication between the initiator client and the recipient client;
providing mutual identity authentication; and
providing forward secrecy, confidentiality of data, and integrity of data comprising:
the initiator client encapsulating a first shared secret using a static Key Encapsulation Mechanism (KEM) public key to produce a first ciphertext;
the initiator client sending the first ciphertext to the server;
the initiator client generating an ephemeral KEM keypair;
the initiator client sending the ephemeral KEM public key to the server using an Authenticated Encryption with Associated Data (AEAD) with the first shared secret;
the server decapsulating the first ciphertext using the static KEM private key to produce the first shared secret;
the server encapsulating a second shared secret using the ephemeral KEM public key to produce a second ciphertext;
the server sending the second ciphertext to the initiator client;
the initiator client decapsulating the second ciphertext using the ephemeral KEM private key to produce the second shared secret;
the server generating a plurality of symmetric session keys, wherein each symmetric session key is updated by the server and the server generating a number of bytes each one of the symmetric session keys used to encrypt;
clients switching to a next symmetric session key prior to a current symmetric session key encrypting a predetermined number of bytes associated with the current symmetric session key; and
the initiator client forwarding an encrypted buffer generated by the server to the recipient client to establish a secure session.