Devices and methods for client device authentication

An access point comprising:

• a communications interface configured to:
• receive from a client a first cryptographic hash for the first nonce, the first cryptographic hash calculated using a first key derived from a second key, the second key input on the client or derived from a passphrase input on the client;
• and
• send to the client a third key and a second cryptographic hash;
• memory configured to store a primary input and at least one secondary input, the primary input and the at least one secondary input each being one of a second key and a passphrase;
• and
• at least one hardware processor configured to:
• derive first keys from each of the stored primary input and at least one secondary input valid at the deriving;
• verify the cryptographic hash using each derived first key to find a derived first key that checks the first cryptographic hash;
• generate the third key and the second cryptographic hash using the derived first key that checks the first cryptographic hash;
• encrypt the third key using an encryption key generated from the derived first key that checks the first cryptographic hash before transmission to the client;
• and
• renew the third key when a stored secondary input becomes invalid.

Computer program product which is stored on a non-transitory computer readable medium and comprises program code instructions executable by a processor to:

• receive from a client a first cryptographic hash for the first nonce, the first cryptographic hash calculated using a first key derived from a second key, the second key input on the client or derived from a passphrase input on the client;
• derive first keys from each of a stored primary input and at least one stored secondary input valid at the deriving, the stored primary input and the at least one stored secondary input each being one of a second key and a passphrase;
• verify the cryptographic hash using each derived first key to find a derived first key that checks the first cryptographic hash;
• generate a third key, and a second cryptographic hash using the derived first key that checks the first cryptographic hash;
• send the third key, encrypted using an encryption key generated from the derived first key that checks the first cryptographic hash, and the second cryptographic hash to the client;
• and
• renew the third key when a stored secondary input becomes invalid.