# US 12,192,184 B2 · Secure session resumption using post-quantum cryptography

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,192,184 B2
- Document ID: US12192184B2
- Status: Granted
- Kind: B2
- Application number: 18/063,192
- Filed: 2022-12-08
- Published: 2023-09-28
- Granted: 2025-01-07
- Earliest claimed: 2021-12-08
- Applicants: John A. Nix
- Inventors: John A. Nix
- Web page: https://patentgrep.com/patent/US12192184B2

## CPC

- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/0852: {Quantum cryptography (transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/16: the keys or algorithms being changed during operation
- H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves}
- H04L 9/3093: {involving Lattices or polynomial equations, e.g. NTRU scheme}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/40: Network security protocols
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A server and a device can support secure sessions with both (i) post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) and (ii) session resumption. In an initial secure session, the device and server can mutually generate a first shared secret key K1 from a first KEM based on a device PKI key pair. The device and server can mutually generate a second shared secret key K2 from a second KEM based on a server PKI key pair. The device and server can mutually generate a symmetric ciphering key S2 from both K1 and K2. The server can encrypt an identity for a “pre-shared” secret key (PSK-ID) with S2. The device and server can (i) mutually generate a PSK from both K1 and K2 and (ii) close the initial secure session. The device can transmit a message to resume the session, where the message includes the PSK-ID and a MAC value.

## Claims

### Claim 1

A method for a device to conduct secure communications with a network, the method performed by the device, the method comprising:
a) storing, in nonvolatile memory, a plurality of key encapsulation mechanism (KEM) algorithms comprising a first KEM algorithm;
b) generating, by a processing unit, a device ephemeral private key and a corresponding device ephemeral public key for the first KEM algorithm;
c) transmitting, to the network via a network interface, a first message comprising (i) the device ephemeral public key, and (ii) identifiers for each of the plurality of KEM algorithms and the first KEM algorithm;
d) receiving, from the network via the network interface, a second message comprising a first asymmetric ciphertext and a first symmetric ciphertext of at least a server public key for a second KEM algorithm;
e) conducting a KEM decapsulation (DECAPS) function to generate a first shared secret K1 using the first asymmetric ciphertext and the first KEM algorithm;
f) conducting a KEM encapsulation (ENCAPS) function to generate a second shared secret K2 and a second asymmetric ciphertext using at least (i) the server public key and (ii) the second KEM algorithm;
g) deriving a symmetric ciphering key S2 using at least the K1 and the K2;
h) deriving a “pre-shared” secret key (PSK) using at least the K1 and the K2;
i) receiving, from the network, a third message comprising a second symmetric ciphertext of an identity of the PSK (PSK-ID), wherein the device decrypts the second symmetric ciphertext with the key S2;
j) transmitting, to the network, a fourth message requesting resumption of a secure session, the fourth message comprising the PSK-ID and a random number generated by the device;
k) generating a symmetric ciphering key S3 using the PSK and the random number;
l) Receiving, from the network, a third symmetric ciphertext; and
m) decrypting the third symmetric ciphertext using the key S3.

### Claim 2 (depends on 1)

The method of claim 1, further comprising in step g), deriving a symmetric ciphering key S2 using at least the K1 and the K2 with one of (i) a HMAC-based Extract-and-Expand Key Derivation Function (HKDF) and (ii) a hash-based key derivation function.

### Claim 3 (depends on 2)

The method of claim 2, further comprising in step g) using the HKDF to derive a message authentication code (MAC) key and an initialization vector for the second symmetric ciphertext.

### Claim 4 (depends on 1)

The method of claim 1, further comprising in step h), deriving the PSK using at least plaintext data from the first message and the second message with one of a HKDF and a hash-based key derivation function.

### Claim 5 (depends on 1)

The method of claim 1, further comprising in step h), generating a symmetric ciphering key S3 using the PSK and the random number with one of a HKDF and a hash-based key derivation function.

### Claim 6 (depends on 5)

The method of claim 5, further comprising in step k) using the HKDF to derive a message authentication code (MAC) key and an initialization vector for the third symmetric ciphertext.

### Claim 7 (depends on 1)

The method of claim 1, wherein the first KEM algorithm comprises a first algorithm type for lattice-based cryptography and the second KEM algorithm comprises a second algorithm type for code-based cryptography.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first KEM algorithm comprises a first algorithm type for code-based cryptography and the second KEM algorithm comprises a second algorithm type for lattice-based cryptography.

### Claim 9 (depends on 1)

The method of claim 1, wherein the server public key comprises a server static public key, wherein a plaintext for the first symmetric ciphertext includes a server certificate with the server static public key and an identity for the second KEM algorithm.

### Claim 10 (depends on 1)

The method of claim 1, wherein the server public key comprises a server ephemeral public key, and wherein a plaintext for the first symmetric ciphertext includes a server digital signature over at least the server ephemeral public key and the device ephemeral public key.

### Claim 11 (depends on 1)

The method of claim 1, wherein the symmetric ciphering key S2 comprises a first portion and a second portion, wherein in step i) the device decrypts with the first portion of the key S2, and wherein the second portion of the key S2 comprises an encryption key.

### Claim 12 (depends on 1)

The method of claim 1, wherein the secure session comprises step c) through step i).

### Claim 13 (depends on 1)

The method of claim 1, wherein the device comprises one of a personal computer, a laptop computer, a mobile handset, a router, and a server.