Embedded TLS protocol for lightweight devices

A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:

• issuing, by a client device to a server, a request to initiate a secure transport layer security (TLS) connection, the client device comprising a lightweight computing device;
• receiving, by the client device, a response to the request to initiate the secure TLS connection from the server, the response comprising a ServerHello message including a digital certificate associated with an Elliptic-Curve Diffie-Hellman (ECDH) public key stored by the server, the digital certificate including the ECDH public key and an unencrypted Diffie-Hellman (DH) parameter, the digital certificate further including a key usage field indicating the ECDH public key is for key agreement, wherein the ECDH public key is associated with a static ECDH key pair of the server;
• validating, by the client device, the digital certificate included in the response to the request to initiate the TLS connection;
• computing, by the client device, a pre-master secret using the ECDH public key included in the response and a private key generated by the client device;
• generating, by the client device, an ephemeral ECDH key pair;
• computing, by the client device, a pre-master secret using the static ECDH public key and the ephemeral private key generated by the client device;
• deriving, by the client device, a session key from the pre-master secret using a key derivation function that incorporates a client random value and a server random value;
• establishing, by the client device, the secure TLS connection after computing the pre-master secret, the establishing the secure TLS connection including:
• encrypting, by the client device, a payload using the pre-master secret, and transmitting the payload to the server;
• and
• erasing, by the client device, the ephemeral private key after the secure TLS connection is established.

A lightweight computing device comprising:

• a processor configured to:
• issue, to a server, a request to initiate a secure transport layer security (TLS) connection;
• receiving a response to the request to initiate the secure TLS connection from the server, the response comprising a ServerHello message including a digital certificate associated with an Elliptic-Curve Diffie-Hellman (ECDH) public key stored by the server, the digital certificate including the ECDH public key and an unencrypted Diffie-Hellman (DH) parameter, the digital certificate comprising a digital certificate associated with an Elliptic-curve Diffie-Hellman (ECDH) key pair stored by the server, the digital certificate further including a key usage field indicating the ECDH public key is for key agreement, wherein the ECDH public key is associated with a static ECDH key pair of the server;
• validating the digital certificate included in the response to the request to initiate the TLS connection;
• computing a pre-master secret using the ECDH key included in the response and a private key generated by the device;
• generating an ephemeral ECDH key pair;
• computing a pre-master secret using the static ECDH public key and the ephemeral private key generated by the client device;
• deriving a session key from the pre-master secret using a key derivation function that incorporates a client random value and a server random value;
• establishing the secure TLS connection after computing the pre-master secret, the establishing the secure TLS connection including:
• encrypting a payload using the pre-master secret, and transmitting the payload to the server;
• and
• erasing, by the client device, the ephemeral private key after the secure TLS connection is established.