Secure session resumption using post-quantum cryptography

A server for securely communicating with a device, the server comprising:

• a nonvolatile memory configured to store a plurality of key encapsulation mechanism (KEM) algorithms comprising a first KEM algorithm and a second KEM algorithm;
• a network interface configured to:
• a) receive a first message for a secure session comprising (i) a device ephemeral public key for the first KEM algorithm, and (ii) an identifier for the second KEM algorithm;
• b) transmit a second message comprising (i) a first asymmetric ciphertext and (ii) a first symmetric ciphertext of at least a server public key for the second KEM algorithm, wherein the first symmetric ciphertext is encrypted with an first encryption key S1;
• c) receive a third message comprising a second symmetric ciphertext, wherein the second symmetric ciphertext is decrypted with the key S1, and wherein the plaintext of the second symmetric ciphertext comprises a second asymmetric ciphertext for the second KEM algorithm;
• d) transmit a fourth message comprising a third symmetric ciphertext of an identity (PSK-ID) of a “pre-shared” secret key (PSK), wherein the third symmetric ciphertext is encrypted with a second encryption key S2;
• and
• e) receive a fifth message for a resumption of a secure session, the fifth message comprising the identity (PSK-ID), a random number generated by the device, and a first message authentication code (MAC) tag value;
• at least one processor configured to:
• a) generate the first asymmetric ciphertext and a first shared secret K1 with a KEM encapsulation (ENCAPS) function for (i) the device ephemeral public key and (ii) the first KEM algorithm;
• b) derive the first encryption key S1 using the first shared secret K1;
• c) derive the server public key and a corresponding server private key for the second KEM algorithm;
• d) generate a second shared secret K2 with a KEM decapsulation (DECAPS) function with (i) the second asymmetric ciphertext, (ii) the server private key, and (iii) the second KEM algorithm;
• e) derive both the second encryption key S2 and the PSK using the first shared secret K1 and the second shared secret K2;
• f) select the PSK using the identity (PSK-ID);
• g) derive a second MAC tag value using the fifth message and the PSK;
• h) compare the first MAC tag value and the second MAC tag value, wherein application data for the resumption of the secure session is encrypted using the PSK if the first MAC tag value and the second MAC tag value are the same.