Verifiable key exchange for cryptography

A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors on a cloud infrastructure, cause the processors to establish, at a first entity, a common secret key (k) for encrypted data communication during a key exchange between the first entity and a second entity, the establishing k comprising:

• selecting a first private key of the first entity;
• receiving from the second entity a second public key (A) of the second entity, wherein the second public key, when properly generated, is based at least on a second private key of the second entity;
• receiving from the second entity a first verification value (C), wherein C, when properly generated, is based at least on a second random number (r) selected by the second entity;
• generating a first random number (e) and sending e to the second entity;
• receiving from the second entity a second verification value (D) in response to the first random number, wherein D, when properly generated, is based at least on r, e and the second private key;
• determining, based on C and D, whether A is properly generated;
• when it is determined that A is properly generated, establishing the common secret key (k) based on A;
• and
• when it is determined that A is not properly generated, ending the key exchange.

A cloud based server comprising

• one or more processors;
• a communication interface coupled to the processors, the communication interface providing encrypted data communication between the server and a client device;
• the one or more processors establishing a common secret key (k) for the encrypted data communication during a key exchange between the client device, the establishing k comprising:
• selecting a first private key;
• receiving from the client device a second public key (A), wherein the second public key, when properly generated, is based at least on a second private key of the client device;
• receiving from the client device a first verification value (C), wherein C, when properly generated, is based at least on a second random number (r) selected by the client device;
• generating a first random number (e) and sending e to the client device;
• receiving from the client device a second verification value (D) in response to the first random number, wherein D, when properly generated, is based at least on r, e and the second private key;
• determining, based on C and D, whether A is properly generated;
• and
• when it is determined that A is properly generated, establishing the common secret key (k) based on A;
• and
• when it is determined that A is not properly generated, ending the key exchange.