Secure session capability using public-key cryptography without access to the private key

A method in a first server for establishing a secure session with a client device, the method comprising:

• receiving a message from the client device that initiates a handshake procedure to establish a secure session between the client device and the first server;
• negotiating a set of cryptographic parameters between the client device and the first server for the secure session, wherein negotiating the set of cryptographic parameters includes the first server receiving an encrypted premaster secret from the client device, wherein the first server does not have access to a key to decrypt the encrypted premaster secret;
• transmitting at least some of the negotiated set of cryptographic parameters to a second server to create a set of one or more session keys to be used in the secure session, wherein the transmitted at least some of the negotiated set of cryptographic parameters includes the encrypted premaster secret;
• receiving, from the second server, the set of session keys;
• and
• completing the handshake procedure with the client device including installing the set of session keys to be used during the secure session with the client device.

An apparatus comprising:

• a first server including a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
• receive, from a client device, a Client Hello message that includes a first random value;
• in response to the received Client Hello message, transmit a Server Hello message to the client device that includes a second random value;
• transmit, to the client device, a Server Certificate message that includes one or more digital certificates;
• transmit, to the client device, a Server Hello Done message;
• receive, from the client device, a Client Key Exchange message that includes an encrypted premaster secret, wherein the first server does not include a private key that can decrypt the encrypted premaster secret;
• transmit, to a second server that has access to a private key that is capable of decrypting the encrypted premaster secret, the encrypted premaster secret, the first random value, the second random value, and an indication of a negotiated cipher suite between the client device and the first server;
• receive, from the second server, a set of or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server that were generated at least using a master secret that is generated using a premaster secret that is decrypted from the encrypted premaster secret, the first random value, the second random value, and the negotiated cipher suite between the client device and the first server;
• receive, from the client device, a first Change Cipher Spec message;
• receive, from the client device, a first Finished message;
• transmit to the client device, a second Change Cipher Spec message;
• and
• transmit, to the client device, a second Finished message.

An apparatus comprising:

• a first server including a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
• receive a message from the client device that initiates a handshake procedure to establish a secure session between the client device and the first server;
• negotiate a set of cryptographic parameters between the client device and the first server for the secure session, wherein negotiating the set of cryptographic parameters includes the first server receiving an encrypted premaster secret from the client device, wherein the first server does not have access to a key to decrypt the encrypted premaster secret;
• transmit at least some of the negotiated set of cryptographic parameters to a second server to create a set of one or more session keys to be used in the secure session, wherein the transmitted at least some of the negotiated set of cryptographic parameters includes the encrypted premaster secret;
• receive, from the second server, the set of session keys;
• and
• complete the handshake procedure with the client device including installing the set of session keys to be used during the secure session with the client device.