Secure channel establishment

A computing device comprising a processor and a memory and configured to carry out the following steps as a first computing device to establish a secure channel for communication between the first computing device and a second computing device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device:

• generating a blinding factor r and sending a blinded public key R=r·Qc to the second computing device;
• receiving an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G generated by the second computing device;
• generating Kc=KDF (r dc·Qt) while the second computing device generates Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device;
• wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer;
• wherein r·dc is chosen such that z is a factor of r·dc.

A computing device comprising a processor and a memory and configured to carry out the following steps as a second computing device to establish a secure channel for communication between a first computing device and the second computing device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device:

• receiving a blinded public key R=r·Qc from the first computing device, which has generated a blinding factor r;
• generating an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sending Qt to the first computing device;
• while the first computing device generates Kc=KDF (r dc·Qt), generating Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device;
• wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer;
• wherein r·dc is chosen such that z is a factor of r·dc.