ECDHE Key Exchange for Server Authentication and a Key Server

A method for a device to authenticate with a server over a wireless network, the method performed by the device, the method comprising:

• a) storing, in a memory, (i) a first point on an elliptic curve, and (ii) a shared key, wherein the shared key is received by the server;
• b) generating a value from a secure hash of at least the shared key:
• c) selecting a first integer as a first subset of the value;
• d) receiving, from the server via a radio connected to the wireless network, (i) a random number and (ii) a second point on the elliptic curve, the second point comprising a public key for the server;
• e) deriving a device private key and corresponding device public key for the elliptic curve;
• f) deriving a shared secret comprising an elliptic curve point addition of (i) the first integer multiplied by the first point and (ii) the device private key multiplied by the public key for the server;
• g) deriving a symmetric ciphering key from a key derivation function with the shared secret;
• h) generating a ciphertext by encrypting with the symmetric key (i) a device digital signature for at least the random number, and (ii) a device certificate;
• and
• i) transmitting, to the server via the radio connected to the wireless network, the ciphertext.