A mutual authentication method for authenticating a mutual relationship between a client device and a server device connected via a communication line using transactional data communicated between the client and the server to independently derive keying material for authentication;
- the method comprising the steps wherein;
- the client creates a data transmission to send to the server device, retrieves a previous transactional characteristics stored for the server and uses the retrieved transactional characteristics to encode the data transmission request sent to the server;
- the client calculates new transactional characteristics using the retrieved transactional characteristics and the data transmission to be sent to the server as input into a computational algorithm to derive a first new transactional characteristics;
- the client contacts the server over the communications line and the server processes the client transmission by first retrieving a previous transactional characteristics stored for the client and validates the identity of the client using the retrieved transactional characteristics and the client data transmission as input to an algorithm to perform the validation;
- the server calculates new transactional characteristics using the previous transactional characteristics and the client data transmission as input into a computational algorithm to derive a second new transactional characteristics;
- the server processes the client transmission and generates a data transmission to send to the client device using the second new transactional characteristics to encode the server data transmission response to the client;
- the server calculates new transactional characteristics using the previous transactional characteristics and the server data transmission to be sent to the client as input to a computational algorithm to derive a third new transactional characteristics;
- the server sends the server data transmission as a response to the client over the communications line;
- the client calculates new transactional characteristics using the previous transactional characteristics and the data transmission sent from the server as input to a computational algorithm to derive a fourth new transactional characteristic and the client validates the identity of the server using the fourth new transactional characteristics;
- the client processes the response and signals the server to complete the transaction wherein the server stores the current transactional characteristics associated with the client and acknowledges to the client that transaction is complete and the client receives the server acknowledgment and stores the current transactional characteristics associated with the server,
- wherein the transactional characteristics are used as keying material to encrypt the communication between the client and server devices.