Secret key authentication with software-only verification

Abstract

Two protocols for authentication based on symmetric key cryptography are described, where the verifier can be implemented in software completely, without the need for secure storage of any secret information. The protocols use a symmetric cipher in an asymmetric fashion: the verifier uses a verification key which is derived from a symmetric master key. Software only verification means that the verifier does not have to be equipped with some tamper resistant device storing the verification keys. The protocols are especially suitable for the smart card environment where symmetric key protocols are extensively used, and will be used for some time to come, to reduce both system cost and transaction time.