Протокол ініціалізації захищеного сеансу у веб-додатках на основі вдосконаленого гібридного узгодження ключів та модифікованої KDF

Abstract

The paper proposes a secure session initialization protocol for web applications based on an improved hybrid key agreement method and a modified key derivation function (KDF). The hybrid approach combines a classical ephemeral agreement (providing forward secrecy) with an additional component aimed at strengthening resistance against both current and emerging attacks. The proposed KDF enforces strict binding of key material to the session context, protocol parameters, and party roles, reducing risks of key reuse and downgrade attacks. Security requirements, protocol architecture, and an integration approach for web environments are outlined.