Abstract

This disclosure describes a way to admit devices to a Wi-Fi network without any human-

chosen shared password. Pressing a button makes the router display a fresh, short-lived,

single-use QR code. The code carries a random pairing secret, a session identifier and the

fingerprint of the router's public key. The joining device scans it and requires the router to

prove possession of the matching private key. The device generates its own key pair and,

over the authenticated channel, submits its public key with proof of possession. The proofs

are bound to a transcript of identities, nonces, network, role and algorithms. A network

authority then signs an enrolment certificate. Redemption is atomic, and the router asks

for confirmation of the enrolled key. Variants: the router scans the device's code, or both

sides scan; a static code holding only public data, with separate admission approval; an

isolated provisioning SSID; NFC, authenticated BLE or end-to-end encrypted sharing.

Router-signed delegation certificates can let a phone enrol others, bounded by depth,

expiry, role, scope and count, with no escalation, and with either cascading or adopting

revocation. Multiple routers carry distinct authority-signed keys. Headless IoT devices

enrol through a phone that acts as a relay, a provisioner or a delegated signer.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Share Alike 4.0 License.

Download

Share

COinS