Patent ID: 6931528

Claim:
A method for a secure handshake protocol between a first party and a second party, connected via a communications channel, wherein each party supports a respective set of cipher suites and for each party, a respective certificate is defined, each of the certificates comprising a public key of its respective owner, the method being characterized in that comprising: sending from the first party to the second party a first inter-party message indicating the set of cipher suites supported by the first party, parameters required by the cipher suites, and an identifier of the first party; wherein in response to the first inter-party message, the second party: selects one of said indicated cipher suites which is also supported by the second party; uses said identifier to obtain the certificate of the first party over a connection which is significantly faster than the communications channel connecting said parties; verifies said obtained certificate of the first party and thereby obtains the public key of the first party; sends a second inter-party message comprising the certificate of the second party, an indication that the second party has verified the certificate of the first party, and an indication about said selected cipher suite; wherein in response to the second inter-party message, the first party: begins to use the selected cipher suite; verifies the certificate of the second party and thereby obtains the public key of the second party; sends a third inter-party message indicating that the first party has verified the certificate of the second party; and wherein information not needed for the above steps can be sent from the first party to the second party in the third inter-party message, thus providing a two-way key-exchange and mutual verification with an effective overhead of two inter-party messages.