# US 12,113,906 B1 · End-to-end encryption based on a simple shared secret

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,906 B1
- Document ID: US12113906B1
- Status: Granted
- Kind: B1
- Application number: 17/993,931
- Filed: 2022-11-24
- Granted: 2024-10-08
- Earliest claimed: 2019-10-29
- Applicants: Boris Reitman
- Inventors: Boris Reitman
- Web page: https://patentgrep.com/patent/US12113906B1

## CPC

- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs}
- H04L 9/3221: {interactive zero-knowledge proofs}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 67/55: Push-based network services
- H04L 2209/50: Oblivious transfer
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This invention enables asynchronous encrypted communication under a protection of a simple password which must be communicated out-of-band. The password is easily communicable in-person, by telephone or by a text message. The invention assumes that one of the parties has an online device, such as a smartphone. After the encrypted session has been established, it can be used for a variety of cryptographic applications, such as encrypting or decrypting messages, sharing of cryptographic keys, and verifying data. The invention also has the secondary benefit of authenticating both parties to each other.

## Claims

### Claim 1

A method to securely transmit a first password over a network by transmitting a second password out-of-band, the method comprising:
a first operator registering a first device on a primary network;
recording to a first memory of the first device (i) a first password for sharing; and (ii) a second password or a value derived from the second password, wherein the first password and the second password or the value derived from the second password are recorded under a first identifier;
first operator communicating the second password to a second operator in one of a face-to-face meeting, a voice conversation, or over a secondary out-of-band network;
establishing a first communication channel between the first device and a second device over the primary network, wherein the second device is pre-programmed with the second password and the first identifier;
performing a data exchange between the first device and the second device over the established first communication channel, wherein the data exchange comprises:
transmitting, from the second device to the first device, an authentication request comprising the first identifier and a first set of parameters of a pre-determined Password Authenticated Key Exchange (PAKE) protocol, wherein the first set of parameters of the pre-determined PAKE protocol are derived from the first password;
computing, on the first device, a first symmetric cryptographic key based on the first password or the value derived from the first password and the first set of parameters of the pre-determined PAKE protocol received from the second device;
transmitting, from the first device to the second device, a second set of parameters of the pre-determined PAKE protocol, a first message authentication code (MAC) derived from the computed first symmetric cryptographic key, first and second sets of parameters of the pre-determined PAKE protocol, and a first command, wherein the first command is encrypted with the computed first symmetric cryptographic key to provide a first encrypted command;
computing, on the second device, the first symmetric cryptographic key based on the first set of parameters of the pre-determined PAKE protocol and the received second set of parameters of the pre-determined PAKE protocol;
deriving, on the second device, a first candidate MAC based on the first and second parameters of the pre-determined PAKE protocol, the first encrypted command, and the computed first symmetric cryptographic key;
validating, on the second device, that the derived first candidate MAC and the received first MAC match;
wherein if the first candidate MAC and the first MAC match, the second device (i) processes the received first encrypted command and generates a second command, wherein the second command is encrypted with the computed first symmetric cryptographic key to provide a second encrypted command, and (ii) transmits to the first device the second encrypted command, second encrypted data to be shared, and a second MAC derived from (a) the computed first symmetric cryptographic key, (b) the first and second sets of parameters of the pre-determined PAKE protocol; (c) the first and second encrypted commands; and (d) the second encrypted data to be shared; and
deriving, on the first device, a second candidate MAC based on (a) the computed first symmetric cryptographic key, (b) the first and second sets of parameters of the pre-determined PAKE protocol; (c) the first and second encrypted commands; and (d) the second encrypted data to be shared;
validating, on the first device, that the second candidate MAC and the received second MAC match;
wherein if the derived second candidate MAC and the received second MAC match, the first device (i) decrypts and processes the received second encrypted command and decrypts and stores the received second encrypted data; and (ii) transmits the first encrypted data to be shared to the second device; and
deciphering, on the second device, the received strong password using the computed first symmetric cryptographic key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the first and second devices are both personal devices.

### Claim 3 (depends on 2)

The method of claim 2, wherein the second device is a public computer.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first and second devices are independently smart phones or personal computers.

### Claim 5 (depends on 1)

The method of claim 1, wherein a pre-determined number of authentication attempts may be performed, and wherein if the pre-determined number of authentication attempts is exceeded one of the first or second devices rejects any further authentication attempts during a pre-determined rejection time period.

### Claim 6 (depends on 1)

The method of claim 1, wherein the data exchange occurs during a pre-determined time period.

### Claim 7 (depends on 1)

The method of claim 1, wherein the PAKE protocol is selected from the group consisting of an OPRF protocol, a DH-OPRF protocol, and a Secure Remote Password (SRP) protocol.

### Claim 8 (depends on 1)

The method of claim 1, wherein the established first communication channel is a direct peer-to-peer communication channel.

### Claim 9 (depends on 1)

The method of claim 1, wherein the established first communication channel is facilitated through a signaling server.

### Claim 10 (depends on 9)

The method of claim 9, wherein the signaling server transmits a Push Notification to the first device, and wherein the transmitted Push Notification includes the first set of parameters of the pre-determined PAKE protocol and the first identifier.

### Claim 11 (depends on 1)

The method of claim 1, wherein the second password is a password of low entropy.

### Claim 12 (depends on 1)

The method of claim 1, wherein after the data exchange is performed, the second password cannot be reused.

### Claim 13 (depends on 1)

The method of claim 1, wherein the secondary out-of-band network is a telecom cellular network; and the second password is communicated by Short Message Service (SMS).

### Claim 14 (depends on 1)

The method of claim 1, wherein the second password is communicated using an Instant Messenger.

### Claim 15 (depends on 1)

The method of claim 1, wherein the second password is a set of objects denoted by words or by pictures.

### Claim 16

A method of encrypted electronic mail (email) messaging, the method comprising:
a first operator configuring a first device, the configuration comprising:
(i) choosing a first symmetric cryptographic key;
(ii) creating a ciphertext by encrypting information using the first symmetric cryptographic key;
(iii) composing an email message, where the email message comprises (a) a body comprising the created ciphertext and additional information; (b) a header including an email address of one or more recipients, where the one or more recipients includes at least a second operator; and a subject header including (i) encrypted subject information, and (ii) additional subject information;
(iv) deriving a first identifier based on the composed email message;
(v) recording to a first memory of a first device (i) the first symmetric cryptographic key; and (ii) a first password or a value derived from the first password, wherein the first symmetric cryptographic key and the first password or the value derived therefrom are recorded under the first identifier;
registering the first device on a network;
transmitting the composed email message to the one or more recipients;
receiving the composed email message on at least a second device and identifying that it includes ciphertext;
deriving, on the second device, the first identifier from the received composed email message;
establishing a first communication channel between the first device and the second device, wherein the second device is pre-programmed with the first password and the first identifier;
performing a data exchange between the first device and the second device over the established first communication channel, wherein the data exchange comprises:
transmitting, from the second device to the first device, an authentication request comprising the first identifier and a first set of parameters of a pre-determined Password Authenticated Key Exchange (PAKE) protocol, wherein the first set of parameters of the pre-determined PAKE protocol are derived from the first password;
computing, on the first device, a second symmetric cryptographic key based on the first password or the value derived from the first password and the first set of parameters of the pre-determined PAKE protocol received from the second device;
transmitting, from the first device to the second device, a second set of parameters of the pre-determined PAKE protocol, a first message authentication code (MAC) derived from the computed first symmetric cryptographic key, first and second sets of parameters of the pre-determined PAKE protocol, and a first command, wherein the first command is encrypted with the computed second symmetric cryptographic key to provide a first encrypted command;
computing, on the second device, the second symmetric cryptographic key based on the first set of parameters of the pre-determined PAKE protocol and the received second set of parameters of the pre-determined PAKE protocol;
deriving, on the second device, a first candidate MAC based on at least the first and second parameters of the pre-determined PAKE protocol, the first encrypted command, and the computed second symmetric cryptographic key;
validating, on the second device, that the derived first candidate MAC and the received first MAC match;
wherein if the first candidate MAC and the first MAC match, the second device (i) decrypts and processes the received first encrypted command and generates a second command, wherein the second command is encrypted with the computed second symmetric cryptographic key to provide a second encrypted command, and (ii) transmits to the first device the generated second encrypted command and a second MAC derived from (a) the computed second symmetric cryptographic key, (b) the first and second sets of parameters of the pre-determined PAKE protocol; (c) the first and second encrypted commands; and
deriving, on the first device, a second candidate MAC based on (a) the computed second symmetric cryptographic key, (b) the first and second sets of parameters of the pre-determined PAKE protocol; (c) the first and second encrypted commands;
validating, on the first device, that the second candidate MAC and the received second MAC match;
wherein if the derived second candidate MAC and the received second MAC match, the first device (i) decrypts and processes the received second encrypted command; and (ii) transmits to the second device the first symmetric cryptographic key encrypted with the second symmetric key; and
the second device decrypts the first symmetric encryption key using the computed second symmetric key;
deciphering the ciphertext included in the email message using the received first symmetric cryptographic key;
wherein a pre-determined number of authentication attempts may be performed, and wherein if the pre-determined number of authentication attempts is exceeded one of the first or second devices rejects any further authentication attempts during a pre-determined rejection time period.

### Claim 17 (depends on 16)

The method of claim 16, wherein the first and second devices are both personal devices.

### Claim 18 (depends on 17)

The method of claim 17, wherein the password is communicated by one of Short Message Service (SMS) or Instant Messenger.

### Claim 19 (depends on 16)

The method of claim 16, wherein the second device is a public computer.

### Claim 20 (depends on 16)

The method of claim 16, wherein a pre-determined number of authentication attempts may be performed, and wherein if the pre-determined number of authentication attempts is exceeded one of the first or second devices rejects any further authentication attempts; or wherein a pre-determined number of authentication attempts may be performed, and wherein if the pre-determined number of authentication attempts is exceeded one of the first or second devices rejects any further authentication attempts during a pre-determined rejection time period.

### Claim 21 (depends on 16)

The method of claim 16, wherein the data exchange occurs during a pre-determined time period.

### Claim 22 (depends on 16)

The method of claim 16, wherein the PAKE protocol is selected from the group consisting of an OPRF protocol, an DH-OPRF protocol, and a Secure Remote Password (SRP) protocol.

### Claim 23 (depends on 16)

The method of claim 16, wherein the established first communication channel is a direct peer-to-peer communication channel.

### Claim 24 (depends on 16)

The method of claim 16, wherein the established first communication channel is facilitated through a signaling server.

### Claim 25 (depends on 24)

The method of claim 24, wherein the signaling server transmits a Push Notification to the first device, and wherein the transmitted Push Notification includes the first set of parameters of the pre-determined PAKE protocol and the first identifier.

### Claim 26 (depends on 16)

The method of claim 16, wherein the first and second commands facilitate a negotiation of a second password.

### Claim 27 (depends on 26)

The method of claim 26, wherein the second password is used for subsequent secured communications between the first and second devices.

### Claim 28 (depends on 16)

The method of claim 16, wherein the first and second commands establish an OTP scheme used for subsequent secured communications between the first and second devices.

### Claim 29 (depends on 16)

The method of claim 16, wherein the first password is a publicly known password.

### Claim 30 (depends on 16)

The method of claim 16, wherein the first password is a password having low entropy.

### Claim 31 (depends on 16)

The method of claim 16, wherein after the data exchange is performed, the first password cannot be reused.

### Claim 32 (depends on 16)

The method of claim 16, wherein the first device is pre-programmed with first operator's asymmetric public key, the first command includes first operator's asymmetric public key and the second device stores it in a contact card of the first operator; and, subsequent emails from a second operator to the first operator are encrypted asymmetrically using the asymmetric public key of the first operator.

### Claim 33

The method of 16, wherein the second device is pre-programmed with second operator's asymmetric public key, the second command includes a second operator's asymmetric public key and the first device stores it in a contact card of the second operator; and, subsequent emails from the first operator to the second operator are encrypted asymmetrically using the asymmetric public key of the second operator.

### Claim 34 (depends on 16)

The method of claim 16, wherein the header of the composed email message comprises a plurality of email addresses corresponding to the one or more recipients, wherein:
a N-th recipient is a (N+1)-th operator using a (N+1)-th device;
a N-th identifier is derived such that it identifies the N-th recipient;
the first device uses a bank of memory to record under N-th identifier the data pertaining to the N-th recipient;
wherein when the first device communicates with one or more third devices, it uses the identifier received from the one or more third devices to lookup the data stored in the bank of memory.

### Claim 35 (depends on 34)

The method of claim 34, wherein the first device records a different password for each recipient of the one or more recipients, and each recipient of the one or more recipients must use the corresponding password to receive the symmetric cryptographic key.

### Claim 36 (depends on 16)

The method of claim 16, wherein the first password is an ordered list of objects denoted by words or by pictures.

### Claim 37 (depends on 32)

The method of claim 32, where the asymmetric key of first person is represented using a PGP public key or an S/MIME certificate, or another Public Key Infrastructure (PKI) certificate.

### Claim 38 (depends on 33)

The method of claim 33, where the asymmetric key of the second operator is represented using a PGP public key, or an S/MIME certificate, or another Public Key Infrastructure (PKI) certificate.