Hardware supported authentication and signatures for wireless, distributed and blockchain systems
AssigneeUniversity of South Florida
InventorsAttila Altay Yavuz, Saif Nouma
Life of this patent
Estimating the term…
Abstract
Systems and methods for efficient cryptographic signing in heterogeneous systems that include IoT or other resource-limited devices. A signer which is the resource-limited device is not expected to generate, store and/or communicate expensive commitment values and/or public keys. A secure hardware platform serves as PUblic nonce-Commitment-Key Oracle (PUCKO) that computes and transmits commitments (e.g., one-time public key keys, ephemeral algebraic commitments) on behalf of the signer(s) to verifiers (or other signers in distributed signatures).
Claims16
A method of generating a cryptographic signature in a heterogeneous system, comprising:
- locally generating, at a signer, a hash on a message using a private seed of the signer and communicating the hash as a signature, the signer being a resource-limited device that does not receive the hash from another device or generate or store commitment values, public nonces and public keys;
- the signer, using a hash-based algorithm to transform a signature HORS into an unbounded time signature;
- at the signer, using a hash chain on a signer's private seed and incrementing a counter during each signature generation to provide a forward-secure multiple-time signature;
- receiving the signature, the unbounded time signature and the forward-secure multiple-time signature at a verifier;
- requesting, by the verifier, a public key and at least one public commitment that corresponds to the signer and the signature from a public key supplier that includes a trusted hardware environment;
- and
- providing, by the public key supplier and independently of the signer, the public key and the at least one public commitment to the verifier,
- wherein the trusted hardware environment of the public key supplier stores a master key from which per-signer keys are deterministically derived, and
- wherein the public key supplier provides standard cryptographic hash functions, and generates a public nonce, the public key, and commitments on behalf of the signer to reduce computational requirements at the signer.
A system for generating a cryptographic signature in a heterogeneous computational environment, comprising:
- a signer that locally generates a hash on a message using a private seed of the signer, wherein the hash is communicated as a signature, the signer being a resource-limited device that does not receive the hash from another device or generate or store commitment values, public nonces and public keys, wherein a hash-based algorithm is used to transform a signature HORS at the signer into an unbounded time signature, and wherein a hash chain is used on a signer's private seed and increment a counter during each signature generation to provide a forward-secure multiple-time signature;
- a public key supplier that executes on secure hardware having a trusted hardware environment that provides standard cryptographic hash functions;
- and
- a verifier that receives the signature, the unbounded time signature and the forward-secure multiple-time signature and requests a public key and at least one public commitment that corresponds to the signer and the signature from the public key supplier,
- wherein the public key supplier that includes a trusted hardware environment and that stores a master key from which per-signer keys are deterministically derived, and
- wherein the public key supplier generates a public nonce, the public key, and commitments on behalf of the signer to reduce computational requirements at the signer.
Dependencies are inferred from the claim text.