Password protocols using xz-elliptic curve cryptography
AssigneeKing Fahd University of Petroleum and Minerals
InventorMohammad K. Ibrahim
Life of this patent
Estimating the term…
Abstract
Remote user authentication is provided using a password protocol based on elliptic curve cryptography. More specifically, the process uses the X-coordinate and the Z-coordinate of an elliptic curve when represented in projective coordinates, wherein point addition is defined over three dimensional space that includes the projective coordinate.
Claims21
A method for authenticating the identity of a device over an unsecured communications channel using a selected elliptic curve and a base point, the method comprising:
- encrypting a password using a deterministic and non-iterative process for embedding bit strings into the X coordinate and Z coordinate of points on a projected elliptic curve defined over a finite field and represented in projective coordinates;
- transmitting the encrypted data over the communication channel to the receiving device;
- and
- authenticating the password, wherein
- the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a first device by a second device over an unsecured communications channel using a password protocol based on shared key EC3 cryptography, the method comprising:
- agreeing by the first and second devices on a set EC3 by selecting an elliptic curve and a base point;
- converting a password of the first device by the device to a first key;
- determining by the first device a cipher point based on the first key;
- and
- transmitting bits of the cipher point from the first device over the communications channel using the X-coordinate and the Z-coordinate of a projected elliptic curve when represented in projective coordinates, and wherein the projective coordinates ensure that the elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a first device having a password by a second device over an unsecured communications channel using a password protocol based on shared key EC3 cryptography using a selected elliptic curve and base point (XB, YB, ZB), the method comprising:
- converting by the first device the password or its image under a one-way function into an equivalent scalar value, kU;
- determining by the first device a first cipher point (XC, YC, ZC) by scalar multiplication of a scalar value, kU, with the base point, (XB, YB, ZB);
- and
- transmitting from the first device bits of the X-coordinate, XC, and the Z-coordinate, ZC, of the first cipher point in projective coordinates of a projected elliptic curve to the second device for password verification, wherein the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a first device having a password by a second device over an unsecured communications channel using a password protocol based on a set EC3 using a selected elliptic curve, the method comprising:
- converting by the first device the password or its image under a one-way function into a secret bit string, kp;
- dividing by the first device the secret key string kp into three binary sub-strings, kp1, kp2 and kp3;
- embedding by the first device the secret sub-string kp1 and kp2 into an X-coordinate and Z-coordinate using a deterministic and non-interactive process to obtain the password embedded point, (XP, YP, ZP);
- determining by the first device a first cipher point (XC, YC, ZC) by scalar multiplication of the scalar value, kp3, with the password embedded point, (XP, YP, ZP);
- and
- transmitting by the first device bits of the X-coordinate, XC, and the Z-coordinate, ZC, of the first cipher point (XC, YC, ZC) to the second device.
A method for authenticating the identity of a first device having a password by a second device over an unsecured communications channel using a password protocol based on public key EC3 cryptography using a selected elliptic curve, the method comprising:
- generating by the second device a random bit sting as a secret key, ks, of the second device;
- dividing by the second device the secret key k, into three binary sub-strings, kS1, kS2 and kS3;
- embedding by the second device the secret sub-string kS1 and kS2 into the X-coordinate and Z-coordinate using a deterministic and non-interactive process to obtain the secret-key embedded point of the second device, (XS, YS, ZS);
- determining by the second device a public key of the second device (XSPu, YSPu, ZSPu) by scalar multiplication of the scalar value of the third secret sub-string kS3 with the secret-key embedded point of the server, (XS, YS, ZS);
- and
- transmitting by the second device the public key of the second device to the first device.
A method for authenticating the identity of a first device having a password by a second device over an unsecured communications channel using a password protocol based on public key EC3 cryptography using a selected elliptic curve, the method comprising:
- generating by the second device a random bit string that is the secret key, ks, of the second device;
- dividing by the second device the secret key k, into three binary sub-strings, kS1, kS2 and kS3;
- embedding by the second device the secret sub-string kS1 and kS2 into the X-coordinate and Z-coordinate using a deterministic and non-iterative process to obtain the secret-key embedded point of the second device, (XS, YS, ZS);
- computing by the second device the public key of the second device (XSPu, YSPu, ZSPu) by scalar multiplication of the scalar value of the third secret sub-string kS3 with the secret-key embedded point of the server, (XS, YS, ZS);
- and
- transmitting by the second device the public key of the second device to the first device.
A method to establish a password pw, the method comprising:
- selecting a random salt a;
- determining a one way has function where x=H(a, pw);
- determining a password verifier (Xv, Yv, Zv) by scalar multiplication of x with a base point (XB, YB, ZB);
- and
- storing (Xv, Yv, Zv) and a as the password verifier and salt, wherein p is a large prime number and (X, Y, Z) is an elliptic curve point defined over a selected elliptic curve in projective coordinates defined over a finite field.
A method to authenticate the identity of a first device by a second device where p is a large prime number and (X, Y, Z) is an elliptic curve point defined over a projected elliptic curve in projective coordinates defined over finite field, the method comprising:
- sending an identifier of the first device to the second device;
- retrieving by the second device a stored password verifier (Xv, Yv, Zv) and corresponding salt a of the first device;
- sending a to the first device from the second device;
- determining a long-term private key x of the first device using a one way hash function of a and the password pw;
- generating by the first device a random number u, where 1<u<p,
- determining by the first device a first ephemeral public key (XU, YU, ZU) by scalar multiplication of u and the base point (XB, YB, ZB);
- sending the first ephemeral public key projective coordinates X coordinate XU and the Z coordinate ZU from the first device to the second device, wherein the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
Dependencies are inferred from the claim text.