# US 2018/0026784 A1 · Secure channel establishment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026784 A1 - Document ID: US20180026784A1 - Status: Published application - Kind: A1 - Application number: 15/642,762 - Filed: 2017-07-06 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Mastercard International Incorporated - Applicants: MasterCard International Incorporated - Inventors: Michael Ward; John Beric; Duncan Garrett; David Anthony Roberts - Web page: https://patentgrep.com/patent/US20180026784A1 ## CPC - H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3033: {details relating to pseudo-prime or prime number generation, e.g. primality test} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of establishing a secure channel for communication between a first computing device and a second computing device is described. The method uses an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device. The first computing device generates (520) a blinding factor r and sends (540) a blinded public key R=r·Qc to the second computing device. The second computing device generates (510) an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sends Qt to the first computing device. The first computing device generates (530) Kc=KDF (r dc·Qt) and the second computing device generates (550) Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device. G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer, wherein r·dc is chosen such that z is a factor of r·dc. Suitable apparatus for performing the method is also described. ## Claims ### Claim 1 A method of establishing a secure channel for communication between a first computing device and a second computing device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device, the method comprising: the first computing device generating a blinding factor r and sending a blinded public key R=r·Qc to the second computing device; the second computing device generating an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sending Qt to the first computing device; wherein the first computing device generates Kc=KDF (r dc·Qt) and the second computing device generates Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device; wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer; wherein r·dc is chosen such that z is a factor of r·dc. ### Claim 2 (depends on 1) The method of claim 1, wherein z is a factor of r. ### Claim 3 (depends on 1) The method of claim 1, wherein z=z1·z2, wherein z1 and z2 are integers, and z1 is a factor of r and z2 is a factor of dc. ### Claim 4 (depends on 1) The method of claim 1, wherein G is a point on the NIST P-256 elliptic curve. ### Claim 5 (depends on 1) The method of claim 1, wherein the second computing device sends its ephemeral public key Qt to the first computing device, before receiving the blinded public key R from the first computing device. ### Claim 6 (depends on 1) The method of claim 1, wherein the first computing device sends the blinded public key R and an encrypted blinding factor r to the second computing device. ### Claim 7 (depends on 6) The method of claim 6, wherein the first computing device sends an encrypted public key certificate for the card public key Qc with the encrypted blinding factor r. ### Claim 8 A computing device comprising a processor and a memory and configured to carry out the following steps as a first computing device to establish a secure channel for communication between the first computing device and a second computing device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device: generating a blinding factor r and sending a blinded public key R=r·Qc to the second computing device; receiving an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G generated by the second computing device; generating Kc=KDF (r dc·Qt) while the second computing device generates Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device; wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer; wherein r·dc is chosen such that z is a factor of r·dc. ### Claim 9 (depends on 8) The computing device of claim 8, wherein z is a factor of r. ### Claim 10 (depends on 8) The computing device of claim 8, wherein z=z1·z2, wherein z1 and z2 are integers, and z1 is a factor of r and z2 is a factor of dc. ### Claim 11 (depends on 8) The computing device of claim 8, wherein the computing device is further configured to send the blinded public key R and an encrypted blinding factor r to the second computing device. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the computing device is further configured to send an encrypted public key certificate for the card public key Qc with the encrypted blinding factor r. ### Claim 13 (depends on 8) The computing device as claimed in claim 8, wherein the computing device is an externally powered passive device. ### Claim 14 (depends on 9) The computing device as claimed in claim 9, wherein the computing device is a payment card. ### Claim 15 A computing device comprising a processor and a memory and configured to carry out the following steps as a second computing device to establish a secure channel for communication between a first computing device and the second computing device using an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dc with a public key Qc=dc G certified by a party trusted by the second computing device: receiving a blinded public key R=r·Qc from the first computing device, which has generated a blinding factor r; generating an ephemeral private key dt and a corresponding ephemeral public key Qt=dt G and sending Qt to the first computing device; while the first computing device generates Kc=KDF (r dc·Qt), generating Kt=KDF (dt·R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device; wherein G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z·m′ where m′ is prime and z is an integer; wherein r·dc is chosen such that z is a factor of r·dc. ### Claim 16 (depends on 15) The computing device of claim 15, wherein z is a factor of r. ### Claim 17 (depends on 15) The computing device of claim 15, wherein z=z1·z2, wherein z1 and z2 are integers, and z1 is a factor of r and z2 is a factor of dc. ### Claim 18 (depends on 15) The computing device of claim 15, wherein the computing device is further configured to send its ephemeral public key Qt to the first computing device, before receiving the blinded public key R from the first computing device. ### Claim 19 (depends on 15) The computing device of claim 15, wherein the computing device is a terminal of a transaction system.