System and method for enabling different grades of cryptography strength in a product

A method for enabling high strength cryptography in a cryptographic product supplied by a product provider, the cryptographic product being installed on a client and initially exposing a low strength cryptography without exposing the high strength cryptography, the method comprising the following steps:

• (A) performing a registration phase between a certifying authority and the product provider, comprising the following steps:
• submitting a request from the certifying authority to the product provider, the request containing an identity certificate of the certifying authority and a desired cryptography strength;
• verifying, at the product provider, an authenticity of the certifying authority;
• computing, at the product provider, a hash digest of the identity certificate;
• creating, at the product provider, a token containing the hash digest of the identity certificate and capabilities to enable the desired cryptography strength;
• transferring the token from the product provider to the certifying authority;
• (B) performing an issuance phase between the certifying authority and the client, comprising the following steps:
• submitting a request from the client to the certifying authority, the request containing an identity of the client and a particular cryptography strength;
• verifying, at the certifying authority, an authenticity of the client;
• evaluating, at the certifying authority, whether the client may be granted the particular cryptography strength;
• creating, at the certifying authority, an authorization certificate that contains an identity of the certifying authority;
• including the token with the authorization certificate;
• transferring the authorization certificate and the token from the certifying authority to the client;
• (C) performing a use phase at the client, comprising the following steps:
• verifying that the authorization certificate originated from the certifying authority;
• verifying that the token originated from the product provider;
• verifying that the token contains the hash digest of the certifying authority's identity certificate;
• and
• if the verifying steps in step (C) return true, utilizing the capabilities contained in the token to expose the high strength cryptography in the cryptographic product.

A method for upgrading a cryptographic product installed on a client computer from using low strength cryptography to using high strength cryptography, comprising the following steps:

• obtaining a signed token from a provider of the cryptographic product, the token containing capabilities to expose the high strength cryptography and an identity of a particular certifying authority to which the token is issued;
• generating a certificate containing the identity of the certifyng authority;
• embedding the signed token within the certificate;
• and
• transferring the certificate with embedded token to the client computer.

In a cryptographic product that is capable of employing varying strength cryptography including at least low and high strength cryptography, a method for exposing the high strength cryptography comprising the following steps:

• initially exposing the low strength cryptography without exposing the high strength cryptography;
• receiving a certificate from a certifying authority, the certificate carrying a token granted by a provider of the cryptographic product, the token containing capabilities to expose the higher strength cryptography in the cryptographic product and an identity of the certifying authority;
• verifying that the certificate originated from the certifying authority;
• verifying that the token originated from the product provider;
• verifying that the token contains the identity of the certifying authority;
• and
• if the verifying steps return true, utilizing the capabilities contained in the token to expose the high strength cryptography in the cryptographic product.

A system comprising:

• a client;
• at least one cryptographic-based product installed on the client, the product being capable of using multiple strength cryptography including at least low and high strength cryptography, the product initially exposing the low strength cryptography without exposing the high strength cryptography;
• a server located at a certifying authority separate from the client;
• the client being configured to submit a request to the server for authorization to expose the high strength cryptography;
• the server being configured to generate an authorization certificate in response to the request, the authorization certificate containing an identity of the certifying authority and a token from a provider of the cryptographic-based product, the token containing capabilities to expose the higher strength cryptography in the cryptographic product and an encoded identity of the certifying authority, the server passing the authorization certificate and the token to the client;
• and
• the cryptographic-based product being configured to verify an authenticity of the authorization certificate and an authenticity of the token, and to expose the high strength cryptography using the capabilities contained in the token.

A data structure embodied on a computer-readable medium, comprising:

• an issuer field to hold an identity of a certifying authority that issues a digital certificate for enabling a cryptographic product to expose one or more strengths of cryptography;
• a subject field to hold an identity of a client to which the digital certificate is issued;
• and
• an extension field to hold a digital token issued by a provider of the cryptographic product, the token containing capabilities to expose the one or more strengths of cryptography in the cryptographic product and an encoded identity of the certifying authority.

A system comprising:

• a computer;
• at least one cryptographic-based product installed on the computer, the product being capable of using multiple strength cryptography including at least low and high strength cryptography, the product initially exposing the low strength cryptography without exposing the high strength cryptography;
• the computer being configured to submit a request to a server for an authorization certificate to expose the high strength cryptography, the authorization certificate containing a token from a provider of the cryptographic-based product, the token containing capabilities to expose the higher strength cryptography in the cryptographic product;
• and
• the cryptographic-based product being configured to verify an authenticity of the authorization certificate and an authenticity of the token and to expose the high strength cryptography using the capabilities contained in the token.

A system for upgrading a cryptographic product installed on a client computer from using low strength cryptography to using high strength cryptography, comprising:

• means for obtaining a signed token from a provider of the cryptographic product, the token containing capabilities to expose the high strength cryptography and an identity of a particular certifying authority to which the token is issued;
• means for generating a certificate containing the identity of the certifying authority;
• means for embedding the signed token within the certificate;
• and
• means for transferring the certificate with embedded token to the client computer.