Key agreement and transport protocol
AssigneeCerticom Corp.
InventorsScott A. Vanstone, Alfred John Menezes, Mingua Qu
Life of this patent
Estimating the term…
Abstract
A key establishment protocol includes the generation of a value of cryptographic function, typically a hash, of a session key and public information. This value is transferred between correspondents together with the information necessary to generate the session key. Provided the session key has not been compromised, the value of the cryptographic function will be the same at each of the correspondents. The value of the cryptographic function cannot be compromised or modified without access to the session key.
Claims16
A method of authenticating a pair of correspondents A, B in a public key data communication system to permit exchange of information therebetween over a communication channel, each of said correspondents having a respective private key a, b and a public key pA, pB derived from a generator α and respective ones of said private keys a, b, said method including the steps of:
- i) a first of said correspondents A selecting a first random integer x and exponentiating a first function f(α) including said generator to a power g(x) to provide a first exponentiated function f(α)g(x);
- ii) said first correspondent A forwarding to a second correspondent B a message including said first exponentiated function f(α)g(x);
- iii) said correspondent B selecting a second random integer y and exponentiating a second function f′(α) including said generator to a power g(y) to provide a second exponentiated function f′(α)g(y);
- iv) said second correspondent B constructing a session key K from information made public by said first correspondent A including said public key pA, and information that is private to said second correspondent B, said session key K also being constructible by said first correspondent A from information made public by said second correspondent B including said public key pB, and information that is private to said first correspondent A;
- v) said second correspondent B generating a value h of a function F[π, K] where F[π, K] denotes a cryptographic function F applied conjointly to π and K to bind the values of π to K and where π is obtained from said information made public by said second correspondent B to permit construction of said session key K;
- vi) said second of said correspondents B forwarding a message to said first correspondent A including said second exponentiated function f′(α)g(y) and said value h of said cryptographic function F[π, K];
- vii) said first correspondent receiving said message and computing a session key K′ from said information made public by said second correspondent B and private to said first correspondent A;
- viii) said first correspondent A computing a value h′ by application of a cryptographic function F to π and K′;
- and
- ix) comparing said values obtained from said application of said cryptographic functions F to confirm their correspondence.
A method of transporting a key between a pair of correspondents A, B in a public key data communication system to permit exchange of information therebetween over a communication channel, each of said correspondents having a respective private key a, b and a public key pA, pB derived from a generator α and respective ones of said private keys a, b, said method including the steps of:
- i) a first of said correspondents A selecting a first random integer x and exponentiating a function f(α) including said generator to a power g(x) to provide a first exponentiated function f(α)g(x);
- ii) said first correspondent A forwarding to a second correspondent B a message including said first exponentiated function f(α)g(x);
- iii) said second correspondent B constructing a session key K from information made public by said first correspondent A including said public key pA, and information that is private to said second correspondent B, said session key K also being constructible by said first correspondent A from information made public by said second correspondent B including said public key pB, and information that is private to said first correspondent A;
- iv) both of said first correspondent A and said second correspondent B computing a respective value h, h′ of function F[π, K] where F [π, K] denotes a cryptographic function applied to π and K thereby to bind the values of π and K where π is obtained from said information made public by one of said correspondents to permit construction of said session key K;
- and
- v) at least one of said correspondents comparing said values h, h′ obtained from said cryptographic function F to confirm their correspondence.
Dependencies are inferred from the claim text.