Key agreement and transport protocol with implicit signatures

A method of authenticating a pair of correspondents A, B to permit exchange of information therebetween, each of said correspondents having a respective private key a, b and a public key pA, pB derived from a generator α and respective ones of said private keys a, b, said method including the steps of

• (i) a first of said correspondents A selecting a first random integer x and exponentiating a function ƒ(α) including said generator to a power g(x) to provide a first exponentiated function ƒ(α)g(x);
• (ii) said first correspondent A generating a first signature sA from said first random integer x and said exponentiated function ƒ(α)g(x);
• (iii) said first correspondent A forwarding to a second correspondent B a message including said first exponentiated function ƒ(α)g(x) and said signature sA;
• (iv) said correspondent B selecting a second random integer y and exponentiating a function ƒ′(α) including said generator to a power g(y) to provide a second exponentiated function ƒ′(α)g(y) and generating a signature sB obtained from said second integer y and said second exponentiated function ƒ′(α)g(y);
• (v) said second correspondent B forwarding a message to said first correspondent A including said second exponential function ƒ′(α)g(y) and said signature sB;
• (vi) each of said correspondents verifying the integrity of messages received by them by computing from said signature and said exponentiated function in such a received message a value equivalent to said exponentiated function and comparing said computed value and said transmitted value;
• (vii) each of said correspondents constructing a session key K by exponentiating information made public by another of said correspondents with said first random integer that is private to itself.