Password protocols using XZ-elliptic curve cryptography
AssigneeKing Fahd University of Petroleum and Minerals
InventorMohammad K. Ibrahim
Life of this patent
Estimating the term…
Abstract
Remote user authentication is provided using a password protocol based on elliptic curve cryptography. More specifically, the process uses the X-coordinate and the Z-coordinate of an elliptic curve when represented in projective coordinates, wherein point addition is defined over three dimensional space that includes the projective coordinate.
Claims21
A method for authenticating the identity of a device over an unsecured communications channel using a selected elliptic curve and a base point, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- encrypting a password using a deterministic and non-iterative process for embedding bit strings into the X coordinates and Z coordinates of points on a projected elliptic curve defined over a finite field and represented in projective coordinates;
- transmitting the encrypted data from said host computer device over the communication channel to the receiving computer device;
- and
- authenticating the password, wherein
- the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a first host computer device by a second client computer device over an unsecured communications channel using a password protocol based on shared key EC3 cryptography, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- agreeing by the host computer device and client computer device on a set EC3 by selecting an elliptic curve and a base point;
- converting a password of the host computer device by the client computer device to a first key;
- determining by the first device a cipher point based on the first key;
- and
- transmitting bits of the cipher point from the first device over the communications channel using the X-coordinate and the Z-coordinate of a projected elliptic curve when represented in projective coordinates, and wherein the projective coordinates ensure that the elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a host computer device having a password by a client computer device over an unsecured communications channel using a password protocol based on shared key EC3 cryptography using a selected elliptic curve and base point (XB, YB, ZB), the method comprising:
- providing a communication system including a client computer devices and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- converting by the first host device the password or its image under a one-way function into an equivalent scalar value, kU;
- determining by the first host device a first cipher point (XC, YC, ZC)by scalar multiplication of a scalar value, kU, with the base point, (XB, YB, ZB);
- and
- transmitting from the first host device bits of the X-coordinate, XC, and the Z-coordinate, ZC, of the first cipher point in projective coordinates of a projected elliptic curve to the client computer device for password verification, wherein the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
A method for authenticating the identity of a first host computer device having a password by a second client computer device over an unsecured communications channel using a password protocol based on a set EC3 using a selected elliptic curve, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- converting by the first host computer device the password or its image under a one-way function into a secret bit string, kp;
- dividing by the first host computer device the secret key string kp into three binary sub-strings, kp1, kp2 and kp3;
- embedding by the first host computer device the secret sub-string kp1 and kp2 into an X-coordinate and Z-coordinate using a deterministic and non-interactive process to obtain the password embedded point, (XP, YP, ZP);
- determining by the first host computer device a first cipher point (XC, YC, ZC) by scalar multiplication of the scalar value, kp3, with the password embedded point, (XP, YP, ZP);
- and
- transmitting by the first host computer device bits of the X-coordinate, XC, and the Z-coordinate, ZC, of the first cipher point (XC, YC, ZC) to the client computer device.
A method for authenticating the identity of a first host computer device having a password by a second client computer device over an unsecured communications channel using a password protocol based on public key EC3 cryptography using a selected elliptic curve, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- generating by the second device a random bit sting as a secret key, ks, of the client computer device;
- dividing by the client computer device the secret key ks into three binary sub-strings, kS1, kS2 and kS3;
- embedding by the client computer device the secret sub-string kS1 and kS2 into the X-coordinate and Z-coordinate using a deterministic and non-interactive process to obtain the secret-key embedded point of the client computer device, (XS, YS, ZS);
- determining by the client computer device a public key of the client computer device (XSPu,YSPu, ZSPu) by scalar multiplication of the scalar value of the third secret sub-string kS3 with the secret-key embedded point of the server, (XS, YS, ZS);
- and
- transmitting by the client computer device the public key of the client computer device to the first computer device.
A method for authenticating the identity of a host computer device having a password by a client computer device over an unsecured communications channel using a password protocol based on public key EC3 cryptography using a selected elliptic curve, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- generating by the client computer device a random bit string that is the secret key, ks, of the client computer device;
- dividing by the client computer device the secret key ks into three binary sub-strings, kS1, kS2 and kS3;
- embedding by the client computer device the secret sub-string kS1 and kS2 into the X-coordinate and Z-coordinate using a deterministic and non-iterative process to obtain the secret-key embedded point of the client computer device, (XS, YS, ZS);
- computing by the client computer device the public key of the client computer device (XSPu, YSPu, ZSPu) by scalar multiplication of the scalar value of the third secret sub-string kS3 with the secret-key embedded point of the server, (XS, YS, ZS);
- and
- transmitting by the client computer device the public key of the client computer device to the host computer device.
A method to establish a password pw, the method comprising:
- providing a communication system including a client computer device and a host computer device connected to said client computer device using a communication channel to provide network online services, contents and resources to one or more client devices and their users;
- selecting a random salt a;
- determining a one way has function where x=H(a, pw);
- determining a password verifier (Xv, Yv, Zv) by scalar multiplication of x with a base point (XB, YB, ZB);
- and
- storing (Xv, Yv, Zv) and a as the password verifier and salt, wherein p is a large prime number and (X, Y, Z) is an elliptic curve point defined over a selected elliptic curve in projective coordinates defined over a finite field.
A method to authenticate the identity of a host computer device by a client computer device where p is a large prime number and (X, Y, Z) is an elliptic curve point defined over a projected elliptic curve in projective coordinates defined over finite field, the method comprising:
- sending an identifier of the host computer device to the client computer device;
- retrieving by the client computer device a stored password verifier (Xv, Yv, Zv) and corresponding salt a of the host computer device;
- sending a to the host computer device from the client computer device;
- determining a long-term private key x of the host computer device using a one way hash function of a and the password pw;
- generating by the host computer device a random number u, where 1<u<p,
- determining by the host computer device a first ephemeral public key (XU, YU, ZU) by scalar multiplication of u and the base point (XB, YB, ZB);
- sending the first ephemeral public key projective coordinates X coordinate XU and the Z coordinate ZU from the host computer device to the client computer device, wherein the projective coordinates ensure that the projected elliptic curve and its twist are isomorphic to each other.
Dependencies are inferred from the claim text.