# US 8,787,566 B2 · Strong encryption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,787,566 B2 - Document ID: US8787566B2 - Status: Granted - Kind: B2 - Application number: 11/466,763 - Filed: 2006-08-23 - Published: 2008-03-20 - Granted: 2014-07-22 - Earliest claimed: 2006-08-23 - Assignees: Red Hat, Inc. - Applicants: Robert Relyea - Inventors: Robert Relyea - Web page: https://patentgrep.com/patent/US8787566B2 ## CPC - H04L 9/0822: {using key encryption key} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An embodiment generally relates to a method of strong encryption. The method includes generating a first cryptographic key based on a random number and generating a second cryptographic key based on a password. The method also includes encrypting private data with the first cryptographic key to arrive at wrapped private data and encrypting the first cryptographic key with the second cryptographic key to arrive at a wrapped first cryptographic key. ## Claims ### Claim 1 A method comprising: providing, by a processing device, a user interface in response to receiving a token; receiving a user selection of one of a plurality of security modes via the user interface; in response to a user selection of a first security mode, generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user; encrypting private data of the user with the first cryptographic key to create wrapped private data; and encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and in response to a user selection of a second security mode, generating a third cryptographic key based on a password of a user; generating an exponent; encrypting the exponent based on the third cryptographic key; generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is ge mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and encrypting private data of the user with the fourth cryptographic key to create wrapped private data, wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p. ### Claim 2 (depends on 1) The method of claim 1, further comprising storing the wrapped private data in a first location and storing the wrapped pseudo-random cryptographic key in a second location. ### Claim 3 (depends on 1) The method of claim 1, wherein the exponent of the time-expanding function is a pseudo-random number. ### Claim 4 (depends on 3) The method of claim 3, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters. ### Claim 5 (depends on 1) The method of claim 1, wherein the time-expanding function is based on one of digital signature algorithm, EI-Gamal encryption algorithm, or Diffie-Hellman. ### Claim 6 An apparatus comprising: a memory to contain instructions; and a processor coupled to the memory and to execute the instructions to perform operations comprising: providing a user interface in response to receiving a token; receiving a user selection of one of a plurality of security modes via the user interface; in response to a user selection of a first security mode, generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user; encrypting private data of the user with the first cryptographic key to create wrapped private data; and encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and in response to a user selection of a second security mode, generating a third cryptographic key based on a password of a user; generating an exponent; encrypting the exponent based on the third cryptographic key; generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is ge mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and encrypting private data of the user with the fourth cryptographic key to create wrapped private data, wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p. ### Claim 7 A non-transitory computer-readable medium comprising instructions to cause a processing device to perform operations comprising: providing, by the processing device, a user interface in response to receiving a token; receiving a user selection of one of a plurality of security modes via the user interface; in response to a user selection of a first security mode, generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user; encrypting private data of the user with the first cryptographic key to create wrapped private data; and encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and in response to a user selection of a second security mode, generating a third cryptographic key based on a password of a user; generating an exponent; encrypting the exponent based on the third cryptographic key; generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is ge mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and encrypting private data of the user with the fourth cryptographic key to create wrapped private data, wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p. ### Claim 8 A method comprising: receiving a private key of a user; generating, by a processor, a first cryptographic key based on a password of the user; generating an exponent; encrypting the exponent based on the first cryptographic key; generating a second cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is ge mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; encrypting the private key of the user with the second cryptographic key to create wrapped private key; and storing the encrypted exponent and the wrapped private key in separate protected locations, wherein a time to attack the second cryptographic key increases with value of p. ### Claim 9 (depends on 8) The method of claim 8, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters. ### Claim 10 (depends on 9) The method of claim 9, wherein the exponent of the time-expanding function is a pseudo-random number. ### Claim 11 A system comprising: a server to execute a token management system, the token management system to generate and manage cryptographic keys; at least one client to couple with the server; and a security client to be executed on the at least one client, wherein the security client is to provide a user interface in response to receiving a token; receive a user selection of one of a plurality of security modes via the user interface; in response to a user selection of a first security mode, generate a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user, encrypt private data of the user with the first cryptographic key to create wrapped private data, and encrypt the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key, and in response to a user selection of a second security mode, generate a third cryptographic key based on a password of a user, generate an exponent, encrypt the exponent based on the third cryptographic key, generate a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is ge mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator, and encrypt private data of the user with the fourth cryptographic key to create wrapped private data, wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p. ### Claim 12 (depends on 11) The system of claim 11, wherein the wrapped private data and the wrapped pseudo-random cryptographic key are stored in separate locations in the server. ### Claim 13 (depends on 11) The system of claim 11, wherein the exponent of the time-expanding function is a pseudo-random number. ### Claim 14 (depends on 13) The system of claim 13, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters.