Cryptographic authentication and/or establishment of shared cryptographic keys, including, but not limited to, password authenticated key exchange (PAKE)

A computer-implemented cryptographic method for communication between a first computer entity and a second computer entity, the method comprising performing, by the second computer entity, at least part of an authentication operation in which the second computer entity checks whether or not the first computer entity knows a predefined secret password π as a value whose knowledge is to be proven in the authentication operation,

• wherein each of the first and second computer entities comprises a computer processor executing associated computer instructions and operating on associated data;
• said at least part of the authentication operation comprising the second computer entity performing the following operations in interacting with the first computer entity:
• determining, from the password π known to the second computer entity as a value whose knowledge is to be proven in the authentication operation, a predefined position in a database, wherein the predefined position depends on the password π and wherein the predefined position and the password π are not revealed by the second computer entity to the first computer entity;
• executing a protocol in which the second computer entity sends one or more queries for data in a database, the queries being for data in the predefined position in the database, the queries not informing the first computer entity of the predefined position, wherein the second computer entity receives one or more responses to the queries from the first computer entity;
• wherein the first computer entity knows a first position in the database, wherein the first position is not revealed by the first computer entity to the second computer entity;
• wherein if the password π is known to the first computer entity and is used by the first computer entity to determine the first position then the predefined position is the same as the first position;
• checking whether or not the first computer entity knows the password π as a value whose knowledge is to be proven in the authentication operations, wherein checking whether or not the first computer entity knows the password π as a value whose knowledge is to be proven in the authentication operation comprises:
• the second computer entity receiving data for use in checking whether or not the predefined position is the same as the first position determined by the first computer entity, the first position being unrevealed to the second computer entity, the received data not revealing the first position, and
• the second computer entity checking from the received data whether or not the predefined position is the same as the first position.

A computer-implemented cryptographic method comprising performing, by a first computer entity, at least part of an authentication operation in which the first computer entity proves, to a second computer entity, knowledge of a predefined secret password π as a value whose knowledge is to be proven in the authentication operation,

• wherein each of the first and second computer entities comprises a computer processor executing associated computer instructions and operating on associated data;
• said at least part of the authentication operation comprising the first computer entity performing the following operations in interacting with the second computer entity:
• determining, from the password π known to the first computer entity as a value whose knowledge is to be proven in the authentication operation, a first position in a database, wherein the first position depends on the password π and wherein the first position and the password π are not revealed by the first computer entity to the second computer entity, and determining data in the first position in the database;
• executing a protocol in which the first computer entity receives one or more queries for data in the database, the queries being for data in a second position in the database, wherein if the password π is known to the second computer entity and is used by the second computer entity to determine the second position then the second position is the same as the first position, the queries not informing the first computer entity of the second position nor of the password π, wherein the first computer entity provides the data in the second position to the second computer entity without knowing the second position;
• proving that the first computer entity knows the value π as a value whose knowledge is to be proven in the authentication operations, wherein proving that the first computer entity knows the value π as a value whose knowledge is to be proven in the authentication operation comprises the first computer entity sending data depending on the first position to the second computer entity for enabling the second computer entity to check whether or not the first position is the same as the second position known to the second computer entity, the sent data not revealing the first position to the second computer entity.

A computer-implemented method for communication between a first computer entity and a second computer entity, the method comprising performing, by the second computer entity, at least part of an authentication operation in which the second computer entity proves, to the first computer entity, knowledge of a predefined secret password π as a value whose knowledge is to be proven in the authentication operation,

• wherein each of the first and second computer entities comprises a computer processor executing associated computer instructions and operating on associated data;
• said at least part of the authentication operation comprising the second computer entity performing the following operations in interacting with the first computer entity:
• determining, from the password π known to the second computer entity as a value whose knowledge is to be proven in the authentication operation, a predefined position in a database, wherein the predefined position depends on the password π and wherein the predefined position and the password π are not revealed by the second computer entity to the first computer entity;
• executing a protocol in which the second computer entity sends one or more queries for data in a database, the queries being for data in the predefined position in the database, the queries not informing the first computer entity of the predefined position, wherein the second computer entity receives one or more responses to the queries from the first computer entity;
• wherein the first computer entity knows a first position in the database, wherein the first position is not revealed by the first computer entity to the second computer entity;
• wherein if the password π is known to the first computer entity and is used by the first computer entity to determine the first position then the predefined position is the same as the first position;
• proving that the second computer entity knows the password π as a value whose knowledge is to be proven in the authentication operations, wherein proving that the second computer entity knows the password π as a value whose knowledge is to be proven in the authentication operation comprises the second computer entity sending data depending on the predefined position to the first computer entity for enabling the first computer entity to check whether or not the first position determined by the first computer entity and unrevealed to the second computer entity is the same as the predefined position, the sent data not revealing the predefined position to the first computer entity.