Cryptographic authentication, and/or establishment of shared...

Details Cryptographic authentication, and/or establishment of shared... Cryptographic authentication, and/or establishment of shared...

2006-07-14

2010-10-12

Zia, Syed A. (Department: 2431)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Particular communication authentication technique

C713S169000, C713S170000, C713S171000, C713S182000, C713S159000, C380S229000

Reexamination Certificate

active

07814320

ABSTRACT:
Using a password (π), a client (C) computes part (H1(<C,πC>) of the password verification information of a server (S), and together they use this information to authenticate each other and establish a cryptographic key (K′), possibly using a method resilient to offline dictionary attacks. Then over a secure channel based on that cryptographic key, the server sends an encryption (EE<C,π>(sk)) of a signing key (sk) to a signature scheme for which the server know a verification key (pk). The encryption is possibly non-malleable and/or includes a decryptable portion (E<C,π>(sk)) and a verification portion (H8(sk)) used to verify the decrypted value obtained by decrypting the decryptable portion. The signing key is based on the password and unknown to the server. The client obtains the signing key using the password, signs a message, and returns the signature to the server. The server verifies this signature using the verification key, hence getting additional proof that the client has knowledge of the password. The client and the server generate a shared secret key (K″), more secure than the password, for subsequent communication.

REFERENCES:
patent: 5241599 (1993-08-01), Bellovin et al.
patent: 5440635 (1995-08-01), Bellovin et al.
patent: 6226383 (2001-05-01), Jablon
patent: 6411715 (2002-06-01), Liskov et al.
patent: 6757825 (2004-06-01), Mackenzie et al.
patent: 6792533 (2004-09-01), Jablon
patent: 6952771 (2005-10-01), Zuccherato et al.
patent: 6988198 (2006-01-01), Zuccherato et al.
patent: 7073068 (2006-07-01), Jakobsson et al.
patent: 7076656 (2006-07-01), MacKenzie
patent: 7149311 (2006-12-01), MacKenzie et al.
patent: 7359507 (2008-04-01), Kaliski
patent: 7493488 (2009-02-01), Lewis et al.
patent: 7522723 (2009-04-01), Shaik
patent: 2002/0067832 (2002-06-01), Jablon
patent: 2003/0079124 (2003-04-01), Serebrennikov
patent: 2003/0221102 (2003-11-01), Jakobsson et al.
patent: 2003/0229788 (2003-12-01), Jakobsson et al.
patent: 2004/0030932 (2004-02-01), Juels et al.
patent: 2004/0234074 (2004-11-01), Sprunk
patent: 2006/0041759 (2006-02-01), Kaliski et al.
patent: 2006/0095769 (2006-05-01), Zuccherato et al.
Password Authenticated Key Exchange Protocol with Stronger Security Ding Xiao-fei, Ma Chuan-gui, Cheng Qing-feng Educational Technology and Computer Science, 2009. ETCS '09. First International Workshop. Mar. 7-8, 2009.
M. Abdalla and D. Pointcheval. Simple Password-Based Encrypted Key Exchange Protocols. InRSA Conference, Cryptographer's Track, CT-RSA 05, LNCS 3376, pp. 191-208, 2005.
M. Bellare, D. Pointcheval, and P. Rogaway. Authenticated key exchange secure against dictionary attacks. InEUROCRYPT 2000(LNCS 1807), pp. 139-155, 2000.
M. Bellare and P. Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In 1stACMConference on Computer and Communications Security, pp. 62-73, Nov. 1993.
M. Bellare and P. Rogaway. Entity authentication and key distribution. InCRYPTO '93(LNCS 773), pp. 232-249, 1993.
M. Bellare and P. Rogaway. Provably secure session key distribution—the three party case. In27thACM Symposium on the Theory of Computing, pp. 57-66, 1995.
S. M. Bellovin and M. Merritt. Encrypted key exchange: Password-based protocols secure against dictionary attacks. InIEEE Symposium on Research in Security and Privacy, pp. 72-84, 1992.
S. M. Bellovin and M. Merritt. Augmented encrypted key exchange: A password-based protocol secure against dictionary attacks and password file compromise. InACM Conference on Computer and Communications Security, pp. 244-250, 1993.
D. Boneh. The decision Diffie-Hellman problem. InProceedings of the Third Algorithmic Number Theory Symposium(LNCS 1423), pp. 48-63, 1998.
V. Boyko, P. MacKenzie, and S. Patel. Provably secure password authentication and key exchange using Diffie-Hellman. InEUROCRYPT 2000(LNCS 1807), pp. 156-171, 2000.
R. Canetti, S. Halevi, J. Katz, Y. Lindell, and P. MacKenzie. Universally-composable password-based key exchange. To appear inEurocrypt, 2005.
R. Cox, E. Grosse, R. Pike, D. Presotto, and S. Quinlan. Security in Plan 9. InUsenix Security Symposium2002.
R. Cramer and V. Shoup. A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack. InCRYPTO '98(LNCS 1462), pp. 13-25, 1998.
W. Diffie and M. Hellman. New directions in cryptography.IEEE Trans. Info. Theory, 22(6):644-654, 1976.
W. Ford and B. S. Kaliski, Jr. Server-assisted generation of a strong secret from a password. InProceedings of the 5thIEEE International Workshop on Enterprise Security, 2000.
R. Gennaro and Y. Lindell. A Framework for Password-Based Authenticated Key Exchange.Advances in Cryptology—Eurocrypt 2003, LNCS vol. 2656, Springer-Verlag, pp. 524-543, 2003.
O. Goldreich and Y. Lindell. Session-Key Generation using Human Passwords Only. InCRYPTO 2001(LNCS 2139), pp. 408-432, 2001.
L. Gong. Optimal authentication protocols resistant to password guessing attacks. In8thIEEE Computer Security Foundations Workshop, pp. 24-29, 1995.
L. Gong, T. M. A. Lomas, R. M. Needham, and J. H. Saltzer. Protecting poorly chosen secrets from guessing attacks.IEEE Journal on Selected Areas in Communications, 11(5):648-656, Jun. 1993.
S. Halevi and H. Krawczyk. Public-key cryptography and password protocolsACM Transactions on Information and System Security(TISSEC), vol. 2, No. 3, pp. 230-268, Aug. 1999. ACM. (Preliminary version) appeared in the 5th ACM-CCS, pp. 122-131. 1998. ACM.
IEEE Standard 1363-2000, Standard specifications for public key cryptography, 2000.
D. Jablon. Strong password-only authenticated key exchange.ACM Computer Communication Review, ACM SIGCOMM, 26(5):5-20, 1996.
D. Jablon. Extended password key exchange protocols immune to dictionary attack. InWETICE'97 Workshop on Enterprise Security, 1997.
D. Jablon Password authentication using multiple servers. InRSA Conference 2001, Cryptographers' Track(LNCS 2020), pp. 344-360, 2001.
S. Jiang and G. Gong. Password based key exchange with mutual authentication. InWorkshop on Selected Areas of Cryptography(SAC), 2004.
J. Katz, R. Ostrovsky, and M. Yung. Efficient password-authenticated key exchange provably secure under standard assumptions. InEurocrypt 2001(LNCS 2045), pp. 475-494, 2001.
J. Katz and M. Yung. Complete characterization of security notions for probabilistic private-key encryption. InACM Symposium on Theory of Computing, pp. 245-254, 2000.
C. Kaufmann and R. Perlman. PDM: A New Strong Password-Based Protocol. InUsenix Security Symposium, 2001.
T. Kwon. Authentication and Key Agreement via Memorable Passwords. In2001 Internet Society Network and Distributed System Security Symposium, 2001.
S. Lucks. Open key exchange: How to defeat dictionary attacks without encrypting public keys. InProceedings of the Workshop on Security Protocols, 1997.
P. MacKenzie, S. Patel, and R. Swaminathan. Password authenticated key exchange based on RSA. InASIACRYPT 2000(LNCS 1976), pp. 599-613, 2000.
P. MacKenzie. More Efficient Password-Authenticated Key Exchange, RSA Conference, Cryptographer's Track (LNCS 2020), pp. 361-377, 2001.
P. MacKenzie. The PAK suite: Protocols for password-authenticated key exchange. DIMACS Technical Report 2002-46, Oct. 2002.
National Institute of Standards and Technology (NIST). Announcing the Secure Hash Standard, FIPS 180-1, U.S. Department of Commerce, Apr. 1995.
S. Patel. Number theoretic attacks on secure password schemes. InProceedings of the IEEE Symposium on Research in Security and Privacy, pp. 236-247, 1997.
Phoenix Technologies. http://www.phoenix.com/, 2005.
R. Rivest, A. Shamir, and L. Adleman. A method for obtaining digital signature and public key cryptosystems.Communications of the ACM, 21:120-126, 1978.
M. Roe, B. Christianson, and D. Wheeler. Secure sessions from weak secrets. Technical report, University of Cambridge and University of Hertfordshire, 1998.
C. P. Schnorr. Efficient identification and signatures for smart cards. InCrypto '89(LNCS 435), pp. 235-251, 1990.
M. Steiner, G. Tsudik, and M. Waidner. Refinement and

Affiliated with

Also associated with

Rating

Cryptographic authentication, and/or establishment of shared... does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Cryptographic authentication, and/or establishment of shared..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Cryptographic authentication, and/or establishment of shared... will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-4196058