Publicly verifiable key recovery

0001Publicly Verifiable Key Recovery Background of the Invention

0002Field of the Invention

0003The present invention relates generally to cryptographic communication systems, and more specifically, toward the verification of information encrypted within a data recovery field.

0004Related Art

0005Communication between two parties can be secured through the encryption of data using a symmetric session key. One method of generating a session key uses a DifBe-Hellman key exchange. The session key is determined by a sender based on a private key of the sender and a public key of a receiver. The session key is determined by the receiver using a private key of the receiver and a public key of the sender. Because of the way in which the private key and the public key are determined, the sender and the receiver will each determine the identical session key. Once determined, the session key is used to encrypt the communications between the two parties.

0006Law enforcement officials are naturally concerned with the widespread use of encryption by criminal entities. Accordingly, law enforcement officials require some form of assurance that they will be able to recover the encrypted communications under the proper circumstances, for example, after obtaining a court order. This form of limited access to the encrypted communications is enabled by the creation and use of a data recovery field ("DRF"), and more particularly a key recovery field ("KRF"). The KRF includes the session key encrypted using the public key of a recovery agent (e.g., a trusted data recovery center ("DRC")) or other information that only the recovery agent can use to determine the session key. For a law enforcement official to recover the contents of the KRF, the law enforcement official provides the KRF together with a suitable court order to the DRC. If the court order is valid, the DRC uses the KRF to determine the session key and provides it to the law enforcement official, thereby allowing access to the encrypted session. From the standpoint of the government, this system will only be effective if the session key or other information included within the KRF is the same session key that was used to encrypt the communications. Thus, what is needed is a system and method for verifying that the session key can be recovered from information included within the KRF without revealing any private information.

0007Summary of the Invention

0008The present invention is a system and method for verifying that a session key, or other user secret, can be recovered from public information associated with an encrypted communication in a system using a Diffie-Hellman key exchange protocol. In particular, the present invention provides recovery information to a recovery agent that allows the recovery agent to recover the session key. In addition to the recovery information, the present invention provides verification information that allows a verifier to verify that the session key can be recovered from the recovery information.

0009N feature of the present invention is that only the recovery agent can recover the session key. Furthermore, any person or device with the proper verification information (and, of course, instructions) can verify that the session key is recoverable from the recovery information. The present invention accomplishes this without revealing any secret information. In other words, the recovery information is publicly verifiable.

0010Brief Description of the Figures

0011The foregoing and other features and advantages of the invention will be apparent from the following, more particular description of a preferred embodiment of the invention, as illustrated in the accompanying drawings. In the drawings, like reference numbers indicate identical or functionally similar elements. Additionally, the left-most digit of a reference number identifies the drawing in which the reference number first appears.

0012FIG. 1 illustrates secure communications between two parties;

0013FIG. 2 illustrates the generation of a Diffie-Hellman key pair; FIG. 3 illustrates a Diffie-Hellman key exchange protocol;

0014FIG. 4 illustrates a Diffie-Hellman key recovery protocol;

0015FIG. 5 illustrates a Diffie-Hellman verifiable key recovery protocol;

0016FIG. 6 illustrates an interactive El Gamal challenge-response protocol;

0017FIG. 7 illustrates a non-interactive El Gamal challenge-response protocol; FIGS. 8 A and 8B illustrate a publicly verifiable key recovery challenge- response protocol;

0018FIGS. 9 A and 9B illustrate a publicly verifiable Diffie-Hellman key recovery protocol that incorporates split key recovery;

0019FIGS. 10A and 10B illustrate a publicly verifiable Diffie-Hellman key recovery protocol that incorporates Gifford key sealing;

0020FIG. 11 illustrates a communication message sent according to one embodiment of the present invention; and

0021FIG. 12 illustrates a communication channel employing firewalls according to a preferred embodiment of the present invention. Detailed Description of the Preferred Embodiments

0022Overview

0023FIG. 1 illustrates secure communications between a first party 110 and a second party 120. For purposes of this discussion, first party 110 is shown in the diagrams as "Alice" and second party 120 is shown in the diagrams as "Bob" following a convention adopted by Bruce Schneier in Applied Cryptography

0024Second Edition: Protocols, Algorithms, and Source Code in C, John Wiley & Sons, Inc., New York, 1996. The convention as adapted for the following discussion is set forth below in Table I.

0025<img file="WO9847260A3_D0001.tif" />

0026As shown in FIG. 1, Alice 110 sends Bob 120 an encrypted message 115 (shown as C_a in FIG. 1). In response, Bob 120 sends Alice 120 an encrypted message 125 (shown as , in FIG. 1). Encrypted message 115 is a message from Alice, m_a, encrypted by a key, s_a, belonging to Alice. Encrypted message 125 is a message from Bob, ^ encrypted by a key, s_b, belonging to Bob. In a preferred embodiment of the present invention, keys s_a and are sessions keys determined according to a Diffie-Hellman key exchange protocol and are thus equivalent to one another. Other embodiments of the present invention may use similar protocols for determining session keys that may or may not be equivalent to one another. Furthermore, as is discussed in further detail below, still other embodiments employ a single session key, such as for storing confidential data, or several session keys, such as for securely communicating among more than two parties.

0027Diffie-Hellman Key Exchange Protocol

0028FIG. 2 and FIG. 3 together illustrate a Diffie-Hellman key exchange protocol 300. FIG. 2 illustrates the generation of a Diffie-Hellman key pair (i.e., a private key and a public key) for Alice 110 and for Bob 120. FIG. 3 illustrates a DiflBe-Hellman key exchange protocol 300 that generates a session key for Alice 110 and Bob 120.

0029The following convention is used in the illustrations to discuss the various protocols. A circle in the illustration (e.g. Alice 110 and Bob 120 in FIG. 2) depicts a party operating in the protocol. A solid line with an arrow connecting two parties indicates a step of sending or providing information from one party to another party in the protocol. A dashed line with an arrow indicates the flow of processing performed by a particular party. A rectangle in the illustration indicates a particular step performed by that particular party. A hexagonal polygon in the illustration indicates a particular result achieved by that particular party obtained through the use of the protocol. A diamond in the illustration indicates a decision step that must be resolved by a particular party in the protocol. The usefulness of this convention will become more apparent by the following discussion.

0030As mentioned above, FIG. 2. illustrates the generation of a Diffie-Hellman key pair by each of Alice 110 and Bob 120. Diffie-Hellman key pairs are generated, given a public prime number, p, and a public number called the generator, g, according to the following relationship:

0031y = g^x mod p (1)

0032where : is a randomly generated number called the private key such that 0 &lt; x_a &lt;p, y is a public key, and (x, y) is a Diffie-Hellman key pair. EQ. (1) represents a one-way function in that computation of the public key, y, is easy given the private key, x; but computation of the private key, x, given the public key, y, is computationally difficult. Herein lies the significance of the Diffie-Hellman key pairs. Alice and Bob can exchange their respective public keys and derive a shared secret key that only they know (as described below).

0033The generation of a Diffie-Hellman key pair 210 for Alice 110 is now discussed. In a step 204, Alice 110 generates a random private key, x_a, according to techniques well known in the art. The private key is bounded by the large public prime, p, as indicated in EQ. (1). In a step 206, Alice 110 determines a public key according to EQ. (1). In particular, Alice 110 determines:

0034y_a = g^X" mod /^; (2)

0035where x_a is Alice's randomly generated private key such that 0 &lt; x_a &lt;p, y_a is Alice's public key, and (x₀ y is Alice's Diffie-Hellman key pair. After determining the public key according to EQ. (2), Alice 110 obtains a DiflBe- Hellman key pair 210. Similar processing is performed by Bob 120. In a step 214, Bob 120 generates a random private key, X_b, according to techniques well known in the art. The private key is bounded by the large public prime, p, as indicated in EQ. (1). In a step 216, Bob 120 determines a public key according to EQ. (1). In particular, Bob 120 determines:

0036y_b = g ^X" m d /^; (3)

0037where x_b is Bob's randomly generated private key such that 0 &lt; x_b &lt;p, y_b is Bob's public key, and (x_b, y,) is Bob's Diffie-Hellman key pair. After determining the public key according to EQ. (2), Bob 120 obtains a Diffie- Hellman key pair 220.

0038Key pairs 210, 220 are not used to encrypt/decrypt all the messages in a communication session. Rather, key pairs 210, 220 are used merely to derive a session key between Alice 110 and Bob 120. This session key is typically a symmetric key which is used to both encrypt and decrypt the messages sent during a particular communication session.

0039As mentioned above, FIG. 3 illustrates how a session key is determined according to Diffie-Hellman key exchange protocol 300. In a step 302, Alice 110 provides Bob 120 with her public key. After receiving Alice's public key, Bob 120, in a step 304, provides Alice 110 with his public key. The exchange of public keys can be accomplished according to various techniques well known in the art. For example, Alice 110 can send her public key directly and openly to Bob 120 (and vice versa) via any conventional communication system including, but not limited to telephone, telegraph, facsimile, modem, E-mail, etc. The exchange can also be accomplished using a public directory where owners or a trusted entity publish public keys for use by the general public as is also well known in the art. Thus, the present invention contemplates an exchange of public keys in steps 302, 304 according any known or future technique whereby Alice 110 obtains Bob's public key and whereby Bob

0040120 obtains Alice's public key.

0041Anytime after Alice 110 receives or is provided with Bob's public key, in a step 306, Alice 110 determines a Diffie-Hellman session key according to the following relationship: <img file="WO9847260A3_D0002.tif" />

0042where s_a is a session key determined by Alice, x_a is Alice's private key, and y_b is Bob's public key. As a result of the determination of EQ. (4), Alice 110 obtains a session key 310. Another expression can be found for session key 310 by substituting EQ. (3) into EQ. (4) which yields the following relationship:

0043s_a = g^x*^*b mod p (5) where s_a is a session key determined by Alice, x_a is Alice's private key, and x_b is Bob's private key. Similarly, anytime after Bob 120 receives or is provided with Alice's public key, in a step 316, Bob 120 determines a Diffie-Hellman session key according to the following relationship:

0044sb = ya " ^mod P (⁶)

0045where s_b is a session key determined by Bob, x_b is Bob's private key, and y_a is Alice's public key. As a result of the determination of EQ. (6), Bob 120 obtains a session key 320. Another expression can be found for session key 320 by substituting EQ. (2) into EQ. (6) which yields the following relationship:

0046s_b = g^x"^Xb mod p (7)

0047where s_b is a session key determined by Bob, x_a is Alice's private key, and x_b is Bob's private key. Comparing EQ. (5) and EQ. (7) yields the following relationship:

0048sa = ^sb = 8^X"^{Xb mod} P («)

0049As shown by EQ. (8), session keys 310, 320 are equivalent to one another even though neither Alice 110 nor Bob 120 has access to or knowledge of the other's private key. After completing Diffie-Hellman key exchange protocol 300, both Alice 110 and Bob 120 have equivalent session keys 310, 320 whereby they may begin their secure communications.

0050As mentioned above, law enforcement officials would like to have access to the secure communications between Alice 110 and Bob 120 should either of them be suspected of criminal activities. One method of providing access to the secure communications uses a recovery agent. According to this method, the session key is encrypted with a public key of the recovery agent and placed in a data recovery field ("DRF"), or more particularly but without limitation a key recovery field ("KRF"), that is sent together with the encrypted message. Later, if the need should arise, and upon obtaining proper authorization, the law enforcement officials present the KRF to the recovery agent who uses his private key to recover the session key. The session key is then used by the recovery agent or the law enforcement officials to decrypt the encrypted message. Such a method is discussed in detail in U.S. Patent Nos. 5,557,346 and 5,557,765. Furthermore,

0051Trusted Information Systems has developed RecoverKey, which is a system that incorporates many of the features disclosed in the above referenced patents.

0052In addition to providing the recovery agent with means to recover the session key, the present invention provides additional functionality by permitting any third party (i.e. a verifier) to verify that a KRF includes the proper session key, particularly, the session key that was used to encrypt the message. The present invention accomplishes this without revealing any private, or secret, information to the third party.

0053Diffie-Hellman Key Recovery Protocol FIG. 4 illustrates a Diffie-Hellman key recovery protocol 400 whereby

0054Alice 110 provides recovery information that permits, or enables, a recovery agent 410 to recover session key 310. Protocol 400 is now described with reference to FIG. 4. In a step 402, recovery agent 410 (shown in FIG. 4 and referred to herein as "Roger") provides Alice 110 with a public key, y_π which is a portion of his Diffie-Hellman key pair. Roger 410 determines his key pair in a manner similar to that discussed above with respect to Alice 110 and Bob 120 using EQ. (1) to obtain the following relationship:

0055y_r = g^*' mod p (9)

0056where x_r is Roger's randomly generated private key such that 0 &lt; x_r &lt;p, y_r is Roger's public key, and (x„ y_r) is Roger's Diffie-Hellman key pair. Roger 410 provides Alice 110 with his public key, y_r, using any known technique including general publication as would be apparent.

0057In a preferred embodiment of the present invention, in a step 404, Alice 110 provides Roger 410 with her public key, y_a. Step 404 may occur only once during the life of Alice's key pair, or each time Alice 110 seeks to secure a communication session. In another embodiment of the present invention, Alice's public key is incorporated into the KRF as will be discussed in further detail below. Regardless of how step 404 specifically operates, Roger 410 ultimately obtains possession of Alice's public key.

0058In a step 406, Alice 110 provides Bob 120 with her public key, y_a, as discussed above with respect to step 302. In a step 408, Bob 120 provides Alice

0059110 with his public key, y_b, as discussed above with respect to step 304. After receiving Alice's public key, Bob 120, in a step 414, determines session key 320 as discussed above with respect to step 316. As far as Bob 120 is concerned, protocol 400 is complete. Alice 110 and Roger 410, however, have further processing to complete.

0060In a step 412, Alice 110 determines recovery information based on Bob's public key, Roger's public key, and Alice's private key. Specifically, Alice 110 determines the recovery information according to the following relationship:

0061t= (y_b/y_r)^x° mod p (10)

0062where t is the recovery information, y_b is Bob's public key, y_r is Roger's public key, x_a is Alice's private key.

0063As is well known, 1/x mod/7 is the multiplicative inverse ofj mod/7.

0064As mentioned above, the recovery information obtained via EQ. (10) permits Roger 410 to recover session key 310 as will be discussed below.

0065In a step 416, Alice 110 provides Roger 410 with the recovery information. In one embodiment of the present invention, Alice 110 sends the recovery information to Roger 410 shortly after its determination. In another embodiment of the present invention, the recovery information is provided in a KRF associated with the encrypted message as will be discussed in further detail below. In this embodiment, Roger 410 does not receive the recovery information until a law enforcement official or other individual with proper authority presents the KRF to him for recovery of the session key.

0066After receiving the recovery information, in a step 418, Roger 410 determines a session key according to the following relationship:

0067sr = ^fy ^mod P ⁽ⁿ⁾

0068where s_r is a session key determined by Roger, t is the recovery information, y_a is Alice's public key, and x_τ is Roger's private key. As a result of the determination of EQ. (11), Roger 410 obtains a session key 420. Another expression for session key 420 can be found by substituting EQ. (2), EQ. (9) and EQ. (10) into EQ. (11) which yields the following relationship:

0069sr = <img file="WO9847260A3_D0003.tif" />^mod P = s^{XaXb mod} P (12)

0070where s_r is a session key determined by Roger, x_a is Alice's private key, y_a is Alice's public key, x_b is Bob's private key, y_b is Bob's public key, x_r is Roger's private key, and y_r is Roger's public key. Comparing EQ. (8) and EQ. (12) yields the following relationship:

0071sa = ^sb = ^sr = g^X"^X" ^mod P (¹³)

0072where s_a is a session key determined by Alice, s_b is a session key determined by Bob, s_r is a session key determined by Roger, x_a is Alice's private key, and x_b is Bob's private key. As shown by EQ. (12), session keys 310, 320, 420 are equivalent to one another.

0073Furthermore, EQ. (12) demonstrates that Roger 410 is able to recover session key 310 from the recovery information using Alice's public key and his own private key. No private information (i.e., private keys) was revealed. (Note that Roger 410 knows his own private key, x,.) Importantly, neither Alice 110 nor Bob 120 have had their respective private keys compromised; only the identical session keys 310, 320 were revealed. Thus, both Alice 110 and Bob 120 are able to continue using their private keys with other parties without fear that their private keys have been compromised. Diffie-Hellman key recovery protocol 400 is not sufficient, however, to enable or permit any third party to verify that the recovery information can be used to recover session key 310. Only Roger 410 can verify that session key 310 can be recovered from the recovery information. Another protocol is necessary to enable third parties to verify that session key 310 can be recovered from the recovery information.

0074In the above described scenario, Alice was the sender. It should be noted, however, that the sender could have been Bob instead of Alice. Also, according to the present invention, Bob and Alice could provide recovery information to different recovery agents.

0075Diffie-Hellman Verifiable Key Recovery

0076FIG. 5 illustrates a Diffie-Hellman verifiable key recovery protocol 500 according to the present invention, whereby Alice 110 provides recovery information that permits, or enables, Roger 410 to recover session key 310, and whereby Alice 110 provides verification information that permits, or enables, a verifier 510 to verify that Roger 410 can recover session key 310 from the recovery information. Protocol 500 is now described with reference to FIG. 5.

0077In a step 502, Roger 410 provides Alice 110 with his public key, y_π as discussed above with reference to step 402. In a step 504, Alice 110 provides

0078Roger 410 with her public key, y_a, as discussed above with respect to step 404. In a step 506, Alice 110 provides Bob 120 with her public key, y_a, as discussed above with respect to step 302. In a step 508, Alice 110 provides verifier 510 (shown in FIG. 5 and referred herein as "Victor") with her public key, y^ in various manners similar to those used to provide Roger 410 with her public key. In a step 512, Bob 120 provides Alice 110 with his public key, y_b, as discussed above with respect to step 304. After receiving Alice's public key, Bob

0079120, in a step 516, determines session key 320 as discussed above in step 316. As far as Bob 120 is concerned, in this embodiment of the present invention, protocol 500 is complete.

0080Alice 110, Roger 410, and Victor 510, however, have further processing to complete. In a step 514, Alice 110 determines recovery information based on Bob's public key, Roger's public key, and Alice's private key as discussed above with respect to 412. In a step 518, Alice 110 provides Roger 410 with the recovery information as discussed above with respect to step 416. After receiving the recovery information, in a step 522, Roger 410 can determine session key 420 as discussed above. At this point, as far as Roger 410 is concerned, protocol 500 is complete.

0081However, Alice 110 must allow Victor 510 to verify that the recovery information can be used to recover session key 310. In a step 524, Alice 110 provides Victor 510 with the recovery information and verification information so that Victor 510 can verify that session key 310 can be recovered from the recovery information. In a preferred embodiment of the present invention this can be stated a bit differently: Alice 110 must allow Victor 510 to verify that the session key that Roger 410 can derive is the same session key that is used in to communicate with Bob 120 (i.e., EQ. (13) holds).

0082The verification information provided to Victor 510 depends on the type of proof required by Victor 510, or law enforcement officials, to ensure that Alice 110 has provided Roger 410 with the proper recovery information. The present invention contemplates various verification schemes for verifying that Alice provided Roger 410 with the proper recovery information. Two of these, a challenge-response proof and a zero-knowledge proof, are described in further detail below. Other verification schemes could be used in the present invention as would be apparent. In any of the verification schemes, Victor's 510 objective is to prove the following relationship:

0083(14)

0084Substituting EQ. (6) and EQ. (11) into EQ. (14) yields the following relationship:

0085ty ^Xr mod p = y ^x" mod p (15)

0086In order for EQ. (15) to be true, the recovery information, t, must be:

0087t = mod g y_b

0088P = mod p = mod p (16) y_a^"r g^x"^Xr y ^x"

0089In order to prove to Victor 510 that EQ. (14) holds (i.e, that the session key

0090Roger 410 derives is the same as the session key shared by Alice 110 and Bob 120), Alice 110 must prove that EQ. (16) holds. However, proving EQ. (16) directly would require Alice 110 to reveal her private key, x_^ which she would prefer not to do. Instead, Alice 110 can prove to Victor 510 that EQ. (16) holds without revealing her private key by showing that she knows a simultaneous discrete logarithm. In other words, Alice 110 can show that she knows a number that is the solution to two distinct discrete logarithm problems.

0091The first discrete logarithm is obtained by taking the logarithm of EQ. (10) with base y y_r, which yields:

0092x_a = lo _J * mod /> (17)

0093The second discrete logarithm is obtain by taking the logarithm of EQ. (2), which yields:

0094xa ^{= lo}&amp;_gy_a^mod P (18) Equating EQ. (17) and EQ. (18) yields the following expression:

0095^,0g ^ ^{= l0g}s " ^{mθd P} (19)

0096In order for Alice 110 to prove that EQ. (16) holds without revealing any private, or secret information, she must show that she knows a solution to both EQ. (17) and EQ. (18). In other words, Alice 110 must demonstrate to Victor 510 that her public key and the recovery information are determined or computed using the same private key, namely, x_a.

0097Both of the verification schemes referred to above, and discussed in further detail below, require that additional information be provided to Victor 510 so that he can verify that the session key can be recovered from the recovery information. This additional information is referred to herein as verification information.

0098Verification information includes any information that is necessary to verify the recovery information. In other words, the verification information must not introduce further ambiguities or uncertainties, or if it does, must do so only within tolerable probabilities (e.g., zero-knowledge proofs). The present invention contemplates that, in one or more embodiments, the verification information can be identical to the recovery information. In these embodiments, the recovery information can be verified using only public information or information otherwise available to the verifier (e.g., Victor 510), and no additional information would be required. In these embodiments, providing verification information may be equivalent to providing recovery information.

0099El Gamal Challenge-Response Protocol

0100One of the verification schemes Alice 110 can use to prove that she knows a simultaneous discrete logarithm is a challenge-response El Gamal digital signature protocol. Two variations of the El Gamal digital signature protocol are shown in FIG. 6 and FIG. 7 and are described in further detail below. El Gamal digital signatures operate using private keys that are discrete logarithms of public keys as is well known. The present invention will operate with any of the El Gamal family of digital signature algorithms, including the Digital Signature Algorithm (DSA). According to the present invention, Alice 110 can prove her knowledge of the simultaneous discrete logarithm by providing two El Gamal digital signatures. This is the preferred embodiment of the present invention because of the simplicity, efficiency, and availability of standard implementations of digital signatures over zero-knowledge proofs. As is well known, an El Gamal public key is given according to the following relationship:

0101y = g^x mod p (20)

0102where x is the El Gamal private key, y is the El Gamal public key, p is the public prime, and g is the public generator. An El Gamal signature (a,b) of an integer, c, by a private key, x, is given by the following relationship:

0103a = g ^k mod p

0104(21) b = Λ ^_1 (c - ax) mod (p - 1)

0105where (a,b) is the El Gamal digital signature, j is the El Gamal private key, y is the El Gamal public key, c is the integer, also referred to as a challenge, A: is a randomly generated integer, p is the public prime, and g is the public generator. Verification of the digital signature is accomplished by determining that the following holds:

0106y ^a a ^b = g ^c mod /7 (22)

0107where

0108(a,b) is the El Gamal digital signature, y is the El Gamal public key, c is the challenge, p is the public prime, and g is the public generator.

0109If EQ. (22) holds, then Alice 110 must know the discrete logarithm of the public key. In other words, if Alice 110 can determine a digital signature, (a,b), such that EQ. (22) holds for the public key, y, then she must know, the private key, x.

0110A brief discussion of two variations of a general El Gamal challenge- response protocol is provided prior to discussing how El Gamal protocols are used in various embodiments of the present inventions. These variations include an interactive El Gamal challenge-response protocol and a non-interactive El

0111Gamal challenge-response protocol.

0112Interactive El Gamal Challenge-response Protocol FIG. 6 illustrates an interactive El Gamal Challenge-response protocol

0113600. In a step 602, Victor 510 issues a challenge to Alice 110. In one embodiment of the present invention, Victor 510 provides Alice 110 with a randomly generated integer, c. In a step 604, Alice 110 computes an El Gamal digital signature according to EQ. (21) using the challenge, the generator, g, the modulus, p, and the public key, y. In a step 606, Alice 110 provides Victor 510 with the digital signature determined in step 604. In a step 608, Victor 510 verifies that EQ. (22) holds using the digital signature provided by Alice 110 in step 606. If Victor 510 determines that EQ. (22) holds, then Victor 510 is assured that Alice 110 knows the private key, x. In other words, if EQ. (22) holds, Victor 510 is assured that Alice knows the discrete logarithm of the number y, base g, mod p. Specifically, as shown in step

0114610 of FIG. 6, if EQ. (22) holds, Alice 110 has proven to Victor 510 that she knows the discrete logarithm (i.e., x) of the public key, y.

0115In practice, El Gamal digital signature protocols replace the challenge, c, with a hash of the challenge, (H(c)), where H(x) is a collision-free hash function. The hash of the challenge is used in place of the challenge itself in order to prevent forgery attacks to the above described protocol.

0116The above described El Gamal digital signature protocol is referred to as a challenge-response protocol because Victor 510 provides a "challenge" and Alice 110 provides a "response" to the challenge. More particularly, the above described protocol is referred to as an interactive challenge-response protocol because both Victor 510 and Alice 110 are required to "interact" with one another to complete the protocol.

0117Non-Interactive El Gamal Challenge-Response Protocol

0118FIG. 7 illustrates a non-interactive El Gamal challenge-response protocol 700. Protocol 700 is non-interactive because Alice 110 and Victor 510 need not interact with one another for Alice 110 to prove that she knows the discrete logarithm. This non-interactive challenge-response protocol is the preferred embodiment of the present invention because it reduces the number of exchanges involved in the protocol as will be apparent from the following discussion. In addition, this embodiment permits any party, not just Victor 510, to verify proof of the knowledge of the discrete logarithm, as will be discussed below.

0119Referring to FIG. 7, in a step 702, Alice 110 generates a random integer, c\ Any well known procedure for generating random integers can be employed, such as procedures that use Alice's public key, Bob's public key, time, Roger's public key, a certificate, a hash of a public key, or any combination of the above. It should be understood that these examples are provided for purposes of illustration only, and are not limiting.

0120As discussed above, random integer, c', is also referred to as a challenge. In a step 704, Alice 110 computes a hash of the challenge according to the following:

0121c = H{c ') (23)

0122where c' is a randomly generated integer referred to as a challenge, c is a hash of the challenge, and H(x) is collision-free hash function.

0123As mentioned above, the hash function is a well known method of preventing forgery attacks. In addition, the hash function permits Alice 110 to generate her own challenge without fear that she will attempt to somehow select a challenge that thwarts EQ. (22). In other words, the hash function prevents Alice 110 from selecting her own value of the challenge in an attempt to spoof the verification process. The fact that Alice 110, and not Victor 510, generates the challenge makes this particular protocol non-interactive.

0124In a step 706, Alice determines an El Gamal digital signature according to EQ. (21) as: a g mod p

0125(24) b = k ^c - ax) mod p 1)

0126where

0127(a,b) is the El Gamal digital signature, x is the El Gamal private key, y is the El Gamal public key, c is the hash of the challenge, c', k is a randomly generated integer, p is the public prime, and g is the public generator. In a step 708, Alice provides the verification information to Victor 510. In this embodiment of the present invention, the verification information includes the challenge, the hash of the challenge, and the digital signature.

0128In a step 710, Victor 510 computes a hash of the challenge, c', provided by Alice 110 to verify that the computed hash is equivalent to the hash provided by Alice 110. The hash function is non-invertible; thus, it is computationally infeasible for Alice 110 to select a hash of the challenge and then determine the challenge from the hash. By verifying that the hash he computed is the same as the hash provided by Alice 110, Victor 510 can verify that Alice 110 is not attempting to spoof the El Gamal digital signature protocol.

0129In a step 712, Victor 510 verifies that EQ. (22) holds using the digital signature (a,b) provided by Alice 110 in step 708. If Victor 510 determines that

0130EQ. (22) holds, then Alice 110 has proven to Victor 510 that she knows the discrete logarithm (i.e., x) of the public key, y.

0131If Victor 510 determines that the computed hash and the hash provided by Alice 110 are equivalent and that EQ. (22) holds, then Victor 510 has verified the El Gamal digital signature protocol.

0132The discussion above with respect to FIG. 6 and FIG. 7 illustrates the operation of an El Gamal digital signature. The following discussion illustrates the operation of the present invention using two El Gamal digital signatures.

0133Specifically, the following discussion illustrates the use of two non-interactive digital signatures in various embodiments of the present invention.

0134Publicly Verifiable Key Recovery Using a Challenge-Response Protocol

0135FIG. 8 illustrates a publicly verifiable key recovery challenge-response protocol 800 according to the present invention. According to the present invention, Alice 110 uses two non-interactive challenge-response protocols 700 to show that she knows the discrete logarithm of two distinct values. See EQ. (17) and EQ. (18). Alice 110 uses a first challenge-response protocol to show that she knows an exponent, α, such that:

0136t = (y_biy_rY mod p (25)

0137where t is the recovery information, y_b is Bob's public key, y_τ is Roger's public key, and is the exponent of which Alice is demonstrating knowledge. Alice 110 does so by creating a first El Gamal signature, (a^b_j), of a random number, c_x = H(c_j'), using the recovery information, t, as the exponent and (y_b/y_r) as the generator. This is expressed, using EQ. (24) as:

0138aι = (y_b^fy_r) * ^mod P (26) b - k₁^~1 (c₁ - a^ mod (p - 1)

0139where

0140(βj_fbj) is the first El Gamal digital signature, yt is Bob's public key, y_r is Roger's public key, x_a is Alice's private key, Cj is the first hash of the first challenge, k, is a randomly generated integer, and p is the public prime. The first digital signature is verified using the following expression:

0141' "' "I ¹ = (y_bfy_r)^Ci mod /⁷ (27)

0142where

0143(aj,bj) is the first El Gamal digital signature, t is the recovery information, y_b is Bob's public key, y_r is Roger's public key,

0144Cj is first hash of the first challenge, and p is the public prime. In other words, if EQ. (27) holds, Alice has demonstrated that she knows α.

0145Alice 110 uses a second challenge response protocol to show that she knows an exponent, β, such that:

0146(*>y_a) ⁼ (y_biy_rgΫ od p (28)

0147where t is the recovery information, y_a is Alice's public key, y_b is Bob's public key, y_τ is Roger's public key, g is the public generator, and β is the exponent of which Alice is demonstrating knowledge. Alice does so by creating a second El Gamal signature, (a₂,b₂), of a random number, C₂ = H^'), using t/y_a mod p as the public key and (y_b / y_r g) mod p as the generator. This is expressed, using EQ. (24) as:

0148<img file="WO9847260A3_D0004.tif" />

0149where

0150(a₂,b₂) is the second El Gamal digital signature, y_b is Bob's public key, y_r is Roger's public key, x_a is Alice's private key, c₂ is the second hash of the second challenge, k₂ is a randomly generated integer, g is the public generator, and p is the public prime. The second digital signature is verified using the following expression:

0151(t/y_a)^a*a₂^b2 = (y_b/y_rg)^Cϊ mod p (30)

0152where (0_2*bz) is the second El Gamal digital signature, t is the recovery information, y_a is Alice's public key, y_b is Bob's public key, y_r is Roger's public key, c₂ is second hash of the second challenge, g is the public generator, and p is the public prime. In other words, if EQ. (30) holds, Alice 110 has shown that she knows β.

0153By demonstrating that Alice 110 knows α and β, Alice 110 has demonstrated that she knows the discrete logarithms of EQ. (17) and EQ. (18).

0154In other words, by knowing α and β, Alice 110 has demonstrated that she knows her private key, x_a. This is demonstrated by Theorem (1).

0155Theorem 1. If Alice 110 knows the discrete logarithms a and β, as verified by EQ. (15), then either a =β = x_a or she knows the discrete logarithm of (y_b /y_r).

0156Proof. EQ. (28) is equivalent to the following expression: t (y_b/y_r)^a (y_biy_r mod p (31) y° g^x° g

0157which can be expressed as:

0158g ^X" ^{' P} = (y_b/y_r^β mod p = g *^(« - P⁾ mod p (32) where: y = x. - x mod p - 1 (33)

0159which is the discrete logarithm of (y^y . Taking the discrete logarithm of EQ.(33) yields the following expression:

0160γ(α - β) = x_a - β mod (p - 1) (₃ )

0161which can be expressed as:

0162*. ^" β

0163(35) a

0164EQ. (35) has two important cases. If α ≠ β, then Alice 110 must know the discrete logarithm, γ, of (yι/y_r), because she knows all the other quantities. Otherwise, a - β = x_a, and Alice 110 need not know γ.

0165Theorem 1 demonstrates the impossibility of spoofing the present invention (e.g., by having α ≠ β). If Alice 110 cannot solve discrete logarithms and determine γ (which is the central assumption underlying the Diffie-Hellman key exchange), then she can only spoof the system by knowing Bob's private key, X_b, and Roger's private key, x,, according to EQ. (33). Even if Alice 110 and Bob 120 collude, Alice 110 cannot spoof the present invention because EQ. (33) still requires Roger' s private key.

0166According to the present invention, a verification function is used to verify that Alice 110 has provided the proper recovery information. This verification function is expressed as:

0167V = v, V where

0168V_j - (t ^fll - (y_b/y_r)^Ci mod /7 (36) b. v2 ⁼ WyJ ²«2 - iy_biy_τg) ² mod p (aj,bj) is the first El Gamal digital signature, (a₂,b₂) is the second El Gamal digital signature, t is the recovery information, y_a is Alice's public key, y_b is Bob's public key, y, is Roger's public key, C_j is the first hash of the first challenge, c₂ is the second hash of the second challenge, g is the public generator, and p is the public prime.

0169The verification function in EQ. (36) is one means of expressing EQ. (27) and EQ. (30) as a single function. Other expressions of verification functions can be obtained using EQ. (27) and EQ. (30) as would be apparent.

0170As indicated above, FIG. 8 (shown as FIG. 8A and FIG. 8B) illustrates the operation of a non-interactive challenge-response protocol 800 according to the present invention using two El Gamal digital signatures. Protocol 800 is now described.

0171In a step 802, Alice 110 determines the recovery information according to the following expression:

0172*= (y_biy_r)^{k mod} P (37)

0173where: t is the recovery information, y_b is Bob's public key, y_τ is Roger's public key, and Λ is a randomly generated integer. In a step 804, Alice 110 generates a first challenge and a second challenge.

0174The first and second challenges are for a first El Gamal digital signature and a second El Gamal digital signature, respectively. Each challenge is a random integer generated according to well known techniques. In a step 806, Alice 110 determines a first hash of the first challenge and a second hash of the second challenge using a collision-free hash function. As discussed above, the hash function is used to prevent forgery attacks as is well- known. The first and second hashes are determined according to:

0175<img file="WO9847260A3_D0005.tif" />

0176where

0177Cj' is a randomly generated first challenge, c₂ is a randomly generated second challenge, Cj is a first hash of the first challenge, c₂ is a second hash of the second challenge, and H(x) is collision-free hash function.

0178In a step 808, the first El Gamal digital signature is computed using EQ. (26) as discussed above. In a step 810, the second El Gamal digital signature is computed using EQ. (29) as discussed above.

0179In a step 812, in one embodiment of the present invention, Alice 110 provides Victor 510 with the recovery information, t, and the verification information, P. In this embodiment of the present invention, the verification information includes: the first El Gamal digital signature, (a^b_j); the second El

0180Gamal digital signature, (a₂,b₂); the first hash, c_x; the second hash, c₂; the challenge, c ; and the second challenge, c₂\ In a step 814, Victor 510 determines a hash from the first challenge provided by Alice 110, and uses the hash determined from the first challenge to determine whether it is equivalent to the first hash provided by Alice 110. In a step 816, Victor 510 determines a hash from the second challenge provided by

0181Alice 110, and uses the hash determined from the second challenge to determine whether it is equivalent to the second hash provided by Alice 110. As discussed above, step 814 and step 816 enable the challenge-response proof to be performed non-interactively. In a step 818, Victor 510 determines a first portion of the verification function according to EQ. (36). The first portion of the verification function is found using EQ. (27). In a step 820, Victor 510 determines a second portion of the verification function according to EQ. (36). The second portion of the verification function is found using EQ. (30).

0182In a step 822, Victor 510 determines whether both the first portion and the second portion equal zero. In one embodiment of the present invention, this is accomplished by "ORing" the first portion with the second portion as indicated in EQ.(36). If the result of ORing the first portion with the second portion is zero, then Victor 510 has verified that Roger 410 can recover session key 310 from the recovery information. In particular, as shown in a result 824, Victor 510 verifies that Alice 110 knows the discrete logarithm that solves EQ. (19).

0183As discussed above, protocol 800 is a non-interactive challenge-response protocol. Protocol 800 could be easily modified, as would be apparent, to operate as an interactive challenge-response protocol.

0184FIG. 8 illustrates Alice 110 providing Victor 510 with the verification information. However, as indicated above, in a preferred embodiment of the present invention, this need not be the case. In the preferred embodiment of the present invention, Alice 110 may provide the verification information to any party. For example, Alice 110 may provide the verification information to Bob 120, to

0185Roger 410, or other agents. Furthermore, Alice 110 may provide the verification information directly to the law enforcement officials for verification. Still further, Alice 110 may provide the verification information directly to herself for verification. For example, hardware or software associated with Alice 110 may prevent her from sending encrypted messages if the verification information indicates that the proper recovery information has not been provided. In any case, the present invention contemplates that any party may use the verification information to verify, without revealing private information, that Roger 410 may recover session key 310 from the recovery information. Even still further, as will be described in detail below, the verification information and/or the recovery information can be included in a KRF sent with each encrypted message so that any recipient or holder of the encrypted message can verify that session key 310 can be recovered from the recovery information. Even though Victor 510 was used to discuss this embodiment of the present invention, it would be apparent that the discussion applies to other parties that may and can verify that Alice 110 has provided the proper recovery information.

0186Zero-Knowledge Proof of Simultaneous Discrete Logarithms

0187In a zero-knowledge proof of a discrete logarithm, the prover (i.e., Alice 110) proves to a verifier (i.e., Victor 510) that she knows a discrete logarithm without revealing any information about what the logarithm is. In a zero- knowledge proof of simultaneous discrete logarithms, the prover proves to the verifier that she knows a single number that solves multiple discrete logarithms problems.

0188Alice 110 can prove the validity of EQ. (19) by completing a zero- knowledge proof of simultaneous discrete logarithms of Alice's public key, y_a, and the recovery information, t. By doing so, Alice 110 is showing that the discrete logarithms are the same, and thus, the discrete logarithm of the recovery information, t, is Alice's private key, x_a, according to EQ. (17).

0189Zero-knowledge proofs are further described in a number of publicly available references, such as D. Chaum, et al., "Demonstrating Possession of a

0190Discrete Logarithm Without Revealing It," Advances in Cryptology-CRYPTO '86 Proceedings, pages 200-212, 1986.

0191Any zero-knowledge proof of simultaneous discrete logarithms could be used in place of the challenge-response proof described above as would be apparent.

0192Publicly Verifiable Split Key Recovery

0193The publicly verifiable DiflBe-Hellman protocol of the present invention can be modified into an embodiment that incorporates split key recovery. In a system using split key recovery, a key (e.g. private key, session key, etc.) is divided into multiple shares and each share is given to a different recovery agent. Split key recovery is also referred to as key sharing or secret sharing. A general discussion of key sharing is found in U.S. Patent No. 5,276,737, to Micali, entitled Fair Cryptosystems and Methods of Use, issued on January 4, 1994.

0194FIG. 9 (shown as FIG. 9 A and FIG. 9B) illustrates an embodiment of the present invention that incorporates key sharing. In particular, FIG. 9 illustrates a Publicly Verifiable Split Key Recovery protocol 900. In the description of this embodiment of the present invention, only two recovery agents are used. However, any number of recovery agents could be used as would be apparent. In a step 902, Roger 410 provides Alice 110 with his public key, y„ as discussed above with reference to step 402. In a step 904, a second recovery agent 910 (shown in FIG. 9 and referred to herein as "Sue") provides Alice 110 her public key, y_s, in a manner similar to that of Roger 410 in step 902. In a step 906, Alice 110 provides Roger 410 with her public key, y_a, as discussed above with respect to step 404. In a step 908, Alice 110 provides Sue 910 with her public key, y_a, in a manner similar to that of Roger 410 in step 906. In a step 912, Alice 110 provides Bob 120 with her public key, y_a, as discussed above with respect to step 302. In a step 914, Bob 120 provides Alice 110 with his public key, y_b, as discussed above with respect to step 304. After receiving Alice's public key, Bob 120, in a step 916, determines session key 320 as discussed above in step 316. As far as Bob 120 is concerned, in this embodiment of the present invention, protocol 500 is complete. Alice 110, Roger 410, Sue 910, and Victor 510, however, have further processing to complete. In a step 918, Alice 110 determines recovery information to be provided to Roger 410. In a step 922, Alice 110 determines recovery information to be provided to Sue 910. Before discussing how this recovery information is determined, some discussion of key sharing is provided. A general principle of key sharing is that in some cases the key can be only recovered from all the individual shares In other cases, the key can be recovered from a subset of the individual shares Typically, the key cannot be recovered from a single share According to one embodiment of the present invention, this is expressed by the following

01955 r S s mod p = s = s. (39)

0196where s, is Roger's share of the session key, s_s is Sue's share of the session key, s_a is the session key computed by Alice, s_b is the session key computed by Bob, and p is the public generator In one embodiment of the present invention, shares of the session key are determined by Alice 110 according to the following equation

0197s, = y_b ' mod p (40)

0198where <img file="WO9847260A3_D0006.tif" />

0199s_t is the i^Λ share of the session key, y_b is Bob's public key, x_Λ is the i* randomly generated component of Alice's private key,

0200N is the number of recovery agents, and p is the public generator In the embodiment of FIG 9 with two recovery agents, EQ (40) and EQ (41) reduce to the following expressions s_r = y_b mod p xa (42) s_s = y_b² mod p

0201and

0202x - x + X. (43)

0203where: s_r is Roger's share of the session key, s_s is Sue's share of the session key, y_b is Bob's public key, x_a is Alice's private key, x_al is the first component of Alice's private key, X_tf is the second component of Alice's private key, and p is the public generator. The shares given in EQ. (42) can also be expressed as:

0204<img file="WO9847260A3_D0007.tif" />

0205where: s_r is Roger's share of the session key, s_s is Sue's share of the session key, t_r is recovery information provided to Roger, t_s is recovery information provided to Sue, y, is Roger' s public key, y_s is Sue's public key, x₀ is Alice's private key, and p is the public generator. Solving EQ. (45) for the respective recovery information yields: y_b t_r = mod p (45) xa y_r

0206y_b fs = mod p (46)

0207where: t_τ is recovery information provided to Roger, t_s is recovery information provided to Sue, y_r is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, Λ:₀ is Alice's private key, x_al is the first component of Alice's private key, X_a2 is the second component of Alice's private key, and p is the public generator.

0208In step 918, Alice 110 determines Roger's recovery information, t„ using

0209Bob's public key, Roger's public key, and Alice's private key according to

0210EQ. (45). In step 922, Alice 110 determines Sue's recovery information, t_s, using

0211Bob's public key, Roger's public key, and Alice's private key according to EQ. (46).

0212In a step 924, Alice 110 provides Roger's recovery information, t_π to Roger 410 as discussed above with respect to step 416. In a step 926, Alice 110 provides Sue's recovery information, t_s, to Sue 910 in a manner similar to that of Roger 410 in step 924. The recovery agents Roger 410 and Sue 910 can recover their respective share of session key 310 using EQ. (11) which can be expressed as:

0213s_r = t_γy_τ ' mod p - t_rg ' " mod p = t_ry_a^r mod p x. ^χ x x x. (⁴ s_s = t_sy_s^* mod p = t_sg ^Xs.^χX"„ ⁷)

0214~s-r s r ~s * mod p = t y_a ' mod p where: s_r is Roger's share of the session key, s_s is Sue's share of the session key, t_r is recovery information provided to Roger, t_s is recovery information provided to Sue, y_r is Roger's public key, y_s is Sue's public key, x_a is Alice's private key, and p is the public generator. Thus, Roger 410 can determine his share of session key 310 from his recovery information, his private key, and Alice's public key. Sue 910 can determine her share of session key 310 from her recovery information, her private key, and Alice's public key.

0215As a result of step 928, Roger 410 obtains a share 940 of session key 310. As a result of step 930, Sue 910 obtain a share 950 of session key 310. According to key sharing, session key 310 is recovered from shares 940, 950 according to:

0216sr^s_s = = JΆ = *_β ( 8) <img file="WO9847260A3_D0008.tif" />

0217where: s_r is Roger's share of the session key, s_s is Sue's share of the session key, s_a is Alice's session key, t_r is recovery information provided to Roger, t_s is recovery information provided to Sue, y_τ is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_a is Alice's private key, x_al is the first component of Alice's private key, x_a2 is the second component of Alice's private key, and p is the public generator. As shown in EQ. (48), session key 310 can be obtained from shares 940, 950 held by the recovery agents, Roger 410 and Sue 910.

0218The present invention adds the feature of public verification to key sharing. According to the present invention, Alice 110 provides Victor 510 verification information that verifies that the recovery information provided to Roger 410 and Sue 910 can be used to recover session key 310 without revealing any private information. In order to do so, a discrete logarithm similar to that in EQ. (19) must be determined for this key sharing embodiment.

0219Substituting EQ. (44) into EQ. (39) yields the following:

0220sι <img file="WO9847260A3_D0009.tif" />_b^{a od} P (⁴⁹>

0221where: s_r is Roger's share of the session key, s, is Sue's share of the session key, t_τ is recovery information provided to Roger, t_s is recovery information provided to Sue, y_r is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_a is Alice's private key, and p is the public generator. EQ. (48) can be expressed as:

0222' = i^yji _r^y. f' ^mod P ⁽⁵°⁾

0223where: t_r is recovery information provided to Roger, t_s is recovery information provided to Sue, y_τ is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_a is Alice's private key, and p is the public generator. EQ. (50) can be used to obtain the discrete logarithm necessary for verification according to the present invention. More specifically, the discrete logarithm is expressed as:

0224xa = ^,0S o ,_f) (' ) ^mod P (51)

0225The second discrete logarithm is included in EQ. (18). Equating EQ. (18) and EQ. (51) yields the following expression:

0226l⁰8,_»/(,_Λ) <'r *.> = ^g_gy_a od p ₍₅₂₎

0227In order for Alice 110 to prove that EQ. (52) holds without revealing any private, or secret information, she must show that she knows a solution to both EQ. (18) and EQ. (51). In other words, Alice 110 must demonstrate to Victor 510 that her public key, y_b, and the recovery information, t„ t_s are determined or computed using the same private key, namely, x„.

0228As would be apparent, other methods are available to determine the shares of the session key and/or the recovery information to be provided to the trustees. One feature of the present invention thus described is that only Alice 110 and the respective recovery agent can determine the respective share of the session key from the recovery information provided to that recovery agent. With this in mind, the remaining portion of this embodiment of the present invention is described. In a step 962, Alice 110 provides Victor 510 with her public key, y_a, in a manner similar to that described above with respect to step 508. In a step 964, Alice 110 provides Victor 510 with the recovery information, t_π t_s, and verification information necessary for Victor 510 to determine that Roger 410 and Sue 910 can recover session key 310 from the recovery information without revealing any private information.

0229As discussed above, the verification information provided to Victor 510 depends on the type of proof required by Victor 510, or law enforcement officials, to ensure that Alice 110 has provided Roger 410 and Sue 910 with the proper recovery information. The specific verification information provided to Victor

0230510 depends on the verification schemes used as described above. Given the description of the challenge-response protocol and the zero-knowledge proof provided above with respect to a single recovery agent, it would be apparent to a person skilled in the art how to implement a proper verification protocol for an embodiment of the present invention employing key sharing.

0231In a step 966, Victor 510 determines whether EQ. (52) holds according to the selected proof as described above. As a result of this determination, Victor 510 verifies that Alice 110 as provided the proper recovery information and that, in fact, EQ. (52) holds.

0232Gifford Sealed Key Recovery

0233Another embodiment of the present invention employs key sealing. Key sealing is another method whereby the role of the recovery agent is distributed to multiple parties. Rather that splitting a key into shares as in key sharing, key sealing involves successively encrypting messages using keys belonging to two or more recovery agents. For example, Alice 110 would encrypt her message with a key belonging to Roger 410 and then encrypt the resulting encrypted message with a key belonging to Sue 910. This can be expressed as: <img file="WO9847260A3_D0010.tif" /> where: c is the resulting ciphertext, k_s is Sue's encryption key, k_r is Roger's encryption key, m_a is Alice's message, and

0234E_x(y) is a encryption function that encrypts y with x.

0235In a system employing key sealing for key recovery, the resulting ciphertext, c, is provided as the recovery information. The message is recovered from the ciphertext in the reverse order by which the ciphertext is generated. In other words, Sue 910 decrypts c and provides E_kr(m_a) to Roger 410 who decrypts this to provide m_a.

0236Gifford key sealing can be incorporated into a publicly verifiable key recovery protocol by using a session key in place of the message, m_a, above. FIG.

023710 illustrates an Publicly Verifiable Gifford Key Sealing Key Recovery protocol 1000 according to one embodiment of the present invention. In the following description of this embodiment of the present invention, only two recovery agents are used. However, as would be apparent, any number of recovery agents could be used. In a step 1002, Roger 410 provides Alice 110 with his public key, y_p as discussed above with reference to step 402. In a step 1004, Sue 910 provides Alice 110 her public key, y^ in a manner similar to that of Roger 410 in step 1004.

0238In a step 1006, Alice 110 provides Roger 410 with her public key, y^ as discussed above with respect to step 404. In a step 1008, Alice 110 provides Sue

0239910 with her public key, y^ in a manner similar to that of Roger 410 in step 1006.

0240In a step 1012, Alice 110 provides Bob 120 with her public key, y_a, as discussed above with respect to step 302.

0241In a step 1014, Bob 120 provides Alice 110 with his public key, y_b, as discussed above with respect to step 304. After receiving Alice's public key, Bob

0242120, in a step 1016, determines session key 320 as discussed above in step 316.

0243As far as Bob 120 is concerned, in this embodiment of the present invention, protocol 500 is complete. Alice 110, Roger 410, Sue 910, and Victor 510, however, have further processing to complete. In a step 1018, Alice 110 determines recovery information to be provided to Roger 410 according to the following: xa t_r = ^yb mod p (54)

0244OVΛ)^*"

0245where: t_r is recovery information provided to Roger, y_r is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_a is Alice's private key, and p is the public generator.

0246Thus, in step 1018, Alice 110 determines Roger's recovery information, t_n using Bob's public key, Roger's public key, Sue's public key, and Alice's private key according to EQ. (54).

0247In a step 1022, Alice 110 provides Roger's recovery information, t_n to Roger 410 as discussed above with respect to step 416. In a step 1024, Roger

0248410 determines recovery information to be provided to Sue 910 according to the following:

0249*_ι^{= f}ry_a^X mod p (55)

0250which is equivalent to: xa trya ' = ^t_ryr^{Xa mθd} P = — ^mθd P (56) y ''

0251where: t_r is recovery information provided to Roger by Alice, t_s is recovery information provided to Sue by Roger, y_r is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_r is Roger's private key, x_a is Alice's private key, and p is the public generator. Thus, in step 1024, Roger 410 determines Sue's recovery information, t_s, using the recovery information provided to him by Alice 110, Alice's public key, and

0252Roger's private key according to EQ. (55). In a step 1026, Roger 410 provides Sue 910 with Sue's recovery information as discussed above with respect to 1022. The recovery agents Roger 410 and Sue 910 cannot individually recover session key 310. In fact, only the last recovery agent (in this case Sue 910) actually obtains session key 310. One difference between the protocol according to this embodiment of the present invention and Gifford key sealing is that a specific order need not be followed as discussed above with respect to EQ. (53). For example, as would be apparent from EQ. (54), the same recovery information could be provided by Alice 110 to Sue 910 as opposed to Roger 410. Upon receipt, Sue 910 would determine Roger's recovery information according to:

0253= &lt;_sy_a^S mod p (57)

0254which is equivalent to:

0255<img file="WO9847260A3_D0011.tif" />

0256where:

0257t_s = ^yb mod p (59)

0258&lt;y_ry,)^x' t_s is recovery information provided to Sue by Alice, t_τ is recovery information provided to Roger by Sue, y_τ is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_s is Sue's private key, x_a is Alice's private key, and p is the public generator. As a result of step 1028, Sue 910 obtains a session key 1030. Note that Roger 410 does not obtain a session key in this embodiment of the present invention unless he does so by other means (e.g. Sue 910 provides him with session key 1030).

0259The present invention includes the feature of public verification. According to the present invention, Alice 110 provides Victor 510 verification information that verifies that the recovery information provided to Roger 410 can be used by him and the other recovery agents (i.e. Sue 910, etc.) to recover session key 310 without revealing any private information. In order to do so, a discrete logarithm similar to that in EQ. (17) must be determined for this Gifford key sealing embodiment. This discrete logarithm can be determined by taking the discrete logarithm of EQ. (54) which yields:

0260x = ^Ioβ„i(,_r,_f) (',) ^mod P (60)

0261where: t_r is recovery information provided to Roger by Sue, y_r is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, x_a is Alice's private key, and p is the public generator. Alice 110 must prove, without revealing any private information, that she knows a solution to both EQ. (60) and EQ. (18), which is reproduced below as:

0262*. ^{= Xo} y_a^mod P (6i)

0263In other words, Alice 110 is demonstrating to Victor 510 that her public key, y_b, and the recovery information, t_r, are determined or computed using the same private key, namely, x„. This can be expressed by equating EQ. (60) and EQ. (61) as:

0264l^0β**FΛ> <'^r) ^{= ,0}V^{« m}°^{d P} (62)

0265where: t_r is recovery information provided to Roger by Sue, v is Roger's public key, y_s is Sue's public key, y_b is Bob's public key, and p is the public generator. One feature of the present invention thus described is that only Alice 110 and the combined efforts of the respective recovery agents can determine the respective share of the session key from the recovery information. With this in mind, the remaining portion of this embodiment of the present invention is described.

0266In a step 1034, Alice 110 provides Victor 510 with her public key, y_a, in a manner similar to that described above with respect to step 508. In a step 1036,

0267Alice 110 provides Victor 510 with the recovery information, t_π and verification information necessary for Victor 510 to determine that the recovery agents (i.e., Roger 410 and Sue 910) can recover session key 310 from the recovery information without revealing any private information to Victor 510. As discussed above, the verification information provided to Victor 510 depends on the type of proof required by Victor 510, or law enforcement officials, to ensure that Alice 110 has provided the proper recovery information. The specific verification information provided to Victor 510 depends on the verification schemes used as described above. Given the description of the challenge-response protocol and the zero-knowledge proof provided above with respect to a single recovery agent, it would be apparent to a person skilled in the art how to implement a proper protocol for an embodiment of the present invention employing key sharing. Based on the protocol used, it would also be apparent as to the verification information required to be provided by Alice 110 to Victor 510.

0268In a step 1038, Victor 510 determines whether EQ. (62) holds according to the selected proof as described above. As a result of this determination, Victor 510 verifies that Alice 110 as provided the proper recovery information and that, in fact, EQ. (62) holds.

0269Data Recovery and Data Verification Fields

0270As mentioned above, in one embodiment of the present invention, the recovery information is concatenated or otherwise combined with an encrypted message to form an object. In a further embodiment of the present invention, the recovery information and the verification information are concatenated or otherwise combined with an encrypted message to form an object. For both embodiments, the resulting object is transmitted from one party to another, and/or stored in some storage device. This latter embodiment is illustrated in FIG. 11.

0271FIG. 11 illustrates an object 1110 according to this embodiment of the present invention. Object 1110 includes a key recovery field (KRF) 1120, a data verification field (DRV) 1130, and an encrypted message 1140. In a preferred embodiment of the present invention, KRF 1120 includes at least recovery information 1125 and DRV 1130 includes at least verification information 1135. In this embodiment of the present invention, recovery information 1125 and verification information 1135 are included with encrypted message 1140 in object 1110 so that any holder of object 1110 can verify that session key 310 can be recovered from recovery information 1125. In this embodiment of the present invention, proper hashing and other security precautions are taken with respect to object 1110, and in particular to verification information 1130, so that the present invention is not subject to spoofing.

0272However, neither recovery information 1125 nor verification information 1135 need be encrypted with any type of key. One of the features of the present invention is that recovery information 1125 and verification information 1135 alone do not reveal any secret information. Thus, they do not need to be encrypted.

0273Other information, while not shown in FIG. 11, may be included within object 1110 in addition to that discussed above. This information may include, for example, any public keys associated with a particular object 1110 including Alice's public key, Bob's public key, Roger's public key, and Sue's public key depending on which of the publicly verifiable key recovery protocols are used.

0274Implementing Publicly Verifiable Key Recovery

0275Thus far, this discussion has identified distinct "individuals" that perform the various functions that comprise the embodiments of the present invention. For example, Roger 410 performs the recovery function, and Victor 510 performs the verification function. Having separate individuals perform each of these functions is not necessary and may or may not be desirable. In other words, the functions of Roger 410 and Victor 510 may be together performed by a single individual, or combined with the functions of another individual such as Alice 110 or Bob 120. Thus, while the above description and the drawings indicated that separate individuals are operating within the present invention, it would be apparent to those skilled in the art to combine and/or distribute the functions of various aspects of the present invention among one or more individuals. The following exemplary embodiments of the present invention are not intended to limit the scope of the present invention.

0276An "individual" need not be an actual living person. The individual may be a particular device, a computer, or a software subroutine that implements the particular functions of the individual. Furthermore, the functions of more that one individual may be implemented together on the same device or in the same software subroutine.

0277In a preferred embodiment of the present invention, an actual "person" does not perform the above described functions. Rather, hardware and/or software ("hardware/software") associated with the actual person performs these functions transparently. In other words, one or more computers or other electronic devices perform the various functions without the knowledge or interaction of the person(s) associated with the computer(s). In this case, Alice 110 and Bob 120 represent hardware/software that performs the respective functions.

0278For example, Diffie-Hellman key exchange protocol 300 (shown in FIG. 3) may be implemented so that session key 310 is generated by hardware/software without any action by a person associated with Alice 110 or Bob 120 other than for Alice 110 to send a message to Bob 120 that she desires to be encrypted. The generation of session key 310 according to protocol 300 (as well as the other protocols where session key 310 is generated) and the subsequent encryption of the message would all be transparent to the actual persons involved.

0279Various other aspects of the protocols discussed above may be handled transparently from the actual persons involved. In fact, for some functions in some embodiments of the present invention, there may not even be a separate individual performing the function. This is particularly true for the functions performed by Victor 510. These functions may be distributed or even duplicated among parties to an encrypted message, such as Alice 110 and Bob 120.

0280"Alice" as Verifier In some embodiments of the present invention that implement protocol 800, the verification functions (e.g., steps 814 to 822 in FIG. 8) are performed by hardware/software associated with a sender of the encrypted message, i.e. "Alice". In these embodiments, the functions of Alice 110 and Victor 510 are incorporated together as a single "individual." More specifically, the sender of an encrypted message has associated hardware/software that encrypts messages and verifies them according to protocol 800. This embodiment automatically ensures that messages sent follow protocol 800. In other words, the hardware/software generates a session key, encrypts the message with the session key, generates the required recovery verification information, performs the verification, and sends the encrypted message together with the recovery and verification information.

0281In another embodiment of the present invention, the sender of the encrypted message has associated hardware/software that merely verifies that the messages include the recovery information. If the message does not include the proper recovery information, then the hardware/software prevents the encrypted message from being sent. This embodiment might be incorporated into, for example, a firewall. As such, the firewall prevents any messages that do not include proper recovery and verification information from being sent from a particular site. The above description is provided with respect to protocol 800 for ease of discussion. This description applies equally to the other protocols described above as would be apparent.

0282"Bob" as Verifier

0283In some embodiments of the present invention that implement protocol 800, the verification functions (e.g., steps 814 to 822 in FIG. 8) are performed by hardware/software associated with a receiver of the encrypted message, i.e. "Bob". In these embodiments, the functions of Bob 120 and Victor 510 are incorporated together as a single "individual." More specifically, the receiver of an encrypted message has associated hardware/software that verifies that the encrypted messages include the recovery information according to protocol 800 and then decrypts the message. This embodiment automatically ensures that messages received were encrypted according to protocol 800. In other words, the hardware/software verifies that the message includes or has been sent with the proper recovery information. This embodiment may or may not notify the proper authorities if an encrypted message is received that does not include the proper recovery information. In another embodiment of the present invention, the receiver of the encrypted message has associated hardware/software that merely verifies that the messages include the recovery information. If the message does not include the proper recovery information, then the hardware/software prevents the encrypted message from being decrypted. This embodiment might also be incorporated into a firewall. As such, the firewall could prevent any messages that do not include proper recovery and verification information from entering a particular site. In other words, encrypted messages that do not include the proper recovery information would be blocked from entering the site.

0284The above description is provided with respect to protocol 800 for ease of discussion. This description applies equally to the other protocols described above as would be apparent.

0285"Alice" and "Bob" as Verifiers

0286In a preferred embodiment of the present invention, the verification functions are incorporated in devices, such as firewalls, on each end of an encrypted communication channel 1200 as shown in FIG. 12. Encrypted communication channel 1200 includes two parties: Alice 110 and Bob 120. For purposes of this discussion, Alice 110 is a user operating in a system 1210 and Bob 120 is a user operating in a system 1220. Systems 1210, 1220 are either single user systems or networked systems as would be apparent.

0287Systems 1210, 1220 are each connected to a public communication channel 1230 (e.g., Internet, telephone exchanges, etc.) via a firewall 1250. Firewall 1250A provides certain protective functions between system 1210 and public communication channel 1230. Firewall 1250B provides certain protective functions between system 1220 and public communication channel 1230. In particular, each firewall 1250 includes the verification functions performed by Victor 510 for any of the various protocols described above.

0288In the preferred embodiment of the present invention, encrypted messages are not sent from firewall 1250A unless the messages sent from system 1210 include or are sent with the proper recovery and/or verification information.

0289Likewise, encrypted messages are blocked from entering system 1220 by firewall 1250B unless the messages include or are received with the proper recovery and/or verification information. The same is true in reverse. Encrypted messages are not sent from firewall 1250B unless the messages sent from system 1220 include or are sent with the proper recovery and/or verification information.

0290Encrypted messages are blocked from entering system 1210 by firewall 1250A unless the messages include or are received with the proper recovery and/or verification information.

0291While the invention has been particularly shown and described with reference to preferred embodiments thereof, it will be understood by those skilled in the relevant art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.