Google Patentsopen access

Public key validation in supersingular isogeny-based cryptographic protocols — ISARA Corporation (US10218504B1)

ABSTRACT

Abstract

In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a first generator point is computed based on a secret integer of a first entity and a pair of elliptic curve points defined by a supersingular isogeny-based cryptosystem. An image curve is computed based on the secret integer, and a shared secret value is computed based on the image curve. An encrypted generator point is computed from the first generator point and the shared secret value. A public key of the first entity is sent to a second entity to enable the second entity to compute the shared secret value. The encrypted generator point is sent to the second entity to enable the second entity to validate the public key of the first entity.

Description

BACKGROUND

The following description relates to verifying data in supersingular isogeny-based cryptographic protocols.

Cryptography systems are used to communicate securely over public channels. For example, some cryptography systems provide confidentiality by encrypting messages, and some cryptography systems provide authenticity through digital signatures. Some cryptography systems operate using public keys, private keys and shared secrets.

DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing aspects of an example communication system.

FIG. 2 is a flow diagram showing aspects of an example cryptosystem process.

FIGS. 3A-3B are flow diagrams showing an example supersingular isogeny-based cryptographic protocol.

FIGS. 4A-4B are flow diagrams showing another example supersingular isogeny-based cryptographic protocol.

DETAILED DESCRIPTION

In some aspects of the present disclosure, improved supersingular isogeny-based cryptographic protocols are described. The supersingular isogeny Diffie-Hellman key agreement protocol (SIDH) is an example of a supersingular isogeny-based cryptographic protocol that is believed to be secure against attacks carried out by quantum computers. In some SIDH deployments, if one of the entities reuses its secret key (e.g., as a static private key), then the secret key can be efficiently recovered, for example, with the active attack described by Galbraith et al. (Galbraith, et al., “On the security of supersingular isogeny cryptosystems,” Advances in Cryptology—ASIACRYPT 2016. Lecture Notes in Computer Science vol. 10031. Springer, Berlin, Heidelberg, pp. 63-91, 2016.) A countermeasure to this attack was described by Kirkwood et al. (Kirkwood, et al., “Failure is not an option: standardization issues for post-quantum key agreement,” Workshop on Cybersecurity in a Post - Quantum World, 2015.). However, existing countermeasures are computationally expensive and therefore time consuming and less practical. Here we describe supersingular isogeny-based cryptographic protocols that include improved countermeasures, for example, countermeasures that allow faster computations while achieving the same or otherwise acceptable security levels.

Accordingly, aspects of the systems and techniques described here can be used to improve the operation of communications systems (e.g., data networks, etc.), computer systems (e.g., network-connected computers, etc.), smart devices (e.g., so-called “Internet-of-Things” (IoT) devices, etc.) and other classes of technology. For example, a wide variety of modern technologies rely on computer-implemented cryptosystems for secure operation, and the techniques described here can improve such computer-implemented cryptosystems, for example, making them more secure, more computationally efficient or providing other advantages in some instances.

In some implementations, the techniques described here can be used to neutralize or otherwise reduce exposure to an attack on a supersingular isogeny-based cryptographic protocol, for example, the active attack proposed by Galbraith et al. and potentially other types of attacks. The active attack proposed by Galbraith et al. is performed by one of the two entities (“Alice” and “Bob”) executing an SIDH protocol. In particular, the attack allows Bob to recover Alice's secret key efficiently one bit a time. In order to determine the i-th bit of Alice's secret key, Bob sends Alice an incorrect public key (E B , U i , V i ) instead of the correct public key (E B , ϕ B (P A ), ϕ B (Q A )), where U i and V i are some linear combinations of ϕ B (P A ) and ϕ B (Q A ). In the cryptographic protocols described here, one of the entities (“Alice”) validates the public key of the other entity (“Bob”) in a manner that neutralizes or otherwise reduces exposure to an attack of the type described by Galbraith et al.

In some cryptographic protocols (including the example protocol 300 shown in FIGS. 3A-3B and variants), Bob sends (an encrypted version of) his secret generator G B instead of a random seed. By receiving the secret generator G B from Bob, Alice can validate Bob's public key without having to duplicate all of Bob's computations to derive the public key. For example, Alice may avoid the computation of both β′=PRF(r B ′) and G B ′=P B +[β′]Q B , where PRF represents a pseudorandom function that generates the integer β′ from the random seed r B ′. Given that β′ is a number whose magnitude is approximately equal to 3 m , this prevents Alice from computing an expensive operation of scalar multiplication by a large number β′.

In addition, the example protocol 300 shown in FIGS. 3A-3B is secure, despite the fact that (potentially dishonest) Bob has several options to modify the data sent to Alice. In particular, Bob can provide a generator point G B that does not have a full order. Or instead of sending the correct generator point G B , Bob can send a different generator of the subgroup <G B >. However, by validating the degree of the isogeny defined by G B (e.g., validating deg(ϕ B ′)=3 m ), Alice can detect if Bob provides a generator point G B that does not have a full order. This condition can be verified in the process of isogeny evaluation, and, at least in some cases, does not require any significant additional computational overhead. Further, by verifying certain conditions (e.g., j(E B )≠0, 1728, E B ′=E B , ϕ B ′(P A )=U and ϕ B ′(Q A )=V), Alice can ensure that, by providing alternative generators of <G B >, Bob does not learn any information about Alice's secret key.

In some cryptographic protocols (including the example protocol 400 shown in FIGS. 4A-4B and variants), Alice verifies a pairing value and an isogeny evaluation (e.g., e 2

n (U, V)=e 2

n (P A , Q A ) 3

m and ϕ B ′(Q A )=V in the example shown in FIGS. 4A-4B ). Using the pairing-based validation allows Alice to validate Bob's public key using only one isogeny evaluation (e.g., ϕ B ′(Q A )). In addition, Alice can complete the pairing-based validation before computing any isogeny evaluations, which means that Alice can detect some invalid public keys without an isogeny evaluation. In addition, the example protocol 400 shown in FIGS. 4A-4B is secure, in the sense that it allows Alice to use a static key and detect if Bob dishonestly modified any of the parameters of his public key (E B , ϕ B (P A ), ϕ B (Q A )).

In some cases, the public key validation techniques described here can be used to improve supersingular isogeny-based key agreement protocols (e.g., SIDH), as well as other supersingular isogeny-based cryptographic protocols. For example, the public key validation techniques described here may be applied to supersingular isogeny-based public key encryption schemes, such as, for example, the public key encryption scheme described by De Feo et al. (De Feo, et al., “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.” Journal of Mathematical Cryptology 8 (3), pp. 209-247, 2014.). As another example, the public key validation techniques described here may be applied to supersingular isogeny-based key encapsulation mechanism (KEM) schemes.

FIG. 1 is a block diagram showing aspects of an example communication system 100 . The example communication system 100 shown in FIG. 1 includes two nodes

102 , 104 . The nodes

102 , 104 use a supersingular isogeny-based cryptosystem to communicate with each other over a channel 106 . The nodes

102 , 104 represent distinct entities in the cryptosystem.

In the example shown, a quantum-enabled adversary 108 has access to the channel 106 , information exchanged on the channel 106 , or both. In some instances, the quantum-enabled adversary 108 can transmit or modify information on the channel 106 . The communication system 100 may include additional or different features, and the components in a communication system may be configured to operate as shown in FIG. 1 or in another manner.

In some implementations, nodes in the communication system 100 may have a server-client relationship. For example, the node 102 can be a server and the node 104 can be its client, or vice-versa. In some implementations, nodes in the communication system 100 may have a peer-to-peer relationship. For example, the nodes

102 , 104 can be peers in a served network, in a peer-to-peer network or another type of network. Nodes may have another type of relationship in the communication system 100 .

In the example shown in FIG. 1 , the example nodes

102 , 104 each have computational resources (e.g., hardware, software, firmware) that are used to communicate with other nodes. In some implementations, nodes in the communication system 100 can be implemented in various systems, such as, for example, laptops, desktops, workstations, smartphones, tablets, personal digital assistants, servers, server clusters, mainframes, IoT devices, and other types of computer systems. As shown in FIG. 1 , the example node 102 includes a memory 110 , a processor 112 , and an interface 114 . Each of the nodes

102 , 104 may include the same, additional or different components. The nodes

102 , 104 may be configured to operate as shown and described with respect to FIG. 1 or in another manner.

In the example shown in FIG. 1 , the entities represented by the nodes

102 , 104 may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node

102 , 104 . Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node

102 , 104 .

The example memory 110 can include, for example, random access memory (RAM), a storage device (e.g., a writable read-only memory (ROM) or others), a hard disk, or another type of storage medium. The example memory 110 can store instructions (e.g., computer

BACKGROUND

The following description relates to verifying data in supersingular isogeny-based cryptographic protocols.

Cryptography systems are used to communicate securely over public channels. For example, some cryptography systems provide confidentiality by encrypting messages, and some cryptography systems provide authenticity through digital signatures. Some cryptography systems operate using public keys, private keys and shared secrets.

DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing aspects of an example communication system.

FIG. 2 is a flow diagram showing aspects of an example cryptosystem process.

FIGS. 3A-3B are flow diagrams showing an example supersingular isogeny-based cryptographic protocol.

FIGS. 4A-4B are flow diagrams showing another example supersingular isogeny-based cryptographic protocol.

DETAILED DESCRIPTION

In some aspects of the present disclosure, improved supersingular isogeny-based cryptographic protocols are described. The supersingular isogeny Diffie-Hellman key agreement protocol (SIDH) is an example of a supersingular isogeny-based cryptographic protocol that is believed to be secure against attacks carried out by quantum computers. In some SIDH deployments, if one of the entities reuses its secret key (e.g., as a static private key), then the secret key can be efficiently recovered, for example, with the active attack described by Galbraith et al. (Galbraith, et al., “On the security of supersingular isogeny cryptosystems,” Advances in Cryptology—ASIACRYPT 2016. Lecture Notes in Computer Science vol. 10031. Springer, Berlin, Heidelberg, pp. 63-91, 2016.) A countermeasure to this attack was described by Kirkwood et al. (Kirkwood, et al., “Failure is not an option: standardization issues for post-quantum key agreement,” Workshop on Cybersecurity in a Post - Quantum World, 2015.). However, existing countermeasures are computationally expensive and therefore time consuming and less practical. Here we describe supersingular isogeny-based cryptographic protocols that include improved countermeasures, for example, countermeasures that allow faster computations while achieving the same or otherwise acceptable security levels.

Accordingly, aspects of the systems and techniques described here can be used to improve the operation of communications systems (e.g., data networks, etc.), computer systems (e.g., network-connected computers, etc.), smart devices (e.g., so-called “Internet-of-Things” (IoT) devices, etc.) and other classes of technology. For example, a wide variety of modern technologies rely on computer-implemented cryptosystems for secure operation, and the techniques described here can improve such computer-implemented cryptosystems, for example, making them more secure, more computationally efficient or providing other advantages in some instances.

In some implementations, the techniques described here can be used to neutralize or otherwise reduce exposure to an attack on a supersingular isogeny-based cryptographic protocol, for example, the active attack proposed by Galbraith et al. and potentially other types of attacks. The active attack proposed by Galbraith et al. is performed by one of the two entities (“Alice” and “Bob”) executing an SIDH protocol. In particular, the attack allows Bob to recover Alice's secret key efficiently one bit a time. In order to determine the i-th bit of Alice's secret key, Bob sends Alice an incorrect public key (E B , U i , V i ) instead of the correct public key (E B , ϕ B (P A ), ϕ B (Q A )), where U i and V i are some linear combinations of ϕ B (P A ) and ϕ B (Q A ). In the cryptographic protocols described here, one of the entities (“Alice”) validates the public key of the other entity (“Bob”) in a manner that neutralizes or otherwise reduces exposure to an attack of the type described by Galbraith et al.

In some cryptographic protocols (including the example protocol 300 shown in FIGS. 3A-3B and variants), Bob sends (an encrypted version of) his secret generator G B instead of a random seed. By receiving the secret generator G B from Bob, Alice can validate Bob's public key without having to duplicate all of Bob's computations to derive the public key. For example, Alice may avoid the computation of both β′=PRF(r B ′) and G B ′=P B +[β′]Q B , where PRF represents a pseudorandom function that generates the integer β′ from the random seed r B ′. Given that β′ is a number whose magnitude is approximately equal to 3 m , this prevents Alice from computing an expensive operation of scalar multiplication by a large number β′.

In addition, the example protocol 300 shown in FIGS. 3A-3B is secure, despite the fact that (potentially dishonest) Bob has several options to modify the data sent to Alice. In particular, Bob can provide a generator point G B that does not have a full order. Or instead of sending the correct generator point G B , Bob can send a different generator of the subgroup <G B >. However, by validating the degree of the isogeny defined by G B (e.g., validating deg(ϕ B ′)=3 m ), Alice can detect if Bob provides a generator point G B that does not have a full order. This condition can be verified in the process of isogeny evaluation, and, at least in some cases, does not require any significant additional computational overhead. Further, by verifying certain conditions (e.g., j(E B )≠0, 1728, E B ′=E B , ϕ B ′(P A )=U and ϕ B ′(Q A )=V), Alice can ensure that, by providing alternative generators of <G B >, Bob does not learn any information about Alice's secret key.

In some cryptographic protocols (including the example protocol 400 shown in FIGS. 4A-4B and variants), Alice verifies a pairing value and an isogeny evaluation (e.g., e 2

n (U, V)=e 2

n (P A , Q A ) 3

m and ϕ B ′(Q A )=V in the example shown in FIGS. 4A-4B ). Using the pairing-based validation allows Alice to validate Bob's public key using only one isogeny evaluation (e.g., ϕ B ′(Q A )). In addition, Alice can complete the pairing-based validation before computing any isogeny evaluations, which means that Alice can detect some invalid public keys without an isogeny evaluation. In addition, the example protocol 400 shown in FIGS. 4A-4B is secure, in the sense that it allows Alice to use a static key and detect if Bob dishonestly modified any of the parameters of his public key (E B , ϕ B (P A ), ϕ B (Q A )).

In some cases, the public key validation techniques described here can be used to improve supersingular isogeny-based key agreement protocols (e.g., SIDH), as well as other supersingular isogeny-based cryptographic protocols. For example, the public key validation techniques described here may be applied to supersingular isogeny-based public key encryption schemes, such as, for example, the public key encryption scheme described by De Feo et al. (De Feo, et al., “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.” Journal of Mathematical Cryptology 8 (3), pp. 209-247, 2014.). As another example, the public key validation techniques described here may be applied to supersingular isogeny-based key encapsulation mechanism (KEM) schemes.

FIG. 1 is a block diagram showing aspects of an example communication system 100 . The example communication system 100 shown in FIG. 1 includes two nodes

102 , 104 . The nodes

102 , 104 use a supersingular isogeny-based cryptosystem to communicate with each other over a channel 106 . The nodes

102 , 104 represent distinct entities in the cryptosystem.

In the example shown, a quantum-enabled adversary 108 has access to the channel 106 , information exchanged on the channel 106 , or both. In some instances, the quantum-enabled adversary 108 can transmit or modify information on the channel 106 . The communication system 100 may include additional or different features, and the components in a communication system may be configured to operate as shown in FIG. 1 or in another manner.

In some implementations, nodes in the communication system 100 may have a server-client relationship. For example, the node 102 can be a server and the node 104 can be its client, or vice-versa. In some implementations, nodes in the communication system 100 may have a peer-to-peer relationship. For example, the nodes

102 , 104 can be peers in a served network, in a peer-to-peer network or another type of network. Nodes may have another type of relationship in the communication system 100 .

In the example shown in FIG. 1 , the example nodes

102 , 104 each have computational resources (e.g., hardware, software, firmware) that are used to communicate with other nodes. In some implementations, nodes in the communication system 100 can be implemented in various systems, such as, for example, laptops, desktops, workstations, smartphones, tablets, personal digital assistants, servers, server clusters, mainframes, IoT devices, and other types of computer systems. As shown in FIG. 1 , the example node 102 includes a memory 110 , a processor 112 , and an interface 114 . Each of the nodes

102 , 104 may include the same, additional or different components. The nodes

102 , 104 may be configured to operate as shown and described with respect to FIG. 1 or in another manner.

In the example shown in FIG. 1 , the entities represented by the nodes

102 , 104 may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node

102 , 104 . Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node

102 , 104 .

The example memory 110 can include, for example, random access memory (RAM), a storage device (e.g., a writable read-only memory (ROM) or others), a hard disk, or another type of storage medium. The example memory 110 can store instructions (e.g., computer code, a computer program, etc.) associated with an operating system, computer applications and other resources. The memory 110 can also store application data and data objects that can be interpreted by one or more applications or virtual machines running on the node 102 . The node 102 can be preprogrammed, or it can be programmed (and reprogrammed), by loading a program from another source (e.g., from a DVD-ROM, from a removable memory device, from a remote server, from a data network or in another manner). In some cases, the memory 110 stores computer-readable instructions for software applications, scripts, programs, functions, executables or other modules that are interpreted or executed by the processor 112 . For example, the computer-readable instructions can be configured to perform one or more of the operations shown in one or both of FIG. 2 .

In the example node 102 shown in FIG. 1 , the processor 112 is a data processing apparatus that can execute instructions, for example, to generate output data based on data inputs. For example, the processor 112 can run computer programs by executing or interpreting the software, scripts, programs, functions, executables, or other modules stored in the memory 110 . In some instances, the processor 112 may perform one or more of the operations shown in FIG. 2 .

The example processor 112 shown in FIG. 1 can include one or more chips or chipsets that include analog circuitry, digital circuitry or a combination thereof. In some cases, the processor 112 includes multiple processor devices such as, for example, one or more main processors and one or more co-processors. For instance, the processor 112 may include a main processor that can delegate certain computational tasks to a cryptographic co-processor, which may be configured to perform the computational tasks more efficiently than the main processor or in parallel with other computational tasks performed by other processor devices. In some instances, the processor 112 coordinates or controls operation of other components of the node 102 , such as, for example, user interfaces, communication interfaces, peripheral devices and possibly other components.

In the example node 102 shown in FIG. 1 , the interface 114 provides communication with other nodes (e.g., via channel 106 ). In some cases, the interface 114 includes a wireless communication interface that provides wireless communication using a wireless protocol or standard. For example, the interface 114 may provide wireless communication via Bluetooth, Wi-Fi, Near Field Communication (NFC), CDMA, TDMA, PDC, WCDMA, CDMA2000, GPRS, GSM, or other forms of wireless communication. Such communication may occur, for example, through a radio-frequency transceiver or another type of component. In some cases, the interface 114 includes a wired communication interface (e.g., USB, Ethernet) that can be connected to one or more input/output devices, such as, for example, a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, for example, through a network adapter.

The example channel 106 can include all or part of a connector, a data communication network or another type of communication link. For example, the channel 106 can include one or more wired or wireless connections, one or more wired or wireless networks or other communication channels. The channel 106 may have any spatial distribution. The channel 106 may be public, private, or include aspects that are public and private. For instance, in some examples, the channel 106 includes one or more of a Local Area Network (LAN), a Wide Area Network (WAN), a Virtual Private Network (VPN), the Internet, a peer-to-peer network, a cellular network, a Wi-Fi network, a Personal Area Network (PAN) (e.g., a Bluetooth low energy (BTLE) network, a ZigBee network, etc.) or other short-range network involving machine-to-machine (M2M) communication, or another type of data communication network.

In the example shown, the quantum-enabled adversary 108 is a node in the communication system 100 that has access to quantum computational resources. For example, the quantum-enabled adversary 108 can be, include, or have access to a quantum computer, a quantum information processor, a quantum memory, a quantum communication interface or a combination of these and possibly other quantum technologies. In some implementations, the quantum-enabled adversary 108 can include a hybrid computing system, for instance, that includes a quantum processor driven by a classical front end processor, or another type of hybrid computing system.

In some examples, the quantum-enabled adversary 108 can store and process information in a quantum system. For instance, the quantum-enabled adversary 108 may encode information as quantum bits (“qubits”) and process the information by manipulating the qubits. The information may be encoded in physical qubits, logical qubits, or a combination of these and other types of qubit encodings. In some implementations, the quantum-enabled adversary 108 can operate in a fault-tolerant regime, or the quantum-enabled adversary may operate below the fault-tolerant regime.

Many public key cryptography systems (“cryptosystems”) are known to be insecure against an attacker armed with a scalable quantum computer. For example, the Diffie-Hellman (DH) and elliptic curve Diffie-Hellman (ECDH) key agreement protocols are vulnerable to certain types of attacks by quantum-enabled adversaries. The threat of quantum computers to public key cryptography can be mitigated by switching to other public key cryptography systems that are believed to be invulnerable to quantum attack. For example, supersingular isogeny-based protocols have been proposed as a quantum-resistant replacement for contemporary key agreement protocols such as the Diffie-Hellman (DH) and elliptic curve Diffie-Hellman (ECDH).

In some implementations, the example quantum-enabled adversary 108 can perform quantum computing algorithms, execute quantum computing circuits or quantum communication protocols, or perform other types of quantum information processing tasks. In the example shown, the quantum-enabled adversary 108 can perform Shor's algorithm, which allows the quantum-enabled adversary to efficiently solve problems that are believed to be hard on a classical computer. For example, the quantum-enabled adversary 108 may use Shor's algorithm to factor large integers, find discrete logarithms or possibly to solve other problems in a computationally-efficient manner. Accordingly, the example quantum-enabled adversary 108 can compromise the security of certain quantum-vulnerable cryptography systems (e.g., by computing a private key of a certificate authority or other entity based on public information).

The example quantum-enabled adversary 108 shown in FIG. 1 can access information exchanged on the channel 106 . For example, the quantum-enabled adversary 108 may access some or all of the information exchanged between the nodes

102 , 104 . In some instances, the quantum-enabled adversary 108 can directly observe correspondence on the channel 106 ; in some instances, the quantum-enabled adversary 108 indirectly obtains such correspondence, for example, by receiving information observed on the channel 106 by another entity or system.

In some implementations, the quantum-enabled adversary 108 can factor integers, compute discrete logarithms, or perform other classically-hard computational tasks fast enough to compromise the security of certain cryptography systems. For example, the quantum-enabled adversary 108 may be capable of computing prime factors fast enough to compromise certain RSA-based cryptography systems or computing discrete logarithms fast enough to compromise certain ECC-based cryptography systems.

In the example shown in FIG. 1 , the nodes

102 , 104 may use a quantum-resistant cryptography system that cannot be compromised by the example quantum-enabled adversary 108 . For instance, the nodes

102 , 104 may use a cryptography system that is secure against a quantum computer that can efficiently execute Shor's algorithm or other types of algorithms that are known to compromise the security of certain conventional cryptography standards.

In some implementations, the nodes

102 , 104 use a digital signature scheme that allows each node to verify the authenticity of messages received from the other node, and the digital signature scheme can be a quantum-resistant scheme that is not vulnerable to the quantum computing resources of the quantum-enabled adversary 108 . In some implementations, the nodes

102 , 104 use an encryption scheme that allows each node to send confidential messages to the other node, and the encryption scheme can be a quantum-resistant scheme that is not vulnerable to the quantum computing resources of the quantum-enabled adversary 108 . Such digital signature schemes and encryption schemes can include or be used in conjunction with a key agreement protocol or a key encapsulation mechanism that is also secure against attacks by the quantum-enabled adversary 108 . In some examples, the nodes

102 , 104 can use the example techniques shown in FIG. 2 , or the nodes

102 , 104 may use variations of these and other techniques to communicate securely on the channel 106 .

FIG. 2 is a flow diagram showing aspects of an example cryptographic process 200 . The example cryptographic process 200 can be performed, for example, by computer systems that can exchange information over a communication channel. For instance, operations in the cryptographic process 200 may be performed by the nodes

102 , 104 in the example communication system 100 shown in FIG. 1 or in another type of system. The example process 200 may include additional or different operations, including operations performed by additional or different entities, and the operations may be performed in the order shown or in another order.

In some cases, one or more of the operations shown in FIG. 2 are implemented as processes that include multiple operations, sub-processes or other types of routines. For example, the processes shown in FIGS. 3A-3B and 4A-4B can be used, in some instances, to perform one or more of the example operations shown in FIG. 2 . In some cases, operations can be combined, performed in parallel, iterated or otherwise repeated or performed in another manner.

The example process 200 shown in FIG. 2 includes operations performed by nodes

202 A, 202 B. In the example shown, the nodes

202 A, 202 B represent two distinct entities in a supersingular isogeny-based cryptosystem. The two distinct entities are referred to as “Alice” and “Bob” in FIG. 2 . In the example shown, the nodes

202 A, 202 B exchange public data, and each node uses the public data provided by the other node to execute the process 200 . In some cases, the nodes

202 A, 202 B may have a server-client relationship, a peer-to-peer relationship or another type of relationship. The nodes

202 A, 202 B may communicate with each other, for example, directly or indirectly, in each stage of the process 200 . In some cases, the process 200 or individual operations within the process 200 can be executed by the nodes

202 A, 202 B over a period of seconds, or the process 200 may be executed over a shorter or longer period of time.

In the example shown in FIG. 2 , each entity may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node

202 A, 202 B. Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node

202 A, 202 B.

In some examples, the cryptographic process 200 is secure against quantum-enabled adversaries such as, for example, the quantum-enabled adversary 108 shown in FIG. 1 . For instance, in some cases, the example cryptographic process 200 is secure against certain types of attacks or other processes that can be performed by a quantum-enabled adversary who has access to public information exchanged between the server 202 and the client 204 . The example cryptographic process 200 may also provide security against classically-enabled adversaries who do not have access to quantum computers or other quantum resources.

At 210 A and 210 B, the nodes

202 A, 202 B perform one or more cryptosystem setup operations. A supersingular isogeny-based cryptosystem can be described in terms of a supersingular elliptic curve E defined over a finite field F p

2 . Let p≥5 be a prime integer; let F p

2 denote a finite field of characteristic p with p 2 elements; and let E be an elliptic curve defined over F p

2 . The cryptosystem setup operations at 210 A, 210 B can include defining the prime integer p=l A n l B m f±1, where l A and l B are distinct prime integers, where f, n, and m are positive integers with f being coprime to l A and l B , such that l A n ≈l B m . In some examples described here, l A =2 and l B =3, and p=2 n 3 m f−1, with f being coprime to 2 and 3, such that 2 n ≈3 m . In such examples, the elliptic curve E has (2 n 3 m f) 2 points.

The cryptosystem setup operations at 210 A, 210 B can include defining elliptic curve points P A , Q A , P B , Q B on the elliptic curve E. For each elliptic curve point, a pair of numbers in the finite field F p

2 can represent the x-coordinate and the y-coordinate. For instance, each coordinate can be expressed A+i*B for some integers A and B between 0 and p. Therefore, each elliptic curve point can be represented by four integers between 0 and p.

In examples where l A =2 and l B =3, {P A , Q A } represents a basis of the set of 2 n -torsion points E[2 n ], and {P B , Q B } represents a basis of the set of 3 m -torsion points E[3 m ]; the order of elliptic curve points P A and Q A is 2 n ; and the order of elliptic curve points P B and Q B is 3 m . The global system parameters p, E, P A , Q A , P B , Q B , p, l A , l B , f, n and m, which define a supersingular isogeny cryptosystem, can be published to, computed by, or otherwise made available to the nodes

202 A, 202 B. When a cryptographic protocol is executed with these parameters, one of the entities works over a first set of elliptic curve points defined by l A n (e.g., E[2 n ]), and the other entity works over a second set of elliptic curve points defined by l A n (e.g., E[3 m ]). In the examples described here (in FIGS. 3A-3B and 4A-4B ), Alice and Bob agree that Alice will work over the set E[2 n ] and Bob will work over the set E[3 m ].

At 212 A and 212 B, the nodes

202 A, 202 B perform one or more operations to each generate a respective key pair. In some implementations, each respective node

202 A, 202 B produces a public-private key pair. For instance, a first public-private key pair for the first entity (“Alice”) may be produced at 212 A, and a second public-private key pair for the second entity (“Bob”) may be produced at 212 B. A public-private key pair of an entity includes a private key and a corresponding public key, which are related as proscribed by the cryptosystem. The private key is kept as a secret of the entity, while the public key can be published to other entities in the cryptosystem. In the example protocol 300 shown in FIGS. 3A-3B , Alice's and Bob's respective public-private key pairs are generated by

operations

310 , 312 , 314 and 316 , 318 , 320 . In the example protocol 400 shown in FIGS. 4A-4B , Alice's and Bob's respective public-private key pairs are generated by

operations

410 , 412 , 414 and 408 , 416 , 418 , 420 . A public-private key pair may be generated in another manner. In some cases, a public-private key pair can be used as a static key pair or an ephemeral key pair.

At 214 A and 214 B, the nodes

202 A, 202 B perform one or more operations to derive a shared secret. In some implementations, the nodes

202 A, 202 B produce a shared secret value that can subsequently be used for cryptographic correspondence. For instance, deriving the shared secret at 214 A, 214 B may produce a secret value that is known to both entities (Alice and Bob), but is not publicly known or easily derivable from public information. In the example protocol 300 shown in FIGS. 3A-3B , the shared secret is the j-invariant value (j(E AB )=j(E BA )) computed at 328 and 340 . In the example protocol 400 shown in FIGS. 4A-4B , the shared secret is the j-invariant value (j(E AB )=j(E BA )) computed at 428 and 440 . In some cases, the protocol performed by each entity to derives the shared secret also validates the public key of the other entity. For example, the techniques described with respect to FIGS. 3A-3B and 4A-4B may be used to validate public keys.

At 216 A and 216 B, the shared secret (generated at 214 A and 214 B) is used for cryptographic correspondence. For example, the keys generated by a key agreement protocol may be used in in a supersingular isogeny-based cryptographic protocol to encrypt or decrypt a message, to sign or verify a message or to generate other parameters that are used for cryptographic correspondence. The keys may be used in another manner.

Two example cryptographic protocols

300 , 400 are described below with respect to FIGS. 3A-3B and FIGS. 4A-4B . In the examples shown in FIGS. 3A-3B and FIGS. 4 A- 4 B, the entities (“Alice” and “Bob”) correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node. Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node.

In some cases, the example cryptographic protocols

300 , 400 can be modified, combined or extended. For example, in the example protocols

300 , 400 , each entity's private key is represented by a single integer (a for Alice, β for Bob). However, private keys for supersingular isogeny-based cryptosystems can have another form. For instance, a private key may have the form (α 1 , α 2 ) for some integers α 1 and α 2 . However, it is possible to choose the private key of the form (1, α) or (α, 1), so that it is given by a single integer α. As another example, FIGS. 3A-3B and 4A-4B show operations in which Alice validates Bob's public key. The protocols

300 , 400 can be modified such that, additionally or alternatively, Bob validates Alice's public key using analogous operations.

In some implementations, the protocols

300 , 400 could be merged, for example, to form a hybrid of the two protocols. For instance, Bob may send his secret generator in place of the random seed. In turn, instead of using two isogeny evaluations, Alice may use one pairing computation and one isogeny evaluation. In this case, Alice would verify, for example, whether e 2

n (U, V)=e 2

n (P A , Q A ) 3

m holds. The <figure-callout id="300" label="protocols" filenames="US1021

CLAIMS

Claims ( 30 )

What is claimed is:

1. A supersingular isogeny-based cryptography method, comprising:

obtaining a secret integer of a first entity;

obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;

computing, by operation of one or more processors, a second image curve based on the secret integer and the first pair of elliptic curve points;

computing, by operation of one or more processors, a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity;

obtaining an encrypted generator point generated by the second entity, wherein the encrypted generator point comprises an encrypted version of a generator point obtained by the second entity based on a secret integer of the second entity and a second pair of elliptic curve points;

obtaining a decrypted generator point by decrypting the encrypted generator point based on the shared secret value; and

using the decrypted generator point to validate the public key.

2. The supersingular isogeny-based cryptography method of claim 1 , wherein the decrypted generator point is decrypted by applying a symmetric key decryption function to the encrypted generator point.

3. The supersingular isogeny-based cryptography method of claim 2 , comprising computing a session key and a verification key based on the shared secret value, wherein the symmetric key decryption function uses the session key and the verification key to generate the decrypted generator point.

4. The supersingular isogeny-based cryptography method of claim 1 , wherein using the decrypted generator point to validate the public key comprises validating the degree of an isogeny having the kernel &lt;G B ′&gt;, where G B ′ represents the decrypted generator point.

5. The supersingular isogeny-based cryptography method of claim 1 , wherein using the decrypted generator point to validate the public key comprises:

using the decrypted generator point to compute a third pair of elliptic curve points, wherein the third pair of elliptic curve points represent an image of a fourth pair of elliptic curve points under an isogeny having a kernel defined by the decrypted generator point; and

verifying that the third pair of elliptic curve points matches the first pair of elliptic curve points.

6. The supersingular isogeny-based cryptography method of claim 1 , wherein using the decrypted generator point to validate the public key comprises:

computing a third image curve based on the decrypted generator point; and

verifying that the third image curve matches the first image curve.

7. The supersingular isogeny-based cryptography method of claim 1 , wherein validating the public key further comprises validating the j-invariant of the first image curve.

8. The supersingular isogeny-based cryptography method of claim 1 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.

9. The supersingular isogeny-based cryptography method of claim 1 , wherein using the decrypted generator point to validate the public key comprises determining that the pubic key is valid, wherein the first pair of elliptic curve points represent an image of a third pair of elliptic curve points under an isogeny.

10. The supersingular isogeny-based cryptography method of claim 9 , further comprising using the shared secret value to execute cryptographic correspondence over a communication network between the first entity and the second entity.

11. A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising:

obtaining a secret integer of a first entity;

obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;

computing a second image curve based on the secret integer and the first pair of elliptic curve points;

computing a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity;

obtaining an encrypted generator point generated by the second entity, wherein the encrypted generator point comprises an encrypted version of a generator point obtained by the second entity based on a secret integer of the second entity and a second pair of elliptic curve points;

obtaining a decrypted generator point by decrypting the encrypted generator point based on the shared secret value; and

using the decrypted generator point to validate the public key.

12. The non-transitory computer-readable medium of claim 11 , wherein the decrypted generator point is decrypted by applying a symmetric key decryption function to the encrypted generator point.

13. The non-transitory computer-readable medium of claim 12 , the operations comprising computing a session key and a verification key based on the shared secret value, wherein the symmetric key decryption function uses the session key and the verification key to generate the decrypted generator point.

14. The non-transitory computer-readable medium of claim 11 , wherein using the decrypted generator point to validate the public key comprises validating the degree of an isogeny having the kernel &lt;G B ′&gt;, where G B ′ represents the decrypted generator point.

15. The non-transitory computer-readable medium of claim 11 , wherein using the decrypted generator point to validate the public key comprises:

using the decrypted generator point to compute a third pair of elliptic curve points, wherein the third pair of elliptic curve points represent an image of a fourth pair of elliptic curve points under an isogeny having a kernel defined by the decrypted generator point; and

verifying that the third pair of elliptic curve points matches the first pair of elliptic curve points.

16. The non-transitory computer-readable medium of claim 11 , wherein using the decrypted generator point to validate the public key comprises:

computing a third image curve based on the decrypted generator point; and

verifying that the third image curve matches the first image curve.

17. The non-transitory computer-readable medium of claim 11 , wherein validating the public key further comprises validating the j-invariant of the first image curve.

18. The non-transitory computer-readable medium of claim 11 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.

19. The non-transitory computer-readable medium of claim 11 , wherein using the decrypted generator point to validate the public key comprises determining that the pubic key is valid, wherein the first pair of elliptic curve points represent an image of a third pair of elliptic curve points under an isogeny.

20. The non-transitory computer-readable medium of claim 19 , the operations further comprising using the shared secret value to execute cryptographic correspondence over a communication network between the first entity and the second entity.

21. A computer device comprising:

one or more processors; and

memory storing instructions that are operable when executed by the one or more processors to perform operations comprising:

obtaining a secret integer of a first entity;

obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;

computing a second image curve based on the secret integer and the first pair of elliptic curve points;

computing a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity;

obtaining an encrypted generator point generated by the second entity, wherein the encrypted generator point comprises an encrypted version of a generator point obtained by the second entity based on a secret integer of the second entity and a second pair of elliptic curve points;

obtaining a decrypted generator point by decrypting the encrypted generator point based on the shared secret value; and

using the decrypted generator point to validate the public key.

22. The computer device of claim 21 , wherein the decrypted generator point is decrypted by applying a symmetric key decryption function to the encrypted generator point.

23. The computer device of claim 22 , the operations comprising computing a session key and a verification key based on the shared secret value, wherein the symmetric key decryption function uses the session key and the verification key to generate the decrypted generator point.

24. The computer device of claim 21 , wherein using the decrypted generator point to validate the public key comprises validating the degree of an isogeny having the kernel &lt;G B ′&gt;, where G B ′ represents the decrypted generator point.

25. The computer device of claim 21 , wherein using the decrypted generator point to validate the public key comprises:

using the decrypted generator point to compute a third pair of elliptic curve points, wherein the third pair of elliptic curve points represent an image of a fourth pair of elliptic curve points under an isogeny having a kernel defined by the decrypted generator point; and

verifying that the third pair of elliptic curve points matches the first pair of elliptic curve points.

26. The computer device of claim 21 , wherein using the decrypted generator point to validate the public key comprises:

computing a third image curve based on the decrypted generator point; and

verifying that the third image curve matches the first image curve.

27. The computer device of claim 21 , wherein validating the public key further comprises validating the j-invariant of the first image curve.

28. The computer device of claim 21 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.

29. The computer device of claim 21 , wherein using the decrypted generator point to validate the public key comprises determining that the pubic key is valid, wherein the first pair of elliptic curve points represent an image of a third pair of elliptic curve points under an isogeny.

30. The computer device of claim 29 , the operations further comprising using the shared secret value to execute cryptographic correspondence over a communication network between the first entity and the second entity.

US15/887,240

2018-02-02

2018-02-02

Public key validation in supersingular isogeny-based cryptographic protocols

Expired - Fee Related

US10218504B1

( en )

Priority Applications (2)

Application Number

Priority Date

Filing Date

Title

US15/887,240

US10218504B1

( en )

2018-02-02

2018-02-02

Public key validation in supersingular isogeny-based cryptographic protocols

US16/220,074

US10313124B1

( en )

2018-02-02

2018-12-14

Public key validation in supersingular isogeny-based cryptographic protocols

Applications Claiming Priority (1)

Application Number

Priority Date

Filing Date

Title

US15/887,240

US10218504B1

( en )

2018-02-02

2018-02-02

Public key validation in supersingular isogeny-based cryptographic protocols

Related Child Applications (1)

Application Number

Title

Priority Date

Filing Date

US16/220,074

Division

US10313124B1

( en )

2018-02-02

2018-12-14

Public key validation in supersingular isogeny-based cryptographic protocols

Publications (1)

Publication Number

Publication Date

US10218504B1

true

US10218504B1 ( en )

2019-02-26

Family

ID=65410782

Family Applications (2)

Application Number

Title

Priority Date

Filing Date

US15/887,240

Expired - Fee Related

US10218504B1

( en )

2018-02-02

2018-02-02

Public key validation in supersingular isogeny-based cryptographic protocols

US16/220,074

Expired - Fee Related

US10313124B1

( en )

2018-02-02

2018-12-14

Public key validation in supersingular isogeny-based cryptographic protocols

Family Applications After (1)

Application Number

Title

Priority Date

Filing Date

US16/220,074

Expired - Fee Related

US10313124B1

( en )

2018-02-02

2018-12-14

Public key validation in supersingular isogeny-based cryptographic protocols

Country Status (1)

Country

Link

US

( 2 )

US10218504B1

( en )

Cited By (19)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

CN110190961A

( en )

*

2019-07-02

2019-08-30

洛阳师范学院

A Verifiable Quantum Secret Sharing Method

CN110932849A

( en )

*

2019-11-27

2020-03-27

苏州大学

Multi-party quantum key agreement method based on non-maximally entangled Bell states with unknown parameters

US10630476B1

( en )

2019-10-03

2020-04-21

ISARA Corporation

Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems

US10805081B1

( en )

2020-04-30

2020-10-13

ISARA Corporation

Processing batches of point evaluations in a supersingular isogeny-based cryptosystem

US10812264B1

( en )

2020-04-30

2020-10-20

ISARA Corporation

Traversing a zigzag path tree topology in a supersingular isogeny-based cryptosystem

US10812265B1

( en )

2020-04-30

2020-10-20

ISARA Corporation

Using cryptographic co-processors in a supersingular isogeny-based cryptosystem

US10880278B1

( en )

2019-10-03

2020-12-29

ISARA Corporation

Broadcasting in supersingular isogeny-based cryptosystems

US11153080B1

( en )

*

2020-07-29

2021-10-19

John A. Nix

Network securing device data using two post-quantum cryptography key encapsulation mechanisms

US20220006835A1

( en )

*

2020-07-02

2022-01-06

International Business Machines Corporation

Tls integration of post quantum cryptographic algorithms

WO2022115491A1

( en )

*

2020-11-24

2022-06-02

Nix John A

Multiple post-quantum cryptography key encapsulations with authentication and forward secrecy

US20220209944A1

( en )

*

2020-12-30

2022-06-30

John A. Nix

Secure Server Digital Signature Generation For Post-Quantum Cryptography Key Encapsulations

US20220385954A1

( en )

*

2018-12-07

2022-12-01

Arris Enterprises Llc

Embedding information in elliptic curve base point

US20230361994A1

( en )

*

2020-09-25

2023-11-09

John A. Nix

System and Methods for Secure Communication Using Post-Quantum Cryptography

US12056549B1

( en )

2015-06-28

2024-08-06

Lcip Jv

Method and apparatus for activating a remote device

US20240421991A1

( en )

*

2021-09-14

2024-12-19

Sony Semiconductor Solutions Corporation

Information processing device, information processing method, information processing system, and computer program

US12192184B2

( en )

2021-12-08

2025-01-07

John A. Nix

Secure session resumption using post-quantum cryptography

US20250015984A1

( en )

*

2023-07-05

2025-01-09

Theon Technology Llc

Use Of Quantum Resistant Iterative Keypads For Large Files

US20260099838A1

( en )

*

2024-10-08

2026-04-09

Circle Internet Group, Inc.

Security and efficiency for multi-party computation wallets

US12609809B2

( en )

2015-06-28

2026-04-21

Peter Lablans

Method and apparatus for activating a remote device

Citations (5)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US20040139029A1

( en )

2002-12-24

2004-07-15

Information And Communications University Educational Foundation

Apparatus and method for generating and verifying ID-based blind signature by using bilinear parings

US20090210716A1

( en )

2008-01-30

2009-08-20

Liqun Chen

Direct anonymous attestation using bilinear maps

US20100329454A1

( en )

2008-01-18

2010-12-30

Mitsubishi Electric Corporation

Encryption parameter setting apparatus, key generation apparatus, cryptographic system, program, encryption parameter setting method, and key generation method

US20120210118A1

( en )

2011-02-14

2012-08-16

Sap Ag

Secure sharing of item level data in the cloud

US20130297929A1

( en )

2012-05-07

2013-11-07

Sap Ag

Real-time Asset Tracking using Discovery Services

Family Cites Families (2)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US9645794B2

( en )

*

2014-09-23

2017-05-09

Texas Instruments Incorporated

Homogeneous atomic pattern for double, add, and subtract operations for digital authentication using elliptic curve cryptography

US10116443B1

( en )

2018-02-02

2018-10-30

ISARA Corporation

Pairing verification in supersingular isogeny-based cryptographic protocols

2018

2018-02-02

US

US15/887,240

patent/US10218504B1/en

not_active

Expired - Fee Related

2018-12-14

US

US16/220,074

patent/US10313124B1/en

not_active

Expired - Fee Related

Patent Citations (5)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US20040139029A1

( en )

2002-12-24

2004-07-15

Information And Communications University Educational Foundation

Apparatus and method for generating and verifying ID-based blind signature by using bilinear parings

US20100329454A1

( en )

2008-01-18

2010-12-30

Mitsubishi Electric Corporation

Encryption parameter setting apparatus, key generation apparatus, cryptographic system, program, encryption parameter setting method, and key generation method

US20090210716A1

( en )

2008-01-30

2009-08-20

Liqun Chen

Direct anonymous attestation using bilinear maps

US20120210118A1

( en )

2011-02-14

2012-08-16

Sap Ag

Secure sharing of item level data in the cloud

US20130297929A1

( en )

2012-05-07

2013-11-07

Sap Ag

Real-time Asset Tracking using Discovery Services

Non-Patent Citations (9)

* Cited by examiner, † Cited by third party

Title

Costello , et al., " Efficient algorithms for supersingular isogeny Diffie-Hellman ", IACR-CRYPTO-2016; https://eprint.iacr.org/2016/413, 2016, 35 pgs.

Costello, Craig, Patrick Longa, and Michael Naehrig. " Efficient algorithms for supersingular isogeny Diffie-Hellman. " Annual Cryptology Conference. Springer, Berlin, Heidelberg, 2016.

*

De Feo , et al., " Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies ", https://eprint.iacr.org/2011/506, 2011, 25 pgs.

Dent, Alexander , " A Designer's Guide to KEMs ", Cryptology ePrint Archive: Report 2002/174, Oct. 31, 2005, 28 pages.

Fujisaki , et al., " Secure Integration of Asymmetric and Symmetric Encryption Schemes ", CRYPTO' 99, LNCS 1666, pp. 537-554, 1999, 18 pgs.

Galbraith, Steven , " On the Security of Supersingular Isogeny Cryptosystems ", Cryptology ePrint Archive: Report 2016/859, Jan. 31, 2017, 22 pages.

Kirkwood , et al., " Failure is not an Option: Standardization Issues for Post-Quantum Key Agreement ", Accessed online Nov. 29, 2017 at https://csrc.nist.gov/csrc/media/events/workshop-on-cybersecurity-in-a-post-quantum-world/documents/presentations/session7-motley-mark.pdf, 21 pgs.

Kirkwood, Daniel, Bradley C. Lackey, John McVey, Mark Motley, Jerome A. Solinas, and David Tuller. " Failure is not an option: standardization issues for post-quantum key agreement. " In Workshop on Cybersecurity in a Post-Quantum World. 2015.

*

USPTO, Non-Final Office Action dated May 4, 2018, in U.S. Appl. No. 15/887,348, 11 pgs.

Cited By (37)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US12609809B2

( en )

2015-06-28

2026-04-21

Peter Lablans

Method and apparatus for activating a remote device

US12056549B1

( en )

2015-06-28

2024-08-06

Lcip Jv

Method and apparatus for activating a remote device

US20220385954A1

( en )

*

2018-12-07

2022-12-01

Arris Enterprises Llc

Embedding information in elliptic curve base point

US11616994B2

( en )

*

2018-12-07

2023-03-28

Arris Enterprises Llc

Embedding information in elliptic curve base point

CN110190961B

( en )

*

2019-07-02

2021-10-15

洛阳师范学院

A Verifiable Method for Quantum Secret Sharing

CN110190961A

( en )

*

2019-07-02

2019-08-30

洛阳师范学院

A Verifiable Quantum Secret Sharing Method

US10880278B1

( en )

2019-10-03

2020-12-29

ISARA Corporation

Broadcasting in supersingular isogeny-based cryptosystems

WO2021062518A1

( en )

*

2019-10-03

2021-04-08

ISARA Corporation

Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems

US10630476B1

( en )

2019-10-03

2020-04-21

ISARA Corporation

Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems

CN110932849A

( en )

*

2019-11-27

2020-03-27

苏州大学

Multi-party quantum key agreement method based on non-maximally entangled Bell states with unknown parameters

CN110932849B

( en )

*

2019-11-27

2021-07-27

苏州大学

Multi-party quantum key agreement method based on non-maximally entangled Bell states with unknown parameters

US10805081B1

( en )

2020-04-30

2020-10-13

ISARA Corporation

Processing batches of point evaluations in a supersingular isogeny-based cryptosystem

US10812264B1

( en )

2020-04-30

2020-10-20

ISARA Corporation

Traversing a zigzag path tree topology in a supersingular isogeny-based cryptosystem

US10812265B1

( en )

2020-04-30

2020-10-20

ISARA Corporation

Using cryptographic co-processors in a supersingular isogeny-based cryptosystem

US20220006835A1

( en )

*

2020-07-02

2022-01-06

International Business Machines Corporation

Tls integration of post quantum cryptographic algorithms

US11374975B2

( en )

*

2020-07-02

2022-06-28

International Business Machines Corporation

TLS integration of post quantum cryptographic algorithms

JP2023531241A

( en )

*

2020-07-02

2023-07-21

インターナショナル・ビジネス・マシーンズ・コーポレーション

TLS Integration of Post-Quantum Cryptography Algorithms

JP7586616B2

( en )

2020-07-02

2024-11-19

インターナショナル・ビジネス・マシーンズ・コーポレーション

TLS integration of post-quantum cryptography algorithms

US11153080B1

( en )

*

2020-07-29

2021-10-19

John A. Nix

Network securing device data using two post-quantum cryptography key encapsulation mechanisms

WO2022060471A3

( en )

*

2020-07-29

2022-06-02

Nix John A

Secure communication with two post-quantum cryptography key encapsulations and authentication

US11722296B2

( en )

*

2020-07-29

2023-08-08

John A. Nix

Device securing communications using two post-quantum cryptography key encapsulation mechanisms

US20240097891A1

( en )

*

2020-07-29

2024-03-21

John A. Nix

Device Securing Communications Using Two Post-Quantum Cryptography Key Encapsulation Mechanisms

US20220038269A1

( en )

*

2020-07-29

2022-02-03

John A. Nix

Device Securing Communications Using Two Post-Quantum Cryptography Key Encapsulation Mechanisms

US12088706B2

( en )

*

2020-07-29

2024-09-10

John A. Nix

Device securing communications using two post-quantum cryptography key encapsulation mechanisms

US20230361994A1

( en )

*

2020-09-25

2023-11-09

John A. Nix

System and Methods for Secure Communication Using Post-Quantum Cryptography

US12388631B2

( en )

*

2020-09-25

2025-08-12

John A. Nix

System and methods for secure communication using post-quantum cryptography

WO2022115491A1

( en )

*

2020-11-24

2022-06-02

Nix John A

Multiple post-quantum cryptography key encapsulations with authentication and forward secrecy

US12301709B2

( en )

*

2020-11-24

2025-05-13

John A. Nix

Multiple post-quantum cryptography key encapsulations with authentication and forward secrecy

US20240106636A1

( en )

*

2020-11-24

2024-03-28

John A. Nix

Multiple post-quantum cryptography key encapsulations with authentication and forward secrecy

US20240323006A1

( en )

*

2020-12-30

2024-09-26

John A. Nix

Secure Server Digital Signature Generation for Post-Quantum Cryptography Key Encapsulations

US12003629B2

( en )

*

2020-12-30

2024-06-04

John A. Nix

Secure server digital signature generation for post-quantum cryptography key encapsulations

US20220209944A1

( en )

*

2020-12-30

2022-06-30

John A. Nix

Secure Server Digital Signature Generation For Post-Quantum Cryptography Key Encapsulations

US20240421991A1

( en )

*

2021-09-14

2024-12-19

Sony Semiconductor Solutions Corporation

Information processing device, information processing method, information processing system, and computer program

US12192184B2

( en )

2021-12-08

2025-01-07

John A. Nix

Secure session resumption using post-quantum cryptography

US20250015984A1

( en )

*

2023-07-05

2025-01-09

Theon Technology Llc

Use Of Quantum Resistant Iterative Keypads For Large Files

US20260099838A1

( en )

*

2024-10-08

2026-04-09

Circle Internet Group, Inc.

Security and efficiency for multi-party computation wallets

US20260100822A1

( en )

*

2024-10-08

2026-04-09

Circle Internet Group, Inc.

Improved security and efficiency for multi-party computation wallets

Also Published As

Publication number

Publication date

US10313124B1

( en )

2019-06-04

Similar Documents

Publication

Publication Date

Title

US10116443B1

( en )

2018-10-30

Pairing verification in supersingular isogeny-based cryptographic protocols

US10313124B1

( en )

2019-06-04

Public key validation in supersingular isogeny-based cryptographic protocols

US9800411B1

( en )

2017-10-24

Using a secret generator in an elliptic curve cryptography (ECC) digital signature scheme

US10454681B1

( en )

2019-10-22

Multi-use key encapsulation processes

JP7221872B2

( en )

2023-02-14

A Key Agreement Protocol Based on Elliptic Curve Homogenies

Odelu et al.

2016

Provably secure authenticated key agreement scheme for smart grid

US9660978B1

( en )

2017-05-23

Using a digital certificate with multiple cryptosystems

US9942040B1

( en )

2018-04-10

Refreshing public parameters in lattice-based cryptographic protocols

US8670563B2

( en )

2014-03-11

System and method for designing secure client-server communication protocols based on certificateless public key infrastructure

US9912479B1

( en )

2018-03-06

Key encapsulation mechanisms

US9571274B2

( en )

2017-02-14

Key agreement protocol

US9705683B2

( en )

2017-07-11

Verifiable implicit certificates

US10880278B1

( en )

2020-12-29

Broadcasting in supersingular isogeny-based cryptosystems

US10027475B2

( en )

2018-07-17

Key agreement device and method

US10812265B1

( en )

2020-10-20

Using cryptographic co-processors in a supersingular isogeny-based cryptosystem

Kara et al.

2021

Secure key exchange against man-in-the-middle attack: Modified diffie-hellman protocol

US10218494B1

( en )

2019-02-26

Performing block form reductions modulo non-Mersenne primes in cryptographic protocols

US10630476B1

( en )

2020-04-21

Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems

US10805081B1

( en )

2020-10-13

Processing batches of point evaluations in a supersingular isogeny-based cryptosystem

Shen et al.

2023

Verifiable privacy-preserving federated learning under multiple encrypted keys

JP2025000864A

( en )

2025-01-07

Computer implemented system and method for sharing common secret

US10061636B1

( en )

2018-08-28

Conversion schemes for public key cryptosystems

US20160352689A1

( en )

2016-12-01

Key agreement protocol

US10031795B1

( en )

2018-07-24

Using conversion schemes in public key cryptosystems

Hussein et al.

2023

NTRU_ SSS: Anew Method Signcryption Post Quantum Cryptography Based on Shamir’s Secret Sharing

Legal Events

Date

Code

Title

Description

2018-02-02

FEPP

Fee payment procedure

Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

2018-03-15

FEPP

Fee payment procedure

Free format text : ENTITY STATUS SET TO SMALL (ORIGINAL EVENT CODE: SMAL); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text : ENTITY STATUS SET TO SMALL (ORIGINAL EVENT CODE: SMAL); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY

2019-02-06

STCF

Information on status: patent grant

Free format text : PATENTED CASE

2020-10-12

FEPP

Fee payment procedure

Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

2022-10-17

FEPP

Fee payment procedure

Free format text : MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

2023-04-03

LAPS

Lapse for failure to pay maintenance fees

Free format text : PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

2023-04-03

STCH

Information on status: patent discontinuation

Free format text : PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362

2023-04-25

FP

Lapsed due to failure to pay maintenance fee

Effective date : 20230226

if (window.help && window.help.service) { helpApi = window.help.service.Lazy.create(0, {apiKey: 'AIzaSyDTEI_0tLX4varJ7bwK8aT-eOI5qr3BmyI', locale: 'en-US'}); window.requestedSurveys = new Set(); window.requestSurvey = function(triggerId) { if (window.requestedSurveys.has(triggerId)) { return; } window.requestedSurveys.add(triggerId); helpApi.requestSurvey({ triggerId: triggerId, enableTestingMode: false, callback: (requestSurveyCallbackParam) => { if (!requestSurveyCallbackParam.surveyData) { return; } helpApi.presentSurvey({ productData: { productVersion: window.version, customData: { "experiments": "", }, }, surveyData: requestSurveyCallbackParam.surveyData, colorScheme: 1, customZIndex: 10000, }); } }); };

window.requestSurvey('YXTwAsvoW0kedxbuTdH0RAr

Related documents

• Generating augmented reality experiences utilizing physical objects to … — Meta Platforms Technologies, Llc (US20260037214A1)#653960
• Virtual reality system using multiple force arrays for a solver — DeepMotion, Inc. (US10657696B2)#653961
• Tracking position of device inside-out for virtual reality interactivity — Sony Interactive Entertainment America Llc (US10535153B2)#653962
• Augmented reality system with spatialized audio tied to user manipulated … — Magic Leap, Inc. (US11231770B2)#653963
• Big data-based autonomous flight drone system and autonomous flight method … — Rgblab Co., Ltd. (US20210390867A1)#653964