Conceptio › Archive › Google Patents

Google Patentsopen access

Hybrid encryption schemes — Certicom Corp. (US9172529B2)

Certicom Corp. · Google Patents

Google Patents · Patents · License: Open Access

patent, google patents, intellectual property, US9172529B2, Certicom Corp., Gregory Marc Zaverucha, en, 2015

ABSTRACT

Abstract

Methods, systems, and computer programs for using hybrid encryption schemes are disclosed. In some implementations, a random value is obtained by a pseudorandom generator. A symmetric key is generated based on the random value. A public component is also generated based on the random value. Additionally, an initialization vector is generated based on the random value. The symmetric key and the initialization vector are used to generate an encrypted message based on an input message. The encrypted message and the public component are transmitted to an entity. At least one of the public component or the symmetric key is generated based additionally on a public key of the entity.

Description

BACKGROUND

This specification relates to hybrid encryption schemes in a cryptography system. Cryptography systems allow entities to communicate in a secure manner over public channels. For example, a hybrid encryption scheme can be used to generate ciphertexts that can be decrypted efficiently only by using a particular entity's private key. In some instances, key collision attacks may be performed by an adversary to compromise the encryption scheme, for example, to decrypt ciphertexts transmitted between entities.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an example data communication system.

FIG. 2 is a schematic diagram of an example cryptography system with an example countermeasure.

FIG. 3 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 4 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 5 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 6 is a flow chart showing an example hybrid encryption process.

Like reference numbers and designations in the various drawings indicate like elements.

DETAILED DESCRIPTION

Some hybrid encryption schemes are vulnerable to certain types of attacks. For example, hybrid encryption schemes that use a fixed or low-entropy initialization vector, and other types of hybrid encryption schemes, may be vulnerable to certain key collision attacks. Hybrid encryption schemes can be designed to include countermeasures that defeat such attacks. Some example countermeasures are described here in the context of Elliptic Curve Integrated Encryption Schemes (ECIES) and RSA hybrid encryption schemes. Such countermeasures can be adapted for other types of hybrid encryption schemes, as appropriate.

Hybrid encryption schemes can be used to encrypt messages exchanged between entities. A symmetric key can be used to generate the encrypted messages according to an encryption function. In some hybrid encryption schemes (e.g., ECIES), a message sender produces the symmetric key based on a random value and a public key of the message recipient. The encryption function generates the encrypted message from a plaintext message based on the symmetric key and an initialization vector. In some implementations, the initialization vector can be generated based on the random value that was used to produce the symmetric key.

In addition to the encrypted message, the message sender produces a public component. The public component can be generated based on the random value that was used to produce the symmetric key. In some hybrid encryption schemes (e.g., RSA-based hybrid encryption schemes), the message sender produces the public component based on the public key of the message recipient and the random value that was used to generate the symmetric key. The message sender sends the public component to the message recipient. The recipient can use the recipient's private key and the public component to produce the symmetric key. The message recipient can then use the symmetric key to produce the plaintext message from the encrypted message.

The random value(s) used by the hybrid encryption scheme can be produced by a pseudorandom generator. Some example pseudorandom generators are described in âSpecial Publication 800-90: Recommendation for Random Number Generation Using Deterministic Bit Generators (Revised),â by E. Barker and J. Kelsey, published by the National Institute of Standards and Technology, dated March 2007. These and other types of pseudorandom number generators can be used, as appropriate. A pseudorandom generator can be implemented in hardware, software, firmware, or any suitable combination thereof. A pseudorandom generator can operate deterministically and provide an output that appears random from an adversary's perspective. Accordingly, the output of a pseudorandom generator can be referred to as a random value although the pseudorandom generator itself operates deterministically. In some implementations, the random value obtained from a pseudorandom generator depends on the state of the pseudorandom generator.

In some implementations, the symmetric key, the initialization vector, or the public component, or any suitable combination of them, can be generated based on the random value produced by a pseudorandom generator. In some instances, one or more of the symmetric key, the initialization vector, or the public component is generated based directly on the random value. For example, all or part of the random value can be used as the symmetric key and/or as the initialization vector in an RSA-based hybrid encryption scheme. As another example, the random value can be used as an input in a function that produces the symmetric key, the initialization vector, and/or the public component. In some instances, one or more of the symmetric key, the initialization vector, or the public component is generated based indirectly on the random value. For example, the symmetric key, the initialization vector, and/or the public component can be generated based on another value that has been generated based on the random value.

FIG. 1 is a schematic diagram of an example data communication system 100 . The data communication system 100 includes a first terminal 102 a , a second terminal 102 b , and an adversary terminal 104 . The data communication system 100 can include additional, fewer, or different components. For example, the data communication system 100 may include servers, additional terminals, additional networking devices and other features not shown in the figure.

The terminals

102 a , 102 b , and the adversary terminal 104 can be computing devices or systems that can communicate over data networks or communication links based on communication schemes specified by a cryptography system. The terminals

102 a , 102 b , the adversary terminal 104 are generally operable to receive, transmit, process, and store information. Although FIG. 1 shows two terminals

102 a , 102 b , and an adversary terminal 104 , a data communication system 100 may include any number of terminals. The data communication system 100 can include groups or subgroups of terminals that can communicate with each other. The data communication system 100 can include terminals of disparate types, having different types of hardware and software configurations, and in a variety of different locations. In some cases, multiple devices or subsystems can be identified together as a single terminal.

The

terminals

102 a , 102 b , 104 typically include a data processing apparatus, a data storage medium, and a data communication interface. For example, the terminals

102 a , 102 b , and the adversary terminal 104 can include a memory, a data processor, and an input/output controller. A terminal can include user interface devices, for example, a monitor, touchscreen, mouse, trackball or keyboard. The memory of the terminal can store messages and information associated with the cryptography system. For example, a terminal may store public and private key data, digital certificate data, and other types of information. The memory of the terminal can store instructions (e.g., computer code) associated with computer applications, programs and computer program modules, and other resources.

Terminals can include handheld devices such as smart phones, personal digital assistants (PDAs), portable media players, laptops, notebooks, tablets, and others. Terminals can include work stations, mainframes, non-portable computing systems, devices installed in structures, vehicles, and other types of installations. Terminals can include embedded communication devices. For example, the terminals can include messaging devices that are embedded in smart energy meters of a smart energy system. Other types of terminals may also be used.

The terminals

102 a , 102 b can communicate with each other and with other components of a data communication system over a data network (not shown). In the example shown in FIG. 1 , the terminal 102 a can generate an encrypted message 110 based on a plaintext message and a public key of an entity associated with the terminal 102 b . The terminal 102 a can send the encrypted message 110 to the terminal 102 b . The terminal 102 b can decrypt the encrypted message 110 based on a private key of the entity associated with the terminal 102 b . The adversary terminal 104 can observe the public communications between the terminals

102 a , 102 b , and the adversary may launch an attack that is designed to discover or exploit vulnerabilities in the encryption scheme. For example, the adversary terminal 104 may perform a key collision attack or another type of attack. In some instances, the terminals

102 a , 102 b employ one or more countermeasures that prevent, or substantially reduce the likelihood of, a successful attack by the adversary terminal 104 .

The encrypted message 110 can include a ciphertext message generated by the terminal 102 a according to a hybrid encryption scheme. The hybrid encryption scheme can use a symmetric key encryption algorithm. In a symmetric key encryption algorithm, the same secret value is used by the message sender to encrypt the message and by the message recipient to decrypt the message. In some examples, E: {0,1} Îº Ã{0,1}*â{0,1}* can be a symmetric key encryption function E(k,M)=C, where k is a Îº-bit symmetric key, M is the input plaintext message that includes one or more plaintext blocks, and C is the output ciphertext.

The symmetric key encryption function E can utilize an initialization vector (IV). The initialization vector can be a public or private value that is r bits long. Generally, a deterministic function may produce the same ciphertext for a given plaintext. An initialization vector can be used to vary the ciphertext produced by the deterministic function. In some instances, the initialization vector may to provide a security property sometimes referred to as âindistinguishability.â Indistinguishability can refer to a situation where, given two plaintexts and an encryption of one of the two plaintexts, the identity of the encrypted plaintext (i.e., which of the two plaintexts has been encrypted) cannot be determined with greater than fifty percent probability. In some cases, an initialization vector may be referred to as a ânonceâ (i.e., a number that is used once).

Hybrid encryption schemes can generate the symmetric key for the symmetric key encryption function based on a public-key and private-key pair. For example, the message sender can generate the symmetric key based on the message recipient's public key, and the message recipient can generate the symmetric key based on the message recipient's private key. As a particular example, let pk represent a public key and Îµ represent a public key encryption function. To encrypt long messages, a symmetric key K can be encrypted using the expensive public key operation c 1 =Îµ(pk, K), and K can then be used to encrypt a (possibly long) encrypted message c 2 =E(K, M). The overall output can be represented (c 1 ,c 2 ). In some cases, hybrid encryption is also referred to as KEM/DEM, since c 1 can be produced by a key encapsulation method (KEM) and c 2 can be produced by a data encapsulation method (DEM).

An example hybrid encryption scheme, ECIES, can be descri

BACKGROUND

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an example data communication system.

FIG. 2 is a schematic diagram of an example cryptography system with an example countermeasure.

FIG. 3 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 4 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 5 is a schematic diagram of another example cryptography system with another example countermeasure.

FIG. 6 is a flow chart showing an example hybrid encryption process.

Like reference numbers and designations in the various drawings indicate like elements.

DETAILED DESCRIPTION

The terminals

102 a , 102 b , the adversary terminal 104 are generally operable to receive, transmit, process, and store information. Although FIG. 1 shows two terminals

The

terminals

102 a , 102 b , 104 typically include a data processing apparatus, a data storage medium, and a data communication interface. For example, the terminals

The terminals

102 a , 102 b employ one or more countermeasures that prevent, or substantially reduce the likelihood of, a successful attack by the adversary terminal 104 .

An example hybrid encryption scheme, ECIES, can be described in terms of the following framework. Let G be a generator of the elliptic curve group G used to implement ECIES, having prime order n. The KEM step can take the recipient's public key A=aG and a parameter keyLen as input, then proceeds as follows: 1) Choose a random integer rÎµ[1, . . . , n]; 2) Compute c 1 =rG; 3) Compute K=KDF(rA)=KDF(raG), where KDF: Gâ{0,1} keyLen is a key derivation function; and 4) Output from the KEM the public component c 1 , and a private component K. The DEM step takes K and a plaintext message M as input to be encrypted. The message M is encrypted as c 2 =E K (M), where E is a symmetric key encryption function, such as, for example, the advanced encryption standard in cipher block chaining mode (AES-CBC). The output from the DEM can include the public component c 2 . The output of ECIES can be represented (c 1 ,c 2 ). In some implementations, keyLen is the length of two symmetric keys, an encryption key and a MAC (message authentication code) key (K 1 and K 2 , respectively), and the DEM outputs a third component c 3 =MAC K

2 (c 2 )=MAC K

2 (E K

1 (M)). The second component c 2 can provide confidentiality, and the third component c 3 can provide authenticity. For example, when both the second component c 2 can and the third component c 3 are provided to the message recipient, the second component c 2 can be used to recover the message, and the third component c 3 can allow the recipient to verify that the message has not been altered (e.g., by an adversary or otherwise).

Another example hybrid encryption scheme, based on RSA, can be described in terms of the following framework. Let (N, e) be an RSA public key. The integer N is a large composite number having two prime factors p and q, (i.e., N=pq). The encryption exponent e is a small integer (e.g., 3, 2 16 â1, etc.). The input to the KEM is (N, e) and a parameter keyLen. The KEM then proceeds as follows: 1) Choose KÎµ R {0,1} keyLen ; 2) Encode K as an integer in

n and compute c 1 =K e (mode N); and 3) Output a public KEM component c 1 and a private component K. The DEM step can take K as input and a plaintext message M to be encrypted. The message M can be encrypted as c 2 =E K (M). The output from the DEM can be represented c 2 . As in the ECIES scheme, a MAC component may be added.

Key collision attacks may be performed by the adversary terminal 104 on the encrypted message 110 . An example key collision attack on block ciphers with Îº-bit keys can be described as follows. The attack is generic in that it treats the encryption function as a black box. Informally, the attacker begins by collecting a large number of ciphertexts that are the encryption of a partially known plaintext under different keys. Then the attacker chooses random keys and encrypts the known portion of the plaintext until finding a match with one of the ciphertexts collected in the first step. Once the attacker finds a match, with high probability the key used to create both ciphertexts is the same, and the attacker may decrypt the remaining part of the matching ciphertext (which corresponds to the unknown portion of the plaintext). Since this is a type of birthday attack on the keyspace, the complexity is O(2 Îº/2 ) time and space. This example attack allows one of roughly O(2 Îº/2 ) ciphertexts to be decrypted, but does not allow the attacker to choose which ciphertext will be decrypted.

An example key collision attack applied to the block cipher DES is provided by E. Biham in âHow to Forge DES-Encrypted Messages in 2^28 Steps,â Technion Department of Computer Science Technical Report Number CS0884-1996, 1996. Additional information about example key collision attacks is provided by M. E. Hellman in âA Cryptanalytic Time-Memory Trade-Off,â IEEE Transactions on Information Theory 26 (1980), pages 401-406.

Key collision attacks are possible, for example, where each time an encrypted message 110 is created, a different symmetric key is used. Key collision attacks can also be used in other conditions. Key collision attacks are also called âtime-memory trade-off attacks.â The attack may be mounted by the adversary terminal 104 based on the symmetric key encryption function E, by ignoring the KEM component of the ciphertext (c 1 ), whenever the DEM is deterministic or poorly randomized, for example, when the IV is constant or is of low-entropy or in other instances. Some conventional key collision attacks could potentially be launched against a hybrid encryption scheme.

The key collision attack may treat the initialization vector and the symmetric key as an r+Îº bit key. The complexity of the attack can increase from O(2 Îº/2 ) when the initialization vector is a constant, to O(2 (r+Îº)/2 ) when the initialization vector is not constant. Suppose the initialization vector has an entropy of r bits. To neutralize the attack, the entropy can be set to r=Îº. For most modes of operation (e.g., counter (CTR), cipher block chaining (CBC), cipher feedback (CFB), counter with CBC MAC (CCM), Galois/Counter Mode (GCM)), r is equal to the block length. Therefore, with at least some versions of the Advance Encryption Standard (AES), r can be 128, providing security when Îº=128. In some cases, when the initialization vector has r 0 <r bits of entropy, the cost of the attack drops to O(2 (r

+Îº)/2 ).

Similar to the case when the initialization vector has low entropy, when the first plaintext block is not known, but has a low entropy of t 0 ,bits the key collision attack may run with complexity O(2 (t

+Îº)/2 ), which can be better than a brute force attack for t 0 <Îº. The complexity O(2 (t

+Îº)/2 ) is obtained by treating the unknown first block as part of the symmetric key. That is, instead of guessing a key in {0,1} Îº when forming, a dictionary of ciphertexts for the key collision attack, a value in {0,1} Îº ÃM is estimated, for some set M of possible first plaintext blocks, having size 2 t

0 . In some cases, with some modes of operation, (e.g., counter mode or ECB mode) the attack may be mounted by an adversary terminal that may know any fixed plaintext blocks instead of just the first plaintext blocks. This may be possible since in these modes all blocks are independent.

A key collision attack and similar types of attacks against a hybrid encryption scheme may be practical for an adversary in various circumstances. For example, certain attacks may be useful where the first block of an encrypted message is a standard protocol header, either public or having low-entropy. As another example, while most users would never produce 2 Îº/2 ciphertexts under different keys, a group of 2 20 users may, and an attacker observing a large network could potentially observe sufficient ciphertexts to succeed. The attack may still be performed with fewer than 2 Îº/2 ciphertexts at the expense of additional computation. A group of ciphertexts (L 1 ) used by the adversary may be created with different public keys, and by different parties, making it easier for the adversary to observe a sufficient number of them. For applications with strict security requirements, creating 2 b ciphertexts may reduce collective security by b bits, which may cause the application to miss its stated security goal. The storage that is used in the attack may not need to be fast (e.g., it may be cheaper disk instead of more expensive memory), and both storage and computation may be efficiently parallelized. Attacks may be considered practical or otherwise useful in additional or different scenarios as well.

In particular, there may be instances where standardized hybrid encryption schemes (and variants thereof) are vulnerable to key collision attacks. For example, an attack may be effective against some standards with time and space O(2 Îº/2 ) (or an allowable tradeoff).

Some versions of SECG standards may be vulnerable to key collision attacks in certain instances. The SEC 1 standard (e.g., the SEC 1 standard specified in âStandards for Efficient Cryptography, SEC 1: Elliptic Curve Cryptography,â Version 2.0, dated May 21, 2009) specifies an example implementation of ECIES. In some current versions of the SEC 1 standard, the initialization vector or initial counter is allowed to be zero for ECIES, and it is recommended that all initialization vectors are zero, which makes the DEM deterministic in this case. The XOR symmetric key encryption mode may be secure against this attack.

Some versions of ISO 18033-2 may be vulnerable to key collision attacks in certain instances. ISO 18033-2 specifies multiple hybrid public key encryption (PKE) schemes, and specifies that the initialization vector used in the symmetric component can be a string of zero bytes. The XOR symmetric key encryption (SC2) mode may be secure against this attack. The attack applies equally to any of the KEMs specified in ISO 18033-2, including the RSA-based methods.

Some versions of IEEE 1363 may be vulnerable to key collision attacks in certain instances. IEEE 1363a (amendment specifying additional techniques) specifies various Diffie-Hellman integrated encryption scheme (DHIES)-like hybrid encryption schemes, and includes ECIES. The symmetric key algorithms that may be used as a DEM: 3DES-CBC-IV0 and AESCBC-IV0 are also specified. A constant initialization vector is also specified. Accordingly, the techniques in IEEE 1363a may be vulnerable to key collision attacks.

Some versions of RFC 5091 may be vulnerable to key collision attacks in certain instances. RFC 5091 describes how to use the Boneh-Franklin (BF) and Boneh-Boyen 1 (BB1) identity-based encryption (IBE) schemes. The standard describes how to encrypt a session key (i.e., a KEM). The attack may be possible if a deterministic DEM is used (e.g., if one of the DEMs from SEC1, or ISO 18033-2 is used with the KEM described in RFC 5091).

Some versions of PKCS#1 may be vulnerable to key collision attacks in certain instances. Similar to RFC 5091, the PKCS#1 standard specifies a KEM, based on RSA. There are at least two variants, RSAES-PKCS1-v1 â 5, and RSAES-OAEP. If implementations use, e.g., RSAES-OAEP to encrypt a Îº-bit symmetric key k and use k with a deterministic DEM, then they key collision attack may have complexity O(2 Îº/2 ).

Some versions of other hybrid encryption proposals may be vulnerable to key collision attacks in certain instances. There are several PKE schemes based on the KEM/DEM paradigm. One example scheme which may be vulnerable to the attacks is the HOMQV scheme, when it is used with a deterministic DEM component.

Some versions of S/MIME and CMS may be vulnerable to key collision attacks in certain instances. The S/MIME (secure multipart message encoding) and CMS (RFC 5652, cryptographic message syntax) standards specify (highly flexible) ways of encrypting content for one or multiple recipients. CMS standards follow the KEM/DEM paradigm, where the KEM is called âkey encryptionâ and the DEM is called âcontent encryption.â Using deterministic DEMs may allow the hybrid attack as described above. For example, using RSA-KEM (RFC 5990) with a deterministic DEM (AES-CBC with a fixed initialization vector), may be vulnerable to the key collision attack.

The techniques described below (e.g., those described with respect to FIGS. 2 , 3 , 4 , 5 , and 6 ) and variations thereof may be used in a hybrid encryption scheme as countermeasures against key collision attacks. Accordingly, the security of the above-described cryptography systems may be improved based on one or more of the countermeasures described below. In addition to the example implementations described here, the countermeasures described below can be adapted for other suitable hybrid encryption schemes. The countermeasures described below may be combined or modified, as appropriate. In some instances, one or more of the techniques described below can be applied to modify a standard. For example, some of the techniques described here can be applied to ECIES as specified in SEC 1, to two identity-based encryption (IBE) schemes from RFC 5091, and others.

FIG. 2 is a schematic diagram of an example cryptography system 200 with an example countermeasure. The example cryptography system 200 includes a terminal module 202 a and a terminal module 202 b . The cryptography system 200 can include additional or different components. The terminal modules

202 a , 202 b can each be computer program modules implemented by one or more terminals, servers, or other types of computing systems. For example, the terminal modules

202 a , 202 b can be implemented by the terminals

102 a , 102 b of FIG. The terminal modules

202 a , 202 b , can be implemented by additional or different types of hardware systems.

The terminal modules

202 a , 202 b can communicate with each other, for example, over a data network or another type of communication link. In the example shown in FIG. 2 , the terminal module 202 a includes an encryption module 222 , a pseudorandom generator module 224 , a key derivation and encapsulation module 226 , and an IV derivation module 230 . The terminal module 202 b includes a key derivation module 228 , a decryption module 220 , and an IV derivation module 232 . The terminal modules

202 a , 202 b can include additional or different components.

In the example shown in FIG. 2 , the terminal module 202 a sends an encrypted message to the terminal module 202 b . The terminal module 202 a can receive a public key A from the terminal module 202 b . In some implementations, the terminal module 202 a can receive the public key A from another source, for example, from a certificate authority. The public key A can be an elliptic curve point or another type of public key value. The public key A corresponds to a private key a. For example, in the ECIES example, the public key A of the terminal module 202 b is related to the terminal module's 202 b private key a by the relationship A=aG, where G represents a generator point.

The public key A is provided as an input to the key derivation and encapsulation module 226 . The pseudorandom generator module 224 produces a random value, which is provided as an input to the key derivation and encapsulation module 226 . For example, the pseudorandom generator module 224 can generate a random integer rÎµ[1, . . . , n] and provide the random integer r to the key derivation and encapsulation module 226 . The random value can be obtained from another source, for example, from a pseudorandom generator outside the terminal module 202 a . Based on the public key A and the random integer r, the key derivation module 226 can compute a private component K and a public component c 1 . The private component K can be computed using a key derivation function. The key derivation function may have the form K=KDF(rA) or another form. The key derivation function may accept additional or different inputs, and may produce additional or different outputs, as appropriate. The private component K can be provided to the encryption module 222 , and the encryption module 222 can use the private component K as a symmetric key for a symmetric key encryption function.

The key derivation and encapsulation module 226 can compute the public component c 1 based on the random value produced by the pseudorandom generator module 224 . For example, the public component c 1 can be computed as c 1 =rG or in another manner. The public component c 1 is provided as an input to the key derivation and encapsulation module 228 , and the IV derivation module 232 of the second terminal module 202 b . The public component c 1 is also provided as an input to the IV derivation module 230 of the first terminal module 202 a.

The IV derivation module 230 generates the initialization vector IV based on the random value r, for example, by deriving the initialization vector IV from the public component c 1 . The public component c 1 can have high entropy, for example, to achieve a specified level of security in the hybrid encryption scheme. As such, a high-entropy initialization vector IV can be derived from the public component c 1 . Use of the high-entropy initialization vector in the symmetric key encryption function executed by the encryption module 222 may improve the security of the hybrid encryption scheme, for example, against key collision attacks. In some examples, based on the input c 1 =rG, the IV derivation module 230 can use least significant bits of the binary representation of rG as the initialization vector. Additionally or alternatively, the IV derivation module 230 can derive the initialization vector from rG using a hash function. The initialization vector IV produced by the IV derivation module 230 is provided as an input to the encryption module 222 .

In some examples, the IV derivation module 230 derives the initialization vector from a binary representation of an elliptic curve point (e.g., the public component c 1 =rG, or another type of elliptic curve point). In some instances, the least significant bits are extracted from the binary representation and used as the initialization vector. The initialization vector can be based on additional or different bits (e.g., other than the least significant bits) from the binary representation of the elliptic curve point.

A binary representation can be generated according to any suitable technique. For example, the curve point can be converted to an octet string representing the (possibly compressed) point. An âoctetâ can be a group of eight bits, which may be interpreted as an 8-bit unsigned integer. The octet string can be converted to a bitstring. Converting an octet string to a bitstring can be accomplished, for example, by concatenating the octets together (in order) to form the bitstring. Point compression may be used. For example, the compressed y-coordinate can be placed in the leftmost octet of the octet string along with an indication that point compression is being used. The x-coordinate can be placed in the remainder of the octet string. If point compression is not being used, the leftmost octet can indicate that point compression is not being used, and the remainder of the octet string can contain the x-coordinate followed by the y-coordinate.

The encryption module 222 can access the private component K, the initialization vector IV, and a message M and produce an encrypted message c 2 . In some cases, the encrypted message c 2 can be produce by a symmetric key encryption function c 2 =E K (M). The outputs from the terminal module 202 a can be represented (c 1 ,c 2 ). The outputs can be transmitted, together or separately, over a public or private channel to the terminal module 202 b . In the example implementation shown in FIG. 2 , the initialization vector IV is derived from the public component c 1 . Accordingly, the initialization vector IV can also be considered a public value that would be available, for example, to an adversary in some instances.

After receiving the public component c 1 , the key derivation and encapsulation module 228 of the terminal module 202 b can compute the private component K and the initialization vector IV. The key derivation and encapsulation module 228 can use its private key a to derive the private component K from the public component c 1 . The private component K can be computed using a key derivation function. For example, the key derivation function may have the form K=KDF(ac 1 ) or another form. In some examples, based on the input c 1 , the IV derivation module 232 of the terminal module 202 b can derive the initialization vector IV using the same technique used by the IV derivation module 230 . For example, the IV derivation module 232 can use least significant bits of the binary representation of c 1 as the initialization vector, the IV derivation module 232 can derive the initialization vector from c 1 using a hash function, or by another technique.

The private component K, the initialization vector IV, and the encrypted message c 2 are provided as inputs to the decryption module 220 . The decryption module 220 uses the private component K as a symmetric key to decrypt the encrypted message c 2 . For example, the decryption module can execute an appropriate symmetric key decryption function that produces the plaintext message M.

The countermeasures described with regard to FIG. 2 and variations thereof may be applied to various standards. Some of the techniques described here can be applied to modify the ECIES technique set forth in the SEC 1 standard (e.g., the SEC 1 standard specified in âStandards for Efficient Cryptography, SEC 1: Elliptic Curve Cryptography,â Version 2.0, dated May 21, 2009). For example, an initialization vector can be generated from the octet string R created in Step 2 in Section 5.1.3 of the SEC 1 standard. Here, R is an octet string that represents an elliptic curve point R=kG, where k is an ephemeral private key, and G is a generator point of an elliptic curve group. The initialization vector can be generated for decryption in Section 5.1.4 of the SEC 1 standard. For example, the initialization vector can be generated after the octet string R is recovered in Step 1 of Section 5.1.4. The initialization vector can be used in Step 9 for the symmetric key derivation. The countermeasures described with regard to FIG. 2 and variations thereof may be applied to other standards as well.

FIG. 3 is a schematic diagram of another example cryptography system 300 with another example countermeasure. The example cryptography system 300 includes a terminal module 302 a and a terminal module 302 b . The cryptography system 300 can include additional or different components. The terminal modules

302 a , 302 b can each be computer program modules implemented by one or more terminals, servers, or other types of computing systems. For example, the terminal modules

302 a , 302 b can be implemented by the terminals

102 a , 102 b of FIG. The terminal modules

302 a , 302 b , can be implemented by additional or different types of hardware systems.

The terminal modules

302 a , 302 b can communicate with each other, for example, over a data network or another type of communication link. In the example shown in FIG. 3 , the terminal module 302 a includes an encryption module 322 , a pseudorandom generator module 324 , and a key derivation and encapsulation module 326 . The terminal module 302 b includes a key derivation and encapsulation module 328 , and a decryption module 320 . The terminal modules

302 a , 302 b can include additional or different components.

The public key A is provided as an input to the key derivation and encapsulation module 326 . The pseudorandom generator module 324 produces a random value, which is provided as an input to the key derivation and encapsulation module 326 . For example, the pseudorandom generator module 324 can generate a random integer rÎµ[1, . . . , n] and provide the random integer r to the key derivation and encapsulation module 326 . The random value can be obtained from another source, for example, from a pseudorandom generator outside the terminal module 302 a . Based on the public key A and the random integer r, the key derivation and encapsulation module 326 can compute a private component K, a public component c 1 , and an initialization vector IV. The key derivation and encapsulation module 326 can compute the public component c 1 based on the random value produced by the <figure-callout id="224" label="pse

CLAIMS

Claims ( 11 )

What is claimed is:

1. A hybrid encryption method for outputting an encrypted message and a public component for transmission to an entity comprising:

obtaining a random value;

generating, by a computing system, a symmetric key based on the random value and a public key of the entity, wherein generating the symmetric key includes computing K=KDF(rA), where KDF represents a key derivation function, K represents the symmetric key, r represents the random value, and A represents the public key of the entity;

generating, by the computing system, the public component (C 1 ) based on the random value (r), wherein generating the public component includes computing the public component C 1 =rG, where G represents a generator of an elliptic curve group;

generating, by the computing system, an initialization vector (IV) based on the public component;

using the symmetric key and the initialization vector to generate the encrypted message based on an input message; and

outputting the encrypted message and the public component for transmission to the entity, wherein the public component enables the entity to decrypt the encrypted message.

2. The method of claim 1 , wherein generating the initialization vector IV from the public component C 1 includes extracting least significant bits of a binary representation of the public component C 1 .

3. The method of claim 1 , wherein generating the initialization vector IV from the public component C 1 includes evaluating a hash function based on the public component C 1 .

4. A hybrid encryption method for outputting an encrypted message and a public component for transmission to an entity comprising:

obtaining a random value;

generating, by a computing system, a symmetric key (K) based on the random value and a public key of the entity, wherein generating the symmetric key includes:

computing X=KDF(rA), where KDF represents a key derivation function, X represents an output of the key derivation function, r represents the random value, and A represents the public key of the entity; and

deriving the symmetric key K from the output of the key derivation function X;

generating, by the computing system, an initialization vector based on the public component;

using the symmetric key and the initialization vector to generate the encrypted message based on an input message; and

outputting the encrypted message and the public component for transmission to the entity, wherein the public component enables the entity to decrypt the encrypted message.

5. A hybrid encryption method for outputting an encrypted message and a public component for transmission to an entity comprising:

obtaining a random value;

generating, by a computing system, a symmetric key based on the random value;

generating, by the computing system, the public component based on the random value and a public key of the entity, wherein generating the public component includes deriving the public component from a value K e , where K represents the symmetric key, (e, N) represents the public key of the entity, and where e and N are integers;

generating, by the computing system, an initialization vector based on the public component;

using the symmetric key and the initialization vector to generate the encrypted message based on an input message; and

outputting the encrypted message and the public component for transmission to the entity, wherein the public component enables the entity to decrypt the encrypted message.

6. A computing device configured to perform operations for hybrid encryption and outputting an encrypted message and a public component for transmission to an entity, the operations comprising:

obtaining a random value;

generating, by the computing device, a symmetric key based on the random value and a public key of the entity, wherein generating the symmetric key includes computing K=KDF(rA), where KDF represents a key derivation function, K represents the symmetric key, r represents the random value, and A represents the public key of the entity;

generating, by the computing device, the public component (C 1 ) based on the random value (r), wherein generating the public component includes computing the public component C 1 =rG, where G represents a generator of an elliptic curve group;

generating, by the computing device, an initialization vector based on the public component;

using the symmetric key and the initialization vector (IV) to generate the encrypted message based on an input message; and

outputting the encrypted message and the public component for transmission to the entity, wherein the public component enables the entity to decrypt the encrypted message.

7. The computing device of claim 6 , wherein generating the initialization vector IV from the public component C 1 includes extracting least significant bits of a binary representation of the public component C 1 .

8. A non-transitory computer-readable medium storing instructions that, when executed, perform operations for hybrid encryption and outputting an encrypted message and a public component for transmission to an entity, the operations comprising:

obtaining a random value;

generating, by the computing system, an initialization vector based on the public component;

using the symmetric key and the initialization vector (IV) to generate the encrypted message based on an input message; and

outputting the encrypted message and the public component for transmission to the entity, wherein the public component enables the entity to decrypt the encrypted message.

9. The computing device of claim 6 , wherein generating the initialization vector IV from the public component C 1 includes evaluating a hash function based on the public component C 1 .

10. The computer-readable medium of claim 8 , wherein generating the initialization vector IV from the public component C 1 includes extracting least significant bits of a binary representation of the public component C 1 .

11. The computer-readable medium of claim 8 , wherein generating the initialization vector IV from the public component C 1 includes evaluating a hash function based on the public component C 1 .

US13/234,944

2011-09-16

Hybrid encryption schemes

Active

2033-11-18

US9172529B2

( en )

Priority Applications (1)

Application Number

Priority Date

Filing Date

Title

US13/234,944

US9172529B2

( en )

2011-09-16

Hybrid encryption schemes

Applications Claiming Priority (1)

Application Number

Priority Date

Filing Date

Title

US13/234,944

US9172529B2

( en )

2011-09-16

Hybrid encryption schemes

Publications (2)

Publication Number

Publication Date

US20130073850A1

US20130073850A1 ( en )

2013-03-21

US9172529B2

true

US9172529B2 ( en )

2015-10-27

Family

ID=47881778

Family Applications (1)

Application Number

Title

Priority Date

Filing Date

US13/234,944

Active

2033-11-18

US9172529B2

( en )

2011-09-16

Hybrid encryption schemes

Country Status (1)

Country

Link

( 1 )

US9172529B2

( en )

Cited By (4)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US11483145B2

( en )

2017-11-10

2022-10-25

Nippon Telegraph And Telephone Corporation

Key exchange device, key exchange system, key exchange method, and key exchange program for exchanging a key with another device

WO2023113572A1

( en )

2021-12-17

2023-06-22

ì£¼ìíì¬ í¬ë¦½í ë©

Electronic apparatus and encryption method

US11748370B2

( en )

2016-06-01

2023-09-05

Otonomo Technologies Ltd.

Method and system for normalizing automotive data

US11991293B2

( en )

2021-08-17

2024-05-21

International Business Machines Corporation

Authorized secure data movement

Families Citing this family (49)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP2506176A1

( en )

2011-03-30

2012-10-03

Irdeto Corporate B.V.

Establishing unique key during chip manufacturing

US8958550B2

( en )

2011-09-13

2015-02-17

Combined Conditional Access Development & Support. LLC (CCAD)

Encryption operation with real data rounds, dummy data rounds, and delay periods

DE102012209404A1

( en )

2012-06-04

2013-12-05

Robert Bosch Gmbh

Apparatus for executing a cryptographic method and method of operation therefor

US8707454B1

( en )

2012-07-16

2014-04-22

Wickr Inc.

Multi party messaging

US20160063496A1

( en )

2013-03-15

2016-03-03

Vijay Kumar Royyuru

Remote Secure Transactions

FR3004561B1

( en )

2013-04-15

2016-11-11

Banque Accord

METHOD AND SYSTEM FOR ENHANCING SECURITY OF ELECTRONIC TRANSACTIONS

US9830089B1

( en )

2013-06-25

2017-11-28

Wickr Inc.

Digital data sanitization

US10567349B2

( en )

2013-06-25

2020-02-18

Wickr Inc.

Secure time-to-live

US9866591B1

( en )

2013-06-25

2018-01-09

Wickr Inc.

Enterprise messaging platform

US10129260B1

( en )

2013-06-25

2018-11-13

Wickr Inc.

Mutual privacy management

JP2015125652A

( en )

2013-12-26

2015-07-06

æéä¼ç¤¾ãã¯ã¼ã¹ã¿ã¼

Data processing apparatus and data processing method

US9698976B1

( en )

2014-02-24

2017-07-04

Wickr Inc.

Key management and dynamic perfect forward secrecy

US20150294123A1

( en )

2014-04-11

2015-10-15

Krimmeni Technologies, Inc.

System and method for sharing data securely

US9584530B1

( en )

2014-06-27

2017-02-28

Wickr Inc.

In-band identity verification and man-in-the-middle defense

US9798677B2

( en )

2014-10-23

2017-10-24

Microsoft Technology Licensing, Llc

Hybrid cryptographic key derivation

US9654288B1

( en )

2014-12-11

2017-05-16

Wickr Inc.

Securing group communications

US20170085371A1

( en )

2015-04-07

2017-03-23

Secure Channels Sa

System and method for an enhanced xor cipher through extensions

US10892889B2

( en )

2015-04-07

2021-01-12

Coleridge Enterprises Llc

Systems and methods for an enhanced XOR cipher through extensions

EP3089398B1

( en )

2015-04-30

2017-10-11

Nxp B.V.

Securing a cryptographic device

US9432340B1

( en )

2015-05-07

2016-08-30

Bogart Associates

System and method for secure end-to-end chat system

US9811680B2

( en )

2015-06-04

2017-11-07

Microsoft Technology Licensing, Llc

Secure storage and sharing of data by hybrid encryption using predefined schema

US9794062B2

( en )

2015-10-08

2017-10-17

The Boeing Company

Scrambled tweak mode of blockciphers for differential power analysis resistant encryption

US9729310B2

( en )

2015-10-08

2017-08-08

The Boeing Company

Scrambled counter mode for differential power analysis resistant encryption

US10038675B2

( en )

2015-10-13

2018-07-31

Google Llc

Storing decrypted body of message and key used to encrypt and decrypt body of message

US9900160B1

( en )

2015-12-03

2018-02-20

Amazon Technologies, Inc.

Asymmetric session credentials

US9894067B1

( en )

2015-12-03

2018-02-13

Amazon Technologies, Inc.

Cross-region roles

US10277569B1

( en )

2015-12-03

2019-04-30

Amazon Technologies, Inc.

Cross-region cache of regional sessions

US9584493B1

( en )

2015-12-18

2017-02-28

Wickr Inc.

Decentralized authoritative messaging

US10291607B1

( en )

2016-02-02

2019-05-14

Wickr Inc.

Providing real-time events to applications

US9590958B1

( en )

2016-04-14

2017-03-07

Wickr Inc.

Secure file transfer

US9591479B1

( en )

2016-04-14

2017-03-07

Wickr Inc.

Secure telecommunications

US9614668B1

( en )

2016-09-14

2017-04-04

ISARA Corporation

Conversion schemes for cryptography systems

US10608811B2

( en )

2017-06-15

2020-03-31

Microsoft Technology Licensing, Llc

Private set intersection encryption techniques

WO2019010421A1

( en )

2017-07-07

2019-01-10

Ligatti Jay

Systems and methods for generating symmetric cryptographic keys

US10404458B1

( en )

2017-11-17

2019-09-03

ISARA Corporation

Multi-round key encapsulation process

US10061636B1

( en )

2017-12-22

2018-08-28

ISARA Corporation

Conversion schemes for public key cryptosystems

US10031795B1

( en )

2017-12-22

2018-07-24

ISARA Corporation

Using conversion schemes in public key cryptosystems

US11190498B1

( en )

2018-01-11

2021-11-30

Secure Channels, Inc.

System and method for use of filters within a cryptographic process

EP3584991A1

( en )

2018-06-18

2019-12-25

Koninklijke Philips N.V.

Device for data encryption and integrity

US11431498B2

( en )

2019-02-12

2022-08-30

Nxm Labs, Inc.

Quantum-augmentable hybrid encryption system and method

KR102435056B1

( en )

2019-08-26

2022-08-22

(ì£¼)ë¼ëì¤

Multiple Certificate Issuing System Using Extension Functions and Issuing Method Therefor

US11804955B1

( en )

2019-09-13

2023-10-31

Chol, Inc.

Method and system for modulated waveform encryption

US11349644B1

( en )

2020-04-29

2022-05-31

Wells Fargo Bank, N.A.

Database exclusion (DBX) for multi party access (MPA) to sensitive personal information (SPI)

US11743039B2

( en )

2021-04-20

2023-08-29

Coinbase Il Rd Ltd.

System and method for data encryption using key derivation

US12513012B1

( en )

2021-12-30

2025-12-30

Tybalt, Llc

Linear network coding for blockchains

US12192328B1

( en )

2022-05-10

2025-01-07

Wells Fargo Bank, N.A.

Systems and methods for secure communication based on random key derivation

CN118740524B

( en )

2024-09-04

2024-11-29

å½ç½æ¹åççµåæéå¬å¸çµåç§å¦ç ç©¶é¢

A ciphertext conversion method and system

CN119325082B

( en )

2024-10-08

2025-03-18

åäº¬çè¾¾æè½ç§ææéå¬å¸

A new energy station network-related detection data encryption wireless transmission storage management system and method

US12500872B1

( en )

2025-01-30

2025-12-16

Alan Earl Swahn

Secure controlled communications

Citations (24)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US5142578A

( en )

1991-08-22

1992-08-25

International Business Machines Corporation

Hybrid public key algorithm/data encryption algorithm key distribution method based on control vectors

US5481613A

( en )

1994-04-15

1996-01-02

Northern Telecom Limited

Computer network cryptographic key distribution system

US5631961A

( en )

1995-09-15

1997-05-20

The United States Of America As Represented By The Director Of The National Security Agency

Device for and method of cryptography that allows third party access

US5832091A

( en )

1994-09-07

1998-11-03

Mytec Technologies Inc.

Fingerprint controlled public key cryptographic system

US6061791A

( en )

1997-05-09

2000-05-09

Connotech Experts-Conseils Inc.

Initial secret key establishment including facilities for verification of identity

US20010024501A1

( en )

2000-03-03

2001-09-27

Nec Corporation

Method and apparatus for shuffle with proof, method and apparatus for shuffle verification, method and apparatus for generating input message sequence and program for same

US20010046292A1

( en )

2000-03-31

2001-11-29

Gligor Virgil Dorin

Authentication method and schemes for data integrity protection

US20020085710A1

( en )

2000-05-23

2002-07-04

Viswanath Ananth

Hybrid stream cipher

US20040174997A1

( en )

2002-12-03

2004-09-09

Masato Yamamichi

Key agreement system, shared-key generation apparatus, and shared-key recovery apparatus

US20040179679A1

( en )

2003-03-14

2004-09-16

Hawkes Philip Michael

Cryptosystem for communication networks

US20050094805A1

( en )

2003-11-04

2005-05-05

Satoshi Kitani

Information-processing apparatus, control method, program and recording medium

US6965673B1

( en )

1997-09-19

2005-11-15

Telcordia Technologies, Inc.

Method of using transient faults to verify the security of a cryptosystem

US20060245590A1

( en )

2002-06-18

2006-11-02

Brickell Ernie F

Method of confirming a secure key exchange

US20080095360A1

( en )

2006-10-19

2008-04-24

Camille Vuillaume

Signature System and Signature Method

US20080123842A1

( en )

2006-11-03

2008-05-29

Nokia Corporation

Association of a cryptographic public key with data and verification thereof

US20080253566A1

( en )

2007-04-16

2008-10-16

Sony Corporation

Communications system, communications apparatus and method, and computer program

US20100098253A1

( en )

2007-02-28

2010-04-22

France Telecom

Broadcast Identity-Based Encryption

US20110022847A1

( en )

2001-02-14

2011-01-27

Dominic Gavan Duffy

Data processing apparatus and method

US20110033046A1

( en )

2008-06-04

2011-02-10

Masao Nonaka

Encryption device and encryption system

US20120023336A1

( en )

2009-12-10

2012-01-26

Vijayarangan Natarajan

System and method for designing secure client-server communication protocols based on certificateless public key infrastructure

US20120106738A1

( en )

2010-11-01

2012-05-03

Microsoft Corporation

Location brokering for providing security, privacy and services

US20120288072A1

( en )

2007-07-31

2012-11-15

At&T Intellectual Property I, L.P.

Automatic Message Management Utilizing Speech Analytics

US20130142323A1

( en )

2011-12-01

2013-06-06

Joseph P. Chiarella

Methods and systems for deriving a cryptographic framework

US20130318351A1

( en )

2011-02-22

2013-11-28

Mitsubishi Electric Corporation

Similarity degree calculation system, similarity degree calculation apparatus, computer program, and similarity degree calculation method

2011

2011-09-16

US13/234,944

patent/US9172529B2/en

active

Active

Patent Citations (25)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US5142578A

( en )

1991-08-22

1992-08-25

International Business Machines Corporation

Hybrid public key algorithm/data encryption algorithm key distribution method based on control vectors

US5481613A

( en )

1994-04-15

1996-01-02

Northern Telecom Limited

Computer network cryptographic key distribution system

US5832091A

( en )

1994-09-07

1998-11-03

Mytec Technologies Inc.

Fingerprint controlled public key cryptographic system

US5631961A

( en )

1995-09-15

1997-05-20

The United States Of America As Represented By The Director Of The National Security Agency

Device for and method of cryptography that allows third party access

US6061791A

( en )

1997-05-09

2000-05-09

Connotech Experts-Conseils Inc.

Initial secret key establishment including facilities for verification of identity

US6965673B1

( en )

1997-09-19

2005-11-15

Telcordia Technologies, Inc.

Method of using transient faults to verify the security of a cryptosystem

US20010024501A1

( en )

2000-03-03

2001-09-27

Nec Corporation

Method and apparatus for shuffle with proof, method and apparatus for shuffle verification, method and apparatus for generating input message sequence and program for same

US20010046292A1

( en )

2000-03-31

2001-11-29

Gligor Virgil Dorin

Authentication method and schemes for data integrity protection

US7103181B2

( en )

2000-05-23

2006-09-05

Mainstream Encryption

State-varying hybrid stream cipher

US20020085710A1

( en )

2000-05-23

2002-07-04

Viswanath Ananth

Hybrid stream cipher

US20110022847A1

( en )

2001-02-14

2011-01-27

Dominic Gavan Duffy

Data processing apparatus and method

US20060245590A1

( en )

2002-06-18

2006-11-02

Brickell Ernie F

Method of confirming a secure key exchange

US20040174997A1

( en )

2002-12-03

2004-09-09

Masato Yamamichi

Key agreement system, shared-key generation apparatus, and shared-key recovery apparatus

US20040179679A1

( en )

2003-03-14

2004-09-16

Hawkes Philip Michael

Cryptosystem for communication networks

US20050094805A1

( en )

2003-11-04

2005-05-05

Satoshi Kitani

Information-processing apparatus, control method, program and recording medium

US20080095360A1

( en )

2006-10-19

2008-04-24

Camille Vuillaume

Signature System and Signature Method

US20080123842A1

( en )

2006-11-03

2008-05-29

Nokia Corporation

Association of a cryptographic public key with data and verification thereof

US20100098253A1

( en )

2007-02-28

2010-04-22

France Telecom

Broadcast Identity-Based Encryption

US20080253566A1

( en )

2007-04-16

2008-10-16

Sony Corporation

Communications system, communications apparatus and method, and computer program

US20120288072A1

( en )

2007-07-31

2012-11-15

At&T Intellectual Property I, L.P.

Automatic Message Management Utilizing Speech Analytics

US20110033046A1

( en )

2008-06-04

2011-02-10

Masao Nonaka

Encryption device and encryption system

US20120023336A1

( en )

2009-12-10

2012-01-26

Vijayarangan Natarajan

System and method for designing secure client-server communication protocols based on certificateless public key infrastructure

US20120106738A1

( en )

2010-11-01

2012-05-03

Microsoft Corporation

Location brokering for providing security, privacy and services

US20130318351A1

( en )

2011-02-22

2013-11-28

Mitsubishi Electric Corporation

Similarity degree calculation system, similarity degree calculation apparatus, computer program, and similarity degree calculation method

US20130142323A1

( en )

2011-12-01

2013-06-06

Joseph P. Chiarella

Methods and systems for deriving a cryptographic framework

Non-Patent Citations (49)

* Cited by examiner, â Cited by third party

Title

" Hybrid Cryptosystem, " Wikipedia, http://en.wikipedia.org/wiki/Hybrid-cryptosystem, dated Jun. 19, 2011, 2 pages.

A. Biryukov and A. Shamir. Cryptanalytic time/memory/data tradeoffs for stream ciphers. Proceedings of ASIACRYPT'00, LNCS 1976 (2000), 1-13.

A. J. Menezes, P. C. van Oorschot and S. A. Vanstone. Handbook of Applied Cryptography, Chapter 2: Mathematical Background, CRC Press, 1997, 39 pages.

A. J. Menezes, P. C. van Oorschot and S. A. Vanstone. Handbook of Applied Cryptography, Chapter 5: Pseudorandom Bits and Sequences, CRC Press, 1997, 23 pages.

A. J. Menezes, P. C. van Oorschot and S. A. Vanstone. Handbook of Applied Cryptography, Chapter 8: Public Key Encryption, CRC Press, 1997, 38 pages.

Abdall, Michel et al.; " The Oracle Diffie-Hellman Assumptions and an Analysis of DHIES "; Topics in Cryptology-CT-RSA 2001; vol. 2020; Jan. 1, 2001; pp. 143-158.

ANSI X9.63-2001, Public Key Cryptography for the Financial Services Industry-Key Agreement and Key Transport Using Elliptic Curve Cryptography, Nov. 20, 2001, 415 pages.

ANSI X9.63-2011, Public Key Cryptography for the Financial Services Industry-Key Agreement and Key Transport Using Elliptic Curve Cryptography, Dec. 21, 2011, 155 pages.

Ayachit et al, Evolutionary Computnig Based Secure Key Management Protocol, Jul. 31, 2010, IEEE, pp. 1-3.

Blahut et al, Secure Systems, Jan. 2004, Association for Computing Machiners, pp. 1-63.

Buttyan, Levente; " PGP-Pretty Good Privacy "; Sep. 29, 2008; Internet .

Buttyan, Levente; " PGP-Pretty Good Privacy "; Sep. 29, 2008; Internet <http://web.archive.org/web/20080929205643/http://crysys.hu/members/bbencsath/courses/bp-07/pgp.pdf>.

Communication Pursuant to Article 94(3) EPC issued in European Application No. 11181579.1 on Oct. 4, 2013; 7 pages.

D. Harrington, Transport Subsystem for the Simple Network Management Protocol (SNMP), Network Working Group Request for Comments: 5590, Jun. 2009, 35 pages.

D. McGrew. Generation of Deterministic Initialization Vectors (IVs) and Nonces. Internet Draft, dates Jul. 4, 2011, 25 pages.

D. Salomon, G. Motta and D. Bryant. Handbook of Data Compression (5th edition). Chapter 5-" Statistical Methods" (pp. 211-327). Chapter 6-"Dictionary Methods " (pp. 329-441), Springer-Verlag (2010), 230 pages total.

E. Biham. How to Forge DES-Encrypted Messages in 2(28) Steps. Technion Department of Computer Science Technical Report No. CS0894-1996, 1996, 11 pages.

Extended European Search Report issued in European Application No. 11181579.1 on Feb. 7, 2012; 8 pages.

FCD 18033-2, Encryption algorithms-Part 2: Asymmetric ciphers, draft dated Dec. 6, 2004, available online at http://shoup.net/iso/std6.pdf, 131 pages.

Institute of Electrical and Electronics Engineers. Specifications for Public-Key Cryptography Amendment 1: Additional Techniques, IEEE Standard 1363A-2004, Sep. 2004, 168 pages.

Institute of Electrical and Electronics Engineers. Specifications for Public-Key Cryptography, IEEE Standard 1363-2000, Aug. 2000, 236 pages.

International Preliminary Examination Report on Patentability under Chapter I issued in International Application No. PCT/US2012/051929 on Mar. 27, 2014; 7 pages.

International Search Report and Written Opinion of the International Searching Authority issued in International Application No. PCT/US2012/051929 on Jan. 3, 3013; 10 pages.

J. Hong and P. Sarkar. New Application of Time Memory Data Tradeoffs, available online at http://www.iacr.org/archive/asiacrypt2005/348/348.pdf, 2005, 20 pages.

M. Abdalla, M. Bellare and P. Rogaway. DHIES: An encryption scheme based on the Diffie-Hellman Problem, Available online at http://cseweb.ucsd.edu/~mihir/papers/dhaes.pdf, dated Sep. 18, 2001, 30 pages.

M. Abdalla, M. Bellare and P. Rogaway. DHIES: An encryption scheme based on the Diffie-Hellman Problem, Available online at http://cseweb.ucsd.edu/Ëmihir/papers/dhaes.pdf, dated Sep. 18, 2001, 30 pages.

M. Bellare and P. Rogaway, Optimal Asymmetric Encryption-How to Encrypt with RSA. Available online at http://cseweb.ucsd.edu/~mihir/papers/oaep.html, dated Nov. 19, 1995, 19 pages.

M. Bellare and P. Rogaway, Optimal Asymmetric Encryption-How to Encrypt with RSA. Available online at http://cseweb.ucsd.edu/Ëmihir/papers/oaep.html, dated Nov. 19, 1995, 19 pages.

M. Bellare, A. Boldyreva and S. Micali. Public-key Encryption in a Multi-User Setting: Security Proofs and Improvements. Proceedings of EUROCRYPT'00, LNCS 1807 (2000), 259-274.

M. Bellare, T. Kohno and V. Shoup. Stateful Public Key Cryptosystems: How to Encrypt with One 160-bit Exponentiation. Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS'06), ACM Press, New York. 2006, 20 pages.

M.E. Hellman. A Cryptanatylic Time-Memory Trade-Off. IEEE Transactions on Information Theory 26 (1980), pp. 401-406.

Mihir Bellare and Phillip Rogaway, Introduction to Modern Cryptography, Chapter 11-Asymmetric Encryption, accessed on Aug. 25, 2011 at http://cseweb.ucsd.edu/users/mihir/cse207/classnotes.html and http://cseweb.ucsd.edu/users/mihir/cse207/w-asym.pdf, 27 pages.

Public-Key Cryptography Standards (PKCS) PKCS #1: RSA Cryptography Standard, version 2.1. Available online at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf, dated Jun. 14, 2002, 61 pages.

R. Anderson and E. Biham. Two practical and provably secure block ciphers: BEAR and LION, available online at http://www.cl.cam.ac.uk/~rja14/Papers/bear-lion.pdf, 1996, 8 pages.

R. Anderson and E. Biham. Two practical and provably secure block ciphers: BEAR and LION, available online at http://www.cl.cam.ac.uk/Ërja14/Papers/bear-lion.pdf, 1996, 8 pages.

R. Housley, Cryptographic Message Syntax (CMS), Network Working Group Request for Comments: 5652, Sep. 2009, 57 pages.

R. Rivest. All-or-nothing encryption and the package transform, available online at http://people.csail.mit.edu/rivest/Fusion.pdf, 1997, 9 pages.

S. Chauerjee. A. Menezes and P. Sarkar. Another Look at Tightness dated Aug. 4, 2011, pp. 1-25.

S. Halevi and H. Krawczyk, One-Pass HMQV and Asymmetric Key-Wrapping, IBM Research, Dec. 22, 2010, available online at http://eprint.iacr.org/2010/638.pdf, 19 pages.

Scarfone et al, Guide to Bluetooth Security, Sep. 2008, NIST, pp. 1-66.

Shoup, V. Oaep Reconsidered, available online at http://www.shoup.net/papers/oaep.pdf, Sep. 18, 2001, 27 pages.

Standards for Efficient Cryptography Group, SEC 1: Elliptic Curve Cryptography, May 21, 2009, Version 2.0. Available online at: http://

Hybrid encryption schemes — Certicom Corp. (US9172529B2)

Related documents