Peer-to-peer smime mechanism

• US 20080301438A1
• Filed: 05/31/2007
• Published: 12/04/2008
• Est. Priority Date: 05/31/2007
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Parkinson, Steven W.
• Granted Patent: US 8,296,559 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method and apparatus for sending a self-asserted certificate is described. In one embodiment, a mail client of a sender is configured to generate a public and private key pair, to create a self-signed certificate, and to form an introduction message addressed to a recipient to enable use of the self-signed certificate prior to corresponding with the recipient. A mail client of a recipient is configured to display an indicator of a receipt of the introduction message from the sender. The indicator comprises a user interface query to the recipient to verify and accept the sender-signed certificate in response to receiving the introduction message from the sender.

Claims

1. A computer-implemented method comprising:

providing a mail client configured to generate a public and private key pair and to create a self-signed certificate; and

forming an introduction message addressed to a recipient to enable use of the self-signed certificate prior to corresponding with the recipient.

2. The method of claim 1 further comprising:

generating the public and private key pair in response to a request of a user of the mail client; and

creating the self-signed certificate based on the user information from the mail client.

3. The method of claim 1 further comprising:

forming an SMIME introduction message in response to a request of a user of the mail client to send the self-signed certificate to the recipient.

4. The method of claim 1 wherein the introduction message comprises an SMIME introduction message comprising a body, an authenticated attribute, a signature, and the self-signed certificate.

5. The method of claim 4 wherein a value of the authenticated attribute triggers a user interface query in a mail client of the recipient to accept the self-signed certificate.

6. The method of claim 4 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.

7. The method of claim 6 wherein the out of band proof comprises a password-based encryption (PBE) of a hash of the self-signed certificate based on a user-selected password for the introduction message, a value of the authenticated attribute to trigger a user interface query in a mail client of the recipient to confirm the user-selected password for the introduction message and to accept the self-signed certificate upon confirmation of the user-selected password.

8. The method of claim 6 wherein the out of band proof comprises a pre-agreed secret key transmitted out of band to the recipient, a value of the authenticated attribute to trigger a user interface query in a mail client of the recipient to confirm the pre-agreed secret key and to accept the self-signed certificate upon confirmation of the pre-agreed secret key.

9. A computer-implemented method comprising:

providing a mail client configured to display an indicator of a receipt of an introduction message from a sender, the introduction message comprising a public key of the sender and a sender-signed certificate; and

generating a user interface query to a user of the mail client to verify and accept the sender-signed certificate in response to receiving the introduction message from the sender.

10. The method of claim 9 wherein the introduction message is an SMIME introduction message comprising a body, an authenticated attribute, a signature, and the sender-signed certificate.

11. The method of claim 10 wherein a value of the authenticated attribute triggers the user interface query in the mail client to accept the sender-signed certificate.

12. The method of claim 10 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.

13. The method of claim 12 wherein the out of band proof comprises a password-based encryption (PBE) of a hash of the sender-signed certificate based on a sender-selected password for the introduction message, a value of the authenticated attribute to trigger the user interface query in the mail client to confirm the sender-selected password for the introduction message and to accept the sender-signed certificate upon confirmation of the sender-selected password.

14. The method of claim 12 wherein the out of band proof comprises a pre-agreed secret key transmitted out of band from the sender, a value of the authenticated attribute to trigger the user interface query in the mail client to confirm the pre-agreed secret key and to accept the sender-signed certificate upon confirmation of the pre-agreed secret key.

15. An article of manufacture comprising:

a machine-accessible storage medium including data that, when accessed by a machine, cause the machine to perform a method comprising;

providing a mail client configured to generate a public and private key pair and to create a self-signed certificate; and

forming an introduction message addressed to a recipient to enable use of the self-signed certificate prior to corresponding with the recipient.

16. The article of manufacture of claim 15 wherein the method further comprises:

generating the public and private key pair in response to a request of a user of the mail client; and

creating the self-signed certificate based on the user information from the mail client.

17. The article of manufacture of claim 15 wherein the method further comprises:

forming an SMIME introduction message in response to a request of a user of the mail client to send the self-signed certificate to the recipient.

18. The article of manufacture of claim 15 wherein the introduction message comprises an SMIME introduction message comprising a body, an authenticated attribute, a signature, and the self-signed certificate.

19. The article of manufacture of claim 18 wherein a value of the authenticated attribute triggers a user interface query in a mail client of the recipient to accept the self-signed certificate.

20. The article of manufacture of claim 18 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.

21. The article of manufacture of claim 20 wherein the out of band proof comprises a password-based encryption (PBE) of a hash of the self-signed certificate based on a user-selected password for the introduction message, a value of the authenticated attribute to trigger a user interface query in a mail client of the recipient to confirm the user-selected password for the introduction message and to accept the self-signed certificate upon confirmation of the user-selected password.

22. The article of manufacture of claim 20 wherein the out of band proof comprises a pre-agreed secret key transmitted out of band to the recipient, a value of the authenticated attribute to trigger a user interface query in a mail client of the recipient to confirm the pre-agreed secret key and to accept the self-signed certificate upon confirmation of the pre-agreed secret key.

23. An article of manufacture comprising:

a machine-accessible storage medium including data that, when accessed by a machine, cause the machine to perform a method comprising;

providing a mail client configured to display an indicator of a receipt of an introduction message from a sender, the introduction message comprising a public key of the sender and a sender-signed certificate; and

generating a user interface query to a user of the mail client to verify and accept the sender-signed certificate in response to receiving the introduction message from the sender.

24. The article of manufacture of claim 23 wherein the introduction message is an SMIME introduction message comprising a body, an authenticated attribute, a signature, and the sender-signed certificate.

25. The article of manufacture of claim 24 wherein a value of the authenticated attribute triggers the user interface query in the mail client to accept the sender-signed certificate.

26. The article of manufacture of claim 24 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.

27. The article of manufacture of claim 26 wherein the out of band proof comprises a password-based encryption (PBE) of a hash of the sender-signed certificate based on a sender-selected password for the introduction message, a value of the authenticated attribute to trigger the user interface query in the mail client to confirm the sender-selected password for the introduction message and to accept the sender-signed certificate upon confirmation of the sender-selected password.

28. The article of manufacture of claim 26 wherein the out of band proof comprises a pre-agreed secret key transmitted out of band from the sender, a value of the authenticated attribute to trigger the user interface query in the mail client to confirm the pre-agreed secret key and to accept the sender-signed certificate upon confirmation of the pre-agreed secret key.

29. A client comprising:

a mail client configured to generate a public and private key pair, to create a self-signed certificate, and to form an introduction message addressed to a recipient to enable use of the self-signed certificate prior to corresponding with the recipient.

30. The client of claim 29 wherein the mail client is to generate the public and private key pair in response to a request of a user of the mail client, and is to create the self-signed certificate based on the user information from the mail client.

31. The client of claim 29 wherein the mail client is to form an SMIME introduction message in response to a request of a user of the mail client to send the self-signed certificate to the recipient, the SMIME introduction message comprising a body, an authenticated attribute, a signature, and the self-signed certificate.

32. The client of claim 31 wherein a value of the authenticated attribute triggers a user interface query in a mail client of the recipient to accept the self-signed certificate.

33. The client of claim 31 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.

34. A client comprising:

a mail client configured to display an indicator of a receipt of an introduction message from a sender, the introduction message comprising a public key of the sender and a sender-signed certificate,

wherein the indicator comprises a user interface query to a user of the mail client to verify and accept the sender-signed certificate in response to receiving the introduction message from the sender.

35. The client of claim 34 wherein the introduction message is an SMIME introduction message comprising a body, an authenticated attribute, a signature, and the sender-signed certificate.

36. The client of claim 35 wherein a value of the authenticated attribute triggers the user interface query in the mail client to accept the sender-signed certificate.

37. The client of claim 35 wherein the authenticated attribute comprises an authenticator, the authenticator comprises an out of band proof.