SYSTEMS, DEVICES, AND METHODS FOR OUTPUTTING ALERTS TO INDICATE THE USE OF A WEAK HASH FUNCTION

• US 20090089584A1
• Filed: 09/28/2007
• Published: 04/02/2009
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael S., Brown, Michael K., Bender, Christopher L.
• Granted Patent: US 8,295,486 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

Systems, devices, and methods for outputting an alert on a mobile device to indicate the use of a weak hash function are disclosed herein. In one example embodiment, the method comprises receiving data (e.g. from a server) that identifies at least one first hash function, identifying a hash digest generated using a second hash function, determining if the second hash function is weak using the received data, and outputting an alert indicating that the second hash function is weak if it is determined that the second hash function is weak.

Claims

1. A method of outputting an alert on a mobile device, the method comprising:

receiving data that identifies at least one first hash function;

identifying a hash digest generated using a second hash function;

determining, using the data received at said receiving, if the second hash function is weak; and

outputting an alert indicating that that the second hash function is weak if it is determined that the second hash function is weak.

2. The method of claim 1, wherein the data received at said receiving is received from a first server.

3. The method of claim 1, wherein the data received at said receiving is received through a user interface on the mobile device.

4. The method of claim 1, wherein each of the at least one first hash function is identified as being weak, and wherein the second hash function is determined to be weak if the second hash function matches any of the at least one first hash function identified by the data received at said act of receiving data.

5. The method of claim 1, wherein each of the at least one first hash function is identified as being sufficiently strong, and wherein the second hash function is determined to be weak if the second hash function does not match any of the at least one first hash function identified by the data received at said act of receiving data.

6. The method of claim 1, further comprising receiving a message comprising a digital signature, wherein the hash digest identified at the mobile device is a hash digest used to form the digital signature.

7. The method of claim 1, further comprising:

receiving a message at the mobile device, the message comprising a digital signature that is verifiable using a public key of a sender, the public key being associated with a certificate of the sender;

repeating said identifying, determining, and outputting for each of a plurality of hash digests, wherein each of the plurality of hash digests is a hash digest used to form a digital signature of an associated certificate belonging to a certificate chain that comprises the certificate of the sender.

8. The method of claim 1, further comprising identifying a secure connection between the mobile device and a second server, wherein the hash digest identified at the mobile device is a hash digest used to form a digital signature of an associated certificate belonging to a certificate chain that comprises a certificate associated with the second server.

9. The method of claim 8, wherein the secure connection is one of a secure sockets layer connection and a transport layer security connection.

10. The method of claim 8, wherein the second server is a web server.

11. The method of claim 2, wherein the first server is a message management server.

12. The method of claim 2, wherein the data is received from the first server in the form of security policy data.

13. The method of claim 1, wherein at least one act performed in the method is performed by a second device coupled to the mobile device.

14. The method of claim 13, wherein the second device coupled to the mobile device is a proxy server.

15. A mobile device comprising a processor and a memory, wherein the mobile device is programmed to execute a plurality of instructions which, when executed, cause the processor to perform the following:

receive data that identifies at least one first hash function;

identify a hash digest generated using a second hash function;

determine, using the data received, if the second hash function is weak; and

output an alert indicating that the second hash function is weak if it is determined that the second hash function is weak.

16. A computer-readable medium on which a plurality of executable instructions is stored, the instructions for performing the following on a mobile device:

receiving data that identifies at least one first hash function;

identifying a hash digest generated using a second hash function;

determining, using the data received, if the second hash function is weak; and

outputting an alert indicating that the second hash function is weak if it is determined that the hash function is weak.

17. A system for outputting an alert on a mobile device, the system comprising:

a server comprising a processor and a memory, wherein the server is programmed to execute a plurality of instructions which, when executed, cause the processor of the server to identify at least one first hash function at the server, and transmit data identifying the at least one first hash function to the mobile device, the data for use in determining whether a second hash function used to generate a hash digest identified at the mobile device is weak; and

the mobile device, which comprises a processor and a memory, wherein the mobile device is programmed to execute a plurality of instructions which, when executed, cause the processor of the mobile device to receive data from the server that identifies the at least one first hash function, identify a hash digest generated using the second hash function, determine using the data received if the second hash function is weak, and output an alert indicating that the second hash function is weak if it is determined that the second hash function is weak.

18. A method of transmitting data to a mobile device, the method comprising:

identifying at least one first hash function at a server; and

transmitting data identifying the at least one first hash function to a mobile device, the data for use in determining whether a second hash function used to generate a hash digest identified at the mobile device is weak.

19. The method of claim 18, wherein each of the at least one first hash function is identified as being weak.

20. The method of claim 18, wherein each of the at least one first hash function is identified as being sufficiently strong, such that the second hash function is deemed to be weak if it does not match any of the at least one first hash function identified by the data transmitted to the mobile device.

21. The method of claim 18, further comprising outputting a listing of a plurality of first hash functions in a user interface, and receiving input specifying one or more selected first hash functions from the plurality of first hash functions, wherein the at least one first hash function identified at the server comprises the one or more selected first hash functions.

22. The method of claim 21, wherein the listing is output as a menu comprising a plurality of check box controls, wherein each check box control corresponds to one of the plurality of first hash functions in the listing, and wherein any one of the plurality of first hash functions in the listing is selectable by activating the corresponding check box control.

23. The method of claim 18, wherein the data transmitted to the mobile device is in the form of security policy data.