Constructive Channel Key

• US 20090097657A1
• Filed: 10/06/2008
• Published: 04/16/2009
• Est. Priority Date: 10/05/2007
• Status: Abandoned Application

• Current Assignee: TecSec, Incorporated
• Original Assignee: TecSec, Incorporated
• Inventors: Butler, Roger, Scheidt, Edward M., Tsang, Wai, Wack, C. JAY, Parsons, Ron
• Application Number:
  US12/246,257
• Publication Number:
  US 20090097657A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 2209/20 Manipulating the length of blocks of bits, e.g. padding or block truncation
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068

Abstract

A method of generating a constructive channel key includes providing an issuer with a card public key as the keying part of a CKM credential. An ephemeral key pair is computed by the issuer using pre-established enterprise domain parameters. A shared value for the ephemeral private key and the card public key is computed using D-H key agreement. The ephemeral private key is destroyed. The shared value is combined with a static key value. The static key value is split into four blocks. The first block is truncated to be used for a session encryption key. The second block is truncated to be used for a session MAC key. The third block is truncated to be used for a session key encryption key. The fourth block is truncated to be used for an initial IVEC.

Claims

1. A method of generating a constructive channel key, comprising:

providing an issuer with a card public key as the keying part of a CKM credential;

computing an ephemeral key pair by the issuer using pre-established enterprise domain parameters;

computing a shared value for the ephemeral private key and the card public key using D-H key agreement;

destroying the ephemeral private key;

combining the shared value with a static key value;

splitting the static key value into four blocks;

truncating the first block to be used for a session encryption key;

truncating the second block to be used for a session MAC key;

truncating the third block to be used for a session key encryption key; and

truncating the fourth block to be used for an initial IVEC.