Technique for asymmetric crypto-key generation

• US 7,565,527 B2
• Filed: 02/14/2005
• Issued: 07/21/2009
• Est. Priority Date: 02/14/2005
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: TriCipher, Inc. (Broadcom, Inc.)
• Inventors: Ganesan, Ravi, Schoppert, Brett Jason, Sandhu, Ravinderpal Singh, deSa, Colin Joseph, Bellare, Mihir
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US11/055,986
• Publication Number:
  US 20060184786A1
• Time in Patent Office: 1,618 Days
• Field of Search: 713/155
• US Class Current: 713/155
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

Techniques for generating a multi-factor asymmetric key pair having a public key and split private key with multiple private portions, at least one of the multiple portions being a multiple factor private key portion, are provided. First and second asymmetric key pairs are generated, each having a private key and a public key. A text string and the first private key are cryptographically combined to make a first private key portion of the split private key. This first private key portion is a multiple factor private key portion. A second private key portion of the split private key is generated based upon the generated first private key portion and the second private key.

Claims

1. A method for generating a multi-factor asymmetric key pair having a public key and split private key with multiple private portions, at least one of the multiple portions being a multiple factor private key portion, comprising:

generating a first asymmetric key pair having a first private key and a first public key;

generating a second asymmetric key pair having a second private key and a second public key, the second public key being the public key of the multi-factor asymmetric key pair;

cryptographically combining a text string and the first private key to generate a first private key portion of the split private key, the first private key portion being a multiple factor private key portion; and

generating a second private key portion of the split private key based upon the generated first private key portion and the second private key.

2. The method of claim 1, wherein:

the first private key is split into three or more private key portions, including the first private key portion and a second private key portion;

the second private key portion is a multiple factor private key portion; and

the multiple factors of the second private key portion being one of i) different than, and ii) the same as, the multiple factors of the first private key portion.

3. The method of claim 1, wherein the text string is a user password.

4. The method of claim 1, further comprising:

destroying the second private key subsequent to generation of the second private key portion.

5. The method of claim 1, wherein cryptographically combining the text string and the first private key includes utilizing a password-based key derivation algorithm.

6. The method of claim 5, wherein cryptographically combining the text string and the first private key includes determining a hash of the text string prior to utilizing the password-based key derivation algorithm.

7. The method of claim 6, wherein cryptographically combining the text string and the first private key includes signing the determined hash of the text string with the first private key prior to utilizing the password-based key derivation algorithm.

8. The method of claim 1, further comprising:

generating a third asymmetric key pair having a third private key and a third public key;

wherein the third private key is cryptographically combined with the text string and the first private key in generating the first private key portion.

9. The method of claim 8, further comprising:

determining a first hash of the text string;

signing the first hash with the first private key;

determining a second hash of the signed first hash;

signing the second hash with the third private key; and

utilizing the password-based key derivation algorithm, subsequent to the signing the second hash;

wherein the utilization of the password-based key derivation algorithm completes the cryptographic combination of the text string, first private key, and third private key.

10. The method of claim 1, wherein a user device generates the multi-factor asymmetric key pair, and further comprising:

storing the first private key on one of i) the user device, and ii) removable media associated with the user device;

transmitting the first public key and the second public key to a central location; and

publicly storing the transmitted first and second public keys at the central location.

11. A system for generating a multi-factor asymmetric key pair having a public key and split private key with multiple private portions, at least one of the multiple portions being a multiple factor private key portion, comprising:

a processor configured to generate a first asymmetric key pair having a first private key and a first public key, generate a second asymmetric key pair having a second private key and a second public key, the second public key being the public key of the multi-factor asymmetric key pair, cryptographically combine a text string and the first private key to generate a first private key portion of the split private key, the first private key portion being a multiple factor private key portion, and to generate a second private key portion of the split private key based upon the generated first private key portion and the second private key; and

a data repository configured to store at least a portion of the generated information.

12. The system of claim 11, wherein:

the first private key is split into three or more private key portions, including the first private key portion and a second private key portion;

the second private key portion is a multiple factor private key portion; and

the multiple factors of the second private key portion being one of i) different than, and ii) the same as, the multiple factors of the first private key portion.

13. The system of claim 11, wherein the text string is a user password.

14. The system of claim 11, wherein the processor is further configured to destroy the second private key subsequent to generation of the second private key portion.

15. The system of claim 11, wherein cryptographically combining the text string and the first private key includes utilizing a password-based key derivation algorithm.

16. The system of claim 15, wherein cryptographically combining the text string and the first private key includes determining a hash of the text string prior to utilizing the password-based key derivation algorithm.

17. The system of claim 16, wherein cryptographically combining the text string and the first private key includes signing the determined hash of the text string with the first private key prior to utilizing the password-based key derivation algorithm.

18. The system of claim 11, wherein:

the processor is further configured to generate a third asymmetric key pair having a third private key and a third public key; and

the third private key is cryptographically combined with the text string and the first private key in generating the first private key portion.

19. The system of claim 18, wherein:

the processor is further configured to determine a first hash of the text string, sign the first hash with the first private key, determine a second hash of the signed first hash;

sign the second hash with the third private key; and

utilize the password-based key derivation algorithm, subsequent to the signing the second hash; and

the utilization of the password-based key derivation algorithm completes the cryptographic combination of the text string, first private key, and third private key.

20. The system of claim 11, wherein the data repository is a first data repository associated with the user and is configured to store the first private key, and further comprising:

a second data repository associated with an entity other than the user and configured to store the first public key and the second public key;

wherein the first data repository is one of i) a hard drive, and ii) removable media associated with a user device.