Strong encryption

• US 8,787,566 B2
• Filed: 08/23/2006
• Issued: 07/22/2014
• Est. Priority Date: 08/23/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Relyea, Robert
• Primary Examiner(s): SHAW, YIN CHEN
• Application Number:
  US11/466,763
• Publication Number:
  US 20080069341A1
• Time in Patent Office: 2,890 Days
• Field of Search: 380 28- 30, 380284-285, 380/44, 713/150, 713168-171
• US Class Current: 380/30
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

An embodiment generally relates to a method of strong encryption. The method includes generating a first cryptographic key based on a random number and generating a second cryptographic key based on a password. The method also includes encrypting private data with the first cryptographic key to arrive at wrapped private data and encrypting the first cryptographic key with the second cryptographic key to arrive at a wrapped first cryptographic key.

Claims

1. A method comprising:

providing, by a processing device, a user interface in response to receiving a token;

receiving a user selection of one of a plurality of security modes via the user interface;

in response to a user selection of a first security mode,

generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user;

encrypting private data of the user with the first cryptographic key to create wrapped private data; and

encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and

in response to a user selection of a second security mode,

generating a third cryptographic key based on a password of a user;

generating an exponent;

encrypting the exponent based on the third cryptographic key;

generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is g^e mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and

encrypting private data of the user with the fourth cryptographic key to create wrapped private data,

wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p.

2. The method of claim 1, further comprising storing the wrapped private data in a first location and storing the wrapped pseudo-random cryptographic key in a second location.

3. The method of claim 1, wherein the exponent of the time-expanding function is a pseudo-random number.

4. The method of claim 3, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters.

5. The method of claim 1, wherein the time-expanding function is based on one of digital signature algorithm, EI-Gamal encryption algorithm, or Diffie-Hellman.

6. An apparatus comprising:

a memory to contain instructions; and

a processor coupled to the memory and to execute the instructions to perform operations comprising;

providing a user interface in response to receiving a token;

receiving a user selection of one of a plurality of security modes via the user interface;

in response to a user selection of a first security mode, generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user;

encrypting private data of the user with the first cryptographic key to create wrapped private data; and

encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and

in response to a user selection of a second security mode,

generating a third cryptographic key based on a password of a user;

generating an exponent;

encrypting the exponent based on the third cryptographic key;

generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is g^e mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and

encrypting private data of the user with the fourth cryptographic key to create wrapped private data,

wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p.

7. A non-transitory computer-readable medium comprising instructions to cause a processing device to perform operations comprising:

providing, by the processing device, a user interface in response to receiving a token;

receiving a user selection of one of a plurality of security modes via the user interface;

in response to a user selection of a first security mode,

generating a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user;

encrypting private data of the user with the first cryptographic key to create wrapped private data; and

encrypting the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key; and

in response to a user selection of a second security mode,

generating a third cryptographic key based on a password of a user;

generating an exponent;

encrypting the exponent based on the third cryptographic key;

generating a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is g^e mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator; and

encrypting private data of the user with the fourth cryptographic key to create wrapped private data,

wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p.

8. A method comprising:

receiving a private key of a user;

generating, by a processor, a first cryptographic key based on a password of the user;

generating an exponent;

encrypting the exponent based on the first cryptographic key;

generating a second cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is g^e mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator;

encrypting the private key of the user with the second cryptographic key to create wrapped private key; and

storing the encrypted exponent and the wrapped private key in separate protected locations,

wherein a time to attack the second cryptographic key increases with value of p.

9. The method of claim 8, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters.

10. The method of claim 9, wherein the exponent of the time-expanding function is a pseudo-random number.

11. A system comprising:

a server to execute a token management system, the token management system to generate and manage cryptographic keys;

at least one client to couple with the server; and

a security client to be executed on the at least one client, wherein the security client is to provide a user interface in response to receiving a token;

receive a user selection of one of a plurality of security modes via the user interface;

in response to a user selection of a first security mode,

generate a first cryptographic key based on a pseudo-random number, and a second cryptographic key based on a password of a user,

encrypt private data of the user with the first cryptographic key to create wrapped private data, and

encrypt the first cryptographic key with the second cryptographic key to create a wrapped pseudo-random cryptographic key, and

in response to a user selection of a second security mode,

generate a third cryptographic key based on a password of a user,

generate an exponent,

encrypt the exponent based on the third cryptographic key,

generate a fourth cryptographic key based on a time expanding function using the encrypted exponent, wherein the time-expanding function is g^e mod p, g is a generator, e is the encrypted exponent, p is a prime number, and mod is a modulo operator, and

encrypt private data of the user with the fourth cryptographic key to create wrapped private data,

wherein in the second security mode, a time to attack the fourth cryptographic key increases with value of p.

12. The system of claim 11, wherein the wrapped private data and the wrapped pseudo-random cryptographic key are stored in separate locations in the server.

13. The system of claim 11, wherein the exponent of the time-expanding function is a pseudo-random number.

14. The system of claim 13, wherein an expansion derived by the time-expanding function is selected based on a plurality of parameters.