Server-assisted regeneration of a strong secret from a weak secret
View Patent ↗Methods for regenerating a strong secret for a user, based on input of a weak secret, such as a password, are assisted by communications exchanges with a set of independent servers. Each server holds a distinct secret value (i.e., server secret data). The strong secret is a function of the user's weak secret and of the server secret data, and a would-be attacker cannot feasibly compute the strong secret without access to both the user's weak secret and the server secret data. Any attacker has only a limited opportunity to guess the weak secret, even if he has access to all messages transmitted in the generation and regeneration processes plus a subset (but not all) of the server secret data.
1. A method involving a client and a group of one or more servers for deriving a strong secret from a first secret, the method comprising:
providing each server of the group with a respective server secret;
for each server of the group, participating in a blind function evaluation protocol to generate a respective strong secret component, the blind function evaluation protocol evaluating a function taking as input the respective server secret and client information derived from the first secret, and generating as output the respective strong secret component;
generating the strong secret from the strong secret components generated for the group of one or more servers; and
using the strong secret to perform a cryptographic function, wherein the blind function evaluation protocol is characterized in that the client cannot determine any of the respective server secrets and in that each server cannot determine the first secret, any other respective strong secret component, or the strong secret, wherein the blind function evaluation protocol is selected from a set of blind function evaluation protocols that excludes any protocol involving:
the client computing server request data by exponentiating the client information to a random first integer a, wherein the client information is an element w of a finite group G in which exponentiation is efficient but the discrete logarithm problem is computationally infeasible;
the server computing server response data from the server request data and the server secret, wherein the server response data comprises a value c in the group G; and
the client computing a strong secret component by exponentiating the value c to a second integer a′, wherein the first and second integers a and a′ are such that x aa′ =x for all x in the group G.
2. The method of claim 1 , further comprising the steps of:
obtaining by the client an encrypted secret;
deriving a decryption key from one or more of the strong secret components using a key derivation function; and
decrypting the encrypted secret using the decryption key.
3. The method of claim 1 wherein the first secret is a PIN or password.
4. The method of claim 1 wherein the function for at least one of the servers comprises h(w b(i) mod n(i)), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, w is the result of a mask generation function or hash function applied to the first secret, and h denotes a one-way function.
5. The method of claim 1 wherein the function for at least one of the servers comprises w b(i) mod n(i), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, w is the result of a mask generation function or hash function applied to the first secret, and h denotes a one-way function.
6. The method of claim 1 wherein the blind function evaluation protocol for at least one of the servers comprises the client sending a(i) e(i) w mod n(i), where i is an index for each of the at least one servers, a(i) is an integer relatively prime to n(i), and w is the result of a mask generation function or a hash function applied to the first secret.
7. The method of claim 6 wherein e(i) is an integer that is relatively prime to LCM(p(i)−1, q(i)−1), where LCM stands for Least Common Multiple, and p(i) and q(i) are two primes whose product is the modulus n(i).
8. The method of claim 7 wherein the server secret b(i) for at least one server i is generated such that b(i) =e(i) − mod LCM(p(i)−1, q(i)−1).
9. The method of claim 6 wherein e(i) is an integer that is relatively prime to LCM(p(i,1)−1 . . . p(i,J)−1), where LCM stands for Least Common Multiple, and {p(i,1), p(i,2) . . . p(i,J)} are J primes whose product is the modulus n(i).
10. The method of claim 1 further comprising the step of verifying the successful recovery of the strong secret by the client.
11. The method of claim 1 wherein the strong secret comprises K(1)⊕K(2)⊕ . . . ⊕K(N), where ⊕ denotes the exclusive-OR operation, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
12. The method of claim 1 wherein the strong secret comprises K(1)+K(2)+ . . . +K(N), wherein + denotes binary addition, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
13. The method of claim 1 wherein the strong secret comprises K(1)*K(2)* . . . K(N), wherein * denotes modular multiplication, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
14. The method of claim 1 wherein the strong secret comprises a combination of values using t-out-of-N threshold secret sharing, wherein the shares are encrypted using the strong secret component values.
15. The method of claim 1 wherein at least one strong secret component is derived using a blind function evaluation protocol based on the problem of extracting roots modulo a composite.
16. The method of claim 1 wherein the function for at least one of the servers comprises h(w, b(i)), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, w is the result of a mask generation function or hash function applied to the first secret, and h denotes a one-way function.
17. The method of claim 16 wherein the blind function evaluation protocol comprises the server constructing a circuit and communicating the circuit to the client, and wherein the client evaluates the circuit with w as the first input value.
18. The method of claim 17 wherein the blind function evaluation protocol comprises an oblivious transfer.
19. The method of claim 18 wherein the client cannot evaluate the circuit for more than one input.
20. The method of claim 1 , wherein the cryptographic function is one of decryption, authentication, and creating a digital signature.
21. A system for decrypting encrypted secrets using a first secret, comprising:
a client and a group of one or more servers, each server of the group comprising a respective server secret and a blind function evaluator for participating in a blind function evaluation protocol with the client, the blind function evaluation protocol resulting in the generation of a strong secret component revealed to the client but not to any of the other servers of the group, the blind function evaluator evaluating a function taking as input the respective server secret and client information derived from the first secret, and generating as output the respective strong secret component, the client generating the strong secret from the strong secret components generated for the group of servers and using the strong secret to decrypt an encrypted secret, wherein the blind function evaluation protocol is characterized in that the client cannot determine any of the respective server secrets and in that each server cannot determine any other respective strong secret component or the strong secret, wherein the blind function evaluation protocol is selected from a set of blind function evaluation protocols that excludes any protocol involving:
the client computing server request data by exponentiating the client information to a random first integer a, wherein the client information is an element w of a finite group G in which exponentiation is efficient but the discrete logarithm problem is computationally infeasible;
the server computing server response data from the server request data and the server secret, wherein the server response data comprises a value c in the group G; and
the client computing a strong secret component by exponentiating the value c to a second integer a′, wherein the first and second integers a and a′ are such that z aa′ =x for all x in the group G.
22. The system of claim 21 further comprising a data store storing an encrypted secret capable of being decrypted with a key derived from the strong secret, the data store accessible to the client over a communications network.
23. The system of claim 21 wherein the function for at least one of the servers comprises w b(i) mod n(i), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, and w is the result of a mask generation function or hash function applied to the first secret.
24. The system of claim 21 wherein the function for at least one of servers comprises h(w b(i) mod n(i)), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, w is the result of a mask generation function or hash function applied to the first secret, and h denotes a one-way function.
25. The system of claim 21 wherein the blind function evaluation protocol for at least one of the servers comprises the client sending a(i) e(1) w mod n(i) to at least one of the at least one servers, where i is an index for the server, a(i) is an integer relatively prime to n(i), and w is the result of a mask generation function or a hash function applied to the first secret.
26. The system of claim 25 wherein e(i) is small integer that is relatively prime to the least common multiple of(p(i)−1) and (q(i)−1), and p(i) and q(i) are two primes whose product is the modulus n(i).
27. The system of claim 26 wherein the server secret b(i) for at least one server i is generated such that b(i)=e(i) −1 mod LCM(p(i)−1, q(i)−1), where LCM denotes the least common multiple.
28. The system of claim 25 wherein e(i) is small integer that is relatively prime to the least common multiple of(p(i,1)−1) . . . (p(i,J)−1), where (p(i,J)−1) . . . (p(i,J)−1) are J primes whose product is the modulus n(i).
29. The system of claim 21 further comprising a verifier for verifying the successful recovery of the strong secret.
30. The system of claim 21 wherein the strong secret comprises K(1)⊕K(2)⊕ . . . ⊕K(N), wherein ⊕ denotes the exclusive-OR operation, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
31. The system of claim 21 wherein the strong secret comprises K(1)+K(2)+ . . . +K(N), wherein + denotes binary addition, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
32. The system of claim 21 wherein the strong secret comprises K(1)*K(2)* . . . * K(N), wherein * denotes modular multiplication, K(i) denotes the strong secret component for each server i, and N denotes the number of servers.
33. The system of claim 21 wherein the strong secret comprises a combination of values using t-out-of-N threshold secret sharing, wherein the shares are encrypted using the strong secret component values.
34. The system of claim 21 wherein at least one strong secret component is derived using a blind function evaluation protocol based on the problem of extracting roots modulo a composite.
35. The system of claim 21 wherein the function for at least one of the servers comprises h(w, b(i)), where i is an index for each of the at least one servers, b(i) comprises the respective server secret for server i, w is the result of a mask generation function or hash function applied to the first secret, and h denotes a one-way function.
36. The system of claim 35 wherein the blind function evaluation protocol comprises the server constructing a circuit and communicating the circuit to the client, and wherein the client evaluates the circuit with w as the first input value.
37. The system of claim 36 wherein the blind function evaluation protocol comprises an oblivious transfer.
38. The method of claim 37 wherein the client cannot evaluate the circuit for more than one input.
39. A system for decrypting encrypted secrets using a first secret, comprising:
a client in communication with a group of one or more servers, each server of the group comprising a respective server secret and a blind function evaluator for participating in a blind function evaluation protocol with the client, the blind function evaluation protocol resulting in the generation of a strong secret component revealed to the client but not the servers, the evaluator evaluating a function taking as input the respective server secret and client information derived from the first secret, and generating as output a respective strong secret component, the client generating the strong secret from the strong secret components generated for the group of servers, wherein the blind function evaluation protocol is characterized in that the client cannot determine any of the respective server secrets and in that each server cannot determine either another respective strong secret component or the strong secret, wherein the blind function evaluation protocol is selected from a set of blind function evaluation protocols that excludes any protocol involving:
the client computing server request data by exponentiating the client information to a random first integer a, wherein the client information is an element w of a finite group G in which exponentiation is efficient but the discrete logarithm problem is computationally infeasible;
the server computing server response data from the server request data and the server secret, wherein the server response data comprises a value c in the group G; and
the client computing a strong secret component by exponentiating the value c to a second integer a′, wherein the first and second integers a and a′ are such that x aa′ =x for all x in the group C,
the client comprising:
a receiver for receiving encrypted secrets;
a decryption function for decrypting the encrypted secrets with a key derived from the strong secret.
40. The system of claim 21 wherein the client comprises a requesting component and a recovery component.