Codeword-enhanced peer-to-peer authentication

1. A method for user authentication, comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending.

2. The method of claim 1 wherein said indicating further comprises:

indicating said first digital certificate is authenticated if said first bit sequence matches said second bit sequence; and

indicating said first digital certificate is not authenticated if said first bit sequence does not match said second bit sequence.

3. The method of claim 1 wherein said creating a secure fingerprint further comprises applying a cryptographic one-way function to said first digital certificate and said randomized codeword.

4. The method of claim 3 wherein said cryptographic one-way function comprises the SHA-1 algorithm.

5. The method of claim 3 wherein said cryptographic one-way function comprises the MD5 algorithm.

6. The method of claim 1 wherein said indicating further comprises:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

7. A method for user authentication, comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending, said randomized codeword comprising eight bits;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, said first bit sequence comprising said randomized codeword and the first ten bits of said secure fingerprint; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said indicating further comprising:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

8. The method of claim 7 wherein said first bit sequence comprises two nine-bit indices.

9. The method of claim 7 wherein said first bit sequence comprises three four-bit indices.

10. The method of claim 7 wherein said first bit sequence comprises one sixteen-bit index.

11. The method of claim 6 wherein said one or more representations comprise one or more words.

12. The method of claim 6 wherein said one or more representations comprise one or more images.

13. The method of claim 6 wherein said one or more representations comprise one or more sounds.

14. The method of claim 6 wherein said one or more representations comprise one or more symbols.

15. A method for user authentication, comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said indicating further comprising:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence;

wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword such that none of said one or more indices comprise the entire second portion of said randomized codeword.

16. The method of claim 1 , further comprising receiving a second digital certificate in response to said sending.

17. The method of claim 1 wherein said creating a secure fingerprint further comprises applying a cryptographic one-way function to said at least part of said first digital certificate and said randomized codeword.

18. The method of claim 1 wherein said out-of-band communication comprises a telephone call.

19. The method of claim 1 wherein said out-of-band communication comprises an email message.

20. The method of claim 1 wherein said out-of-band communication comprises a facsimile.

21. The method of claim 1 wherein said out-of-band communication comprises a face-to-face communication.

22. A method for user authentication, comprising:

receiving a first digital certificate from an initiator;

sending a randomized codeword in response to said receiving;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said initiator via an out-of-band communication in response to said sending.

23. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for user authentication, the method comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending.

24. The program storage device of claim 23 wherein said indicating further comprises:

indicating said first digital certificate is authenticated if said first bit sequence matches said second bit sequence; and

indicating said first digital certificate is not authenticated if said first bit sequence does not match said second bit sequence.

25. The program storage device of claim 23 wherein said creating a secure fingerprint further comprises applying a cryptographic one-way function to said first digital certificate and said randomized codeword.

26. The program storage device of claim 25 wherein said cryptographic one-way function comprises the SHA-1 algorithm.

27. The program storage device of claim 25 wherein said cryptographic one-way function comprises the MD5 algorithm.

28. The program storage device of claim 23 wherein said indicating further comprises:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

29. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for user authentication, the method comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending, said randomized codeword comprising eight bits;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, said first bit sequence comprising said randomized codeword and the first ten bits of said secure fingerprint; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said indicating further comprising:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

30. The program storage device of claim 29 wherein said first bit sequence comprises two nine-bit indices.

31. The program storage device of claim 29 wherein said first bit sequence comprises three four-bit indices.

32. The program storage device of claim 29 wherein said first bit sequence comprises one sixteen-bit index.

33. The program storage device of claim 28 wherein said one or more representations comprise one or more words.

34. The program storage device of claim 28 wherein said one or more representations comprise one or more images.

35. The program storage device of claim 28 wherein said one or more representations comprise one or more sounds.

36. The program storage device of claim 28 wherein said one or more representations comprise one or more symbols.

37. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for user authentication, the method comprising:

sending a first digital certificate to a responder;

receiving a randomized codeword in response to said sending;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said indicating further comprising:

using said first bit sequence as one or more indices into a vector of one or more representations;

using said second bit sequence as one or more indices into said vector of one or more representations; and

indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence;

wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword such that none of said one or more indices comprise the entire second portion of said randomized codeword.

38. The program storage device of claim 23 , further comprising receiving a second digital certificate in response to said sending.

39. The program storage device of claim 23 wherein said creating a secure fingerprint further comprises applying a cryptographic one-way function to said at least part of said first digital certificate and said randomized codeword.

40. The program storage device of claim 23 wherein said out-of-band communication comprises a telephone call.

41. The program storage device of claim 23 wherein said out-of-band communication comprises an email message.

42. The program storage device of claim 23 wherein said out-of-band communication comprises a facsimile.

43. The program storage device of claim 23 wherein said out-of-band communication comprises a face-to-face communication.

44. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for user authentication, the method comprising:

receiving a first digital certificate from an initiator;

sending a randomized codeword in response to said receiving;

creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said initiator via an out-of-band communication in response to said sending.

45. An apparatus for user authentication, comprising:

means for sending a first digital certificate to a responder;

means for receiving a randomized codeword in response to said sending;

means for creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

means for creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

means for indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending.

46. The apparatus of claim 45 wherein said means for indicating further comprises:

means for indicating said first digital certificate is authenticated if said first bit sequence matches said second bit sequence; and

means for indicating said first digital certificate is not authenticated if said first bit sequence does not match said second bit sequence.

47. The apparatus of claim 45 wherein said means for creating a secure fingerprint further comprises means for applying a cryptographic one-way function to said first digital certificate and said randomized codeword.

48. The apparatus of claim 47 wherein said cryptographic one-way function comprises the SHA-1 algorithm.

49. The apparatus of claim 47 wherein said cryptographic one-way function comprises the MD5 algorithm.

50. The apparatus of claim 45 wherein said means for indicating further comprises:

means for using said first bit sequence as one or more indices into a vector of one or more representations;

means for using said second bit sequence as one or more indices into said vector of one or more representations; and

means for indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

51. An apparatus for user authentication, comprising:

means for sending a first digital certificate to a responder;

means for receiving a randomized codeword in response to said sending, said randomized codeword comprising eight bits;

means for creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

means for creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, said first bit sequence comprising said randomized codeword and the first ten bits of said secure fingerprint; and

means for indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said means for indicating further comprising:

means for using said first bit sequence as one or more indices into a vector of one or more representations;

means for using said second bit sequence as one or more indices into said vector of one or more representations; and

means for indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

52. The apparatus of claim 51 wherein said first bit sequence comprises two nine-bit indices.

53. The apparatus of claim 51 wherein said first bit sequence comprises three four-bit indices.

54. The apparatus of claim 51 wherein said first bit sequence comprises one sixteen-bit index.

55. The apparatus of claim 50 wherein said one or more representations comprise one or more words.

56. The apparatus of claim 50 wherein said one or more representations comprise one or more images.

57. The apparatus of claim 50 wherein said one or more representations comprise one or more sounds.

58. The apparatus of claim 50 wherein said one or more representations comprise one or more symbols.

59. An apparatus for user authentication, comprising:

means for sending a first digital certificate to a responder;

means for receiving a randomized codeword in response to said sending;

means for creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

means for creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size; and

means for indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said sending, said means for indicating further comprising:

means for using said first bit sequence as one or more indices into a vector of one or more representations;

means for using said second bit sequence as one or more indices into said vector of one or more representations; and

means for indicating said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence;

said first bit sequence comprising bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword such that none of said one or more indices comprise said entire second portion of the randomized codeword.

60. The apparatus of claim 45 , further comprising means for receiving a second digital certificate in response to said sending.

61. The apparatus of claim 45 wherein said means for creating a secure fingerprint further comprises means for applying a cryptographic one-way function to said at least part of said first digital certificate and said randomized codeword.

62. The apparatus of claim 45 wherein said out-of-band communication comprises a telephone call.

63. The apparatus of claim 45 wherein said out-of-band communication comprises an email message.

64. The apparatus of claim 45 wherein said out-of-band communication comprises a facsimile.

65. The apparatus of claim 45 wherein said out-of-band communication comprises a face-to-face communication.

66. An apparatus for user authentication, comprising:

means for receiving a first digital certificate from an initiator;

means for sending a randomized codeword in response to said receiving;

means for creating a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

means for creating a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

means for indicating said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said initiator via an out-of-band communication in response to said sending.

67. An apparatus for user authentication, comprising:

a memory for storing at least one randomized codeword; and

a processor configured to:

send a first digital certificate to a responder;

receive a randomized codeword in response to said first digital certificate being sent to said responder;

create a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

create a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicate said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said first digital certificate being sent to said responder.

68. The apparatus of claim 67 wherein said processor is further configured to:

indicate said first digital certificate is authenticated if said first bit sequence matches said second bit sequence; and

indicate said first digital certificate is not authenticated if said first bit sequence does not match said second bit sequence.

69. The apparatus of claim 67 wherein said processor is further configured to create said secure fingerprint by applying a cryptographic one-way function to said first digital certificate and said randomized codeword.

70. The apparatus of claim 69 wherein said cryptographic one-way function comprises the SHA-1 algorithm.

71. The apparatus of claim 69 wherein said cryptographic one-way function comprises the MD5 algorithm.

72. The apparatus of claim 67 wherein said processor is further configured to:

use said first bit sequence as one or more indices into a vector of one or more representations;

use said second bit sequence as one or more indices into said vector of one or more representations; and

indicate said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

73. An apparatus for user authentication, comprising:

a memory for storing at least one randomized codeword; and

a processor configured to:

send a first digital certificate to a responder;

receive a randomized codeword in response to said first digital certificate being sent to said responder, said randomized codeword comprising eight bits;

create a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

create a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, said first bit sequence comprising said randomized codeword and the first ten bits of said secure fingerprint; and

indicate said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said first digital certificate being sent to said responder, wherein said processor further configured to:

use said first bit sequence as one or more indices into a vector of one or more representations;

use said second bit sequence as one or more indices into said vector of one or more representations; and

indicate said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence.

74. The apparatus of claim 73 wherein said first bit sequence comprises two nine-bit indices.

75. The apparatus of claim 73 wherein said first bit sequence comprises three four-bit indices.

76. The apparatus of claim 73 wherein said first bit sequence comprises one sixteen-bit index.

77. The apparatus of claim 72 wherein said one or more representations comprise one or more words.

78. The apparatus of claim 72 wherein said one or more representations comprise one or more images.

79. The apparatus of claim 72 wherein said one or more representations comprise one or more sounds.

80. The apparatus of claim 72 wherein said one or more representations comprise one or more symbols.

81. An apparatus for user authentication, comprising:

a memory for storing at least one randomized codeword; and

a processor configured to:

send a first digital certificate to a responder;

receive a randomized codeword in response to said first digital certificate being sent to said responder;

create a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

create a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size; and

indicate said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said responder via an out-of-band communication in response to said first digital certificate being sent to said responder, wherein said processor is further configured to:

use said first bit sequence as one or more indices into a vector of one or more representations;

use said second bit sequence as one or more indices into said vector of one or more representations; and

indicate said first digital certificate is authenticated based upon whether the one or more representations indexed by said first bit sequence match the one or more representations indexed by said second bit sequence;

wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword such that none of said one or more indices comprise the entire second portion of said randomized codeword.

82. The apparatus of claim 67 wherein said processor is further configured to receive a second digital certificate in response to said sending.

83. The apparatus of claim 67 wherein said creating a secure fingerprint further comprises applying a cryptographic one-way function to said at least part of said first digital certificate and said randomized codeword.

84. The apparatus of claim 67 wherein said out-of-band communication comprises a telephone call.

85. The apparatus of claim 67 wherein said out-of-band communication comprises an email message.

86. The apparatus of claim 67 wherein said out-of-band communication comprises a facsimile.

87. The apparatus of claim 67 wherein said out-of-band communication comprises a face-to-face communication.

88. An apparatus for user authentication, comprising:

a memory for storing a randomized codeword; and

a processor configured to:

receive a first digital certificate from an initiator;

send said randomized codeword in response to said receiving;

create a secure fingerprint having a first size, said secure fingerprint based at least in part on said first digital certificate and said randomized codeword;

create a first bit sequence based at least in part on a first portion of said secure fingerprint and a second portion of said randomized codeword, said first bit sequence having a second size, said second size less than said first size, wherein said first bit sequence comprises bits of said first portion of said secure fingerprint interspersed among bits of said second portion of said randomized codeword; and

indicate said first digital certificate is authenticated based upon whether said first bit sequence matches a second bit sequence received from said initiator via an out-of-band communication in response to said sending.