Protecting one-time-passwords against man-in-the-middle attacks

1. A method for authenticating a user of a communications network based on a one-time-password, the user having an associated asymmetric crypto-key pair including a private key D and a public key E; and the private key D being split into a first private key portion D 1 , a second private key portion D 2 , and a third private key portion D 3 corresponding to the one-time-password, comprising:

partially signing, by the user, a symmetric session key with the first private key portion D 1 ;

receiving, by the authenticating entity from the user via the network, the partially signed symmetric session key;

determining, by the authenticating entity, the third private key portion D 3 ;

completing the signature, by the authenticating entity, on the received partially signed symmetric session key with the second private key portion D 2 and the determined third private key portion D 3 to recover the symmetric session key;

encrypting, by the user, the one-time-password with the symmetric session key;

receiving, by the authenticating entity from the user via the network, the encrypted one-time-password;

decrypting, by the authenticating entity, the received encrypted one-time-password with the recovered symmetric session key; and

authenticating the user based on the decrypted one-time-password.

2. The method according to claim 1 , further comprising:

authenticating the user based on the recovery of the symmetric session key by the authenticating entity;

partially signing, by the authenticating entity, the recovered symmetric session key with the second private key portion D 2 ;

receiving, by the user from the authenticating entity via the network, the partially signed symmetric session key;

completing the signature, by the user, on the received partially signed symmetric session key with the first private key portion D 1 to recover the symmetric session key; and

authenticating the authenticating entity based on the recovery of the symmetric session key by the user.

3. The method according to claim 1 , further comprising:

only after authenticating the user based on the decrypted one-time-password, partially signing, by the authenticating entity, a relying party authenticating message with the second private key portion D 2 ;

receiving, by the user from the authenticating entity via the network, the partially signed relying party authenticating message;

further signing, by the user, the received partially signed relying party authenticating message with the first private key portion D 1 ; and

transmitting, by the user to a relying party via the network, the further signed relying party authenticating message, wherein the relying party authenticating message is recoverable by applying the public key E to the further signed relying party authenticating message; and

authenticating the user based on recovery of the relying party authenticating message by the relying party.

4. The method according to claim 3 , wherein:

the network is the Internet; and

the relying party authenticating message is a secure socket layer hash.

5. The method according to claim 1 , further comprising:

receiving, by the user from an authenticating entity via the network, a challenge;

partially signing, by the user, the received challenge with the first private key portion D 1 ;

receiving, by the authenticating entity from the user via the network, the partially signed challenge;

completing the signature, by the authenticating entity, on the received partially signed challenge with the second private key portion D 2 to recover the challenge;

authenticating the user based on the recovery of the challenge by the authenticating entity; and

determining, by the user, the one-time-password based on the received challenge.

6. The method according to claim 5 , wherein the third private key portion D 3 is further split into a fourth private key portion D 4 and a fifth private key portion D 5 , and further comprising:

identifying, by the authenticating entity, a number as the fourth private key portion D 4 ;

partially signing, by the authenticating entity, the recovered symmetric session key with the second private key portion D 2 and the fourth private key portion D 4 ;

receiving, by the user from the authenticating entity via the network, the partially signed symmetric session key and the fourth private key portion D 4 ;

determining, by the user, the fifth private key portion D 5 based on the third private key portion D 3 , and the received fourth private key portion D 4 ;

completing the signature, by the user, on the received partially signed symmetric session key with the first private key portion D 1 and the determined fifth private key portion D 5 to recover the symmetric session key; and

authenticating the authenticating entity based on the recovery of the symmetric session key by the user.

7. A system for authenticating a user of a communications network based on a one-time-password, the user having an associated asymmetric crypto-key pair including a private key D and a public key E, and the private key D being split into a first private key portion D 1 , a second private key portion D 2 , and a third private key portion D 3 corresponding to the one-time-password, comprising:

a user network device configured to

(i) partially sign a symmetric session key with the first private key portion D 1 ,

(ii) transmit the partially signed symmetric session key via the network,

(iii) encrypt the one-time-password with the symmetric session key, and

(iv) transmit the encrypted one-time-password via the network; and

an authenticating entity network device configured to

(i) receive the transmitted partially signed symmetric session key,

(ii) determine the third private key portion D 3 ,

iii) complete the signature on the received partially signed symmetric session key with the second private key portion D 2 and the determined third private key portion D 3 to recover the symmetric session key,

(iv) receive the transmitted encrypted one-time-password,

(v) decrypt the received encrypted one-time-password with the recovered symmetric session key, and

(vi) authenticate the user based on the decrypted one-time-password.

8. The system according to claim 7 , wherein:

the authenticating entity network device is further configured to (i) authenticate the user based on the recovery of the symmetric session key, (ii) partially sign the recovered symmetric session key with the second private key portion D 2 , and (iii) transmit the partially signed symmetric session key via the network; and

the user network device is further configured to (i) receive the transmitted partially signed symmetric session key, (ii) complete the signature on the received partially signed symmetric session key with the first private key portion D 1 to recover the symmetric session key, and (iii) authenticate the authenticating entity based on the recovery of the symmetric session key.

9. The system according to claim 7 , wherein:

the authenticating entity network device is further configured to, only after authenticating the user based on the decrypted one-time-password, (i) partially sign a relying party authenticating message with the second private key portion D 2 , and (ii) transmit the partially signed relying party authenticating message via the network;

the user network device is further configured to (i) receive the transmitted partially signed relying party authenticating message, (ii) further sign the received partially signed relying party authenticating message with the first private key portion D 1 , and (iii) transmit the further signed relying party authenticating message to a relying party via the network;

the relying party authenticating message is recoverable by completing the signature on the further signed relying party authenticating message with the public key E; and

authenticating the user based on recovery of the relying party authenticating message by the relying party.

10. The system according to claim 7 , wherein:

the authenticating entity network device is further configured to transmit a challenge via the network;

the user network device is further configured to (i) receive the transmitted challenge, (ii) partially sign the received challenge with the first private key portion D 1 , (iii) transmit the partially signed challenge via the network, and (iv) determine the one-time-password based on the received challenge; and

the authenticating entity network device is further configured to (i) receive the partially signed challenge, (ii) complete the signature on the received partially signed challenge with the second private key portion D 2 to recover the challenge, and (iii) authenticate the user based on the recovery of the challenge.

11. The system according to claim 10 , wherein:

the third private key portion D 3 is further split into a fourth private key portion D 4 and a fifth private key portion D 5 ;

the authenticating entity network device is further configured to

(i) identify a number as the fourth private key portion D 4 ,

(ii) partially sign the recovered symmetric session key with the second private key portion D 2 and the fourth private key portion D 4 ,

(iii) transmit the partially signed symmetric session key via the network, and

(iv) transmit the fourth private key portion D 4 via the network; and

the user network device is further configured to

(i) receive the transmitted partially signed symmetric session key and the transmitted fourth private key portion D 4 ,

(ii) determine the fifth private key portion D 5 based on the third private key portion D 3 and the received fourth private key portion D 4 ,

(iii) complete the signature on the received partially signed symmetric session key with the first private key portion D 1 and the determined fifth private key portion D 5 to recover the symmetric session key, and

(iv) authenticate the authenticating entity based on the recovery of the symmetric session key.

12. A method for authenticating a user of a communications network based on a one-time-password, the user having an associated asymmetric crypto-key pair including a private key D and a public key E, and the private key D being split into a first private key portion D 1 , a second private key portion D 2 , and a third private key portion D 3 corresponding to the one-time-password, comprising:

receiving a first network communication from the user including a symmetric session key partially signed with the first private key portion D 1 ;

determining the third private key portion D 3 ;

completing the signature on the received partially signed symmetric session key with the second private key portion D 2 and the determined third private key portion D 3 to recover the symmetric session key;

receiving a second network communication from the user including a one-time-password encrypted with the symmetric session key;

decrypting the received encrypted one-time-password with the recovered symmetric session key; and

authenticating the user based on the decrypted one-time-password.

13. The method according to claim 12 , further comprising:

also authenticating the user based on the recovery of the symmetric session key;

partially signing the recovered symmetric session key with the second private key portion D 2 ;

transmitting a third network communication to the user including the partially signed symmetric session key, wherein the signature on the transmitted partially signed symmetric session key can be completed with the first private key portion D 1 to recover the symmetric session key and thereby authenticate the authenticating entity to the user.

14. The method according to claim 12 , further comprising:

only after authenticating the user based on the decrypted one-time-password, partially signing a relying party authenticating message with the second private key portion D 2 ;

transmitting a third network communication to the user including the partially signed relying party authenticating message, wherein the transmitted partially signed relying party authenticating message can be further signed by the user with the first private key portion D 1 , so that the relying party authenticating message is recoverable by completion of the signature on the further signed relying party authenticating message with the public key E by a relying party.

15. The method according to claim 12 , further comprising:

transmitting a third network communication to the user including a challenge;

receiving a fourth network communication from the user including the transmitted challenge partially signed by the user with the first private key portion D 1 ;

completing the signature on the received partially signed challenge with the second private key portion D 2 to recover the challenge; and

also authenticating the user based on the recovery of the challenge.

16. The method according to claim 15 , wherein the third private key portion D 3 is further split into a fourth private key portion D 4 and a fifth private key portion D 5 , and further comprising:

identifying a number as the fourth private key portion D 4 ;

partially signing the recovered symmetric session key with the second private key portion D 2 and the fourth private key portion D 4 ;

transmitting a fifth network communication to the user including the partially signed symmetric session key and the fourth private key portion D 4 , wherein the signature on the transmitted partially signed symmetric session-key can be completed by the user with the first private key portion D 1 and the fifth private key portion D 5 to recover the symmetric session key and thereby authenticate the authenticating entity to the user.

17. A system for authenticating a user of a communications network based on a one-time-password, the user having an associated asymmetric crypto-key pair including a private key D and a public key E, and the private key D being split into a first private key portion D 1 , a second private key portion D 2 , and a third private key portion D 3 corresponding to the one-time-password, comprising:

a network interface configured to receive

(i) a first network communication including a symmetric session key partially signed with the first private key portion D 1 and

(ii) a second network communication including the one-time-password encrypted with the symmetric session key; and

a processor configured to

(i) determine the third private key portion D 3 ;

(ii) complete the signature on the received partially signed symmetric session key with the second private key portion D 2 and the determined third private key portion D 3 to recover the symmetric session key,

(iii) decrypt the received encrypted one-time-password with the recovered symmetric session key, and authenticate the user based on the decrypted one-time-password.

18. The system according to claim 17 , wherein:

the processor is further configured to (i) also authenticate the user based on the recovery of the symmetric session key, (ii) partially sign the recovered symmetric session key with the second private key portion D 2 , (iii) direct transmission of a third network communication including the partially signed symmetric session key;

the network interface is further configured to transmit the third network communication in accordance with the processor directive; and

the signature on the transmitted partially signed symmetric session key can be completed with the first private key portion D 1 to recover the symmetric session key and thereby authenticate the authenticating entity to the user.

19. The system according to claim 17 , wherein:

the processor is further configured to, only after authenticating the user based on the decrypted one-time-password, (i) partially sign a relying party authenticating message with the second private key portion D 2 , and (ii) direct transmission of a third network communication to the user including the partially signed relying party authenticating message;

the network interface is further configured to transmit the third network communication in accordance with the processor directive; and

the transmitted partially signed relying party authenticating message can be further signed by the user with the first private key portion D 1 , so that the relying party authenticating message is recoverable by completion of the signature on the further signed relying party authenticating message with the public key E by a relying party.

20. The system according to claim 17 , wherein:

the interface is further configured to (i) transmit a third network communication to the user including a challenge, (ii) receive a fourth network communication from the user including the transmitted challenge partially signed by the user with the first private key portion D 1 ;

the processor is further configured to (i) complete the signature on the received partially signed challenge with the second private key portion D 2 to recover the challenge, and (ii) also authenticate the user based on the recovery of the challenge.

21. The system according to claim 20 , wherein:

the third private key portion D 3 is further split into a fourth private key portion D 4 and a fifth private key portion D 5 ;

the processor is further configured to

(i) identify a number as the fourth private key portion D 4 ,

(ii) partially sign the recovered symmetric session key with the second private key portion D 2 and the fourth private key portion D 4 , and

(iii) direct transmission of a fifth network communication to the user including the partially signed symmetric session key and the fourth private key portion D 4 ; and

the signature on the transmitted partially signed symmetric session key can be completed by the user with the first private key portion D 1 and the fifth private key portion D 5 to recover the symmetric session key and thereby authenticate the authenticating entity to the user.