Multi-factor password-authenticated key exchange

1. A computer controlled method for mutually authenticating a first computer and a second computer over a network, the computer controlled method comprising:

sending first authentication evidence by said first computer to said second computer, said first authentication evidence used to prove to said second computer that said first computer has access to a first plurality of authentication secrets without exposing said first plurality of authentication secrets, wherein said first authentication evidence comprises a shielded ephemeral public key (m) that is generated using an ephemeral public DH key (X), a hash τ, and a hash γ, in accordance with m=X·γ·τ, wherein τ is computed using a hash of an account identifier (C), an identifier for the first computer (S), and a short-term password (re C,S ), and wherein γ is computed using a hash of C, S, and a long-term password (pw C,S ; and

sending second authentication evidence by said second computer to said first computer, said second authentication evidence used to prove to said first computer that said second computer has access to a second plurality of authentication secrets without exposing said second plurality of authentication secrets, said first plurality of authentication secrets related to said second plurality of authentication secrets, whereby said first computer is authenticated to said second computer and said second computer is authenticated to said first computer.

2. The computer controlled method of claim 1 , further comprising:

prompting, by said second computer, for one of said second plurality of authentication secrets; and

acquiring, by said second computer, said one of said second plurality of authentication secrets.

3. The computer controlled method of claim 1 , further comprising:

authenticating said second computer by said first computer responsive to said second authentication evidence;

constructing a symmetric session key by said first computer responsive to authenticating of said second computer;

authenticating said first computer by said second computer responsive to said first authentication evidence; and

constructing said symmetric session key by said second computer responsive to authenticating said first computer; wherein said symmetric session key is capable of being used to establish a secure channel between said first computer and said second computer.

4. The computer controlled method of claim 1 , wherein sending said first authentication evidence and sending said second authentication evidence is performed over a secure channel.

5. The computer controlled method of claim 1 , wherein said first plurality of authentication secrets are related to said second plurality of authentication secrets by at least one of said first or second plurality of authentication secrets being a non-identity transformation of at least one of said other plurality of authentication secrets.

6. The method of claim 1 , wherein τ and γ are computed in accordance with:

τ=H 4 (C,S,re C,S ); and

γ=H 1 (C,S,pw C,S ).

7. A computer controlled method comprising:

sending first authentication evidence over a network by a first computer, said first authentication evidence capable of enabling a second computer to verify that said first computer has access to a first plurality of authentication secrets without exposing said first plurality of authentication secrets, wherein said first authentication evidence comprises a shielded ephemeral public key (m) that is generated using an ephemeral public DH key (X), a hash τ, and a hash (γ), in accordance with m=X·γ·γ, wherein τ is computed using a hash of an account identifier (C), an identifier for the first computer (S), and a short-term password (re C,S ), and wherein γ is computed using a hash of C, S, and a long-term password (pw C,S ); and

receiving, by said first computer over said network, second authentication evidence, said second authentication evidence enabling said first computer to verify that said second computer has access to a second plurality of authentication secrets without exposing said second plurality of authentication secrets, said first plurality of authentication secrets related to said second plurality of authentication secrets, whereby said second computer is authenticated by said first computer and said first computer can be authenticated by said second computer.

8. The computer controlled method of claim 7 , further comprising:

receiving said first authentication evidence by said second computer over said network; and

authenticating said first computer by said second computer responsive to said first authentication evidence and said second plurality of authentication secrets.

9. The computer controlled method of claim 7 , further comprising:

receiving said first plurality of authentication secrets; and

storing said first plurality of authentication secrets.

10. The computer controlled method of claim 7 , wherein said first plurality of authentication secrets are related to said second plurality of authentication secrets by at least one of said first or second plurality of authentication secrets being a non-identity transformation of at least one of said other plurality of authentication secrets.

11. The computer controlled method of claim 7 , wherein sending said first authentication evidence and receiving said second authentication evidence is performed over a secure channel.

12. An apparatus having a central processing unit (CPU) and a memory coupled to said CPU comprising:

a transmission logic configured to send first authentication evidence over a network by a first computer, said first authentication evidence capable of enabling a second computer to verify that said first computer has access to a first plurality of authentication secrets without exposing said first plurality of authentication secrets, wherein said first authentication evidence comprises a shielded ephemeral public key (m) that is generated using an ephemeral public DH key (X), a hash τ, and a hash γ, in accordance with m=X·γ·τ, wherein τ is computed using a hash of an account identifier (C), an identifier for the first computer (S), and a short-term password (re C,S ), and wherein γ is computed using a hash of C, S, and a long-term password (pw C,S );

a receiver logic configured to receive over said network second authentication evidence as proof that said second computer has access to a second plurality of authentication secrets without exposing said second plurality of authentication secrets; and

an authentication logic, responsive to said second authentication evidence received by the receiver logic, configured to verify that said first plurality of authentication secrets is related to said second plurality of authentication secrets, whereby said second computer is authenticated by said first computer and said first computer can be authenticated by said second computer.

13. The apparatus of claim 12 , further comprising:

a registration receiver logic configured to receive said first plurality of authentication secrets; and

a storage logic configured to store said first plurality of authentication secrets.

14. The apparatus of claim 12 , wherein said first plurality of authentication secrets are related to said second plurality of authentication secrets by at least one of said first or second plurality of authentication secrets being a non-identity transformation of at least one of said other plurality of authentication secrets.

15. The apparatus of claim 12 , wherein the transmission logic sends said first authentication evidence over a secure channel and the receiver logic receives said second authentication evidence over a secure channel.

16. A computer program product comprising:

a non-transitory computer-usable data carrier providing instructions that, when executed by a computer, cause said computer to perform a method comprising:

sending first authentication evidence over a network by a first computer, said first authentication evidence capable of enabling a second computer to verify that said first computer has access to a first plurality of authentication secrets without exposing said first plurality of authentication secrets, wherein said first authentication evidence comprises a shielded ephemeral public key (m) that is generated using an ephemeral public DH key (X), a hash τ, and a hash γ, in accordance with m=X·γ·τ, wherein τ is computed using a hash of an account identifier (C), an identifier for the first computer (S), and a short-term password (re C,S ), and wherein γ is computed using a hash of C, S, and a long-term password (pw C,S ); and

receiving, by said first computer over said network, second authentication evidence, said second authentication evidence enabling said first computer to verify that said second computer has access to a second plurality of authentication secrets without exposing said second plurality of authentication secrets, said first plurality of authentication secrets related to said second plurality of authentication secrets, whereby said second computer is authenticated by said first computer and said first computer can be authenticated by said second computer.

17. The computer program product of claim 16 , further comprising:

receiving said first authentication evidence by said second computer over said network; and

authenticating said first computer by said second computer responsive to said first authentication evidence and said second plurality of authentication secrets.

18. The computer program product of claim 16 , further comprising:

receiving said first plurality of authentication secrets; and

storing said first plurality of authentication secrets.

19. The computer program product of claim 16 , wherein said first plurality of authentication secrets are related to said second plurality of authentication secrets by at least one of said first or second plurality of authentication secrets being a non-identity transformation of at least one of said other plurality of authentication secrets.