Identity based authenticated key agreement protocol

1. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:

sending an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;

receiving an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and

sending the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;

wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.

2. The method of claim 1 , wherein the respective public keys used by the first party and the second party to perform the identity based encryption operation comprise a result of a hash function applied to information indicative of an identity of the respective party to which the public key is assigned.

3. The method of claim 1 , wherein the first random key component, xP, is computed from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.

4. The method of claim 3 , wherein the first random key component, xP, is computed by P being added to itself x times as a point on the elliptic curve.

5. The method of claim 1 , wherein the second random key component, yP, is computed from a random number y chosen by the second party and the point P of large prime order on the elliptic curve over the finite field.

6. The method of claim 5 , wherein the second random key component, yP, is computed by P being added to itself y times as a point on the elliptic curve.

7. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the first party from a random number x chosen by the first party and the second key component yP, yP having been computed at the second party from a random number y chosen by the second party and a point P of large prime order on an elliptic curve over a finite field.

8. The method of claim 7 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding yP to itself x times.

9. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the second party from a random number y chosen by the second party and the first key component xP, xP having been computed at the first party from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.

10. The method of claim 9 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding xP to itself y times.

11. The method of claim 1 , wherein an elliptic curve used to compute the first random key component and the second random key component is independent of an elliptic curve used for the identity based encryption operation.

12. The method of claim 1 , wherein an elliptic curve used for the identity based encryption operation performed by the first party is different than an elliptic curve used for the identity based encryption operation performed by the second party.

13. The method of claim 1 , wherein respective private keys used by the first party and the second party to decrypt encrypted messages are assigned by a key generation function located on a computer system separate from the computer systems of the first party and the second party.

14. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is used to form a session key.

15. The method of claim 14 , wherein the session key is computed as a function of the key for use in subsequent communications between the first party and the second party.

16. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of an end-to-end key agreement for an application over a network.

17. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of a secure proxy based route optimization protocol.

18. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.

19. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:

computing a first random key component at the first party;

encrypting at the first party the first random key component, wherein the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation;

sending the encrypted first random key component to the second party, wherein, at the second party: (i) the encrypted first random key component is decrypted to obtain the first random key component; (ii) a second random key component is computed; (iii) a random key component pair comprising the first random key component and the second random key component is formed and encrypted using a public key of the first party in accordance with the identity based encryption operation; and (iv) the encrypted random key component pair is sent to the first party;

decrypting at the first party the encrypted random key component pair to obtain the second random key component;

encrypting at the first party the second random key component, wherein the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation;

sending the encrypted second random key component to the second party; and

computing at the first party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the first party based on the second random key component, and wherein the key is computable at the second party based on the first random key component.

20. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:

receiving an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;

sending an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and

receiving the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;

wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.

21. The method of claim 20 , wherein the key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.

22. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:

receiving an encrypted first random key component at the second party from the first party, wherein, at the first party: (i) the first random key component is computed; (ii) the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation; and (iii) the encrypted first random key component is sent to the second party;

decrypting the encrypted first random key component to obtain the first random, key component;

computing a second random key component;

forming a random key component pair comprising the first random key component and the second random key component;

encrypting the random key component pair using a public key of the first party in accordance with the identity based encryption operation;

sending the encrypted random key component pair to the first party, wherein, at the first party: (i) the encrypted random key component pair is decrypted to obtain the second random key component; (ii) the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation, and (iii) the encrypted second random key component is sent to the second party; and

computing at the second party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the second party based on the first random key component, and wherein the key is computable at the first party based on the second random key component.

23. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the first party comprising:

a memory; and

a processor coupled to the memory and configured to: (i) send an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) receive an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) send the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.

24. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the second party comprising:

a memory; and

a processor coupled to the memory and configured to: (i) receive an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) send an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) receive the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.