Password self encryption method and system and encryption by keys generated from personal secret information
View Patent ↗A public key cryptographic system and method is provided for a password or any other predefined personal secret information that defeats key factoring and spoofing attacks. The method adopts a new technique of encrypting a password or any predefined secret information by a numeric function of itself, replacing the fixed public key of the conventional RSA encryption. The whole process involving key generation, encryption, decryption and password handling is discussed in detail. Mathematical and cryptanalytical proofs of defeating factoring and spoofing attacks are furnished.
1. A method comprising:
submitting a user identification for a user from a user computer to a server computer;
receiving a set of information at the user computer from the server computer, in response to the submission of the user identification for the user;
wherein the set of information includes a parameter of a key; and
further comprising
using the user computer to convert user confidential information to a number x, wherein the number x is dependent on the user confidential information;
using the user computer to compute a number e which is a function of x and which is a function of the user confidential information;
using the user computer to pad the number x to convert x to X p;
using the user computer to encrypt x p by using the parameter of the key and the number e to form a cipher C, wherein C is a function of the user confidential information; and
submitting the cipher C from the user computer to the server computer.
2. The method of claim 1 wherein
the parameter of the key is a key modulus.
3. The method of claim 1 wherein
the number e is an odd integer.
4. The method of claim 1
the cipher C is formed by the formula:
C=x p e mod n.
5. The method of claim 1 further comprising
using the user confidential information as a digital certificate of the user and digitally signing messages using a public key generated from the user confidential information.
6. The method of claim 5 wherein
the user confidential information is a user password.
7. The method of claim 1 wherein
the step of encrypting x p by using the parameter of the key and the number e to form a cipher C is implemented using a layer underlying communication between the user computer and the server computer.
8. The method of claim 7 wherein
the layer includes a web browser.
9. The method of claim 7 wherein
the layer includes a web page.
10. The method of claim 1 further comprising
decrypting messages from the server computer to the user computer using a public key generated from the user confidential information in order to secure information communicated both from the server computer to the user computer and from the user computer to the server computer.
11. The method of claim 1 wherein
the user confidential information is a user password.
12. The method of claim 1 further comprising
encrypting a message digest by using a public key generated from the user confidential information.
13. The method of claim 12 wherein
the user confidential information is a user password.
14. The method of claim 1 wherein
the set of information received from the server computer comprises a part of a public key used for encryption on the user computer.
15. The method of claim 1 wherein
the server computer is comprised of a plurality of computers.
16. The method of claim 1 further comprising
entering the user identification and the user confidential information in a single web page on the user computer;
submitting the user identification from the user computer to the server computer, without the user confidential information; and
subsequently receiving a further set of information at the user computer, from the server computer,
and wherein the step of submitting the cipher C from the user computer to the server computer is performed after the set of information is received at the user computer from the server computer.
17. The method of claim 1 further comprising
entering the user identification in a first web page on a user computer;
submitting the user identification from the user computer to the server computer, without the user confidential information;
subsequently receiving the set of information at the user computer, from the server computer;
entering the user confidential information in a second web page on the user computer after the set of information has been received at the user computer;
and wherein the step of submitting the cipher C from the user computer to the server computer is performed after the user confidential information is entered in the second web page of the user computer.
18. The method of claim 1 further comprising
receiving the user confidential information as a text entry into an authentication web page at the user computer prior to using the user computer to convert the user confidential information to the number x;
and wherein the user computer uses a text to number conversion scheme to convert the user confidential information to the number x.
19. The method of claim 18 wherein
the user confidential information is a user password.