Granted Patent B2

US 10,148,422 · App. 13/463,965 · Granted Dec 4, 2018

Abstract

Claims (39)

1. A method comprising:

accessing an implicit certificate associated with an entity and generated by a subordinate certificate authority that is subordinate to a root certificate authority, wherein the implicit certificate includes a public key reconstruction value of the entity;

accessing subordinate certificate authority public key information associated with the subordinate certificate authority;

accessing root certificate authority public key information associated with the root certificate authority;

generating a first value based on evaluating a hash function, wherein evaluating the hash function produces a hash function output from hash function inputs comprising the subordinate certificate authority public key information, the root certificate authority public key information, and the public key reconstruction value of the entity; and

generating a public key value of the entity based on the first value.

2. The method of claim 1 , wherein the subordinate certificate authority comprises a first subordinate certificate authority that is intermediate the root certificate authority and a second certificate authority, the entity comprises the second subordinate certificate authority, and the implicit certificate is based on a chain of implicit certificates.

3. The method of claim 1 , wherein the entity comprises a correspondent.

4. The method of claim 1 , wherein generating the public key value comprises at least one of:

validating the public key value; or

using the public key value to verify a digital signature from the entity.

5. The method of claim 1 , wherein generating the public key value comprises evaluating a cryptographic function that uses the public key value.

6. The method of claim 5 , wherein evaluating the cryptographic function does not explicitly compute the public key value.

7. The method of claim 1 , wherein the first value and the public key value are generated by the entity.

8. The method of claim 1 , wherein the first value and the public key value are generated by the subordinate certificate authority.

9. The method of claim 1 , wherein the first value and the public key value are generated by a second, different entity that relies on the public key value.

10. The method of claim 1 , wherein the subordinate certificate authority public key information comprises at least one of a public key value of the subordinate certificate authority or a public key reconstruction value of the subordinate certificate authority.

11. A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising:

accessing an implicit certificate associated with an entity and generated by a subordinate certificate authority that is subordinate to a root certificate authority, wherein the implicit certificate includes a public key reconstruction value of the entity;

accessing subordinate certificate authority public key information associated with the subordinate certificate authority;

accessing root certificate authority public key information associated with the root certificate authority;

generating a first value based on evaluating a hash function, wherein evaluating the hash function produces a hash function output from hash function inputs comprising the subordinate certificate authority public key information, the root certificate authority public key information, and the public key reconstruction value of the entity; and

generating a public key value of the entity based on the first value.

12. The computer-readable medium of claim 11 , wherein the subordinate certificate authority comprises a first subordinate certificate authority that is intermediate the root certificate authority and a second certificate authority, the entity comprises the second subordinate certificate authority, and the implicit certificate is based on a chain of implicit certificates.

13. The computer-readable medium of claim 11 , wherein generating the public key value comprises at least one of:

validating the public key value; or

using the public key value to verify a digital signature generated by the entity.

14. The computer-readable medium of claim 11 , wherein generating the public key value comprises evaluating a cryptographic function that uses the public key value, and evaluating the cryptographic function does not explicitly compute the public key value.

15. A computing system comprising:

memory; and

one or more processors operable to perform operations, the operations comprising:

accessing an implicit certificate associated with an entity and generated by a subordinate certificate authority that is subordinate to a root certificate authority, wherein the implicit certificate includes a public key reconstruction value of the entity;

accessing subordinate certificate authority public key information associated with the subordinate certificate authority;

accessing root certificate authority public key information associated with the root certificate authority;

generating a first value based on evaluating a hash function, wherein evaluating the hash function produces a hash function output from hash function inputs comprising the subordinate certificate authority public key information, the root certificate authority public key information, and the public key reconstruction value of the entity; and

generating a public key value of the entity based on the first value.

16. The computing system of claim 15 , wherein the one or more processors are operable to perform the operations of a signature generation module.

17. The computing system of claim 15 , wherein the one or more processors are operable to perform the operations of a signature verification module.

18. The computing system of claim 15 , wherein the one or more processors are operable to perform the operations of certificate generation module.

Assignments (10)