Authentication methods, systems, devices, servers and computer program products, using a pairing-based cryptographic approach

1. A method of authenticating a client computing device to a server, the method including the steps of:

(i) the authentication approach using a pairing based cryptographic approach, using type-3 pairing defined by a mapping e: G1×G2→GT, in which G1, G2 and GT are all cyclic groups of the same prime order q and in which the groups G1 and G2 are distinct, and in which Q is a fixed point in G2, the client computing device receiving an encrypted identifier (s-ε)A from a trusted authority, the trusted authority having used its master key s and a secret ε to encrypt the encrypted identifier (s-ε)A associated with the client computing device, where A=H1(ID), where H1 is a hash function which hashes its input to a point on G1, and ID is an identifier of the client computing device;

(ii) the server receiving from the trusted authority a secret sQ encrypted by the trusted authority using the master key s;

(iii) the client computing device generating a random x<q, and calculating A=H1(ID) and U=xA;

(iv) the client computing device calculating y=H(U|T), where H is a hash function which hashes its input to an element in Fq, and T is a time stamp;

(v) the client computing device calculating V=−(x+y)(s-ε)A;

(vi) the client computing device sending ID, U, T and V to the server in an authentication request;

(vii) the server rejecting the authentication request if T is not current, the server otherwise proceeding to step (viii);

(viii) the server calculating A=H1(ID) and y=H(U|T);

(ix) the server calculating g=e(V,Q)·e(U+yA,sQ)=e(U,Q)^(ε), and solving for ε;

(x) the server recording that the client computing device with the identifier ID has supplied the secret ε in an encrypted form, and

(xi) the server authenticating the client computer.

2. Method of claim 1 , the method including the step of: the trusted authority using its master key s and the secret ε to encrypt the encrypted identifier (s-ε)A, and sending the encrypted identifier (s-ε)A to the client computing device.

3. Method of claim 1 , the method including the step of: the trusted authority using its master key s to calculate the secret sQ, and sending sQ to the server.

4. Method of claim 1 , wherein the secret ε is a short secret.

5. Method of claim 4 , wherein the short secret ε is a credit card number.

6. Method of claim 1 , wherein the method is one in which a financial transaction is authenticated.

7. Method of claim 1 , in which the server decrypts the secret ε without the server knowing (s-ε)A.

8. Method of claim 1 , in which the server decrypts the secret ε without the client computing device knowing the secret ε.

9. Method of claim 1 , in which the client computing device has no way of decrypting (s-ε)A to obtain the secret ε.

10. Method of claim 1 , in which the pairing-based cryptographic approach uses an elliptic curve.

11. Method of claim 10 , in which the elliptic curve is a Barreto-Naehrig (BN) elliptic curve.

12. Method of claim 10 , in which the elliptic curve uses Advanced Encryption Standard (AES)-128 level of security, or in which the elliptic curve uses Advanced Encryption Standard (AES)-192 level of security, or in which the elliptic curve uses Advanced Encryption Standard (AES)-256 level of security.

13. Method of claim 1 , in which the pairing-based cryptographic approach makes standard pairing-based security assumptions, including external Diffie-Hellman (XDH) assumption that decisional Diffie-Hellman problem is hard in G1.

14. Method of claim 1 , in which the server is authenticated to the client computing device.

15. Method of claim 1 , in which the method attempts to prove in zero knowledge to the server that an owner of the claimed identity ID is in possession of the value (s-ε)A issued to it by the trusted authority.

16. Method of claim 1 , in which the server performs a calculation of a pairing and a solution of a discrete logarithm problem in GT, to find ε.

17. Method of claim 16 , in which the server performs a calculation of a pairing and a solution of a discrete logarithm problem in GT, using method of Pollard's Kangaroos, to find E.

18. Method of claim 1 , in which the client computing device receives the encrypted identifier (s-ε)A from the trusted authority in a plurality of blocks.

19. Method of claim 1 , in which the encrypted identifier (s-ε)A includes an authentication factor.

20. Method of claim 19 , the method including the step of receiving an authentication factor from a user.

21. Method of claim 20 , the method including the step of the authentication factor being re-inserted in the encrypted identifier (s-ε)A.

22. Method of claim 20 , in which if the authentication factor is incorrect, a valid secret ε will not be decrypted by the server.

23. Method of claim 1 , in which the trusted authority is distributed.

24. Method of claim 1 , in which the client computing device is a mobile phone.

25. Method of claim 1 , in which the ID which is an identifier of the client computing device is a pseudonym in a predetermined format to preserve anonymity.

26. A system comprising a client computing device and a server, the system configured to perform an authentication approach using a pairing based cryptographic approach, using type-3 pairing defined by a mapping e: G1×G2→GT, in which G1, G2 and GT are all cyclic groups of the same prime order q and in which the groups G1 and G2 are distinct, and in which Q is a fixed point in G2, in which:

(i) the client computing device is arranged to receive an encrypted identifier (s-ε)A from a trusted authority, the trusted authority having used its master key s and a secret ε to encrypt the encrypted identifier (s-ε)A associated with the client computing device, where A=H1(ID), where H1 is a hash function which hashes its input to a point on G1, and ID is an identifier of the client computing device;

(ii) the server is arranged to receive from the trusted authority a secret sQ encrypted by the trusted authority using the master key s;

(iii) the client computing device is configured to generate a random x<q, and to calculate A=H1(ID) and U=xA;

(iv) the client computing device is configured to calculate y=H(U|T), where H is a hash function which hashes its input to an element in Fq, and T is a time stamp;

(v) the client computing device is configured to calculate V=−(x+y)(s-ε)A;

(vi) the client computing device is configured to send ID, U, T and V to the server in an authentication request;

(vii) the server is configured to reject the authentication request if T is not current, the server configured to otherwise proceed to (viii);

(viii) the server is configured to calculate A=H1(ID) and y=H(U|T);

(ix) the server is configured to calculate g=e(V,Q)·e(U+yA,sQ)=e(U,Q)^(ε), and to solve for ε;

(x) the server is configured to record that the client computing device with the identifier ID has supplied the secret ε in an encrypted form, and

(xi) the server is configured to authenticate the client computer.

27. A server forming part of a system comprising a client computing device and the server, the system configured to perform an authentication approach using a pairing based cryptographic approach, using type-3 pairing defined by a mapping e: G1×G2→GT, in which G1, G2 and GT are all cyclic groups of the same prime order q and in which the groups G1 and G2 are distinct, and in which Q is a fixed point in G2, in which:

(i) the client computing device is arranged to receive an encrypted identifier (s-ε)A from a trusted authority, the trusted authority having used its master key s and a secret ε to encrypt the encrypted identifier (s-ε)A associated with the client computing device, where A=H1(ID), where H1 is a hash function which hashes its input to a point on G1, and ID is an identifier of the client computing device;

(ii) the server is arranged to receive from the trusted authority a secret sQ encrypted by the trusted authority using the master key s;

(iii) the client computing device is configured to generate a random x<q, and to calculate A=H1(ID) and U=xA;

(iv) the client computing device is configured to calculate y=H(U|T), where H is a hash function which hashes its input to an element in Fq, and T is a time stamp;

(v) the client computing device is configured to calculate V=−(x+y)(s-ε)A;

(vi) the client computing device is configured to send ID, U, T and V to the server in an authentication request;

(vii) the server is configured to reject the authentication request if T is not current, the server configured to otherwise proceed to (viii);

(viii) the server is configured to calculate A=H1(ID) and y=H(U|T);

(ix) the server is configured to calculate g=e(V,Q)·e(U+yA,sQ)=e(U,Q)^(ε), and to solve for ε;

(x) the server is configured to record that the client computing device with the identifier ID has supplied the secret ε in an encrypted form, and

(xi) the server is configured to authenticate the client computer.

28. A pair of computer program products, including a client computing device computer program product and a server computer program product, the client computing device computer program product executable on a client computer device, and the server computer program product executable on a server, to perform a method of authenticating the client computing device to the server, the authentication approach using a pairing based cryptographic approach, using type-3 pairing defined by a mapping e: G1×G2→GT, in which G1, G2 and GT are all cyclic groups of the same prime order q and in which the groups G1 and G2 are distinct, and in which Q is a fixed point in G2, the method including:

(i) the client computing device receiving an encrypted identifier (s-ε)A from a trusted authority, the trusted authority having used its master key s and a secret ε to encrypt the encrypted identifier (s-ε)A associated with the client computing device, where A=H1(ID), where H1 is a hash function which hashes its input to a point on G1, and ID is an identifier of the client computing device;

(ii) the server receiving from the trusted authority a secret sQ encrypted by the trusted authority using the master key s;

(iii) the client computing device generating a random x<q, and calculating A=H1(ID) and U=xA;

(iv) the client computing device calculating y=H(U|T), where H is a hash function which hashes its input to an element in Fq, and T is a time stamp;

(v) the client computing device calculating V=−(x+y)(s-ε)A;

(vi) the client computing device sending ID, U, T and V to the server in an authentication request;

(vii) the server rejecting the authentication request if T is not current, the server otherwise proceeding to (viii);

(viii) the server calculating A=H1(ID) and y=H(U|T);

(ix) the server calculating g=e(V,Q)·e(U+yA,sQ)=e(U,Q)^(ε), and solving for ε;

(x) the server recording that the client computing device with the identifier ID has supplied the secret ε in an encrypted form, and

(xi) the server authenticating the client computer.