One way authentication
A cryptosystem prevents replay attacks within existing authentication protocols, susceptible to such attacks but containing a random component, without requiring modification to said protocols. The entity charged with authentication maintains a list of previously used bit patterns, extracted from a portion of the authentication message connected to the random component. If the bit pattern has been seen before, the message is rejected; if the bit pattern has not been seen before, the bit pattern is added to the stored list and the message is accepted.
1. A method performed by one correspondent in a data communication system for confirming the originality and authenticity of messages generated by other correspondents in the data communication system, the method comprising:
a cryptographic processor at the one correspondent obtaining a signed message, said signed message comprising information and a signature signing said information, from another correspondent in the data communication system via a communication link, wherein said information was generated by said other correspondent, and wherein a first component of the signature comprises random data generated by said other correspondent and a second component of the signature comprises a calculated value generated from the information and the random data in accordance with a particular cryptographic protocol;
said cryptographic processor verifying said signature to authenticate said signed message, wherein said verifying utilizes said random data and said information;
said cryptographic processor extracting from said signature, a bit pattern representative of said random data and comparing said bit pattern to one or more previously extracted bit patterns stored in a memory of the correspondent, said previously extracted bit patterns previously received with signed messages received from said other correspondent; and,
said cryptographic processor confirming said originality and said authenticity of said signed message if said signature is verified and said extracted bit pattern is not matched to said previously extracted bit patterns.
2. The method according to claim 1 wherein said previously extracted bit patterns are maintained in a database at said one correspondent.
3. The method according claim 2 wherein when said extracted bit pattern is not matched to said previously extracted bit patterns, said extracted bit pattern is added to said database.
4. The method according to claim 2 wherein said database is organized to conduct a comparison with bit patterns previously obtained from said other correspondents.
5. The method according to claim 1 wherein said random data is derived from an ephemeral public key.
6. The method according to claim 5 wherein said signed message includes information to be exchanged between said one correspondent and said other correspondent.
7. The method according to claim 1 wherein said verifying said signature is performed according to a protocol for verifying an ECDSA signature.
8. The method according to claim 1 wherein said verifying said signature is performed according to protocol for verifying an RSA signature.
9. The method according to claim 1 wherein said random data is utilized to verify said signature prior to extracting said bit pattern.
10. The method according to claim 1 wherein said bit pattern is extracted prior to verifying said signature.
11. A computing device comprising a processor and a memory, said computing device being connectable to a data communication system, and being configured for confirming originality and authenticity of messages generated by other correspondents in said data communication system by operating said processor to perform acts of:
obtaining a signed message, said signed message comprising information and a signature signing said information, from another correspondent in the data communication system via a communication link, wherein said information was generated by said other correspondent, and wherein a first component of the signature comprises random data generated by said other correspondent and a second component of the signature comprises a calculated value generated from the information and the random data in accordance with a particular cryptographic protocol;
verifying said signature to authenticate said signed message, wherein said verifying utilizes said random data and said information;
extracting from said signature, a bit pattern representative of said random data;
comparing said bit pattern to one or more previously extracted bit patterns stored in a memory of the correspondent, said previously extracted bit patterns previously received with signed messages received from said other correspondent; and
confirming said originality and said authenticity of said signed message if said signature is verified and said extracted bit pattern is not matched to said previously extracted bit patterns.
12. The computing device according to claim 11 wherein said previously extracted bit patterns are maintained in a database at said one correspondent.
13. The computing device according claim 12 wherein when said extracted bit pattern is not matched to said previously extracted bit patterns, said extracted bit pattern is added to said data base.
14. The computing device according to claim 12 wherein said database is organized to conduct a comparison with bit patterns previously obtained from said other correspondents.
15. The computing device according to claim 11 wherein said random data is derived from an ephemeral public key.
16. The computing device according to claim 15 wherein said signed message includes information to be exchanged between said one correspondent and said other correspondent.
17. The computing device according to claim 11 wherein said verifying said signature is performed according to a protocol for verifying an ECDSA signature.
18. The computing device according to claim 11 wherein said verifying said signature is performed according to protocol for verifying an RSA signature.
19. The computing device according to claim 11 wherein said random data is utilized to verify said signature prior to extracting said bit pattern.
20. The computing device according to claim 11 wherein said bit pattern is extracted prior to verifying said signature.