Incorporating shared randomness into distributed cryptography
A method of distributed cryptography for high consequence security systems which employs shared randomness between operating parties. Shared randomness is accomplished by sharing cryptographic keys stored in secure hardware tokens by potentially less secure software or general purpose computing units that perform distributed cryptography. The shared randomness is based on shared keys (at the tokens) and unique context. Shared random values are incorporated into the computation of partial results used in the distributed cryptographic calculation. The incorporation of shared randomness provides a hand-shake among the hardware tokens. When the operation is successful, a result is computed with assurance that the correct parties have taken part in forming the result. The hand-shake assures binding of operating parties and added system security.
1. A method, executed on computer hardware in combination with software, for improved security in a distributed cryptographic process, the method comprising:
identifying entities participating in a distributed cryptographic process;
receiving a partial result from each of the identified entities participating in the distributed cryptographic process, the partial results calculated based on the identified entities; and
calculating a distributed cryptographic process result using the received partial results, such that verification of the distributed cryptographic process result assures that the correct identified entities actually participated in the distributed cryptographic process;
wherein each of the identified entities comprises a cryptographic processing unit that includes a hardware token and is associated with a software process executed by a processor core.
2. The method of claim 1 wherein each of the identified entities is associated with a software process executed by a processor core.
3. The method of claim 2 wherein sources of randomness are shared among pairs of the identified entities.
4. The method of claim 1 wherein the distributed cryptographic process includes one or more from the group consisting of:
digital signing;
encryption; and
decryption.
5. The method of claim 1 wherein the distributed cryptographic process performs a cryptographic function.
6. The method of claim 5 wherein the cryptographic function is an RSA function.
7. The method of claim 1 wherein the received partial results are calculated using sources of randomness shared among the identified entities.