System and method for secure two-factor authenticated ID-based key exchange and remote login using an insecure token and simple second-factor such as a PIN number

1. A method comprising:

finding, at a trusted authority, a non-supersingular curve with an even k for which no distortion map exists, the curve having a base field F p and an extension field F p2 and a curve order c.q;

generating a master secret s;

choosing hash function H 1 : {0,1}*→E(F p );

publishing public parameters;

identifying and authenticating an authentication service to the trusted authority;

taking, at the trusted authority, an identity IDs of the authentication service as input and mapping the identity IDs to a point, S, on the curve;

using, over the extension field F p2 , a second hash function of H 2 : {0,1}*→E(F p2 ) such that S=H 2 (ID s ) so s, a secret number, is a point on the curve E(F p2 );

issuing back to the authentication service over a secure network connection the secret number s, parameters of the curve and the H 2 hash function along with a location of the public parameters;

authenticating, at a client, an identity to the trusted authority;

taking, at the trusted authority, a client's identity ID a as input;

hashing, at the trusted authority, the identity ID a and mapping to a point A of large prime order on the curve;

receiving, at the client, from the trusted authority over the secure network connection A and s, where A=c.H 1 (ID a ) is a point of order q over the base field of the curve E(F p );

taking, at the client, as input a PIN number, α, and calculating αA;

producing, at the client, a number (s−α)A;

storing, at the client, both (s−α)A and A in a browser storage of the client;

using an authentication program at the client to prompt a user of the client for their PIN and their identifier;

using, at the client, the authentication program to hash ID a ;

using, at the client, the hash function H 1 , and to look up a key/value pair to obtain (s−α)A and A;

sending identities ID a and ID s , between the client and authentication service;

generating values of x<q at the client and y<q at the authentication service;

calculating, at the client, S where S=H 2 (ID s ) and A where A=H 1 (ID a ) to achieve P a =xA while, at the authentication service, calculating A where A=H 1 (ID a ) and S where S=H2(IDs) to achieve Ps=yS;

exchanging P a and P s between the client and authentication service;

calculating r a= H q (P a |P s ) and r s =H q (P s |P a ) at the client and the authentication service;

calculating, at the client, k=e((x+r a )((s−α)A+αA),r s S+P s ) to obtain K=H 3 (k) and M=H 3 (ID a , ID s , K);

at the authentication service, calculating k=e(r a A+P a (y+r s )sS) to obtain K=H 3 (k) and N=H 3 (ID a , ID s , K);

sending, at the client, M over the secure connection to the authentication service;

sending N to the client in response to a comparison, N=M, at the authentication service indicating a match; and

determining, at the client, that the client and authentication service have successfully mutually authenticated each other and have a mutually agreed upon session key N in response to a comparison of N to M at the client indicating a match.