US5214698A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for validating entry of cryptographic keys
Assignee: International Business Machines Corp
•
Filing: 1991-03-20
•
Granted: 1993-05-25
•
Expires: 2011-03-20
Abstract
Abstract A cryptographic facility implements a multiple key part import procedure. The installation manager can verify that a key part has been correctly entered and has not been compromised. The security requirement for the procedure is that no single party can subvert the system security by misusing the procedure. This is accomplished by the use of a control-vector-dependent verification pattern to indicate that each key part has been accepted by using the proper control vector and the use of different key switch positions to specify whether the key part is a master key part or an operational key part and whether the key part is a first part or a subsequent key part. The apparatus provides an automatic reset of the key part register at the completion of each key-entry instruction so that each key part can be imported only once. This prevents the same key part from being imported twice as different key part types. The apparatus also prevents a key part from being combined with itself to create a known key. The procedure is fail-safe so that the program cannot steal a key part from a previously failed procedure.
Inventors
- 👤 Ronald M. Smith, Sr.
- 👤 Phil C. Yeh
- 👤 Randall J. Easter
- 👤 Donald B. Johnson
- 👤 An Van Le
- 👤 Stephen M. Matyas
- 👤 Julian Thomas
- 👤 John D. Wilkins
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 09:24
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/08; H04L9/088
Claims Analysis
Total Claims: 25
Claim 1
Independent Claim
120 words
A method for securely importing into a data processing system a cryptographic key by a multiple key part import procedure comprising the steps of: receiving by said data processing system information specifying an intended us of an ultimate key; receiving by said data processing system a first key part; combining said first key part with said information specifying the intended use of an ultimate key and then storing the result as a modified key part; verifying the intended use of said first key part; receiving by said data processing system a second key part; combining said second key part and said modified key part to produce said ultimate cryptographic key; and verifying the intended use of said second key part.
Claim 2
Independent Claim
120 words
A method for securely importing into a data processing system a cryptographic key by a multiple key part import procedure comprising the steps of: receiving by said data processing system information specifying an intended us of an ultimate key; receiving by said data processing system a first key part; combining said first key part with said information specifying the intended use of an ultimate key and then storing the result as a modified key part; verifying the intended use of said first key part; receiving by said data processing system a second key part; combining said second key part and said modified key part to produce said ultimate cryptographic key; and verifying the intended use of said second key part.
Claim 3
Dependent Claim
32 words
The method recited in claim 1 wherein said information combined with said first key part consists of a control vector which is a function of an intended use of the ultimate key.
Claim 4
Dependent Claim
18 words
The method recited in claim 1 wherein the steps of verifying are performed using a one-way cryptographic function.
Claim 5
Dependent Claim
19 words
The method recited in claim 3 wherein the result of the one-way cryptographic function is a usage-dependent verification pattern.
Claim 6
Dependent Claim
21 words
The method recited in claim 1 further comprising the step of limiting the importation of each key part to once only.
Claim 7
Dependent Claim
19 words
The method recited in claim 5 further comprising the step of clearing a key part after it is imported.
Claim 8
Dependent Claim
19 words
The method recited in claim 5 further comprising the step of generating usage-independent verification pattern of the key part.
Claim 9
Dependent Claim
38 words
The method recited in claim 1 further comprising the steps of: encrypting modified key part prior to storing; decrypting the stored encrypted modified key part prior to combining with said second key part; and encrypting said ultimate key.
Claim 10
Dependent Claim
224 words
In a data processing system, an apparatus for securely importing by a multiple key part import procedure a cryptographic key comprising: input means for receiving information specifying an intended use of an ultimate key; key usage storage means for storing information specifying the intended use of the ultimate key from said input means; cryptographic key entry means for receiving key parts; key part storage means for sequentially storing at least first and second key parts entered from said cryptographic key entry means; first combination means responsive to a first key part stored in said key part storage means and the information stored in said key usage storage means for combining said first key part with said information to form a modified key part; temporary storage means for temporarily storing said modified key part; first generation means for generating a first verification pattern responsive to said first combination means; second combination means responsive to a second key part stored in said key part storage means and said modified key part stored in said temporary storage means for combining said second key part and said modified key part to produce said ultimate key; and second generation means for generating a second verification pattern responsive to said second key part stored in said key part storage means and said information stored in said key usage storage means.
Claim 11
Dependent Claim
224 words
In a data processing system, an apparatus for securely importing by a multiple key part import procedure a cryptographic key comprising: input means for receiving information specifying an intended use of an ultimate key; key usage storage means for storing information specifying the intended use of the ultimate key from said input means; cryptographic key entry means for receiving key parts; key part storage means for sequentially storing at least first and second key parts entered from said cryptographic key entry means; first combination means responsive to a first key part stored in said key part storage means and the information stored in said key usage storage means for combining said first key part with said information to form a modified key part; temporary storage means for temporarily storing said modified key part; first generation means for generating a first verification pattern responsive to said first combination means; second combination means responsive to a second key part stored in said key part storage means and said modified key part stored in said temporary storage means for combining said second key part and said modified key part to produce said ultimate key; and second generation means for generating a second verification pattern responsive to said second key part stored in said key part storage means and said information stored in said key usage storage means.
Claim 12
Dependent Claim
19 words
The apparatus of claim 9 further comprising display means for displaying a status of said key part storage means.
Claim 13
Dependent Claim
19 words
The apparatus of claim 9 in which said first and second generation means each perform a one-way cryptographic function.
Claim 14
Dependent Claim
34 words
The apparatus of claim 9 wherein said cryptographic key entry means includes cryptographic key entry controls for enabling an entry of each key part and for clearing contents of said key part storage means.
Claim 15
Dependent Claim
37 words
The apparatus of claim 9 wherein said cryptographic key entry means includes automatic auditing means for reporting information concerning a status of the key part storage means and a value and intended use of the key part.
Claim 16
Dependent Claim
35 words
The apparatus of claim 9 wherein said key part import means and said final key part combination means cause contents of the key part storage means to be cleared at a completion of an operation.
Claim 17
Dependent Claim
33 words
The apparatus of claim 9 wherein said key part import means and said second combination means include automatic auditing means for reporting information concerning a value and intended use of a key part.
Claim 18
Dependent Claim
47 words
The apparatus of claim 9 further comprising: means for encrypting contents of said modified key part storage means and returning encrypted information to a program; and means for receiving information from the program and decrypting this information before placing it in the modified key part storage means.
Claim 19
Dependent Claim
41 words
The apparatus of claim 9 wherein said key usage storage means includes a table indexed by said information specifying the intended use of the ultimate key for generating a control vector to be used by said first and second combination means.
Claim 20
Dependent Claim
21 words
The apparatus of claim 9 wherein said first and second combination means are a single combination means performing functions in sequence.
Claim 21
Dependent Claim
15 words
The apparatus of claim 18 wherein said single combination means performs an Exclusive OR function.
Claim 22
Dependent Claim
95 words
The apparatus of claim 9 wherein said key part storage means sequentially stores at least three key parts entered from said cryptographic key entry means, said apparatus further comprising intermediate combination means responsive to an intermediate key part stored in said key part storage means between entries of said first and second key parts and to said modified key part stored in said temporary storage means for combining said intermediate key part and said modified key part to produce modified combined key parts, said modified combined key parts being stored in said temporary storage means.
Claim 23
Dependent Claim
29 words
The apparatus of claim 20 wherein said intermediate key part combination means causes content of the key part storage means to be cleared at a completion of an operation.
Claim 24
Dependent Claim
29 words
The apparatus of claim 20 wherein said intermediate key part combination means includes automatic auditing means for reporting information concerning a value and intended use of a key part.
Claim 25
Dependent Claim
22 words
The apparatus of claim 20 wherein said first, intermediate and second combination means are a single combination means performing functions in sequence.
References Cited (Backward Citations)
US4694491A
Cited
US4803725A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1996-05-24 | 1996-11-23 | 1997-05-25 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2000-05-24 | 2000-11-23 | 2001-05-25 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2004-05-24 | 2004-11-23 | 2005-05-25 | $7700.00 | Window Closed / Lapsed |