Cryptographic key escrow system having reduced vulnerability to harvesting attacks

Claim 3

A method as in claim 1 wherein said proof of knowledge protocol is a zero-knowledge protocol.

Claim 4

A method as in claim 1 wherein said proof of knowledge protocol includes the steps: a) generating, by the sending member, a random number r between 1 and n-1; b) computing, by the sending member, a value x, where x=r.sup.e mod n; c) sending x to the receiving member; d) generating, by the receiving member, a random number c between 0 and e-1; e) sending c to the sending member; f) computing, by the sending member a value y, where y=rS.sup.c mod n; g) sending y to the receiving member; h) determining by the receiving member that y.sup.e =xh.sup.c mod n; and i) if the equation is satisfied accepting that the sender has a valid certificate, wherein: n is the certifier's modulus; e is the public exponent of the certifier; h is the hash of the certificate body; and S is the signature on the certificate such that h=S e mod n.

Claim 5

The method in claim 3 including the step of repeating the proof of knowledge protocol.

Claim 6

The method of claim 1 including the step of encrypting the string with a current session key.

Claim 7

The method of claim 1 wherein said proof of knowledge protocol includes the steps of: generating by the sending member; i) a number r and using r to compute a value x, where x=r e mod n, and ii) a number c and using r and c to compute a value y, where y=rS c mod n; sending to the receiving member x and y or y and c; and determining by the receiving member, who generates c in the same manner as the sending member, using y e =xh c mod n to verify the value of x or solve for x, respectively, that the value of c has been properly generated by the sending member wherein: n is the certifier's modulus; e is the public exponent of the certifier; h is the hash of the certificate body; S is the signature on the certificate; such that h=S e mod n.

Claim 8

The method of claim 6 wherein the value of c is made dependent on x through a hash function.

Claim 9

The method of claim 7 wherein the value of c is made dependent on a non-repeating value.

Claim 10

The method of claim 7 wherein the value of c is made dependent on a timestamp.

Claim 11

The method of claim 7 wherein the value of c is made dependent on the current session key.

Claim 12

A public key escrow program embedded in a software product medium for communicating to a receiving program comprising: an encrypting session key; a law enforcement access field comprising the session key encrypted by an escrow key with both encrypted by a family key; a verification string including the escrow key; and a sending member's components of a proof of knowledge protocol for establishing the proof of the sending member's certificate.

Claim 13

A public key escrow program embedded in a software product medium for communicating to a receiving program comprising: an encrypting session key; a law enforcement access field comprising the session key encrypted by an escrow key with both encrypted by a family key; a verification string including the escrow key; and a sending member's components of a proof of knowledge protocol for establishing the proof of the sending member's certificate.

Claim 14

A public key escrow program as in claim 11 wherein the components of the proof of knowledge protocol include; a routine for computing a value x where x=r e mod n, and r is a random number, e is the public exponent of the certifier and n is the certifier's modulus; and a routine for computing a value y where y=r S c mod n, and S is the signature on the certificate and c is a random number provided by a receiving member.

Claim 15

A public key escrow program as in claim 11 wherein the components of the proof of knowledge protocol include: a routine for generating a number r and a number c and a routine for computing a value x and a value y where x=r e mod n, y=rS c mod n and c is made dependent on x and a non-repeating value, and e is the public exponent of the certifier, n is the certifier's modulus and S is the signature on the certificate.

Claim 16

A public key escrow program embedded in a software product medium for responding to communications from a sending program having a certificate comprising: a routine for receiving a law enforcement access field and a verification string, for reconstructing a law enforcement access field from the received verification string, and for comparing the received law enforcement access field with the reconstructed law enforcement access field; and a routine with a proof of knowledge protocol for establishing the proof of the sending program's certificate.

Claim 17

A public key escrow program embedded in a software product medium for responding to communications from a sending program having a certificate comprising: a routine for receiving a law enforcement access field and a verification string, for reconstructing a law enforcement access field from the received verification string, and for comparing the received law enforcement access field with the reconstructed law enforcement access field; and a routine with a proof of knowledge protocol for establishing the proof of the sending program's certificate.

Claim 18

A public key escrow program as in claim 14 wherein said routine with a proof of knowledge protocol includes interactive components for interacting with components in a proof of knowledge routine in the sending program.

Claim 19

A public key escrow program as in claim 15 wherein said routine interactive components include: a subroutine for computing a random number c and for sending c to the sending program; and a subroutine for computing that y.sup.e =xh.sup.c mod n where x and y are parameters provided by the sending program, e is the public exponent of the certifier of the certificate, n is the certifier's modulus and h is the hash of the certificate body.

Claim 20

A public key escrow program as in claim 14 wherein said proof of knowledge protocol comprises a routine for computing that y.sup.e =xh.sup.c mod n where x and y are parameters received from the sending program, c is a parameter generated in the same manner as in the sending program, e is the public exponent and n is the modulus of the certifier of the certificate possessed by the sending program, and h is the hash on the body of the certificate.

Claim 21

A public key escrow program as in claim 17 wherein c is made dependent on x and a non-repeating value.

Claim 22

A public key escrow program as in claim 14 wherein said proof of knowledge protocol comprises a routine for computing the value of x from y.sup.e =xh.sup.c mod n where y and c are parameters received from the sending program, e is the public exponent and n is the modulus of the certifier of the certificate possessed by the sending program, and h is the hash on the body of the certificate, and a routine for determining that the value of c generated from x in the same manner as in the sending program is the same as the value of c received from the sending program.

Claim 23

A public key escrow program as in claim 19 wherein c is made dependent on x and a non-repeating value.