US6058188A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for interoperable validation of key recovery information in a cryptographic system
Assignee: International Business Machines Corp
•
Filing: 1997-07-24
•
Granted: 2000-05-02
•
Expires: 2017-07-24
Abstract
Abstract In a cryptographic communications system, a method and apparatus for allowing a sender of encrypted data to demonstrate to a receiver its ability to correctly generate key recovery information that is transmitted along with the encrypted data and from which law enforcement agents or others may recover the original encryption key. Initially, the sender generates a key pair comprising a private signature key and a corresponding public verification key and sends the latter to a key recovery validation service (KRVS). Upon a satisfactory demonstration by the sender of its ability to correctly generate key recovery information, the KRVS generates a certificate certifying the public verification key and the ability of the sender to correctly generate key recovery information. The sender uses its private signature key to generate a digital signature on the key recovery information, which is sent along with the key recovery information and encrypted data to the receiver. The receiver verifies the signature on the key recovery information using the certified public verification key and decrypts the encrypted data only if the signature is verified as being a valid signature.
Inventors
- 👤 Coimbatore S. Chandersekaran
- 👤 Rosario Gennaro
- 👤 Sarbari Gupta
- 👤 Stephen M. Matyas, Jr.
- 👤 David R. Safford
- 👤 Nevenko Zunic
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-08 22:04
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/32; H04L9/3247; H04L9/08; H04L9/0894; H04L9/3263; H04L9/3268
Claims Analysis
Total Claims: 27
Claim 1
Independent Claim
241 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, a method of demonstrating to said second party the ability of said first party to correctly generate said recovery information, comprising the steps of: having said first party generate a first key recovery block as a test block containing recovery information for a first decryption key and transmit said first key recovery block to an independent certification authority; having said independent certification authority validate said recovery information and, upon determining that said recovery information is correctly generated, generate a certificate certifying a public verification key corresponding to a private signature key of said first party; having said first party generate a second key recovery block containing recovery information for a second decryption key used by said second party to decrypt encrypted data received from said first party; and having said first party transmit said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 2
Dependent Claim
241 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, a method of demonstrating to said second party the ability of said first party to correctly generate said recovery information, comprising the steps of: having said first party generate a first key recovery block as a test block containing recovery information for a first decryption key and transmit said first key recovery block to an independent certification authority; having said independent certification authority validate said recovery information and, upon determining that said recovery information is correctly generated, generate a certificate certifying a public verification key corresponding to a private signature key of said first party; having said first party generate a second key recovery block containing recovery information for a second decryption key used by said second party to decrypt encrypted data received from said first party; and having said first party transmit said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 3
Dependent Claim
23 words
The method of claim 1 in which said first and second decryption keys are the same as said first and second encryption keys.
Claim 4
Dependent Claim
35 words
The method of claim 1 in which said first party generates a key pair comprising said private signature key and said public verification key and transmits said public verification key to said independent certification authority.
Claim 5
Dependent Claim
26 words
The method of claim 1 in which said first party receives said certificate from said independent certification authority and transmits said certificate to said second party.
Claim 6
Dependent Claim
40 words
The method of claim 1 in which said second party verifies said digital signature using said certificate and decrypts said encrypted data received from said first party only if said digital signature is verified as being a valid digital signature.
Claim 7
Dependent Claim
253 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, apparatus for demonstrating to said second party the ability of said first party to correctly generate said recovery information, said apparatus comprising: means associated with said first party for generating a first key recovery block as a test block containing recovery information for a first decryption key and for transmitting said first key recovery block to an independent certification authority; means associated with said independent certification authority for validating said recovery information and, upon determining that said recovery information is correctly generated, for generating a certificate certifying a public verification key corresponding to a private signature key of said first party; means associated with said first party for generating a second key recovery block containing recovery information for a second decryption key used by said second party to decrypt encrypted data received from said first party; and means associated with said first party for transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 8
Dependent Claim
253 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, apparatus for demonstrating to said second party the ability of said first party to correctly generate said recovery information, said apparatus comprising: means associated with said first party for generating a first key recovery block as a test block containing recovery information for a first decryption key and for transmitting said first key recovery block to an independent certification authority; means associated with said independent certification authority for validating said recovery information and, upon determining that said recovery information is correctly generated, for generating a certificate certifying a public verification key corresponding to a private signature key of said first party; means associated with said first party for generating a second key recovery block containing recovery information for a second decryption key used by said second party to decrypt encrypted data received from said first party; and means associated with said first party for transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 9
Dependent Claim
23 words
The apparatus of claim 6 in which said first and second decryption keys are the same as said first and second encryption keys.
Claim 10
Dependent Claim
35 words
The apparatus of claim 6 in which said first party generates a key pair comprising said private signature key and said public verification key and transmits said public verification key to said independent certification authority.
Claim 11
Dependent Claim
26 words
The apparatus of claim 6 in which said first party receives said certificate from said independent certification authority and transmits said certificate to said second party.
Claim 12
Dependent Claim
40 words
The apparatus of claim 6 in which said second party verifies said digital signature using said certificate and decrypts said encrypted data received from said first party only if said digital signature is verified as being a valid digital signature.
Claim 13
Dependent Claim
219 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, a method of demonstrating to said second party the ability of said first party to correctly generate said recovery information, wherein said first party performs the steps of: transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 14
Dependent Claim
219 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, a method of demonstrating to said second party the ability of said first party to correctly generate said recovery information, wherein said first party performs the steps of: transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 15
Dependent Claim
23 words
The method of claim 11 in which said first and second decryption keys are the same as said first and second encryption keys.
Claim 16
Dependent Claim
35 words
The method of claim 11 in which said first party generates a key pair comprising said private signature key and said public verification key and transmits said public verification key to said independent certification authority.
Claim 17
Dependent Claim
26 words
The method of claim 11 in which said first party receives said certificate from said independent certification authority and transmits said certificate to said second party.
Claim 18
Dependent Claim
227 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, apparatus for demonstrating to said second party the ability of said first party to correctly generate said recovery information, said apparatus being associated with said first party and comprising: means for transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; means for receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; means generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and means for transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 19
Dependent Claim
227 words
In a communications system in which a first party transmits encrypted data along with recovery information to a second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, apparatus for demonstrating to said second party the ability of said first party to correctly generate said recovery information, said apparatus being associated with said first party and comprising: means for transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; means for receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; means generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and means for transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 20
Dependent Claim
23 words
The apparatus of claim 15 in which said first and second decryption keys are the same as said first and second encryption keys.
Claim 21
Dependent Claim
35 words
The apparatus of claim 15 in which said first party generates a key pair comprising said private signature key and said public verification key and transmits said public verification key to said independent certification authority.
Claim 22
Dependent Claim
26 words
The apparatus of claim 15 in which said first party receives said certificate from said independent certification authority and transmits said certificate to said second party.
Claim 23
Dependent Claim
242 words
A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for demonstrating to a second party the ability of said first party to correctly generate said recovery information in a communications system in which said first party transmits encrypted data along with recovery information to said second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, said method steps being performed by said first party and comprising: transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 24
Dependent Claim
242 words
A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for demonstrating to a second party the ability of said first party to correctly generate said recovery information in a communications system in which said first party transmits encrypted data along with recovery information to said second party who decrypts the encrypted data using a decryption key, said system having one or more key recovery agents for enabling recovery of said decryption key using said recovery information, said method steps being performed by said first party and comprising: transmitting a first key recovery block as a test block containing recovery information for a first decryption key to an independent certification authority; receiving a certificate from said independent certification authority certifying a public verification key corresponding to a private signature key upon validation of said recovery information by said independent certification authority; generating a second key recovery block containing recovery information for a second decryption key used by said second part to decrypt encrypted data received from said first party; and transmitting said second key recovery block to said second party along with a digital signature generated on said second key recovery block using said private signature key to allow said second party to verify the ability of said first party to correctly generate the recovery information in said second key recovery block by validating said digital signature using said certificate.
Claim 25
Dependent Claim
25 words
The program storage device of claim 19 in which said first and second decryption keys are the same as said first and second encryption keys.
Claim 26
Dependent Claim
37 words
The program storage device of claim 19 in which said first party generates a key pair comprising said private signature key and said public verification key and transmits said public verification key to said independent certification authority.
Claim 27
Dependent Claim
28 words
The program storage device of claim 19 in which said first party receives said certificate from said independent certification authority and transmits said certificate to said second party.
References Cited (Backward Citations)
US4200770A
Cited
US5276737A
Cited
US5315658A
Cited
US5276737B1
Cited
US5315658B1
Cited
US5825880A
Cited
US5841865A
Cited
US5579393A
Cited
US5557765A
Cited
US5615268A
Cited
US5661803A
Cited
US5664017A
Cited
US5815573A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-05-02 | 2003-11-01 | 2004-05-02 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-05-02 | 2007-11-01 | 2008-05-02 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-05-02 | 2011-11-01 | 2012-05-02 | $7700.00 | Window Closed / Lapsed |