Abstract: A method and apparatus for establishing security credentials for a user to access and subsequently use in secure on-line transactions begins when a service provider generates a registration secret for a user in response to a registration request. The registration request identifies user information of a particular user. Before a registration request can be provided to the service provider, the user must establish a relationship with the service provider. Having generated the registration secret, the service provider stores a user identifying secret, which includes the initialization data, the user information, the registration secret, and/or a security name in a mapping repository. The service provider provides the registration secret to the user in a trustworthy manner. Sometime thereafter, the user provides an on-line initialization request for the initialization data, where the initialization request is encoded based on at least a part of the user identifying secret.

Abstract: A method and apparatus for dynamically accessing security credentials that are used to participate in a secure communication begins by obtaining virtual credentials of an entity, where the virtual credentials include a data specifier and/or an identifier. The data specifier functions as a pointer to a particular physical security credential, its data storage location, and the format of the physical security credential. The identifier functions as a pointer to secondary virtual credentials, which include at least one data specifier. The processing continues by generating physical security credentials based on the physical security credentials retrieved via the data specifiers. The processing then continues by utilizing the physical security credentials by an individual entity (e.g., a party, a server, an administrator, etc.) such that the individual entity may participate in a secured communication.

Abstract: A method and apparatus for public key management is accomplished when an associated authority provides, from time to time, a public key of at least one of a plurality of certificate authorities to a client. The associated authority provides the public key in a trustworthy manner over an on-line communication path and/or a store and forward communication path, which may be done using a self-signed signature public key certificate. Upon receiving the public key, the client maintains it in a storage medium associated with a client cryptographic engine. When a client application needs a security-related operation to be performed, it evokes the client cryptographic engine via an application program interface. Upon being evoked the client cryptographic engine determines whether a public key certificate associated with the security-related operation is verified as authentic based on the public key of at least one of the plurality of certification authorities.

Abstract: A method and apparatus for securing and accessing data elements within a database is accomplished by securing a symmetric key based on an encryption public key. This may be done for the entire database or portions thereof. Once a symmetric key is secured, the computing system may receive a data element for storage in a database. When a data element is received, the computing device retrieves the secured symmetric key and then decrypts it based on a decryption private key. Having decrypted the secured symmetric key, the recaptured symmetric key is used to secure the data element. The securing is done utilizing an encryption algorithm and the symmetric key. Once the data element has been secured, it is stored in the database. To retrieve a secured data element from the database, a request for access must be received. Once a request is received, the computing device retrieves a secured data element in response to the request.

Abstract: A method and apparatus for providing off-line secure communications is accomplished when an end-user is on-line with a security information repository and transmits a request for security information relating to at least one targeted communication entity. The targeted communication entity may be another end-user that has sent the present end-user an encrypted message or another end-user that will receive an encrypted message from the present end-user. In response to the request, the present end-user subsequently receives the security information and updates a local security information repository (e.g., cache memory) with the security information related to the at least one targeted communication entity. Having updated the local security information repository, the current end-user goes off-line from the security information repository.

Abstract: A method and apparatus for accessing user specific encryption information is accomplished upon receiving a request for access to user specific encryption information from a requesting entity. Based on the identity of the requesting entity and/or the type of request, a server determines the requesting entity's authorized level of access to user specific encryption information. Based on the authorized level of access, the requesting entity is provided with controlled access to the user specific information.

Abstract: A method and apparatus for creating communities of trust within a secure communications system is accomplished by allowing end-users to obtain arbitrary lists of trusted public keys from other end-users and from associated authorities. Once an arbitrary list has been obtained by an end-user, the end-user determines whether it was obtained in a manner consistent with a security policy of the secured community. The security policy may enable an end-user to receive trusted public keys from other end-users, from associated authorities only, to receive public keys of associated authorities, other end users, or any combination thereof. When the arbitrary lists of trusted keys are obtained in a manner consistent with the security policy, the end-user adds keys of the arbitrary lists to a trusted key list. When a security-related operation is to be performed (e.g.

Abstract: A method of generating a substitution box (S-box) involves generating an S-box with desired characteristics, forming a new S-box with another column such that the new S-box has the desired characteristics as well, and continuing to add columns in these ways until the S-box has the proper size.

Abstract: Encryption frequently needs to be used in communication networks which span different geographical regions which can be considered to be trusted to different extents. According to one embodiment, the invention uses both a strong encryption algorithm and a weak encryption algorithm. A device in the high-trusted region can encrypt using the strong algorithm and can decrypt using either the strong or weak algorithm. A device in the low-trusted region can decrypt with either the strong or the weak algorithm but can encrypt only with the weak algorithm.

Abstract: A method of encrypting or decrypting an input message block of binary data of predetermined length 2n into an output message block by dividing the message block into two equal size halves, performing one or more transformation rounds on the message block halves, each transformation round further comprising the steps of determining a key, processing the first half data block using a hash function to obtain a modified first half data block of length n, and combining the modified first half data block with the second half data block to obtain a modified second half data block of length n; and, lastly, appending the first modified half data block to the second modified half data block to obtain the output message block.

Abstract: The invention allows for transporting, in different degrees of security strength, a symmetric key encrypted using an asymmetric encryption technique, and along with this transporting ciphertext derived from plaintext encrypted under this symmetric key. The encryptor encrypts the plaintext using a symmetric whose strength is commensurate with the trust level of the environment in which the encryptor is located. The encryptor encrypts this symmetric key for one or more intended recipients using an asymmetric technique commensurate with a high-trust environment. In the case of the encryptor residing in the low-trust environment, the encryptor additionally encrypts this symmetric key using an asymmetric encryption public key of the originator itself (or alternatively, that of a third party). Decryption equipment in all environments uses the decryption process corresponding to an algorithm identifier included by the originator.

Abstract: A new design procedure for constructing a family of DES-like Substitution-Permutation Network (SPN) cryptosystems with desirable cryptographic properties including provable resistance to differential cryptanalysis, linear cryptanalysis, and related-key cryptanalysis is described. New cryptosystems called CAST ciphers, constructed according to the procedure, are also described. Details of the design choices in the procedure are given, including those regarding the component substitution boxes (s-boxes), the overall framework, the key schedule, and the round function. A fully specified example CAST cipher, an output of this design procedure, is presented as an aid to understanding the concepts and to encourage detailed analysis by the cryptologic community.