Abstract: Methods and apparatus for providing secure user identification or digital signatures based on evaluation of constrained polynomials. In an exemplary user identification technique, a prover sends a verifier a commitment signal representative of a first polynomial satisfying a first set of constraints. The verifier sends the prover a challenge signal representative of a second polynomial satisfying a second set of constraints. The prover generates a response signal as a function of (i) information used to generate the commitment signal, (ii) a challenge signal, and (iii) a private key polynomial of the prover, such that the response signal is representative of a third polynomial satisfying a third set of constraints. The verifier receives the response signal from the prover, and authenticates the identity of the prover by evaluating a function of information contained in at least a subset of (i) the commitment signal, (ii) the challenge signal, (iii) the response signal and (iv) a public key of the prover.

Abstract: Methods and apparatus for converting a value A representing in a first basis an element of a finite field GF(q.sup.m) to a value B representing the element in a second basis, where q is a prime number or power of a prime number and m is an integer greater than or equal to 2, and where the value B includes a vector of m coefficients from a finite field GF(q). An exemplary apparatus, particularly well-suited for exporting the value A in an internal basis representation to the value B in an external basis representation, includes an externally shifted sequence generator for generating from the value A a sequence of intermediate values representing in the first basis elements of the finite field GF(q.sup.m) whose representations in the second basis are related to the value B by a predetermined external shift operation. An extractor coupled to the externally shifted sequence generator receives and processes the sequence of intermediate values to generate each coefficient of the value B.

Abstract: A public key escrow system is adapted to have a proof of knowledge protocol for a certificate. The certificate is signed with RSA and is proved using a protocol based on the Guillou-Quisquater proof of knowledge scheme, or other proof of knowledge protocol. Interactive and non-interactive protocols are disclosed.

Abstract: Encrypted data objects are distributed via a broadcast communication channel or media. Relatively large access indicia may also be pre-distributed to any potential data object users and/or purchasers via an access communication channel or media. Subsequently, when a particular potential user or purchaser wishes to decrypt a given data object, he or she communicates to a data distribution point the identity of the desired data object and the identity of a valid access incidium. A relatively short decryption key is then furnished via a key distribution communication channel or media to permit decryption while at the same time permitting appropriate accounting operations to take place. The system is resistant to abuse in several ways but in part because such abuse would be approximately as difficult as would be re-distribution of the entire decrypted data object itself.