Abstract: An adaptable cryptographic method and system provides updated digital signature key pairs in a public key system by providing, through a multi-client manager unit, selectable expiry data such as digital signature certificate lifetime data, public key expiry data and private key expiry data as selectable on a per client basis. The multi-client manager unit stores selected public key expiry data and private key expiry data for association with a new digital signature key pair and associates the stored selected expiry data with the new digital signature key pair to facilitate a transition from an old digital signature key pair to a new digital signature key pair.

Abstract: An adaptable cryptographic method and system provides updated digital signature key pairs in a public key system by providing, through a multi-client manager unit, selectable expiry data such as digital signature certificate lifetime data, public key expiry data and private key expiry data as selectable on a per client basis. The multi-client manager unit stores selected public key expiry data and private key expiry data for association with a new digital signature key pair and associates the stored selected expiry data with the new digital signature key pair to facilitate a transition from an old digital signature key pair to a new digital signature key pair.

Abstract: A data management system and method for a limited cryptographic storage unit, such as a smartcard or other hardware token, includes a cryptographic data manager that interfaces with the limited capacity cryptographic storage unit and a data overflow memory coupled to the cryptographic data manager. The cryptographic data manager stores cryptographic data, such as decryption private keys or other secret cryptographic data, in the overflow memory from the limited capacity cryptographic storage unit based on a limited capacity storage unit data update condition. The cryptographic data manager may serve as a secondary cryptographic data manager that receives the cryptographic data from an original cryptographic data storage device, or primary storage device such as a server that generates the cryptographic data, that stores a history of the cryptographic data.

Abstract: A multi-factor biometric authenticating device and method generates error correction based partial encryption key seed data based on a plurality of sample biometric inputs, such as raw biometric data The error correction based partial encryption key seed data serves as a partial seed for generating a secret encryption key for encrypting user data. The first partial seed is combined with a second partial encryption seed to generate the secret encryption key. The device stores the error correction based partial encryption key seed data and does not store the secret encryption key.

Abstract: A method and system for protecting a multipurpose data string used for both decrypting data and for authenticating a user utilizes a remote storage element that contains a long random data string or password protected by a short easy to remember access data, such as a personal identification number or other user authentication mechanism. The remote storage element contains data used for both initially encrypting secret private keys and for later decrypting the encrypted secret private keys, or other secret data, so they can be used to decrypt data transferred within a computer network, or be used for digitally signing data transferred within a computer network.

Abstract: A method and apparatus constructs a preferred certificate chain, such as a list of all certificate authorities in a shortest trusted path, based on generated certificate chain data, such as a table of trust relationships among certificate issuing units in a community of interest, to facilitate rapid validity determination of the certificate by a requesting unit. In one embodiment, requesting units, such as certificate validation units or subscribers, send queries to a common certificate chain constructing unit. Each query may identify a beginning and target certification authority in the community. The certificate chain constructing unit then automatically determines the certification chain among certification issuing units between the beginning and target certification authorities for each query and provides certificate chain data to the requesting unit. The requesting unit then performs validity determination on the certificate to be validated based on the certificate chain data.

Abstract: A method of encrypting or decrypting an input message block of binary data of predetermined length 2n into an output message block by dividing the message block into two equal size halves, performing one or more transformation rounds on the message block halves, each transformation round further comprising the steps of determining a key, processing the first half data block using a hash function to obtain a modified first half data block of length n, and combining the modified first half data block with the second half data block to obtain a modified second half data block of length n; and, lastly, appending the first modified half data block to the second modified half data block to obtain the output message block.

Abstract: Novel cryptographic key distribution techniques to be used in large computer networks are disclosed. The techniques require trusted key release agent systems in each security domain. The encryptor of a data message nominates the set of authorized decryptors, using a set of access control attributes recognized by a key release agent in a target security domain. Data enabling the message decryption key and the access control attributes to be recovered are sent to the decryptor in an access controlled decryption block, which is encrypted under a separate key. The access controlled decryption block can only be decrypted by a key release agent in the correct security domain. The key release agent recovers the decryption key and supplies it to an authorized decryptor, which allows the decryptor to recover the original data message.

Abstract: For a public key encryption system, for example using the RSA algorithm, large numbers, for example each of the order of 256 bits and represented by a plurality of sequentially stored words, must be multiplied together. To achieve this at high speed there is described a method using a digital signal processor which has two accumulators for accumulating products of words, each accumulator having a capacity of more than twice the size of the words which are multiplied. The two accumulators are used alternately for accumulating partial products of the same significance in a multiplication of two numbers. Pointers to the sequentially stored words are incremented in opposite directions to point to words to be multiplied to form partial products of the same significance, and the pointer incrementing directions are changed for sets of partial products of increasing significance. The pointer control and alternating use of the accumulators enables a significant increase in multiplication speed to be achieved.