SYSTEM AND METHOD OF PERFORMING AUTHENTICATION
Disclosed herein are systems, method and computer readable medium for providing authentication of an entity B by an entity A. In the method, entity A selects a value p, a range [a, b] and a granularity epsilon. Entity A sends p, [a, b], and epsilon to entity B. Entity B initializes a value yB=0 and for each x in {a, a+epsilon, . . . , b−epsilon, b} and computes z=E(x)*x. The function E(x) is an encryption scheme and the multiplication is carried out mod p. Entity B updates yB=yB+z. After processing each x, entity B sends yB to entity A. Entity A performs the same calculation and generates a yA value and compares yA with yB. If yB=yA, Entity A authenticate entity B. In one aspect, a light HMAC scheme splits an input x into n blocks with key expansion.
Latest Apple Patents:
- TECHNOLOGIES FOR CONTROLLING DISCONTINUOUS RECEPTION OPERATION
- Auto-activating smart responses based on activities from remote devices
- 2-step RACH initiated by PDCCH order
- User interfaces for displaying content recommendations for a group of users
- Configurations for dynamic indication of soft resource availability
This application is a divisional of U.S. patent application Ser. No. 12/116,819, filed on May 7, 2008, which is incorporated by reference in its entirety, for all purposes, herein.
BACKGROUND OF THE INVENTION1. Field of the Invention
The present invention relates to authentication and more specifically relates to a system and method of providing authentication based on a weighted average principal.
2. Introduction
Protection of digital content transferred between entities over a network is a principal element of computer security. Computer security includes protection of digital content from theft or corruption and also addresses the preservation of system availability. Authentication plays an important role in computer security. Authentication is the process of verifying the digital identity of the sender of a communication. Once an entity has been authenticated, data transfer between the two entities may begin.
Authentication systems provide differing levels of functionality. At a minimum, they allow a recipient to verify that a message originated from a particular user, program or computer. More powerful systems can ensure that messages cannot be copied and replayed in the future, prove to a third party that a message originated with a particular user (non-repudiation), or require multiple users to validate a message.
Authentication is often used in conjunction with cryptography. Cryptography is the traditional method of protecting data. Cryptography protects communications between two mutually trusting parties from thievery or hackers by attack on the data in transit. Encryption is the process of obscuring information in a systematic way, using an algorithm. Decryption is process of removing the protection and retrieving the original data. Encryption and decryption use a key, which is the shared secret that both parties must have. To ensure data integrity, only the authorized parties should hold the secret key.
In many communication systems, the weakest link in security is not the encrypted data but rather cryptographic key management and handling. Unauthorized users may gain access to sensitive data when key management is not performed securely.
Many processes for authenticating an entity have been proposed. Typically, a sender sends a message and both the sender and receiver use the message and a shared secret key to generate a signature. If the signatures are the same, the entity is accepted as authentic in a symmetric encryption scheme. If an asymmetric scheme is used, the system verifies the signature is valid since only the originator of the signature should be able to create that signature.
A system can be compromised when patterns in the signature can be detected and used to surmise and exploit the authentication process. Attacking such encryption schemes requires the collection of a set of the input and the output. Typically, encryption schemes are used to authenticate by encrypting a value. If both the sender and receiver generate the same value, authentication is achieved. What is needed in the art, however, is an improved authentication process that is less susceptible to hacking.
SUMMARYAdditional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The features and advantages of the invention may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the present invention will become more fully apparent from the following description and appended claims, or may be learned by the practice of the invention as set forth herein.
Disclosed herein are systems, method and computer readable media related to authentication. In order to address the possible attacks on an encryption scheme by collecting a set of the input and output, an aspect of the present disclosure renders it more difficult to collect such input and output values since generating those values involves a more complicated process. In one exemplary embodiment enables an entity A to authenticate an entity B. The method includes, at entity A: selecting a value p, a range [a, b] and a granularity epsilon. The value p is preferably a power of 2 but may depend on other powers as well. Entity A sends p, the range [a, b] and the granularity epsilon to an entity B. At entity B, the method includes initializing yB=0 and for each x in a set {a, a+epsilon, . . . , b−epsilon, b}, performing the following steps: computing z=E(x)*x, wherein E(x) is an encryption scheme (the multiplication is carried out mod p), and updating yB=yB+z. In one embodiment, the E(x) is the proposed HMAC scheme disclosed herein. Entity B then transmits yB to entity A. Entity A then uses the same calculation to generate a yA value. The value yA is compared with the value yB and if they are determined to be equal, entity A accepts entity B as authentic.
In a variation on the method set forth above, entity B may not receive the granularity epsilon but may generate the value and then perform similar steps as set forth above using the locally generated granularity epsilon. The basis upon which entity B generates the granularity epsilon may vary. The granularity epsilon may be predetermined instead of generated.
The principle discussed above regarding sending or sharing a set {ai} may be extended using a polynomial principle. In the “polynomial principle” aspect of the disclosed scheme, P is the result calculated by both parties. Here, let P equal a sum ai*xi over i. The values of the set {xi} are sent from entity A to entity as above. The set of values {ai} is preferably defined a priori and communicated to each of entity A and entity B. The value P, the sum ai*xi over i (for each x in the set), may be transmitted from entity A or calculated locally at entity B. In this case, the value of P represents either yA or yB depending on what entity performed the calculation. Under this approach, no encryption may be performed in the authentication process.
We next return to the scenario where encryption is used. Entity A sends a set of values {xi} and the value p to entity B. Entity B computes a result based on the set {ai} and E(xi), wherein E(xi) represents an encryption scheme or a hash MAC scheme and multiplication is carried out mod p. A value yB is set to equal the calculated result and entity B transmits yB to entity A. Entity A performs the same computation to calculate a yA value which is compared with the generated yB to determine whether to accept entity B as authentic.
Because of the increased security gained by using the improved key management scheme above, a classical encryption scheme or a less secure encryption scheme may be used without a reduction in overall security. Another embodiment of this disclosure proposes a new “light” hash message authentication code (HMAC) scheme which can be viewed as a less secure approach that can be used in connection with the improved authentication process disclosed herein. The disclosed “light” HMAC scheme may also stand independent of the particular authentication scheme as a separate embodiment.
The HMAC is a type of message authentication code that is calculated using a specific algorithm involving a cryptographic hash function in combination with a secret key. For further background information on HMAC, see the publication of the specifications for The Keyed-Hash Message Authentication Code (HMAC), 2002 Mar. 6, Federal Information Processing Standards Publication 198, incorporated herein by reference. This embodiment provides an alternate approach in which an HMAC is created based on an encryption scheme. A component of the light HMAC scheme is the implementation of a function R as disclosed herein. In this aspect, the method includes splitting an input x into n number of xi blocks, initializing an input key RK[0]=k and initializing y=0. The method includes performing key expansion by, for i=1 to L, computing round keys as RK[i]=R(RK[i−1]). An updated y is generated as follows: for i=0 to (n−1), setting y=y XOR xi. For j=0 to L−1: computing y=R(y) and setting y=y XOR RK[j] and setting y=R(y). The computed value of y is output and used for in authentication.
Steps that may be involved in the key expansion process include performing a function gi that concatenates members of a first set of bits and XORs the concatenated members with a constant to generate a second set of bits, performing a function Gi that compresses the second set of bits from gi and generates a compressed output and XORing the compressed output with the first set of bits to generate a respective round key. Multiple iterative application of the function gi can be performed.
Other aspects of the disclosure as found herein also include a black box approach in which a particular embodiment involves processing as viewed by an entity A or an entity B separately.
In order to describe the manner in which the above-recited and other advantages and features of the invention can be obtained, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only exemplary embodiments of the invention and are not therefore to be considered to be limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings in which:
Various embodiments of the invention are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the invention.
With reference to
Although the exemplary environment described herein employs the hard disk, it should be appreciated by those skilled in the art that other types of computer readable media which can store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, digital versatile disks, cartridges, random access memories (RAMs), read only memory (ROM), a cable or wireless signal containing a bit stream and the like, may also be used in the exemplary operating environment.
To enable user interaction with the computing device 100, an input device 190 represents any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech and so forth. The device output 170 can also be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems enable a user to provide multiple types of input to communicate with the computing device 100. The communications interface 180 generally governs and manages the user input and system output. There is no restriction on the invention operating on any particular hardware arrangement and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.
For clarity of explanation, the illustrative system embodiment is presented as comprising individual functional blocks (including functional blocks labeled as a “processor”). The functions these blocks represent may be provided through the use of either shared or dedicated hardware, including, but not limited to, hardware capable of executing software. For example the functions of one or more processors presented in
Disclosed herein is an authentication function that is generally based on a weighted average principle. The disclosure herein may be used as a modification of a classical encryption scheme using something similar to a weighted area defined by a curve from any classical algorithm.
The present invention addresses the issue of a need for an improved authentication and key management approach. This disclosure addresses the possible attacks on an encryption scheme by collecting a set of the input and output. The proposed scheme renders it more difficult to collect such input and output values since generating these values involves a more complicated process. Rather than doing only one encryption, the present invention defines a scheme where entity A needs to authenticate B and where an iterative process is applied.
In this example, entity A performs several functions. In block 304, entity A selects a value p, which is preferably a power of 2 but may be other values as well, selects a range [a, b] and a granularity epsilon (402). The granularity epsilon is used to define at entity B what values in the range [a, b] will be used in its calculations. For example, if the range is [0, 10] and the granularity epsilon is 2, then the values used at entity B will be 0, 2, 4, 6, 8, 10. Entity A transmits p, the range [a, b] and the granularity epsilon to entity B (404). Next, entity B performs multiple encryptions. Here, as shown in block 308, entity B initializes yB as 0 (406) and for each x in the set {a, a+epsilon, . . . , b−epsilon, b} (408), entity B computes z=E(x)*x, wherein E(x) is an encryption scheme or an HMAC scheme and the multiplication is carried out mod p. In one aspect, E(x) is the “light” HMAC scheme disclosed herein. Entity B updates yB=yB+z (410). After iterating through each x in the set (412), entity B transmits yB from entity B to entity A (414). The value YB is stored in one or more locations and is used for authentication (416). In one aspect, the range and the granularity epsilon may be relatively small.
One mechanism by which yB may be used in authentication is wherein entity A calculates a yA value by initializing yA=0 and for each x in {a, a+epsilon, . . . , b−epsilon, b}, computing z=E(x)*x, wherein E(x) is an encryption scheme or a hashing mac scheme (the multiplication is carried out mod p), and updates yA=yA+z. After iteratively following through the process for each x in the set, a yA is generated that is then compared to the yB for authentication. This approach provides a more complex authentication process wherein rather than doing a single encryption calculation, multiple encryption calculations are performed to generate y value used for authentication. Ultimately, if yB=yA, entity B is accepted as authentic. Under the principles disclosed herein, the encryption scheme may be any encryption scheme such as the known AES, DES, or HMAC. Any other encryption scheme may be used in the authentication process.
In another aspect, the granularity epsilon can be selected by an equation or be used in connection with an equation. These equations can be used to render the selection of values x from the range [a, b] more complex or dynamic. Furthermore, entity B may select a granularity epsilon or implement an equation based on some other factor such as a coordinated time or some other physical value that may be retrieved independently from entity A and entity B. These variations could provide increased security in the authentication process.
Next, entity B initializes yB as 0 (426) and for each x in {a, a+epsilon, . . . , b−epsilon, b} (428). The value yB may be initialized to any other value as well besides zero. Entity B computes z=E(x)*x, wherein E(x) is an encryption scheme (the multiplication is carried out mod p), and updates yB=yB+z (430). The method then determines whether there is another x in the range [a, b] (432) and if so, proceeds to step (430) for processing another iteration in the loop. If the loop has processed each x in the range [a, b], then the method includes sending yB from entity B to entity A (434) and storing yB for use in authentication (436).
The method may also include comparing yB with a yA generated when entity A performs the same calculation disclosed above. If yB=yA, then the system accepts entity B as authentic. Also as noted above, p is preferably a power of 2 that may be some other value as well. Also as noted above, the encryption scheme used in step (430) may be one of AES, DES, HMAC, a hashing function, the “light” HMAC scheme below or some other known or hereinafter developed encryption scheme.
Another aspect related to
Entity A then generates a yA by performing the same computation used to generate yB. If yB equals yA, then entity A accepts entity B as authentic. As discussed above, any encryption or hashing function may be used in the authentication process. The computation of a result based on the set {ai} and E(xi) may include a sum of ai*xii*E(xi) over each value of i or a sum of ai*(xi*E(xi))i over i. An advantage of this approach is that it can protect the encryption scheme E since an attacker does not have the ability to choose the input. This is referred to as a chosen plaintext attack, and this approach renders it harder to break the scheme. Note that in the generalization approaches above related to the use of polynomials, the granularity is predetermined inasmuch as it depends on the number of coefficients. As an example, the solution to this embodiment is a0+a1*x1*E(x1)+a2*(x2*E(x2))2+ . . . . The disclosed approach can be used with any classical encryption scheme and can also be used with an HMAC function. Another advantage of the disclosure is that it possible to use a less secure encryption scheme, such as the “light” HMAC scheme disclosed below.
Because of the increased level of security provided in key management as set forth above, a simpler encryption scheme may be applied and maintain the same or better overall level of security. Accordingly, another embodiment of this disclosure discussed next relates to a version of the HMAC function which may be referred to as a “light” HMAC scheme because it is easy to implement and efficient. There are only two basic functions which can be implemented directly or using different approach such as digital signal processing.
First, a function gi is defined as follows:
gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
Here, “∥” denotes the concatenation operation. Each xi is preferably 2 bytes but may be represented by a different number of bits as well. Let Gi be defined as:
Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
When xi is 2 bytes, the input to gi is 32 bits in length and the output is 32 bits in length. The input to Gi is 64 bits in length and the output is 32 bits in length, thus providing a compression of the data. The values c, csti and cstii are constant values depending on i. These values are typically stored in a table. The light HMAC scheme disclosed herein is an iterative scheme. One internal round during the key expansion phase of the light HMAC scheme generates output data based on the input data for a particular x. The output is the concatenation x0∥x1∥x2∥x3∥x4∥x5∥x6∥x7, which in this example is 128 bits. Also, it is noted that the general principles of this scheme may be applicable to other organizations of input data. For example, the bit value of x, split into n number of xi blocks may also be processed wherein x is a greater or lesser number of bits and n is more or less than eight.
Another aspect of the disclosure relates to a method of authentication that is centric to a particular entity. This is shown in
Similarly, another embodiment of the disclosure relates to processing as viewed from entity B. This aspect is illustrated in
In any embodiment disclosed herein, variations may be made similar to those set forth above wherein particular processing occurs or is viewed from the standpoint of an entity A or an entity B, or a receiver and a sender. Therefore, other embodiments may be generated based on the disclosure herein along these lines.
for i=0 to (n−1):
-
- setting y=y XOR xi;
- for j=0 to L−1:
- computing y=R(y); and
- setting y=y XOR RK[j].
- for j=0 to L−1:
- setting y=y XOR xi;
Finally, y is set equal to R(y) (610). The y is output for use in authentication (612).
Therefore, as disclosed above, the process of performing key expansion generates a table of round keys for a predetermined number of rounds L. The key expansion function includes, for each key, performing a function gi that concatenates members of a first set of bits and XORs the concatenated members with a constant to generate a second set of bits. The function Gi compresses the second set of bits from gi to generate the compressed output. The compressed output is XORed with the first set of bits to generate a respective round key. The iterative value of y is updated by using the table of round keys in an iterative application of an encryption scheme such as HMAC. Of course, the value y is used for authentication. This approach may then be practiced on different entities to generate the different values y for the different entities. These values can then be compared for authentication purposes as discussed above.
Embodiments within the scope of the present invention may also include computer-readable media for carrying or having computer-executable instructions or data structures stored thereon. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store desired program code means in the form of computer-executable instructions or data structures. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or combination thereof) to a computer, the computer properly views the connection as a computer-readable medium. A “tangible” computer-readable medium expressly excludes software per se (not stored on a tangible medium) and a wireless, air interface. Thus, any such connection is properly termed a computer-readable medium. Combinations of the above should also be included within the scope of the computer-readable media.
Computer-executable instructions include, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Computer-executable instructions also include program modules that are executed by computers in stand-alone or network environments. Generally, program modules include routines, programs, objects, components, and data structures, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of the program code means for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps. Program modules may also comprise any tangible computer-readable medium in connection with the various hardware computer components disclosed herein, when operating to perform a particular function based on the instructions of the program contained in the medium.
Those of skill in the art will appreciate that other embodiments of the invention may be practiced in network computing environments with many types of computer system configurations, including personal computers, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, and the like. Embodiments may also be practiced in distributed computing environments where tasks are performed by local and remote processing devices that are linked (either by hardwired links, wireless links, or by a combination thereof) through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
Although the above description may contain specific details, they should not be construed as limiting the claims in any way. Other configurations of the described embodiments of the invention are part of the scope of this invention. Accordingly, the appended claims and their legal equivalents should only define the invention, rather than any specific examples given.
Claims
1. A method comprising:
- splitting an input x into n number of xi blocks;
- initializing an input key RK[0]=k;
- initializing y=0;
- performing key expansion by, for each p in {1... L−1}, computing round keys as RK[p]=R(RK[p−1]);
- generating an updated y as follows: for each i in {0... (n−1)}: setting y=y XOR xi; for each j in {0... L−1}: computing y=R(y); and setting y=y XOR RK[j]; setting y=R(y); and outputting y for use in authentication.
2. The method of claim 1, wherein performing key expansion further comprises, for each round key:
- performing a function gi that performs steps comprising: receiving a first set of bits and outputs a second set of bits; and processing the first set of bits by concatenating members of the first set and XORing the concatenation with a constant, and (3) generates an output from gi;
- performing a function Gi that performs steps comprising: compressing the output from gi; and generating compressed output from Gi; and
- exclusive or'ing the compressed output from Gi with the first set of bits to generate a respective round key.
3. The method of claim 2, wherein gi comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
4. The method of claim 3, wherein Gi comprises:
- Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
5. The method of claim 4, wherein csti and cstii are constant values depending on i, and wherein each xi comprises 2 bytes of data.
6. A method comprising:
- initializing an input key RK[0]=k;
- initializing y=0;
- performing key expansion by generating a table of round keys for a pre-determined number of rounds L, wherein the key expansion function comprises, for each round key: performing a function gi that concatenates members of a first set of bits and XORs the concatenated members with a constant to generate a second set of bits; performing a function Gi that compresses the second set of bits from gi and generates compressed output; and exclusive or'ing the compressed output with the first set of bits to generate a respective round key;
- generating an updated y by using the table of round keys in an iterative application of an encryption scheme; and
- storing y for use in authentication.
7. The method of claim 6, wherein multiple iterations of the function gi occur with each round.
8. The method of claim 6, wherein gi comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
9. The method of claim 8, wherein Gi comprises:
- Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
10. A system comprising:
- a processor;
- a memory storing instructions for controlling the processor to perform steps comprising: receiving an input x that comprises a set of xi blocks; performing key expansion by, for i=1 to L−1, computing round keys as RK[i]=R(RK[i−1]), wherein RK[0] is an input key having a value k; generating an updated y as follows: for i=0 to (n−1): setting y=y XOR xi wherein y has an initial value of 0; for j=0 to L−1: computing y=R(y); and setting y=y XOR RK[j]; setting y=R(y); and outputting y for use in authentication.
11. The system of claim 10, wherein performing key expansion further comprises, for each round key:
- performing a function gi that (1) receives a first set of bits and outputs a second set of bits, (2) processes the first set of bits by concatenating members of the first set and XORing the concatenation with a constant, and (3) generates an output from gi;
- performing a function Gi that compresses the output from gi and generates compressed output from Gi; and
- XORing the compressed output from Gi with the first set of bits to generate a respective round key.
12. The system of claim 11, wherein gi comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
13. The system of claim 12, wherein Gi comprises:
- Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
14. The system of claim 13, wherein csti and cstii are constant values depending on i, and wherein each xi comprises 2 bytes of data.
15. A system comprising:
- a processor;
- a memory storing instructions for controlling the processor to perform steps comprising: performing key expansion on an input key by generating a table of round keys for a pre-determined number of rounds L, wherein the key expansion function comprises, for each round key: performing a function gi that concatenates members of a first set of bits and exclusive or's the members with a constant to generate a second set of bits; performing a function Gi that compresses the second set of bits from gi to yield compressed output; and exclusive or'ing the compressed output with the first set of bits to generate a respective round key; generating an updated output value by using the table of round keys in an iterative application of an encryption scheme; and storing the updated output value in an authentication database.
16. The system of claim 15, wherein multiple iterations of the function gi occur with each round.
17. The system of claim 15, wherein gi comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
18. The system of claim 17, wherein Gi comprises:
- Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
19. A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform steps comprising:
- receiving an input x having xi blocks;
- performing key expansion by computing, for i=1 to L−1, iteration keys as RK[i]=R(RK[i−1]), wherein RK[0] is an input key having a value k;
- generating an updated y as follows: for i=0 to (n−1): setting y=y XOR xi, wherein y has an initial value of 0; for j=0 to L−1: computing y=R(y); and setting y=y XOR RK[j]; setting y=R(y); and
- storing y in an authentication database.
20. The non-transitory computer-readable storage medium of claim 19, wherein performing key expansion further comprises, for each iteration key:
- performing a function gi that (1) receives a first set of bits and outputs a second set of bits, (2) processes the first set of bits by concatenating members of the first set and XORing the concatenation with a constant, and (3) generates an output from gi;
- performing a function Gi that compresses the output from gi and generates compressed output from Gi; and
- XORing the compressed output from Gi with the first set of bits to generate a respective iteration key.
21. The non-transitory computer-readable storage medium of claim 20, wherein gi comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
22. The non-transitory computer-readable storage medium of claim 21, wherein Gi comprises:
- Gi(x0,x1,x2,x3,c)=[(((x0∥x1+c)2XOR cstii XOR(((x0∥x1+c)2>>32))+(((x2∥x3)+c)2XOR cstii XOR((x2∥x3)+c)2>>32))] mod 232.
23. A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform steps comprising:
- performing key expansion on an input key by generating a table of iteration keys for L iterations, wherein the key expansion comprises, for each iteration key: concatenating a first set of bits and exclusive or'ing the first set of bits with a constant to generate a second set of bits; compressing the second set of bits to yield compressed bits; and exclusive or'ing the compressed bits with the first set of bits to generate a respective iteration key;
- generating an updated output value by iteratively applying the table of iteration keys in an encryption scheme; and
- storing the updated output value in an authentication database.
24. The non-transitory computer-readable storage medium of claim 23, wherein multiple iterations of concatenating the first set of bits occur with each iteration.
25. The non-transitory computer-readable storage medium of claim 24, wherein exclusive or'ing the first set of bits comprises:
- gi(x0,x1,c)=(((x0∥x1+c)2XOR csti XOR(((x0∥x1+c)>>16)2)mod 232.
Type: Application
Filed: Sep 1, 2011
Publication Date: Dec 29, 2011
Applicant: Apple Inc. (Cupertino, CA)
Inventors: Mathieu Ciet (Paris), Augustin Farrugia (Cupertino, CA), Jean-Francois Riendeau (Santa Clara, CA), Nicholas T. Sullivan (Sunnyvale, CA)
Application Number: 13/224,163