Abstract: Described is a communications system in which messages may be processed using public key cryptography with a private key (SKu) unique to one or more users (150). The system comprises a server means (130) adapted for data communication with a client (110) via a network (100), the server means (130) comprising first data storage means in which is stored in a secure manner a private key for the or each user, the private key being encrypted with a key encrypting key. The server means further comprises second data storage means in which is stored applet code executable on the client. The server provides the applet code to the client via the network in response to connection of the client to the server via the network.

Abstract: Clients within a computing environment may establish a secure communication session. Sometimes, a client may trust another client to read, but not modify, a message. Clients may utilize a cryptography service to generate a message protected against improper modification. Clients may utilize a cryptography service to verify whether a protected message has been improperly modified.

Abstract: Clients within a computing environment may establish a secure communication session. Sometimes, a client may trust another client to read, but not modify, a message. Clients may utilize a cryptography service to generate a message protected against improper modification. Clients may utilize a cryptography service to verify whether a protected message has been improperly modified.

Abstract: The invention relates to a method for secure and compact exponentiation. The inventive method can be applied in the field of cryptology where cryptographic algorithms are used in electronic devices such as chip cards.

Abstract: Methods are disclosed for improving public key cryptography schemes, such as RSA and its variants, to allow for decryption of messages using less than all of the prime factors of the modulus that is used for encryption of said messages.

Abstract: Provided is an architecture (hardware implementation) for an authentication engine to increase the speed at which SHA1 multi-loop and/or multi-round authentication algorithms may be performed on data packets transmitted over a computer network. As described in this application, the invention has particular application to the variant of the SHA1 authentication algorithms specified by the IPSec cryptography standard. In accordance with the IPSec standard, the invention may be used in conjunction with data encryption/encryption architecture and protocols. However it is also suitable for use in conjunction with other non-IPSec cryptography algorithms, and for applications in which encryption/decryption is not conducted (in IPSec or not) and where it is purely authentication that is accelerated. Among other advantages, an authentication engine in accordance with the present invention provides improved performance with regard to the processing of short data packets.

Abstract: A value corresponding to an input for a cryptographic operation may be received. The value may blinded by multiplying the value based on an exponentiation of a random number raised to an exponent value that is associated with a public key. A cryptographic operation may be performed based on the blinded value.

Abstract: Systems and methods are described for trapdoor pairing. In one implementation, a trapdoor pairing is a cryptographic primitive generated by determining a bilinear pairing between an elliptic curve group and another group and selecting a parameter of the bilinear pairing, such as a group order or an isogeny between curves, to be a key for generating and evaluating the bilinear pairing. Trapdoor pairing allows construction of a group in which the Decisional Diffie-Hellman (DDH) problem is computationally infeasible given only the description of the group, but is easy given the secret key. Exemplary trapdoor pairing constructions have general applicability to cryptography and also lend themselves more specifically to certain special practical implementations, such as public key cryptography and certificate authority infrastructures.

Abstract: Modulus scaling applied a reduction techniques decreases time to perform modular arithmetic operations by avoiding shifting and multiplication operations. Modulus scaling may be applied to both integer and binary fields and the scaling multiplier factor is chosen based on a selected reduction technique for the modular arithmetic operation.

Abstract: Time to perform scalar point multiplication used for ECC is reduced by minimizing the number of shifting operations. These operations are minimized by applying modulus scaling by performing selective comparisons of points at intermediate computations based on primality of the order of an ECC group.

Abstract: This invention relates to a variant of the El-Gamal public key encryption scheme, which is provably secure against an adaptively chosen ciphertext adversary using standard public-key cryptography assumptions i.e. not the random oracle model. This new scheme has roughly half the computational overhead and similar communication overhead as the scheme by Cramer-Shoup.

Abstract: A system may transmit, to a first entity, data to indicate an association between the first entity and a public key, wherein the public key is to be used to establish a cryptographically protected communications session between the first entity and a second entity, receive the data in response to a request to verify the association, and transmit, to the second entity, an indication that the data is valid. The system may be a cryptography service that is partially by the first and second entities. A partially trusted system can a computer system that is trusted in some respects but not trusted in other respects. A partially trusted cryptography service may be trusted to generate digital signatures and verify authenticity of digital signatures, but not trusted with access to a cryptographic key that can be used to access a cryptographically protected communications between a first entity and a second entity.

Abstract: A system may transmit, to a first entity, data to indicate an association between the first entity and a public key, wherein the public key is to be used to establish a cryptographically protected communications session between the first entity and a second entity, receive the data in response to a request to verify the association, and transmit, to the second entity, an indication that the data is valid. The system may be a cryptography service that is partially by the first and second entities. A partially trusted system can a computer system that is trusted in some respects but not trusted in other respects. A partially trusted cryptography service may be trusted to generate digital signatures and verify authenticity of digital signatures, but not trusted with access to a cryptographic key that can be used to access a cryptographically protected communications between a first entity and a second entity.

Abstract: Apparatus and methods for performing quantum computations are disclosed. Such quantum computational systems may include quantum computers, quantum cryptography systems, quantum information processing systems, quantum storage media, and special purpose quantum simulators.

Abstract: A computer processing system and method for reducing memory footprint that includes initiating, through at least one computer processor, a cryptography session utilizing an i-degree isogeny arithmetic computation having chained computations therein. The cryptography session includes implementing a first iteration cycle, of a plurality of iteration cycles, and a implementing a remaining amount of the plurality of iteration cycles, each of the plurality iteration cycles computing isogenies using a compressed Z value to complete the -degree isogeny arithmetic computation. The first iteration cycle includes individually computing a plurality of sequentially occurring pivot points within the chained computations, implementing a Co—Z algorithm within the plurality of sequentially occurring pivot points to compute and store the compressed Z value on one of the plurality of temporary registers and computing a first isogeny of the -degree isogeny arithmetic computations using the compressed Z value.

Abstract: Provided is an architecture (hardware implementation) for an authentication engine to increase the speed at which SHA1 multi-loop and/or multi-round authentication algorithms may be performed on data packets transmitted over a computer network. As described in this application, the invention has particular application to the variant of the SHA1 authentication algorithms specified by the IPSec cryptography standard. In accordance with the IPSec standard, the invention may be used in conjunction with data encryption/encryption architecture and protocols. However it is also suitable for use in conjunction with other non-IPSec cryptography algorithms, and for applications in which encryption/decryption is not conducted (in IPSec or not) and where it is purely authentication that is accelerated. Among other advantages, an authentication engine in accordance with the present invention provides improved performance with regard to the processing of short data packets.

Abstract: Methods and apparatus reduce the computational load for computing r=x mod n, given two numbers x and n, where x is 2t bits long and n is t bits long. Such reduced computational loading in modular reduction schemes is useful for, at least, network communication systems that include modular reduction in cryptography, particularly, public key encryption algorithms such as RSA, El Gamal, Rabin, and Diffie-Hellman.

Abstract: A key generation system is implemented as follows. In an enrolment apparatus, a unique number for use with PIN operated machines or public key cryptography systems is generated by manipulation of fingerprint information of a subscriber. A filter is then generated which is a function both of the Fourier transform of the subscriber's fingerprint(s) and of the unique number. This filter is stored on a subscriber card. When the subscriber wishes to generate his key, he inputs his card to a card reader of an apparatus and places his finger(s) on a fingerprint input. The apparatus generates an optical Fourier transform from the fingerprint input. The Fourier transform signal is incident on to a spatial light modulator programmed with the filter information from the card. An inverse transform is generated from the filtered signal and this is used to regenerate the key that will be used as the PIN in a PIN operated device, or as the private key cryptography system.

Abstract: A password element is generated for a station running an Elliptic Curve Cryptography (ECC) or a Finite Field Cryptography (FFC) group based password authenticated protocol. A password element is multiplied by a cofactor to generate a modified password element for the ECC group. The station verifies that the modified password element is not equal to a point at infinity for the ECC group. A password element is generated by exponentiating a password value to a power t, where t=(p?1)/r, p and r are primes, and r has a bit length of at least 160 bits for the FFC group. A commit-element parameter is generated using a temporary secret value and the ECC modified password element or the FFC password element, and is then transmitted to another station in a commit message. The receiving station checks if the received commit-element parameter has desired properties before continuing with the protocol.