Method and apparatus for enabling user equipment to utilize secret

Abstract

A user device (210) may use a secret in cryptographic authentication of cryptographically protected communications and / or data. The communication portion (211) is configured to forward a secret received from a trusted external source (100) to the key generator (215). The key generator (215) is configured to generate one or more keys using the secret as a cryptographic seed, and to store the one or more keys in a key memory (216). The communication encryptor and decryptor portion (212) is configured to retrieve the one or more keys from the key memory (216) and cryptographically protect communications performed through the communication portion (211) using the one or more keys.

Description

Technical Field

[0001] The present invention generally relates to the field of security techniques required for using digital services in communications between digital devices. Specifically, the present invention relates to the task of establishing secrets within user devices for such communications, without relying on inherent features of the user devices. Examples of such secrets include, but are not limited to, users' encryption and signing keys. Background Art

[0002] Security in digital communications involves several aspects, such as confidentiality (only authorized parties can access a piece of information), authentication (communicating parties must be certain who they are communicating with), integrity (a piece of information has not been modified without permission), and non-repudiation (a party cannot successfully deny having sent a piece of information). All of these security aspects must ultimately be reflected in a secret piece of digital information (often simply called a secret). To provide sufficient security against cracking attempts, the secret must be randomly derived.

[0003] Digital devices operate deterministically according to the laws of nature, making it challenging for them to generate any kind of true randomness. For verifiable information confidentiality and protection, it's important to know and verify how and where the randomness in question is generated. In theory, the randomness may appear correct and even be testable using various randomness testing methods. However, if the randomness is deterministically generated based on a computational or logical function whose variables can be manipulated or predicted in some way, a malicious party could potentially corrupt the randomness through modeling or brute force. To this end, various methods based on true randomness have been developed in place of pseudorandomness. Examples of such methods involve gleaning randomness from data streams external to the computing unit, such as naturally occurring noise that is difficult to predict.

[0004] The widely used PKI (Public Key Infrastructure) technology is a good example of how secrets can be used for secure digital communications. A communicating device can randomly generate a secret key and use a mathematical algorithm to derive a corresponding public key. This public key can be freely distributed and used to encrypt communications sent to the device in question. Since the device in question is the only one that knows the secret key, no one else can decrypt such encrypted communications. A device can also use its secret key to digitally sign outgoing transmissions, allowing others to verify the correct originator by successfully using the corresponding public key. In this case, a necessary prerequisite for trust is that sufficient randomness is initially involved in the generation of the secret key so that a malicious party cannot guess the secret key using publicly available information.

[0005] Examples of algorithms involved in the generation and use of secret and public keys are, for example, RSA (Rivest-Shamir-Adleman), DSA (Digital Signature Algorithm) and ECC (Elliptic Curve Cryptography). As an example, if the last-mentioned algorithm is used, the secret key is called URT SK , and the public key is called URT PK , and the public key can be derived from the secret key using an algorithm called Curve25519.

[0006] As an example use case, consider digital communication between parties A and B, where A is a centrally operated digital service and B is an individual user. Party A's device may have been assembled and programmed by A themselves, and verified for secure operation by a trusted neutral entity, C. Therefore, the device's ability to randomly generate secrets for Party A to use in communications can be trusted. Party B, on the other hand, uses a common user device, such as a smartphone or laptop. Such a device may or may not include inherent features, such as circuitry specifically designed and programmed to generate secrets. The user device may have been designed, manufactured, and programmed in Country X, and if present, the circuitry may originate from Country Y. The ability of Party B's user device to generate secrets of sufficient randomness for Party B to use in communications depends on many factors, few or none of which can be verified or truly relied upon by either Party A or Party B. Even if manufacturers ensure that their products meet certain standards regarding randomness, industrial, commercial, and even governmental actors may have both the motivation and the means to implant backdoors in algorithms and hardware solutions that appear to have proven confidentiality.

[0007] Prior art document US2018 / 0026950A1 describes a client application that uses an application-layer cryptographic key to cryptographically protect application data.

[0008] Another prior art document US 2022 / 0070666 A1 describes a method for secure communication between a medical sensor and a computing device.

[0009] Another prior art document, US Pat. No. 10,963,593 B1, describes a technique for enhancing information security in an environment utilizing a key management system and other cryptographic service providers. Summary of the Invention

[0010] This summary is provided to introduce some concepts in a simplified form that will be further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0011] The object is to provide methods and apparatus for ensuring secure digital communications between parties without having to rely on randomness from unknown sources.

[0012] According to a first aspect, a device is provided for enabling a user device to utilize secrets in cryptographic authentication of cryptographically protected communications and / or data. The device includes a communication portion, a communication encryptor and decryptor portion, a key generator, and a key memory. The communication portion is configured to forward a secret received from a trusted external source to the key generator. The key generator is configured to use the secret as a cryptographic seed to generate one or more keys and store the one or more keys in the key memory. The communication encryptor and decryptor portion is configured to verify a digital signature received in association with the secret using the public key of the supposed sender of the secret before the secret is forwarded to the key generator, so as to cryptographically verify the invariance and integrity of the received secret. The communication encryptor and decryptor portion is configured to retrieve the one or more keys from the key memory and use the one or more keys to cryptographically protect communications performed by the communication portion.

[0013] According to an embodiment, the communication part is configured to establish a secure digital communication channel with a peer and thereafter receive the secret via the secure digital communication channel, thereby making the peer appear as the trusted external source. This involves at least the following advantages: one can rely on the trusted high entropy properties of the secret generated in the peer's environment and still achieve sufficient digital security in the device.

[0014] According to an embodiment, the communication part is configured to use the Transport Layer Security (also known as TLS) standard to establish the secure digital communication channel. This at least involves the advantage that standardized and well-known methods can be used without having to make very specific requirements on the devices and software involved.

[0015] According to one embodiment, the communication section is configured to receive the secret key via a different channel than the channel used for the cryptographically protected communication performed by the communication section when the communication encryptor and decryptor section has retrieved the one or more secret keys from the key memory. This has at least the following advantages: when receiving secrets, potential security risks involved in the channel used for the cryptographically protected communication can be avoided.

[0016] According to an embodiment, the communication section is configured to use at least one of the following as the different channel: optical fiber communication, near-field wireless communication, and communication via a manually operated user interface. This has at least the following advantages: sufficient distinction from other channels can be achieved, thereby correspondingly improving security.

[0017] According to an embodiment, the communication encryptor and decryptor are configured to perform the cryptographic verification by comparing a public key received in association with the secret with a separately obtained public key of the supposed sender of the secret. This involves at least the advantage that the reliability of the verification can be assessed based on knowledge of certain known methods.

[0018] According to an embodiment, the key generator is configured to generate the one or more keys by performing at least one of the following: using the secret as a seed for a key generation algorithm; and using the secret and information received from a user of the device as input information for the key generation algorithm. This has at least the following advantages: even if the confidentiality of the secret is compromised, there is still a further barrier to compromising the security of any use of the results of the key generation algorithm.

[0019] According to an embodiment, the device is configured to permanently discard at least one of the one or more keys generated by the key generator after immediate use. This involves at least the following advantage: unintended intermediate access to data stored by the device by an unauthorized party will not reveal the discarded key, because the key will be regenerated each time, used only for immediate use, and then discarded again.

[0020] According to a second aspect, a method is provided for enabling a user device to utilize a secret in at least one of: cryptographic protection of communications; cryptographic authentication of data. The method comprises receiving a secret by the user device from a trusted external source; cryptographically verifying the immutability and integrity of the received secret, wherein the cryptographic verification involves verifying a digital signature received in association with the secret using a public key of the supposed sender of the secret; and, following the cryptographic verification, using the secret as a cryptographic seed to generate one or more keys. The method comprises storing the one or more keys for later use, and retrieving and using the one or more keys to cryptographically protect communications performed by the user device.

[0021] According to one embodiment, the method comprises establishing a secure digital communication channel with a peer and then receiving the secret via the secure digital communication channel, thereby making the peer appear as the trusted external source. This involves at least the following advantages: one can rely on the trusted high entropy properties of the secret generated in the peer's environment and still achieve sufficient digital security in the device.

[0022] According to an embodiment, establishing the secure digital communication channel includes at least one of the following: establishing the secure digital communication channel using the Transport Layer Security (also known as TLS) standard; using optical fiber communication as the secure digital communication channel; using near-field wireless communication as the secure digital communication channel; and using communication via a manually operated user interface as the secure digital communication channel. This has at least the following advantages: standardized and well-known methods can be used without placing very specific requirements on the devices and software involved.

[0023] According to an embodiment, the cryptographic verification involves comparing a public key received in association with the secret with a separately obtained public key of the supposed sender of the secret. This involves at least the advantage that the reliability of the verification can be assessed based on knowledge of certain known methods.

[0024] According to an embodiment, the generation of the one or more keys comprises at least one of: using the secret as a seed for a key generation algorithm; and using the secret and information received from a user of the device as input information for the key generation algorithm. This has at least the advantage that even if the confidentiality of the secret is compromised, there is still a further barrier to compromising the security of any use of the results of the key generation algorithm.

[0025] According to an embodiment, the method comprises permanently discarding at least one of the one or more keys generated after its immediate use. This involves at least the following advantages: unintended intermediate access by an unauthorized party to data stored by the device will not reveal the discarded key, since the key will be regenerated each time, used only for immediate use, and then discarded again

[0026] According to a third aspect, there is provided a computer program product comprising one or more sets of one or more machine-readable instructions which, when executed by one or more processors, cause a method of the above type to be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In the attached figure:

[0028] Figure 1 shows parts of two communication devices,

[0029] Figure 2 shows parts of two communication devices,

[0030] Figure 3 shows the communication between two devices,

[0031] Figure 4 shows the actions performed by the trusted central device,

[0032] Figure 5 shows actions performed by a user device,

[0033] Figure 6 shows an example of the content in the message,

[0034] Figure 7 The diagram shows an example of generating a key.

[0035] Figure 8 shows an example of generating a key, and

[0036] Figure 9 An example of generating a key is shown. DETAILED DESCRIPTION

[0037] In the following description, reference is made to the accompanying drawings, which form a part of this disclosure and in which are shown by way of illustration specific aspects in which the present disclosure may be placed. It should be understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of this disclosure. Therefore, the following detailed description should not be taken in a limiting sense, as the scope of the present disclosure is defined by the appended claims.

[0038] For example, it should be understood that the disclosure in conjunction with a described method may also apply to a corresponding device or system for performing the method, and vice versa. For example, if specific method steps are described, the corresponding device may include units for performing the described method steps, even if such units are not explicitly described or shown in the accompanying drawings. On the other hand, for example, if a specific device is described based on functional units, the corresponding method may include steps for performing the described functions, even if such steps are not explicitly described or shown in the accompanying drawings. In addition, it should be understood that unless otherwise specifically noted, the features of the various example aspects described herein may be combined with each other.

[0039] The following description uses the terms "trusted central device" and "user device." The former refers to a computer device or an arrangement of interconnected computer devices that together form a trusted computing environment. This means that the configuration and operation of the trusted central device are known and verifiable by a party deemed trustworthy by the relevant parties. Examples of trusted central devices include, but are not limited to, computer systems at banks or government agencies. Other terms that may be used instead of or in addition to "trusted central device" include at least "trusted environment," "trusted server," and "wallet provider."

[0040] A user device is not necessarily a single device and / or is not necessarily used by a single human user, although the most illustrative examples of user devices herein are a user's smartphone, tablet computer, or laptop computer. Generally, a user device is a device or a group of interconnected devices that are used to engage in secure, cryptographically protected digital communications with one or more trusted central devices. While it can be assumed that the user device uses installed and / or downloadable applications of known types for such digital communications (and for services that rely on such digital communications), the construction and operation of the user devices referred to herein are not known and verifiable in a manner similar to the construction and operation of the trusted central devices.

[0041] 1 , a trusted central device 100 includes a communication transceiver 101, a cryptographic engine designated as an encryptor and decryptor portion 102, and higher layers of communication 103. Higher layers of communication 103 are an overall designation of all such services, applications, and protocol layers that can utilize the capabilities of the trusted central device 100 to communicate with other devices and apparatuses.

[0042] Trusted central device 100 is capable of generating all cryptographic products and cryptographic elements required for cryptographically protected communications. It includes a source of randomness, represented in FIG1 as random generator 104. To generate true randomness, it can use seed information such as ambient noise. In a trusted server environment, the generation of true randomness is often associated with the concept of an HSM (Hardware Security Module). For example, this can be a specially manufactured circuit board or device in a computer room used by the trusted central device. The output from random generator 104 is a random bit string that can be used by key generator 105 to generate one or more keys. The generated keys are stored in key storage 106, from which the encryptor and decryptor portion 102 can retrieve them as needed to perform encryption, decryption, digital signatures, and other cryptographic operations required for cryptographically protected communications.

[0043] In FIG1 , the user device 110 essentially comprises only the counterparts of all the corresponding parts of the trusted central apparatus: a communication transceiver 111, an encryptor and decryptor part 112, a higher layer of communication 113, a random generator 114, a key generator 115, and a key memory 116. These components are coupled to one another and are arranged to act only on a smaller scale, like the corresponding parts of the trusted central apparatus 100, since the number of parties with which the user device 110 will need to engage in cryptographically protected communications is typically much smaller than the number of trusted central apparatuses 100.

[0044] The arrangement of Figure 1 addresses the shortcomings discussed above in the description of the prior art. It is unknown whether the random number generator 114 in the user device can generate a sufficiently random bit string. More importantly, it is unknown whether the secret generated in the user device is trustworthy due to the potential for hidden backdoors in both software and hardware. If such hidden backdoors exist, they could be triggered when the user device generates random numbers, thereby compromising the credibility of any operation in which the generated random numbers are used. This is not uncommon.

[0045] exist Figure 2 In FIG. 1 , the trusted central device 100 has all of the same components as in FIG. 1 , although some of them may have been programmed to perform additional actions, as will be described in more detail below. User device 210 includes a communication portion 211, a communication encryptor and decryptor portion 212, a key generator 215, and a key storage 216. The higher layers of communication within user device 210 are represented by block 213. Based on the practices adopted above, block 213 is a general designation of all such services, applications, and protocol layers that may utilize the ability of user device 210 to communicate with other devices and apparatuses.

[0046] It is worth noting that for the purposes discussed herein, the user device 210 need not contain its own random generator. This is not excluded, as the user device may utilize more or less random inputs for many other purposes. The communication portion 211 is configured to forward secrets received from a trusted external source to the key generator 215. Figure 2 In the exemplary embodiment shown, this forwarding occurs through the communications encryptor and decryptor portion 212 and through some of the higher layers of the communications in block 213, for reasons that will become apparent in the more detailed description below. A key generator 215 is then configured to use this forwarded secret as a cryptographic seed to generate one or more keys and store them in a key memory 216. The communications encryptor and decryptor portion 212 is configured to retrieve the one or more keys from the key memory 216 and use the one or more keys to cryptographically protect communications performed by the communications portion 211.

[0047] The keys referred to herein may be, for example, encryption and / or signature keys of a user, used in a PKI framework. Additionally or alternatively, the same principles may be used to generate and use other types of keys, such as keys of the type used to establish a secure communication channel whose security does not rely on manufacturer-specific features of the user's device, and / or keys of the type used for cryptographic authentication of data.

[0048] It is not (necessarily) necessary for the user device to include a random generator that relies on the principle of providing the user device 210 with a secret (ie random information) from the trusted central apparatus 100 . Figure 3 An example communication sequence utilizing this principle is shown in . Figure 3 The party marked as A on the left side represents the trusted central device, and the party marked as B on the right side represents the user equipment.

[0049] Steps 301 and 302 are preparatory steps that a trusted central device may take in order to Figure 3 The remaining actions shown are prepared; they may have been executed very early, and they are related to Figure 3 The other steps shown in have only a weak conceptual connection. In step 301, the trusted central arrangement generates a random seed, and in step 302, the trusted central arrangement uses the generated random seed to generate one or more keys for cryptographically protecting communications to be performed with the user device.

[0050] In step 303, the communication portion in user device B establishes a secure digital communication channel with a peer in trusted central arrangement A. The concept of peer is used here to emphasize that, while in at least some embodiments, a trusted central arrangement may refer to a large apparatus comprised of interconnected computer devices that together form a trusted computing environment, only a limited portion of such an apparatus may be involved in communications with a single user device at a given time.

[0051] The manner and mechanism used to establish the secure digital communication channel in step 303 is not very important. As an example, the communication components in the user device and its peer can be configured to use the Transport Layer Security or TSL standard to establish the secure digital communication channel. As another example, an algorithm based on quantum-safe cryptography (QSC) can be used. The concept is under development at the time of this writing and may alternatively be referred to as post-quantum cryptography (PQC) or quantum-resistant cryptography (QRC). As another example, step 303 may involve bringing the user device close enough to the wireless communication device or connecting it to a cable (e.g., a shielded cable or fiber optic cable) to exchange information over a short distance in a situation deemed sufficiently secure (e.g., under the supervision of an authorized official). As yet another example, step 303 may involve using an optical fiber as a quantum channel to establish an electrically controlled polarization system for encoding and decoding secrets using a two-photon source. This fiber optic communication principle is used for quantum key transmission (QKD), so it can also be used to transmit secret seeds or salt values from a trusted computing environment, which is suitable as a secure digital communication channel because it cannot be broken by conventional methods.

[0052] In the event that the secure digital communication channel established in step 303 involves a secure TLS connection, it is advantageous to use a communication protocol that is capable of authenticating the parties. For example, when using the HTTPS protocol, the user device should at least use the Basic Auth method to log in to the trusted central device. If trust has previously been established between the parties regarding the token information required for login, the more advanced OAuth2.x method is more preferred. In conjunction with TLS, certificates can also be used for authentication between the parties, in which case the user device does not need to log in in the manner described above. In this case, the trusted central device authenticates the user device using a certificate electronically signed by the trusted central device itself or by another trusted entity. These alternatives can generally be described such that the communication portion in the user device is configured to establish a secure digital communication channel with the peer. The communication portion is also configured to thereafter receive a secret via the secure digital communication channel.

[0053] In optional step 304, the user device requests a random seed from the trusted central apparatus. This step is optional because in some cases the communicating entity may have been programmed not to require a request from the user device; the trusted central apparatus may proactively start transmitting secrets to the user device.

[0054] At step 305, the trusted central device generates a secret for later use by the user device. Figure 3 In the example, the secret is called a random seed. To generate the secret in step 305, the trusted central device uses its authentication capabilities so that the generated secret meets the criteria of true randomness. It must be noted that Figure 3 The order of the method steps shown in is not mandatory: for example, the trusted central device could actually have generated the secret in question long ago.

[0055] At step 306, the user device receives the secret from the trusted central apparatus. As already mentioned above, the communication portion of the user device can be configured to receive the secret via the same channel that it will later use for cryptographically protected communication (the secret will then be used to cryptographically protect the communication). Alternatively, the communication portion can be configured to receive the secret via a channel different from the channel used for the cryptographically protected communication later performed by the communication portion. Examples of such different channels include, but are not limited to, near-field wireless communication and communication via a manually operated user interface (such as a keypad or touch-sensitive display).

[0056] At step 308, a key generator in the user device uses the received secret as a cryptographic seed to generate one or more keys. Preferably, this or these keys are keys of a PKI framework. At least one of the generated one or more keys can be stored in a key memory of the user device. However, according to an advantageous embodiment, the user's key memory is not used to store any secret keys of the user, but rather to perform the action of generating such a secret key again whenever a secret key is needed. Figure 3 As shown in optional step 307 in , a PIN code or corresponding personal non-stored information may be received from the user before the key is generated in step 308. An example of how the received secret may be used as a cryptographic seed to generate a key (possibly together with a PIN code, etc.) is described in more detail later in this document.

[0057] Since the generated keys can be used for communication, it can be further assumed that the communication encryptor and decryptor portion of the user device is configured to retrieve one or more of said keys from said key storage (or directly from the key generation step) and to use said one or more keys to cryptographically protect communications performed by the communication portion of the user device. As part of such communications, Figure 3 3. The user device may, for example, request the trusted central device to store in its database a public key generated by the user device using the previously transmitted secret as a cryptographic seed. In a typical PKI framework, public keys such as signature keys (in DSA) or public encryption keys (in ECC and RSA) are stored (possibly in the form of a signature, as in DSA) in a database and / or in a user certificate stored in a key store of the user device.

[0058] In those embodiments where the act of generating a secret key is performed again each time the secret key is needed, the concept of storing such a secret key and retrieving it for later use can be understood as follows: when the secret key is generated immediately and is available for use, the secret key becomes "stored" in the sense that the secret key exists for a short period of time in a digital register, etc. When the communications encryptor and decryptor components then use the secret key to cryptographically protect communications, the communications encryptor and decryptor components "retrieve" the secret key from the digital register, etc. In other words, the "storing for later use" and "retrieval and use" cycles can be very brief in duration, after which the secret key is permanently discarded from the memory and only regenerated at a later time if needed again.

[0059] Figure 4 Shown Figure 3305, when the trusted central apparatus is ready to provide the requested secret to the user device. Step 401 represents the actual generation of the requested secret. In step 402, the trusted central apparatus provides cryptographic protection for the secret to be transmitted to the user device.

[0060] The secret may be cryptographically protected at step 402 with or without the Figure 3 The secure digital communication channel established at step 303 is directly associated with the trusted central device. If trust has already been established between the trusted central device and the user device, then asymmetric or symmetric encryption keys can be shared between the parties. As an example of a symmetric encryption key, the trusted central device and the user device may have previously transmitted a one-time encryption key based on the PSK (Pre-Shared Key) model, which the trusted central device can then use in step 402 to protect the secret using a block or queue cipher such as AES256-CTR or ChaCha20. As an example of an asymmetric encryption key, the trusted central device and the user device may have previously transmitted each other's public ECC keys, such as those generated using the Curve25519 algorithm. Between these keys, the parties can calculate a common secret, which can then be used. Alternatively, encryption keys generated therefrom can be distributed to protect randomness using a corresponding block or queue cipher.

[0061] To securely transmit secrets between a trusted central device and user devices without compromising confidentiality, it is recommended to employ several layers of security. If reliable encryption between the trusted central device and the user device is not possible, the secret can be digitally signed with the trusted central device's secret signature key, allowing the recipient to ensure its immutability by verifying it using the trusted central device's corresponding public signature key. As an example of such an implementation, the EdDSA electronic signature method based on the Ed25519 algorithm is cost-effective and relatively secure. It is also recommended that the recipient verify that the secret's signature is valid, meaning that the correct trusted central device has verifiably signed the secret. This check can be performed using the trusted central device's public signature key.

[0062] It is particularly advantageous to use a signature algorithm that itself includes hashing the information to be signed or checked in order to prevent attack vectors aimed at changing or forging the original information. The decentralization of the information to be signed increases security and speeds up the signing or verification process, because the information to be signed is changed into a hash code of a fixed size, which makes it difficult to change or forge the information to be signed, because even small changes will result in a change in the distributed hash. Here, the DSA method of the Ed25519 signing key is used as an example. It has a built-in hash for the information to be signed. If some other signature algorithm that does not have such a built-in hash is used, then in this case it is strongly recommended to hash the data with a one-way algorithm (such as SHA2 or SHA3) before generating the signature and therefore before verifying the signed information.

[0063] Figure 4 Step 403 in represents the trusted central apparatus performing an action of sending the cryptographically protected secret towards the user device. Depending on the communication method selected, the transmission may involve transmission in one or more parts.

[0064] Figure 5 Shown Figure 3 An example of a sub-step that may be involved in step 308 of is when the user device uses the received secret as a cryptographic seed to generate one or more keys and stores the one or more keys in a key memory. Again, it should be noted that preferably, no secret keys are ever stored in the key memory of the user device, but rather are regenerated each time they are needed, preferably using a specifically received PIN code or the like. Therefore, the discussion herein regarding storing one or more keys in a key memory primarily applies to storing public keys and / or signature certificates involving such public keys.

[0065] Step 501 represents the user device performing actions to receive a transmission containing a secret. As described above, these actions may include receiving digital information in the form of a modulated carrier wave via a wired or wireless communication channel. Additionally or alternatively, these actions may include other means of receiving information, such as optically reading a QR code or other optically readable information, or receiving information via a manually operated user interface.

[0066] exist Figure 4 In

[0015] , it is assumed that the trusted central device uses one or more methods to cryptographically protect the secret before transmission. Accordingly, Figure 5 Step 502 in FIG. 4 represents a cryptographic verification by the user device of the immutability and integrity of the received secret before forwarding it to the key generator. The exact method used for this verification is essentially a known counterpart of the method used by the trusted central device in step 402, an example of which is described above. Figure 6Some additional advantageous features are described. It is noted that in a preferred embodiment where the user device logs into the trusted central device using the https protocol, the user device can use either a user identifier and password or a client certificate as login information. In both cases, such identification information is already configured in the user device in a service-specific manner.

[0067] Figure 6 Schematically, a digitally transmitted message 601 is shown. Sub-parts of the message are the public (signature) key of the trusted central device shown in box 602, the signature of the secret shown in box 603, and the secret itself, shown in box 604 and designated as a "salt." The complete digitally transmitted message 601 may be further encrypted for transmission, for example using the public key of the intended recipient, such that successful decryption requires knowledge of the corresponding secret key.

[0068] The trusted central device may have used the ED25519 algorithm to generate a secret signing key and a corresponding public signing key. After generating the secret 604, the trusted central device can compose the digitally transmitted message 601 by combining the generated secret 604, the signature 603 it has calculated from it using the secret signing key, and the public signing key 602. It can be noted that the trusted central device does not need its own public signing key 602 during the signing process because it uses its secret signing key to sign the message to be signed. In this proposed embodiment, for convenience, the public signing key 602 of the trusted central device is included in the transmitted message so that it is transmitted along with the signed message and the user device does not need to obtain it separately.

[0069] Then, when the user device receives digital transmission 601, it first decrypts any outer encryption and retrieves public key 602, signature 603, and secret 604. If public key 602 is identical to a public key known to the user device from another source as belonging to a trusted central device, the cryptographic verification action in step 502 may involve a simple check by comparing public key 602 received in association with secret 604 with a separately obtained public key of the supposed sender of the secret. As a more thorough check, the user device can verify digital signature 603 received in association with secret 604 using the public key of the supposed sender of the secret. The user device can input the decrypted content of the received digital transmission 601 into the corresponding ED25519 algorithm, which will only give a positive result if the particular secret is immutable and complete (i.e., the secret originally generated by the trusted central device and signed with its secret signing key).

[0070] Return Reference Figure 5, after having ensured that it has received the secret in the correct original form, in step 503 the user device uses the secret as a cryptographic seed to generate one or more keys and stores the one or more keys in its key memory. Figure 7 and Figure 8 Two more detailed examples of how the generation of keys may occur are shown.

[0071] exist Figure 7 In the example, the secret received by the user device from the trusted central device is designated as URT SALT . Figure 7 The method involves using the secret and information received from the user as input information for a key generation algorithm. The information received from the user is Figure 7 Designated as URT PIN , and it can be, for example, a short PIN code that the user enters using a keypad or touch-sensitive display. In step 701, the key generator of the user device uses a hash algorithm to generate a secret key URT SK , as shown below:

[0072] URT SK =Hash(URT PIN ,URT SALT ).

[0073] An example of a hash algorithm that can be used in this manner is the Argon2 algorithm, which is well known and widely used in the art of digital cryptography. In step 702, the key generator of the user device generates a public key URT using the Curve25519 algorithm. PK ,as follows:

[0074] URT PK =Curve25519(URT SK )

[0075] =Curve25519(Hash(URT PIN ,URT SALT )).

[0076] Generated key URT SK and URT PK Both can be stored in the key memory of the user device and used to cryptographically protect communications performed by the communication part of the user device. However, as mentioned above, it is best not to make the secret key URT SK storage time longer than is necessary for its immediate use.

[0077] Figure 8A somewhat simpler approach is shown, where the key generator of the user device uses only the received secret (and no additional information received from the user) as a seed for the key generation algorithm. Figure 8 In the example, the received secret is designated as KEY SEED At step 801, the key generator of the user device uses the Ed25519 algorithm to generate secret and public signature keys KEY SK and KEY PK , as shown below:

[0078] KEY SK ,KEY PK =Ed25519(KEY SEED ).

[0079] An alternative could be Figure 9 The method shown in steps 901 and 902 represents the following generation of secret and public keys KEY SK and KEY PK :

[0080] KEY SK ,KEY PK =Ed25519(Hash(URT PIN ,URT SALT )).

[0081] In a simpler embodiment, the user device may use the received secret (or a portion thereof) as, for example, an encryption key. Thus, the previously defined actions of the key generator for using the received secret as a cryptographic seed to generate one or more keys should be interpreted broadly, such that using the secret or a portion thereof is only one way of using the secret as a cryptographic seed to generate one or more keys.

[0082] The proposed method for delivering trusted randomness allows all devices capable of communicating with a trusted central device to obtain high-quality randomness and, therefore, implement secure cryptography. For example, this technology enables users to utilize various e-commerce services using their existing devices, which do not include a secure environment for implementing high-quality cryptographic functions. Furthermore, it enables the development of new types of consumer products that can perform secure electronic transactions using even the simplest computing units (e.g., wearable devices or clothing). This solution ensures that external parties cannot manipulate the randomness (to derive secret information from it). Furthermore, this technology can ensure a very high level of security for confidential information when using cryptographic algorithms that can exploit the full entropy of the randomness to derive the secret, and are therefore theoretically resistant to attacks by even the most powerful future quantum computers.

[0083] Any range or device value given herein may be expanded or changed without losing the effect sought. In addition, any embodiment may be combined with another embodiment unless expressly not permitted.

[0084] Although the subject matter has been described in language specific to structural features and / or acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims, and other equivalent features and acts are intended to fall within the scope of the claims.

[0085] It should be understood that the benefits and advantages described above may relate to one embodiment or may relate to several embodiments. The embodiments are not limited to embodiments that solve any or all of the problems described or have any or all of the benefits and advantages described. It will be further understood that reference to "an" item may refer to one or more of those items.

[0086] The steps of the methods described herein may be performed in any suitable order, or simultaneously where appropriate. In addition, individual blocks may be deleted from any method without departing from the spirit and scope of the subject matter described herein. Aspects of any of the above-described embodiments may be combined with aspects of any other described embodiments to form further embodiments without losing the effects sought. What is explained herein with respect to the methods is directly applicable to computer program products consisting of machine-readable instructions that, when executed by one or more processors, cause the implementation of the methods of the type described.

[0087] The term "comprising" is used herein to mean including the identified methods, blocks or elements, but such blocks or elements do not comprise an exclusive list and the method or apparatus may include additional blocks or elements.

[0088] It should be understood that the above description is given by way of example only and that various modifications may be made by those skilled in the art. The above description, examples, and data provide a complete description of the structure and use of the exemplary embodiments. Although various embodiments have been described above with a certain degree of particularity or with reference to one or more individual embodiments, those skilled in the art may make various changes to the disclosed embodiments without departing from the spirit or scope of this specification.

Claims

1. An apparatus for enabling a user device (210) to use secrets in at least one of: cryptographically protected communications, cryptographic authentication of data, the apparatus comprising: -Communication part(211); - Communication encryptor and decryptor section (212); - a key generator (215); as well as - a key memory (216); wherein the communication section (211) is configured to forward a secret received from a trusted external source (100) to the key generator (215), and wherein the key generator (215) is configured to generate one or more keys using the secret as a cryptographic seed and store the one or more keys in the key storage (216), and wherein the communication encryptor and decryptor portion (212) is configured to: - before forwarding the secret to the key generator, verifying the digital signature received in association with the secret using the public key of the supposed sender of the secret to cryptographically verify the immutability and integrity of the received secret, and - retrieving said one or more keys from said key storage (216) and cryptographically protecting communications performed by said communication section (211) using said one or more keys.

2. The device according to claim 1, wherein: - said communication portion being configured to establish a secure digital communication channel with a peer and thereafter receive said secret over said secure digital communication channel, thereby causing said peer to appear as said trusted external source.

3. The device according to claim 2, wherein The communication portion is configured to establish the secure digital communication channel using the Transport Layer Security (also known as TLS) standard.

4. The device according to any one of the preceding claims, wherein The communication portion is configured to receive the secret over a channel different from a channel used for the cryptographically protected communications performed by the communication portion when the communication encryptor and decryptor portion has retrieved the one or more keys from the key storage.

5. The device according to claim 4, wherein The communication portion is configured to use at least one of the following as the different channel: cable or optical fiber communication, near field wireless communication, communication through a manually operated user interface.

6. A device according to any one of the preceding claims, wherein The communications encryptor and decryptor portion is configured to perform the cryptographic verification by comparing a public key received in association with the secret with a separately obtained public key of the supposed sender of the secret.

7. A device according to any one of the preceding claims, wherein The key generator is configured to perform at least one of the following to generate the one or more keys: - using the secret as a seed for a key generation algorithm; - Using the secret and information received from the user of the device as input information to a key generation algorithm.

8. The device according to claim 8, wherein The apparatus is configured to permanently discard at least one of the one or more keys generated by the key generator after immediately using the at least one key.

9. A method for enabling a user device to use secrets in at least one of the following: cryptographically protected communications, cryptographic authentication of data, the method comprising the user device performing the following steps: - receiving a secret from a trusted source external to said user device, - cryptographically verifying the immutability and integrity of the received secret, wherein, The cryptographic verification involves verifying a digital signature received in association with the secret using the public key of the supposed sender of the secret, - after said cryptographic verification, generating one or more keys using said secret as a cryptographic seed, - storing the one or more keys for later use, and - retrieving the one or more keys and cryptographically protecting communications performed by the user device using the one or more keys.

10. The method according to claim 9, comprising: - establish a secure digital communication channel with a peer, and - thereafter receiving said secret over said secure digital communication channel, thereby causing said peer to appear as said trusted external source.

11. The method according to claim 10, wherein: Establishing the secure digital communication channel comprises at least one of the following: - using the Transport Layer Security (also known as TLS) standard to establish said secure digital communication channel; - using cable or optical fiber communication as said secure digital communication channel; - using near field wireless communication as said secure digital communication channel; - Using communication via a manually operated user interface as said secure digital communication channel.

12. The method according to any one of claims 9 to 11, wherein The cryptographic verification involves comparing a public key received in association with the secret with a separately obtained public key of the supposed sender of the secret.

13. The method according to any one of claims 9 to 12, wherein: Generating the one or more keys comprises at least one of the following: - using the secret as a seed for a key generation algorithm; - Using the secret and information received from the user of the device as input information to a key generation algorithm.

14. The method of claim 13, comprising permanently discarding at least one of the generated one or more keys after immediate use of the at least one key.

15. A computer program product comprising one or more sets of one or more machine-readable instructions which, when executed by one or more processors, cause implementation of the method according to any one of claims 9 to 14.

Images