Commitment-Based Password Verification System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computing systems face limitations in effectively protecting user passwords, as they often transmit passwords in clear form or hash them with static keys, lacking robust protection against unauthorized access.
Innovation Solution
Implementing a commitment-based verification system where a client device generates and stores an initial commitment for a user password without transmitting the actual password, and subsequently verifies it by comparing differences in commitment values, ensuring secure authentication without storing the password on the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are transmitted in clear form from client to server, then authentication is simple and direct, but password security is compromised and vulnerable to interception
Solution Approach 1:
The patent introduces cryptographic commitments as an intermediary mechanism between the client and server. Instead of transmitting the password directly, the client generates a commitment to the password and transmits this commitment along with a proof of knowledge. The server verifies the proof without ever receiving the actual password, thus mediating the authentication process to maintain both simplicity and security.
Solution Approach 2:
The patent extracts the password from the transmission process entirely. The server never receives or stores the actual password; only cryptographic commitments and verification proofs are transmitted. This extraction eliminates the security vulnerability of password transmission while preserving authentication functionality through zero-knowledge proof mechanisms.
2Reliability
If passwords are hashed on the client device using a static key, then password protection is improved, but the hashed password is still stored on the server creating a security risk
Solution Approach 1:
The patent extracts the password and its hash from the server's storage entirely. Instead of storing hashed passwords on the server, the system uses commitment schemes where only cryptographic commitments are stored. The actual password and even its direct hash never reside on the server, eliminating the vulnerability of stored credential data.
Solution Approach 2:
Cryptographic commitments serve as an intermediary representation of the password. The server stores and verifies commitments rather than the actual password or its hash. This intermediary mechanism provides password protection while removing the vulnerable stored credential that exists in conventional hashing approaches.
3Reliability
If encrypted public/private key cryptography is used, then password security is enhanced, but system complexity increases due to key management requirements
Solution Approach 1:
The patent extracts the private key from the authentication process entirely. The client proves knowledge of the password through zero-knowledge proofs without using or transmitting private keys. This eliminates the complexity of private key generation, storage, and management while maintaining strong cryptographic security through commitment schemes and proof-of-knowledge protocols.
Data Source
AI summary
Methods that can verify a password utilizing commitments are provided. One method includes receiving from a client device and storing, by a processor, an initial commitment representing a password for a user account without storing the actual password on the apparatus, receiving, from the client device, a subsequent commitment, and verifying that the subsequent commitment represents the password for the user account based on a difference between the initial commitment and the subsequent commitment. Systems and apparatus that can include, perform, and/or implement the methods are also provided.