Cross-Certificate Hash Extensions for PKI Tamper Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cryptographic systems lack efficient methods to securely bind different PKI systems and detect tampering, especially with the advent of quantum computing, which threatens the security of root certificates.

Innovation Solution

Implement cross-certification methods involving cross certificates that include unique attributes and hash values from each certificate authority, embedded as extensions within the certificates, to securely bind different cryptographic systems and detect tampering.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional cross-certification is used between two CAs, then trust is established between the CAs, but there is no way to detect tampering if one root key is compromised

Engineering Contradiction:

Improvetrust detection capabilityVSAvoidcertificate structure complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent embeds a hash value (nested element) within the cross certificate structure. This nested hash acts as a tamper-detection mechanism that verifies the integrity of the certificate chain without requiring complex additional verification systems. The hash is nested inside the certificate extension, creating a self-verifying structure.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent implements a feedback mechanism where the hash value embedded in the cross certificate provides continuous verification of the certificate's integrity. Any tampering with the certificate would change the hash value, providing immediate feedback that the certificate has been compromised. This allows the receiving CA to detect tampering and reject forged certificates.

Inventive Principle:

Principle #23Feedback

2Power

If quantum computing capabilities are introduced, then computational power increases, but the security of existing RSA or elliptic curve certificates is compromised

Engineering Contradiction:

Improvecomputational powerVSAvoidcertificate security

Core Design Contradiction:

PowerVSReliability

Solution Approach 1:

The patent changes the cryptographic parameter from traditional RSA or elliptic curve signatures to hash-based signatures. This parameter change makes the system resistant to quantum computing attacks while maintaining compatibility with existing certificate structures. The hash value embedded in the cross certificate uses quantum-resistant cryptographic properties.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If cross certificates include full signature data, then tampering detection capability is enhanced, but certificate size increases significantly

Engineering Contradiction:

Improvetampering detectionVSAvoidcertificate size

Core Design Contradiction:

ReliabilityVSWeight of moving object

Solution Approach 1:

The patent extracts only the essential hash value from the full signature data and embeds it in the cross certificate. This extracted hash provides sufficient tamper-detection capability without the overhead of storing complete signature information. The full signature verification is performed separately during the cross-certification process, allowing the certificate itself to remain compact.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12407526B2Cross-certification for secure binding of cryptographic systems

Publication Date: 2025.09.02 ENTRUST CORP

AI summary

Methods and systems for cross-certification to bind together two cryptographic systems are disclosed. One method includes receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority. The method includes generating a cross certificate and embedding the hash value as a certificate extension within the cross certificate.