Cryptographic Secret Equality Checks With Multi-Part Salts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for checking equality of cryptographic secrets stored in secure systems, such as hardware security modules, are inefficient and vulnerable to attacks, especially when secrets lack sufficient entropy, making it difficult to verify equality without exposing the secrets.
Innovation Solution
A method using a multi-part salt with self-determined and externally determined salt portions, combined with a cryptographic hash function, allows secure comparison of secrets by generating and swapping salt portions to create unique hash values, ensuring secrecy and resistance to attacks like rainbow tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic secrets are stored in a read-protected manner in a secure system, then security against unauthorized access is improved, but the ability to verify equality of secrets between different systems deteriorates
Solution Approach 1:
The patent introduces a cryptographic hash function as an intermediary mechanism. Instead of directly comparing secrets, the system computes hash values of the secrets and compares these hash values. This mediator allows verification of secret equality without exposing the actual secrets, thus maintaining security while enabling operational verification.
Solution Approach 2:
The patent transforms the secret (original data) into a different parameter form (hash value) that preserves the equality property but is suitable for comparison. By changing the parameter representation from plaintext secret to cryptographic hash, the system enables verification while maintaining security constraints.
2Reliability
If cryptographic hash values are used to compare secrets, then security is improved by not exposing secrets, but vulnerability to attacks like rainbow tables increases when secrets lack sufficient entropy
Solution Approach 1:
The patent applies salt to the secret before computing the hash value. This preliminary action of adding random data (salt) to the secret transforms weak secrets into stronger inputs for the hash function, preventing rainbow table attacks by ensuring that even identical secrets produce different hash values when different salts are used.
Solution Approach 2:
The patent combines the secret with salt to create a composite input for the hash function. This composite structure (secret + salt) enhances the security properties of the hashing process, making it resistant to pre-computed rainbow table attacks while maintaining the ability to verify secret equality.
3Reliability
If secrets are regularly renewed for safety reasons, then security is improved, but the difficulty of troubleshooting cryptographic operations increases when secrets are stored in secure systems
Solution Approach 1:
The patent replaces the mechanical approach of reading and comparing plaintext secrets with a cryptographic system based on hash functions. This substitution allows troubleshooting of secret equality issues without requiring access to the actual secret values, maintaining security while enabling diagnostic capabilities.
Data Source
AI summary
A method for checking cryptographic secrets for equality involves at least one of the secrets being stored in a read-protected manner in a secure system. The at least one secure system has a cryptographic hash value interface. For checking purposes, a hash value of the secret provided with a salt or with the hash value of a salt is output via the interface for comparison with a corresponding hash value of another secret provided with the salt or with the hash value of the salt.