Dual Digital Signature Algorithms for Quantum Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing digital signature algorithms, such as RSA and ECC, are vulnerable to quantum computers, and there is a need for secure authentication protocols that can transition to post-quantum cryptographic algorithms while maintaining compatibility with existing infrastructure and protocols like TLS, which face challenges in backward compatibility and integration with middle boxes and firewalls.
Innovation Solution
Implementing a dual digital signature algorithm system where a classical algorithm like RSA or ECC is combined with a post-quantum cryptographic algorithm, such as lattice or multivariate algorithms, to generate and verify digital signatures, ensuring security even if one algorithm is compromised, and incorporating these into existing X.509 certificate structures to support secure sessions across the Internet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If quantum computers are used to break existing digital signature algorithms, then security is compromised, but transitioning to post-quantum algorithms requires significant infrastructure changes
Solution Approach 1:
The patent segments the digital signature verification process into two independent parts: a classical algorithm component (RSA or ECC) and a post-quantum algorithm component. Each component operates independently with its own key pair and signature generation/verification logic. This segmentation allows the system to leverage both classical and post-quantum algorithms without requiring a complete infrastructure overhaul, as existing classical components can continue to function while adding quantum-resistant capabilities.
Solution Approach 2:
The patent merges classical digital signature algorithms with post-quantum digital signature algorithms into a unified authentication system. The combined approach uses both algorithm types simultaneously, where a server generates signatures using both classical and post-quantum methods, and clients verify both signatures. This merging provides quantum-resistant security while maintaining compatibility with existing infrastructure that relies on classical algorithms.
2Reliability
If post-quantum cryptographic algorithms are implemented, then quantum security is achieved, but backward compatibility with existing systems becomes difficult
Solution Approach 1:
The patent implements a universal authentication system that supports multiple digital signature algorithms simultaneously. The server and client are configured to handle both classical algorithms (RSA, ECC) and post-quantum algorithms. This multi-functionality allows the system to provide quantum security while maintaining backward compatibility, as existing systems can continue to use classical algorithms while new quantum-resistant capabilities are added without replacing existing infrastructure.
3Reliability
If dual digital signature algorithms are used, then security against quantum computers is enhanced, but computational overhead increases
Solution Approach 1:
The patent implements partial action by selectively applying post-quantum digital signature algorithms only when quantum resistance is required, while allowing classical algorithms to be used for standard authentication scenarios. The system can choose to use both algorithms together or rely on classical algorithms alone depending on the security requirements, thereby reducing unnecessary computational overhead while maintaining quantum security capabilities when needed.
Data Source
AI summary
A server can record (i) a first digital signature algorithm with a first certificate, and a corresponding first private key, and (ii) a second digital signature algorithm with a second certificate, and a corresponding second private key. The server can select first data to sign for the first algorithm and the first private key in order to generate a first digital signature. The server can select second data to sign, wherein the second data to sign includes at least the first digital signature. The server can generate a second digital signature for the second data to sign using the second algorithm and the second private key. The server can transmit a message comprising (i) the first and second certificates, and (ii) the first and second digital signatures to a client device. Systems and methods can concurrently support the use of both post-quantum and classical cryptography to enhance security.