Encryption Method Combining User and Random Sub Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption and authentication methods are vulnerable to brute forcing due to the high performance of modern computers and computer clusters, which can rapidly test large numbers of password combinations, making keys with human-memorized lengths insufficiently secure.
Innovation Solution
The method combines a first sub key entered by the user with a randomly generated second sub key of a different length, increasing the total number of combinations that must be tested, thereby significantly extending the time required for brute forcing attacks. This is achieved by concatenating, inserting, or interleaving the sub keys, and using a verifier to validate the combined key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a password is made longer to increase security against brute forcing, then the security level improves, but the memorability and ease of use deteriorates
Solution Approach 1:
The password is segmented into two distinct parts: a user-chosen first sub-key and a system-generated second sub-key. This segmentation allows the user to remember only the first sub-key while the system handles the second sub-key, resolving the contradiction between security (longer password) and memorability (shorter password).
Solution Approach 2:
The system acts as an intermediary that generates and manages the second sub-key, which the user does not need to remember. This intermediary function allows the user to work with a shorter, memorable first sub-key while the system ensures overall security through the combined two-sub-key structure.
2Reliability
If idle time is introduced after wrong key entry to prevent brute forcing, then the number of testable keys decreases, but the method can only be applied to predetermined interfaces and can be circumvented by computer clusters
Solution Approach 1:
Instead of changing the time parameter (idle time), the invention changes the key space parameter by introducing a second sub-key. This transforms the security approach from temporal restriction to combinatorial complexity, making brute forcing computationally infeasible regardless of the interface or system performance.
3Reliability
If a second sub-key is appended to the user key before hashing (salt), then pre-calculated hashing tables become useless, but the key becomes more complex and the user must manage additional key material
Solution Approach 1:
The key is segmented into two parts with distinct roles: the first sub-key is user-managed and memorable, while the second sub-key is system-managed and random. This segmentation reduces key management complexity compared to traditional salting, where the user would need to manage the entire complex key including the salt.
Data Source
AI summary
The invention discloses a method for encrypting and/authenticating, comprising the following steps:Sending a request for a first bit combination or character combination as a first sub key (102);storing said first bit combination or character combination in the memory (104);generating a second bit combination or character combination as a second sub key (106), wherein the second bit combination or character combination is a random or pseudo random pattern; andcombining said first sub key and second sub key to a key (108);further comprising at least one of the following steps:encrypting the data with the key (110);using the key as an authentication password (112); and a method of decrypting and/or authenticating, comprising the following steps:sending a request for a first bit combination or character combination as a first sub key (202);storing said first bit combination or character combination in the memory (204);repeating the following steps until a key has been verified as valid:generating one by one a second bit combination or character combination as a second sub key (206), wherein the second bit combination or character combination is one by one taken from the set of all possible second sub keys (208);combining said first sub key and second sub key to a key (210);verifying, whether the key is valid (212);if said key has been verified as valid, decrypting the data with the key (214) and/or using the key an authentication password (216).