Implicit Certificate Chaining Security Against Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptography systems using explicit certificates are vulnerable to attacks such as chaining attacks, which can compromise the security of implicit certificates and signatures, especially in public key infrastructure scenarios where explicit key conveyance is not necessary.
Innovation Solution
Implementing implicit certificate schemes like the Elliptic Curve Qu-Vanstone (ECQV) protocol, which generates self-signed implicit certificates, and incorporating countermeasures in public key construction and digital signature verification algorithms to thwart such attacks, such as using hash functions and public key reconstruction techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit certificates are used in cryptography systems, then key conveyance is straightforward and verification is simple, but the system becomes vulnerable to chaining attacks and other security compromises
Solution Approach 1:
The patent extracts the public key information from explicit certificate structures and embeds it implicitly within the signature itself. The signature contains encoded public key data that can be recovered during verification, eliminating the need for separate certificate transmission while maintaining security against chaining attacks through the use of implicit certificate generation and verification algorithms
Solution Approach 2:
The patent introduces an intermediary implicit certificate structure that mediates between the explicit key conveyance of traditional systems and the security requirements of implicit systems. This intermediary structure allows public key information to be conveyed indirectly through the signature, providing both security and verification capability without the vulnerabilities of explicit certificates
2Reliability
If implicit certificate schemes are implemented to improve security, then vulnerability to chaining attacks is reduced, but the complexity of public key construction and verification algorithms increases
Solution Approach 1:
The patent merges the public key conveyance function and the signature verification function into a unified implicit certificate structure. The public key information is embedded within the signature itself, allowing verification to occur in a single operation rather than requiring separate certificate and signature verification steps, thereby reducing algorithmic complexity while maintaining security
Solution Approach 2:
The patent performs preliminary encoding of public key information within the signature structure during the signing process. This preliminary action embeds the necessary verification data in advance, eliminating the need for complex runtime certificate processing and reducing verification algorithm complexity while maintaining resistance to chaining attacks
3Reliability
If explicit key conveyance is eliminated to enhance security, then security against certain attacks is improved, but the ability to convey public keys straightforwardly is reduced
Solution Approach 1:
The patent extracts public key information from separate certificate structures and embeds it directly within the signature. This extraction and embedding process eliminates the need for explicit key conveyance while maintaining the ability to recover and use the public key for verification, thereby enhancing security without sacrificing operational ease
Solution Approach 2:
The patent creates a copy of the public key information and embeds it within the signature structure in encoded form. This copying allows the public key to be conveyed indirectly through the signature without requiring separate transmission, maintaining both security and ease of operation by allowing straightforward signature-based verification
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer programs for using an implicit certificate are described. In some aspects, an implicit certificate is accessed. The implicit certificate is associated with an entity and generated by a certificate authority. The implicit certificate includes a public key reconstruction value of the entity. Certificate authority public key information is accessed. The certificate authority public key information is associated with the certificate authority that issued the implicit certificate. A first value is generated based on evaluating a hash function. The hash function is evaluated based on the certificate authority public key information and the public key reconstruction value of the entity. A public key value of the entity can be generated or otherwise used based on the first value.