Multifactor Split Asymmetric Crypto-Key Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems face challenges in securely managing asymmetric crypto-keys, particularly in preventing unauthorized access and dictionary attacks, due to the need for users to remember long private keys and the complexity of certificate validation in large user environments.
Innovation Solution
A multifactor split private key asymmetric cryptosystem is developed, where the private key is split into multiple portions, with each portion generated using different factors, and securely stored and managed to enhance security, including the use of rolling keys to periodically change the encryption keys, reducing the vulnerability of stored factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users store long private keys locally, then security is improved, but user convenience deteriorates due to the need to remember and manage complex keys
Solution Approach 1:
The private key is divided into multiple portions (first private key portion and second private key portion) that are stored in different locations. The first portion is stored locally on the user's computer while the second portion is stored remotely on a server. This segmentation allows users to authenticate without remembering the entire private key, improving convenience while maintaining security through distributed key storage.
2Ease of operation
If passwords are stored on the computer, then authentication is simplified, but security deteriorates due to single point of compromise
Solution Approach 1:
The authentication system splits the private key into two portions stored in different locations (local and remote). This eliminates the single point of compromise by ensuring that neither location alone possesses the complete private key, thereby improving security while maintaining authentication functionality.
Solution Approach 2:
A server acts as an intermediary to store and manage the second private key portion. The server facilitates authentication by providing the remote key portion to the user's computer when needed, eliminating the need for the user to manually manage the entire private key while distributing security responsibility.
3Ease of operation
If passwords travel in clear over the network, then communication simplicity is improved, but security deteriorates due to eavesdropping vulnerability
Solution Approach 1:
The server acts as a secure intermediary that manages the private key portions and facilitates authentication. By using the server to store and distribute the second private key portion, the system enables secure authentication without requiring the complete private key or password to travel in clear text over the network.
4Reliability
If certificate validation is implemented in large user environments, then security is improved, but system complexity deteriorates
Solution Approach 1:
The private key is segmented into two portions stored in different locations, simplifying the authentication process compared to traditional certificate validation in large environments. This segmentation reduces system complexity by eliminating the need for complex certificate authorities and validation infrastructures while maintaining security through distributed key storage.
Data Source
AI summary
A processor generates an asymmetric crypto-key, such as an RSA crypto-key, which is associated with the user and includes a private key and a public key. It computes a first key portion based on a stored random number generation function, which has one or more constants such as a salt and/or iteration count, and a first value of a constant, and a second key portion based on the computed first key portion and one of the private key and the public key. It additionally computes another first key portion based on the stored random number generation function and a second value of that constant, and another second key portion based on the computed other first key portion and the one key. The computed first and second key portions and the computed other first and second key portions form first and second splits of the one key of the asymmetric crypto-key.