Password-Derived Prime Key Exchange Protocol
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure key exchange methods, such as Diffie-Hellman, are vulnerable to man-in-the-middle attacks due to the lack of authentication, allowing adversaries to intercept and misuse passwords for unauthorized key establishment.
Innovation Solution
A method using a password-derived prime number to facilitate a secure key exchange between client and server, where the client and server generate a shared secret key through a modified Diffie-Hellman protocol, with the client and server each computing Ks=Yx mod P and Ks=Xy mod P respectively, using a password to determine a strong prime number P and generator g, and optionally utilizing a SALT to reduce search time for P.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Diffie-Hellman key exchange is used, then secure key exchange over insecure networks is achieved, but vulnerability to man-in-the-middle attacks occurs due to lack of authentication
Solution Approach 1:
The patent introduces a password-derived prime number as an intermediary authentication mechanism. This prime number serves as a mediator that both parties must independently derive from their shared password, thereby proving their identity without exposing the password itself. The intermediary element (prime number) enables authentication while maintaining the security properties of Diffie-Hellman key exchange.
Solution Approach 2:
The patent modifies the traditional Diffie-Hellman parameters by deriving the prime number P from a shared password rather than using a publicly agreed-upon prime. This parameter change transforms the authentication model, allowing parties to verify each other's identity through independent derivation of the same prime number from their shared secret password, thereby preventing man-in-the-middle attacks.
2Adaptability or versatility
If password-based authentication is added to Diffie-Hellman, then authentication capability is improved, but vulnerability to man-in-the-middle attacks persists
Solution Approach 1:
The patent merges password-based authentication with Diffie-Hellman key exchange by using the password to derive the prime number P. This combination creates a unified protocol where authentication and key exchange are integrated, eliminating the vulnerability where passwords could be intercepted and reused in man-in-the-middle attacks. The merged protocol ensures that the password never leaves the client's system.
Solution Approach 2:
The system implements self-service authentication where both client and server independently derive the same prime number from their shared password without exchanging the password itself. Each party performs the derivation locally and uses the resulting prime number for key exchange, eliminating the need to transmit authentication credentials over the network.
3Reliability
If a SALT is used to derive the prime number, then security against dictionary attacks is improved, but computational overhead increases
Solution Approach 1:
The patent applies preliminary action by pre-computing a SALT value and storing it in the database alongside the user's password. This pre-computed SALT is then used during the prime number derivation process, eliminating the need for real-time SALT generation and reducing computational overhead during authentication while maintaining security against dictionary attacks.
Data Source
AI summary
One embodiment of the present invention provides a system that uses a password-derived prime number to facilitate a secure key exchange between a client and a server across a network. During operation, the client receives a password from a user. Next, the client uses the password to determine a prime number P associated with the password. The client then uses the prime number P to determine a generator g associated with P. The client uses this prime number to calculate X=gx mod P, wherein x is a random number generated by the client. Next, the client sends X to the server. The client also receives Y=gy mod P from the server, wherein y is a random number generated by the server. The client then computes a secret key Ks=Yx mod p at the client, which the server can similarly obtain by computing Ks=Xy mod p. In this way, the client and the server can both obtain the same secret key Ks through insecure communications over the network.