Self-Signed Certificate Verification Without Public Key Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing self-signed certificates face security vulnerabilities due to the transmission of public keys in clear text, which can be exploited by unauthorized entities, especially with advancements in quantum computing, potentially leading to the derivation of private keys.
Innovation Solution
A system and method for generating and authenticating self-signed certificates that omit the public key from the certificate payload, using a key value generated from a hash function or a signed digest of the public key, and employing a digital signature to ensure authentication, while maintaining security even against quantum attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the public key is transmitted in clear text in existing self-signed certificates, then the certificate can be easily verified and used for authentication, but the public key becomes vulnerable to unauthorized access and potential private key derivation attacks
Solution Approach 1:
The patent extracts the public key from the certificate payload and replaces it with a key value (hash or signed digest). The public key is kept separate in the issuer's key pair, while only the derived key value is embedded in the certificate. This extraction removes the vulnerability of clear-text public key transmission while preserving verification functionality.
Solution Approach 2:
The patent introduces a key value as an intermediary between the public key and the certificate payload. This key value (whether a hash or signed digest) acts as a mediator that allows verification without exposing the actual public key. The intermediary maintains the security link while preventing direct exposure of sensitive cryptographic material.
2Reliability
If the public key is omitted from the certificate payload, then security against quantum attacks is improved, but the verification process becomes more complex requiring additional computational steps
Solution Approach 1:
The patent applies preliminary action by pre-computing the key value (hash or signed digest) during certificate generation and embedding it in the payload. This pre-computation eliminates the need for complex real-time operations during verification. The verification process simply compares the computed key value from the public key against the embedded key value, maintaining simplicity while ensuring security.
3Object-affected harmful factors
If a key value derived from the public key is used instead of the public key itself, then unauthorized access to the public key is prevented, but additional computational overhead is introduced for generating and verifying the key value
Solution Approach 1:
The patent changes the parameter representation by transforming the public key into a derived key value through hashing or signing operations. This parameter transformation maintains the essential verification property while changing the form to prevent unauthorized access. The computational overhead is minimal and one-time during verification, as hash and signature verification are efficient operations compared to the security benefits gained.
Data Source
AI summary
A non-transitory machine-readable medium includes machine-readable instructions for a key value generator and a certificate generator. The key value generator is executable by a processor core to concatenate a public key of a certificate issuer with a second value to form a key combination and generate a digest of the key combination to provide a key value. The certificate generator is executable by the processor core to provide a payload of a self-signed certificate for the certificate issuer, replace data in a public key field of the payload with the key value, sign the modified payload with a private key of the certificate issuer to provide a digital signature, remove the key value from the modified payload, and add the digital signature to the self-signed certificate.