Patent ID: 6119227
Filing Date: 2000-09-12
Classification: G06Q,H04L

Abstract:
A method of enabling a first party to authenticate a second party by confirming that a communication from the second party must have been derived using a password of the first party, wherein the second party does not know the password, comprising the steps:the first party: applying a commutative one-way function to the password to form a first result, generating a first random value and providing the first result and the first random value to the second party;the second party: generating a second random value and a session key, applying the commutative one-way function to the first result received from the first party and the second random value to calculate a second result, combining the first random value received from the first party with the second result to obtain a first hashed result, calculating a protected hashed result from the first hashed result and the session key, and applying the commutative one-way function to the second random value to form a protected second random value and providing the first party with the protected second random value and the protected hashed result;whereby the first party can calculate: (a) the second result from the password and the protected second random value, (b) the first hashed result from the second result the first party calculates and the first random value, and (c) the session key by combining the hashed result calculated by the first party with the protected hashed result received from the second party.