Patent ID: 7694141

Claim:
A computer-implemented method for extended authenticated key exchange with key confirmation protocol using a mathematical group, wherein the method is implemented by a first computing device in communication with a second computing device via a network, the method comprising: determining, by the first computing device, an identity of an initiator, an identity of a responder; prior to computing session keys for exchange of information between the initiator and the responder, confirming whether the initiator or the responder has received information to compute of a session key of the session keys; if a first party on the first computing device comprising one of the initiator or the responder confirms that a second party on the second computing device comprising the other of the initiator or the responder has received the information, generating, by the first party, a session key of the session keys using at least the identities of the initiator and the responder, wherein the session key is calculated by applying a hash function to a concatenation of values including the identity of the initiator and the identity of the responder, and a unique session identifier, wherein the identity of the initiator comprises a first binary string that represents a name of the initiator and the identity of the responder comprises a second binary string that represents a name of the responder; if the first party confirms that the second party has not received the information, terminating the extended authenticated key exchange with key confirmation protocol; wherein the confirming further comprises: computing, by the responder, a key confirmation value based on the mathematical group, registered identities of the initiator and the responder, the unique session identifier, a first element computed from a long-term public key of the initiator and an ephemeral secret key of the responder, and a second element computed from an ephemeral public key of the initiator and a long-term secret key of the responder; calculating a responder signature by inputting the key confirmation value, the registered identities of the initiator and the responder, and the unique session identifier, into a message authorization code; communicating, by the responder, the responder signature to the initiator, the responder signature for use by the initiator to determine whether the responder has computed information to generate a valid session key.