Patent ID: 7596704

Claim:
A method for protecting a digital secret, comprising: transforming a user-selected password, which is independent of a digital secret to be protected, into a temporary value by a first transformation; using the temporary value and the digital secret as inputs to a second transformation to produce a secret-dependent digital segment in a transitory memory; storing the secret-dependent digital segment in a persistent memory; deleting the secret-dependent digital segment from the transitory memory; deleting the digital secret and the temporary value from each memory associated with computations of the first and second transformations; receiving a password and a secret-dependent segment from a user requesting the recovery of the digital secret; without a prior validation of the received password, using the received password and the received secret-dependent digital segment as inputs to a third transformation to compute a value as a recovered secret; validating the recovered secret with verification information that has a relationship with the digital secret; and determining whether the received password matches the selected password and whether the received secret-dependent digital segment matches the secret-dependent digital segment according to an outcome of the validating step, wherein the first and second transformations are configured, respectively, as a first function ƒ 1 and a second function ƒ 2 , and the third transformation is configured as a composite function of the first function ƒ 1 and a third function ƒ 3 in the sequence of computing ƒ 1 first and subsequently computing ƒ 3 , and wherein the first, the second, and the third functions are as follows: (1) U=ƒ 1 (password)=hash(password)+β, where hash( ) is a collision-resistant hash function producing a positive integer for all instances of the password and β is a constant non-negative integer; (2)V=ƒ 2 (U, S)=(U+α×S) mod q, where U is an input value representing an output instance produced by the function ƒ 1 , S is a positive integer representing an instance of the digital secret, q is a positive integer larger than all instances of the digital secret and also larger than hash(password) for all instances of the password, α is a positive integer relatively prime to q; and (3) S=ƒ 3 (U, V)=(α −1 ×V+((−(α −1 ×U mod q)) mod q)) mod q, where U is an input value representing an output instance produced by the function ƒ 1 , V is an input value representing an instance of the secret-dependent digital segment, q is the sufficiently large integer as defined in ƒ 2 , α is also as defined in ƒ 2 , and α −1 is the multiplicative inverse of α, modulo q.