Patent ID: 8464060

Claim:
A computer-implemented method of proof-of-knowledge and key-exchange between two parties interconnected by a device or a network, said method comprising: denoting X 1 =A=g a and X 2 =X=g x , where A is a fixed Diffie-Hellman component (DH-component) of a first party Â and is a public key, a is a fixed DH-exponent of said first party Â and is a secret-key, X is an ephemeral DH-component of said first party Â and x is an ephemeral DH-exponent of said first party Â; denoting Y 1 =B=g b and Y 2 =Y=g y , where B is a fixed DH-component of a second party {circumflex over (B)} and is a public-key, b is a fixed DH-exponent of said second party {circumflex over (B)} and is a secret-key, Y is an ephemeral DH-component of said second party {circumflex over (B)} and y is an ephemeral DH-exponent of said second party {circumflex over (B)}, wherein said a,x,b,y are integers such that 1≦a,x,b,y≦q−1 for some prime number q,g is a generator of a subgroup G of order q of a finite Abelian group G′ of order N; denoting m 1 as other arbitrary public information related to a session of said method from said first party Â; denoting m 2 as other arbitrary public information related to a session of said method from said second party {circumflex over (B)}; obtaining {X 1 ,X 2 ,m 1 } by said second party {circumflex over (B)}; computing, using a computer, K {circumflex over (B)} =K {circumflex over (B)} (1) K {circumflex over (B)} (2) =A (bc 1 (1) +yc 2 (1) )modq X (bc 1 (2) +yc 2 (2) )modq mod N by said second party {circumflex over (B)}; obtaining {Y 1 ,Y 2 ,m 2 } by said first party Â; computing K Â =K Â (1) K Â (2) =B (ac 1 (1) +xc 1 (2) )modq Y (ac 2 (1) +xc 2 (2) )modq mod N, wherein said c 1 (1) =t 1 ƒ, c 2 (1) =t 2 c, c 1 (2) t 3 d, c 2 (2) =t 4 e, where said t i =1 or t i =N/q,1≦i≦4, and each one of said c,d,e,ƒ comprises a predetermined mathematical function with a subset of said {Â,A,X,m 1 ,{circumflex over (B)},B,Y,m 2 } being its arguments, wherein c=h(Y,pub 1 ) or c=1, d=h(X,pub 2 ) or d=1, e=h(X,Y,pub 3 ) or e=0, and ƒ=0 or ƒ=1 or ƒ=h(pub 4 ), where said h comprises a predetermined function that can be modeled to be a random function in possibly idealized cryptographic models, or one of a cryptographic hash function, a cryptographic pseudorandom function, a cryptographic commitment function, an encryption function and a one-way function, wherein each said pub i ,1≦i≦4 comprises a subset of messages of said {Â,A,m 1 ,{circumflex over (B)},B,m 2 }, and wherein if c=d=1, then e≠1, wherein said K {circumflex over (B)} and K Â are used to derive secrets shared between said first and second parties, said first party Â derives said secrets by computing KDF Â (K Â ), where KDF Â comprises a predetermined mathematical function having at least one arguments K Â , said second party {circumflex over (B)} derives said secrets by computing KDF {circumflex over (B)} (K {circumflex over (B)} ), where said KDF {circumflex over (B)} comprises a predetermined mathematical function having at least one arguments K {circumflex over (B)} .