CA1128159A - Public key cryptographic apparatus and method - Google Patents

Abstract

PUBLIC KEY CRYPTOGRAPHIC APPARATUS AND METHOD

Abstract of the Disclosure A cryptographic system transmits a computationally secure cryptogram that is generated from a publicly known transformation of the message sent by the transmitter; the cryptogram is again transformed by the authorized receiver using a secret reciprocal transformation to reproduce the message sent. The authorized receiver's transformation is known only by the authorized receiver and is used to generate the transmitter's transformation that is made publicly known. The publicly known transformation uses operations that are easily performed but extremely difficult to invert.
It is infeasible for an unauthorized receiver to invert the publicly known transformation or duplicate the authorized receiver's secret transformation to obtain the message sent.

Description

Background of the Invention _ . , Field of Invention The invention relates to cryptographic systems.
Description of Prior Art Cryptographic systems are widely used to ensure the privacy and authenticity of messages communicated over insecure channels. A privacy system prevents the extraction of information by unauthorized parties from ~essages trans-mitted over an insecure channel, thus assuring the sender of a message that it is being read only by t`~e intended receiverO
An authentication system prevents the unauthorized injection of messages into an insecure channel, assuring the receiver of the message of the legitimacy of its sender.
Currently, most message authentication consists of appending an authenticator pattern, known only to the trans-mitter and intended receiver, to each message and encrypting ~he col~b-irlation. This protects against an eav~sclropper being ablc~ to fo~ge new, properly authenticated messages unless he has also stolen the cipher key being used. How-ever, there is little protec-tion agains~ the threat of dispute; that is, the transmitter may transmit a properly authenticated message, later deny this action, and falsely blame the receiver for ta~ing unauthorized action. Or, conversely, the receiver may take unauthorized action, forge a message to itself, and falsely blame the transmitter for these actions. The threat of dispute arises out of the absence of a sui-table receipt mechanism that could prove a particular message was sent to a receiver by a particular transmitter.
One oE the principal difficulties with existing cryptographic systems is the need for the sender and re~
ceiver to exchange a cipher key over a secure channel to which the unauthorized party does not have access. The e~;change of a cipher key frequently is done by sending the key in advance over a secure channel such as private courier or registered mail; such secure channels are usually slow ar.d expensive.
Diffie, et al, in "l~ultiuser Cryptographic Techniques,"
AFI~S - Conference Proceedings, Vol. 45, pp. 109-112, June 8, l9/6, propose the concept of a public key cryptosystem that would eliminate the need for a secure channel by making the sender's keying information public. It is also proposed how such a public key cryptosyst~m could allow an authentication system which generates an unforgeable message dependent digital signature. Diffie presents the idea of using a pair of keys E and D, for enciphering and deciphering a message, such that E is public information while D is kept secret by ~2~5~

the inLen-led receiver. Furtiler, although D is determined by E, it is infeasible to compute D from E. Diffie sucJgests the plausibility of designing such a pu~lic key cryptosystem that would allow a user to encipher a message and send it to the intended receiver, but only the intended receiver could decipher it. While suggesting the plausibility of designing such systems, DiEfie presents neither proof that public key cryptosystems exist, nor a demonstration system.
Diffie suggests -three plausibility arguments for the existence of a public key cryptosystem: a matrix approach, a machine language approach and a logic mapping approach. While the matrix approach can be designed with matrices that require a demonstrably infeasible cryptanalytic time (i.e., computing D from E) using known methods, the matrix approach e~hibits a lack of practical utility because of the en~rmous dimensions of the required matrices. The machine language approach and logic mapplng approach are also suggested, but there is no way shown to design them in such a manner -that they would require demonstrably infeasible cr~-ptanalytic time.
Diffie also introduces a procedure using the proposed pu~lic key cryptosystems, that could allow the receiver to ea;~ly verify the authenticity of a message, but which pre-- verts him from generating apparently authenticated messages.
Dif~ie describes a protocol to be fo]lowed to obtain authen-tication with the proposed public key cryptosystem. How-ever, the authentication procedure relies on the existence of a public key cryptosystem which Diffie did not provide.

sl~

Summary and Ob~jects of the Invention Accordingly, it is an object of the invention to allow authori-zed parties to a conversation (conversers) to converse privately even though an unauthorized party (eavesdropper) intercepts all of their communicationsO
Another object of this invention is to allow a converser on an insecure channel to authenticate another converser's identity.
Another object of this invention is to provide a receipt to a receiver on an insecure channel to prove that a particular message was sent to the receiver by a particular transmitter. The object being to allow the receiver to easily verify the authenticity of a message, but to prevent the receiver from generating apparently authenticated messages.
Thus, in accordance with one broad aspect of the invention, there is provided, in a method of communicating securely over an insecure communication channel of the Lype which communicates a message from a transmitter to a receiver, the improvement characterized by: providing random numbers at the receiver, generating from said random numbers a public enciphering key at the receiver; generating from said random numbers a secret deciphering key at the receiver such that the secret deciphering key is directly related to and computationally infeasible to generate from the public enciphering key; communicating the public encipher-ing key from the receiver to the transmitter; processing the message and the public enciphering key at the transmitter and generating an enciphered message by an enciphering transformation, such that the enciphering trans-formation is easy to effect but computationally infeasible to invert with-out the secret deciphering key; transmitting the enciphered message from the transmitter to the receiver; and processing the enciphered message and the secret deciphering key at the receiver to transform the enciphered message with the secret deciphering key to generate the message.
- 30 In accordance with another broad aspect of the invention there is provided, in an apparatus for communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characteri~ed by: means for generating random information at the receiver; means for generating from said random information a public enciphering key at the receiver, means for generating from said random information a secret deciphering key such that the secret deciphering key is directly related to and computationally infeasible to generate from the public enciphering key; means for communi-cating the public enciphering key from the receiver to the transmitter;
means for enciphering a message at the transmitter having an input connect-ed to receive said public enciphering key, having another input connected to receive said message, and serving to transform said message wlth said publlc enclphering key, such that the enciphering transformation ln com-putationally infeaslble to invert without the secret declphering key;
means for transmitting the enciphered message from the transmitter to the receiver; and means for decipherlng said enclphered message at the recelver having an input connected to receive said enciphered message, having another input connected to receive sald secret declphering key and serving to generate said message by lnverting said transformatlon with said secret deciphering key.
An lllustrated embodiment of the present invention describes a method and apparatus for communicating securely over an insecure channel, by communicating a computationally secure cryptogram that is a publicly known transformatlon of the message sent by the transmitter. The illus-trated embodiment d;ffers from prior approaches to a publlc key crypto-system, as described in "Multiuser Cryptographic Techniques," in that it is both practical to lmplement and ls demonstrably lnfeaslble to lnvert uslilg known methods.
In the present inventlon, a receiver generates a secret de-cipherlng key and a public enciphering key, such that the secret decipher-ing key is difficult to generate from the public enciphering key. The -4a-transmitter enciphers a message to be communicated by transforming the message with the public enciphering key, wherein the transformation used to encipher the message is easy to effect but difficult to invert without the secret deciphering key. The enciphered message is ~hen communicated from the transmitter to the -4b-receiver. The receiver deciphers the enciphered message by invertin~3 the enciphering transformation with the secret deciphering key.
Another illustrated embodiment of the present in-vention describes a method and apparatus for allowing a transmitter to authenticate an authorized receiver's iden-tity. The authorized receiver generates a secret deciphering key and a public enciphering keyr such that the secret de-ciphering key is difficult to generate from the public en-ciphering key. The transmitter enciphers a message to be communicated by transforming the message with the public enciphering key, wherein the transformation used -to encipher the message is easy -to effect but diEficult to invert without the secret deciphering key. The enciphered messa~e is -then transmitted from the transmitter to the receiver. The re-ceive~ deciphers the enciphered messa~e by inverting the enciphering transformation with -the secret deciphering key.
The receiver's identity is authenticated to the transmitter by the receiver's ability to decipher the enciphered message.
Another illustrated embodiment of the present in~
ve.tion describes a method and apparatus for providing a receipt for a communicated message. A transmitter generates a sec^et key and a public key, such that the secret key is difficult to generate from the public key. The transmitter then generates a receipt by transforling a representation of the communicated message with the secret key, wherein the transformation used to generate the receipt is difficult to effect without the secret key and easy to invert with the public key. The receipt is -then communicated from the trans-mitter to the receiver. The recei~er inverts the transfor-mation with the public key to obtain the representation of the colnmunicated m~ssc~cJe from the receipt ancl ~lid~tes the receipt by comparin~ the simil~rity of the representation o~ the con~iunic~ted mess~ge with the co~municated messa~e.
Ad~itional o~jects and features o~ the present in-S vention will appear from the description that follows wherein the preferred embodiments have been set ~orth in detail in conjunction with the accompanyin~ drawings.

Brief D script on of the Drawings Figure 1 is a block diagram of a public key cryptosystem that-transmits a co~iputationally secure cryptogram over an insecure communi-cation channel.
Figure 2 is a block diagram of an enciphering device for enciphering a message into ciphertext in the public key cryptosystem of Figure 1.
Figure 3 is a block diagram of a mul-tiplier for performing modular multiplications in the deciphering device of Figure 7, the exponentiator of Figure 10, and the public key generator of Figure 11.
Figure ~ is a detailed schelllatic diagram of an adder for performing additions in the enciphering device of Figure 2, the multiplier of Fiyure 3, and the public key generator of Figure 11.
Figure 5 is a detailed schematic diagram of a comparator for per~orming magnitude comparisons in the enciphering device of Figure 2, the miJltiplier of Figure 3, the deciphering device of Figure 7, the divider of Figure 8, and the alternative deciphering device of Figure 9.
Figure 6 is a detailed schematic diagram of a subtractor for performing subtraction in the multiplier of Figure 3, the deciphering device of Figure 7, and the divider of Figure 8.
Figure 7 is a block diagram of a deciphering device for deciphering a ciphertext into message in the public key cryptosystem of Figure 1.

Figure ~ is a block diagram of a divider for performing division in the invertor of Figure 7 and the alterna-tive decipheriny device of Figure 9.
Figure 9 is a block diagralrl of an alternative deciphering device for deciphering a ciphertext into message in the public key cryptosystem of Figure 1.
Figure 10 is an exponentiator for raising various numbers to various powers in modulo arithme-tic in the alternative deciphering device of Figure 9 and the public key generator of Figure 11.
Figure 11 is a public key generator for generating the public encipnering key in the public key cryptosystem oF Figure 1.
Figure 12 is a flow chart for the algorithm of the logarithmic converter o~ Fic~re 11 when p-1 .is a ~ower of 2.
Figure 13 is a flo~ chart for the algorithm for computing the coefficients {bj} of the expansion n. nj-l x(mod p; ) = j~O bj p~

~ rhere 0 ~ bj < pj - 1, of the logarithmic convertor of Figure 11, - wnen p-l is not a power o~ 2.

, ,. J , O~ _ ~ t _cription of the Prefer _d Embodiment Referring to Figure 1, a puhlic key cryptosystem is sho~n in which all transmissions take place over an insecure communication channel 19, for example a telephone line. Communication is effected on the insecure channel 19 he-tween transmitter 11 and receiver 12 using transmitter-receiver units 31 and 32, which may be modems such as Bell 201 modems. Transmitter 11 possesses an unenciphered or plaintext message X to be communicated to receiver 12. Transmitter 11 and receiver 12 include an enciphering device 15 and deciphering device 16 respectively, for enciphering and deciphering information under the action of an enciphering key E on line E and a reciprocal deciphering key D on line D. The enciphering and deciphering devices 15 and 16 implement inverse transformations when loaded with the corresponding keys E and D. For example, the keys may be a sequence of random letters or diyits. The enciphering device 15 enciphers the plaintext message X into an enciphered message or ciphertext S that is transmitted by transmitter 11 through the insecure channel 19; the ciphertext S is received by receiver 12 and deciphered by deciphering device 16 -to ob~ain the plaintext message X. An unauthori2ed party or ea~esdropper 13 is assumed to have key generator 23 and decipher-ins device 18 and to have access ~o the insecure channel 19, so if he knew the deciphering key D he could decipher the ciphertext S to obtain the plaintext message X.
The example system makes use of the difficulty of the so-called "knapsack pro'Dlem." Simply stated, given a one-dimensional knapsack of length S and a vector a composed of n rods of leng-ths al, a2, .. an, the knapsack problem is to find a subset of the rods which exactly fills the knap-sack, if such a subset c~xists. Equivalently, find a binary n-vector x of O's and l's such -that S = a * x, if such an x exists, (* applied to vectors denotes dot product, applied to scalars deno-tes normal multiplication).
A supposed solution, x, is easily checked in at most n additions; but, to the best oE curren-t knowledge, finding a solution requires a number of operations which grows exponentially in n. Exhaustive trial and error search over all 2n possible x's is computationally infeasible if n is larger than one or two hundred. A task is considered computationally infeasible if its cost as measured by either the amount of memory used or the computing time is Einite but impossibly large, for example, on the order of approxi-mately 103 operations with exis-ting computational methods and equipment.
Theory suggests the dieEiculty of the knapsack pro-blem because it is an NP-complete problem, and is therefore one of the most difficult computational problems of a cry~to-gr~phic nature. ~See for example, A. V. Aho, J.E. Hopcraft and J. D. Ullman, The Design and Analysis of Computer Algo-ri hms, Reading, Ma.; Addison-Wesley, 1974, pp. 363-404.) _ _ _ ._ Its ~ecJree of difficulty, however, is dependen-t on the choice of a. If a = (1, 2, 4, ... 2~ )), then solving for x is equivalent to findin~ the binary representation of S.
Somewhat less trivially, if for all i, i-l ai > ~ aj (1) j=l , then x is also easily found: xn = 1 if and only if S > an, andr for i = n-l, n-2, ... lr xi = 1 if and only if j, ~t ' ~ 2~ 3 S -~ xj * ai > ai (2) i = i + 1 If the components of x are allowed to take on integer values between O and Q then condition (1) can be replaced by aj > Q ~ a~
5 and x; can be recovered as the integer part of (S - ~ xj*aj)/aj.
Equation (2) for evaluating x; when x; is binary valued is equiva-lent to this rule for Q = 1.

A trap door knapsack is one in which careful choice of a allows -the desi~ner to easily solve for any x, but which prevents an~one else from findiny the solution. Two methods will ~e described for constructing trap door knapsacks, but first a description of their use in a pub]ic key cryptosystem as shown in Eigure 1 is provided. Receiver 12 generates a -trap door knapsack vector a, and either places it in a public file or transmits it to transmi-tter 11 over the insecure channel 19. Transmitter 11 represents the plaintext message X as a vector x of n O's and l's, computes S = a * x, and transmits S to receiver 12 over the insecure channel 19.
Receiver 12 can solve S for x, but it is infeasi.ble for eaves-dropper 13 to solve S ~or x.
In one method for generating trap door knapsacks, the l~ey generator 22, uses random numbers generated by key source 26 to select two large lntegers, m and w, such that w is invertible modulo m, (i.e., so that m and w have no common factors except 1). For example, the key source 26 may contain a random number generator that is implemented from noisy amplifiers (e.g., Fairchild ~ 709 operational amplifiers) with a polarity detector. The key generator 22.is - provided a kr,apsack vector, a' which satisfies (1) and therefore allowssolu-Eion of S' = a' * x, and transforms the easily solved knapsack vectora' into a trap door knapsack vector a via the relation ai = w * a i mod m ~3) The vector a serves as the publlc enciphering key E on line E, and is either placed in a public ~ile or transmitted over the insecur~ channel 19 to transmitter 11. The enciphering key E is thereb~ macle available to both the transmi-tter 11 and the cavesdropper 13. The transmitter 11 uses the enci-pherincJ ~ey E, equal to a, to generate the ciphertext S
from the plaintext messac3e X, represented by vector x, by letting S = a -k X. ~lowever, because the ai may be pseudo-randomly distributed, the eavesdropper 13 who kno~s a, but not w or m, cannot feasibly solve a knapsack problem involving a -to ob-tain the desired message x.
The deciphering device 16 of receiver 12 is given w, m and a as its secret deciphering key D, and can easily compute S = l/w * S mod m (4) = l/w * ~ xi * ai mod m (5) = l/w * ~,xi * w * ai mod m (6) = ~ Xi * ai mod m (7) If m is chosen so that m > ~, ai . (8) ~hen (7) implies that S is equal to ~ xi * ai in integer arithrnetic as well as mod m. This knapsack is easily solved for x, which is also the solution to the more dif~icult trap door knapsack problem S = a * x. Receiver 12 is therefore a~le to recover the plaintext message X, represented as the binary vector x. But, the eavesdropper 13's trap door knapsack problem can be mad2 computationally infeasible to solve, thereby preventing the eavesdropper 13 from recovering the plaintext message X.
To help make these ideas more clear, an illustrative example is given in which n = 5. Taking m = 8443, _ = (171, 196, 457, 1191, 2410), and w = 2550, then a = (5457, 1663, 216, 6013, 7439). Given x = (0, 1, 0, 1, 1) the enciphering device 15 computes S = 1663 + 6013 + 7439 = 15115. The de-ciphering device 16 uses Euclid's algorithm (see for instance, 8~

D. Knuth, The Art of o puter_Proc~_a m ng, vol. II, ~cl~ison-~e~ley, 1969, R~ading,~la. ) to compute l/w = 3950 and then compu~:es S = l/w * S mod m (9) = 3950 * 15115 mod 8443 = 3797 Because S ~ a5, the decipllering device 16 determines tha-t X5 = 1. Then, using (2) for -the a vec-tor, it determines that x4 = 1~ x3 = 0~ x2 = 1~ xl which is also the correct solution to S = a * x.
The eavesdropper, 13 who does no-t know m, w or a has great difficulty in solving for x in S = a * x even though he knows the rnethod used for generatiny the trap door knapsack vec-tor a. ~lis -task can be made infeasible by choosing lar~er values for n, m, w and a . His task can be further compl.icated by scramblin~ the order of the ai, and by adding differen~ ranclom multiples of m to each of the ai.
The example given was extremely small in size and only intended to illustrate the technique. Using n = 100 (which is the lower end of the usable range Eor high security systerns at present) as a more reasonable value, it is sug ges~ed that m be chosen approximately uniformly from the numb~rs between 221 + 1 and 2 - l; that al be chosen uniformly from the range (1, 21)i that a 2 be chosen uni-formly from (21 + 1, 2 * 21)i that a3 be chosen uniformly from (3 x 21 + 1, 4 * 21); ... and that ai be chosen niformly from ((2i-1-1) * 21 ~ 1 2i-1 100 w be chosen uniformly from (2, m-2) and then divided by the greatest cornmon divisor of (w , m) to yield w.

~ ~L 2 ~

Thcse cho:ices ensure that (8) is met and that an eavcsclropper 13 has at least 2l possibi.lities Eor each parameter and hence cannot search over them all..
The encipherillg device 15 is sho~.~n in Figure 2.
The sequence of integers al, a2, .... an is presented sequen-tially in synchronization with the sequential presentation xl, x2, ... xn. The S register 41 is initially set -to zero. If xi = 1 the S re~ister 41 contents and ai are added by adder 42 and the result placed in the S
register 41. If xi = 0 the con-tents of the S register 41 are left unchanged. In either event,i is replaced by i + 1 until i ~ n, in which cas~ the enciphering operation is complete. The i register 43 is initially set to zero and inc.remented by 1 after each c~cle of the enci-phering device. Either the adde:c 42, or a special up counter can be used to increment the i rec~ister 43 conte~ts. With the ran~e of values suggested above, the S and i registers 4i and 43 both can be obtained from a single 1024 bit random access memory (RAM) such as the Intel 2102. The implementation of the adder 42 will be described in more detail later, as will the implementation of a comparator 44 required for co~paring i and n to determine when the enciphering operation is ccmplete.
The key generator 22 comprises a modulo m multiplier, such as tha-t depicted in Figure 3, for producing ai = w * ai mod m. The two numbers w and a i to be multi-plied are loaded into the ~ and A registers 51 and 52 respectively, and m is loaded into the M reglster 53. The product w * a i modulo m will be produced in the P register 54 which is initially set to zero. If k, the number of bits in the bina.ry representation of m, is 200, then all four ~2~

re<3;sl-ers can be obtainec1 from a single 1024 bi-t R~`~
s.lch as the Intel 2102. Thc implementation of Figure 3 is based on the act that wa i mod m -- t~Oai mod m ~

2 wlal mod m -~ 4 w2ai mod m + ... + 2k 1 Wk lai mod m.
To mul-tiply w times a;, if -the ric~htmost bit, con-taining wO of the W register 51 is 1 -then the contents of the A register 53 are added to the P register 54 by adder 55. If wO = 0, then the P register 54 is unchanged. Then the ~l and P register contents are compared by compara-tor 56 to determine i~ the contents of the P reglster 54 are greater than or equal to m, the conten-ts of the M register 53, If the contents of the P register 54 are greater -than or equal to m then subtractor 57 subtracts m rom the con-ten-ts of the P register 54 and places the diEference in the P register 54, if less than m the P register 54 is unchanged.
Next, the contents of W re~ister 51 are shifted one bit to the right and a O is shited in at the left so its contents become Owk_l w~_2...w2wl, so that w is ready for computing 2wla mod m. The quantit-y 2a mod m is computed for this purpose by using adder 55 to add a to itself, using comparator 56 to determine if the result, 2a , is le~s than m, and using subtrac-tor 57 for sub-trac-ting m from 2a i, the result is not less than m. The result, 2a mod m is then stored in the A regis-ter 52. The rightmost bit~
containing ~1' o-E the W register 51 is then examined, as before, and the process repeats.
This process is repeated a maximum of k times or until the W register 51 contains all O's, at which point wa modulo m is stored in the P register 54.

~s an example of these operations, consider the - problem of cornputing 7 x 7 modulo 23. Tne ~ollowing steps show the successive contents oE the W, A and P registers which result in the answer 7 x 7 - 3 modulo 23.
i W (in binary) A P
0 00111 7 o 1 00011 14 0 ~ 7 - 7 2 00001 5 7 + 14 = 21

3 00000 10 21 + 5 = 3 mod 23 Figure 4 depicts an implementation of an adder 42 or 55 for adding two k bit numbers p and z. The numbers are presented one bit at a time to the device, low order bit first, and the delay element is lnitially set to 0.
(The delay represents the binary carry bit.) The AND gate 61 determines if the carry bit sllould be a one based on Pi and Zi both being 1 and the AND gate 6? de-termines iE the carry should be 1 based on the previous carry being a 1 and O:l~ of Pi or Zi being 1- If either of these two conditions is met, the OR gate 63 has an output of 1 indicating a carry to the next stage~ The two exclusive-or (XOR) ~ates 64 and 65 determine the ith bit of the sum, si, as the modulo-2 su~ of Pi~ Zi and the carry blt from the previous stage The delay 66 stores the previous carry bit. Typical parts fo~ implementing these-gates and the delay are SN7400, SN7~04, and SN7474.
Figure 5 depicts an implementation of a comparator 44 or 56 for comparing two numbers p and m. The two numbers are presented one bit at a time, high order bit first. If neither the p <m nor the p > m outputs have been triggered after the last bits pO and mO have been presented, then p = m.
The first triggering of either the p< m or the p~ m output ca~lscs thc comparison op~ration to ccase. The two AND
~ates 71 and 72 ec~ch have one input inverted (denotecl by a circle at the input). ~n SN7400 and 5~7404 provide all of the needed log;c circuits.
Figure 6 clepicts an impleme~ntation of a su~tractor 57 for sub-tracting two numbers. Because the numbers sub-tracted in Figure 3 always produce a non-neyative difference, there is no need to worry about negative differences The larger number, the minuend, is labelled p and the sm~ller number, -the subtrahend, is labelled m. Both p and m are presented serially -to the subtrac-tor 57, low order bit first. A~D gates 81 and 83, OR gate 84 and XOR gate 82 determine if borrowiny (negative carrying) is in effec-t.
A borrow occurs if either Pi = and mj - 1, or Pi = mi and borrowing occurred in the previous stage. The delay 85 stores the previous borrow st:ate. The ith bit of the difference, di, is computed as t:he ~OR, or modulo-2 diEfer-ence, OL Pi, mi and the borrow bit. The ou-tput of XOR gate ~2 gives the modulo-2 difference bet~een Pi and mi, and XOR
s~te 86 takes tne modulo-2 difference of this with the pre-vious borrow bit. Typical parts for implementing these gates and the delay are SN7400, SN7404 and SN7474.
The deciphering device 16 is depicted in ~igure 7.
It is given the ciphertext S, and the deciphering key con-sisting of w, m and a , and must compute x.
To compute x, first, w and m are input to a modulo m invertor 91 which computes w mod m. It then uses the modulo m multiplier 92 to compute S = w S mod m. As noted in equations (7) and (8), S = a * x, which is easily solved for x. The co;nparator 93 then compares S
with a and decides that xn = 1 if S ~ a n and that xn~

if S <an. If xn -- 1, S is replaced by S -- a , computed by the subtractor 94. If xn = 0, S is unchanged. The process is repeated for an 1 and xn 1 and continues until x is computed. The j re~ister 95 is initially set to n and is decremented by 1 after each stage of the deciphering process until j--0 results, causing a halt to the process and signifying x is computed. Either the subtractor 94 or a do~n counter can be used to decrement -the con-tents of the j register 95. The comparator 96 can be used to compare the contents of the j register 95 with zero to determine when to halt the process. The modulo m multiplier 92 is detailed in Fiyure 3; the comparator 93 is cletailed in Figure 5; and, the subtractor 94 is detailed in Figure 6. The modulo m invertor 91 can be based on a well kno~n extended version of Fuclid's algorithm. (See for instance, D. Knuth, The ~rt of Cornputer Programmin~, Vol. II, Addison-Wesley, 1969, Read-ing, Ma., p. 302 and p. 315 yroblem 15.) As described by ~nuth, an implementation requires six registers, a comparator, a divider and a subtractor. All of these devices have already been detailed with the exception of the divider.
- Figure 8 details an apparatus for dividing an integer u ~y another integer v to compute a quotient q and a remainder r, such that 0< r <v - 1. First, u and v, represented as binary numbers, are loaded into the U and V registers 101 and 102, respectively. Then v, the contents of the V reyister 102, are shifted to the left until a 1 appears in vk 1' the leftmost bit of the V register 102. This process can be effected by using the complement of vk 1 to drive the shift control on a shift register, such as the Siynetics 2533, which was initially set to zero. The contents of the up-do~n counter 103 equal the number of bi-ts in the quotient less one.

~fter this initialization, v, tne contents of the V recJister 102 are compared with the contents of the U recJister 101 by the comparator 104. If v> u then qn, the most significant bit of the quotient, is 0 and u is left unchanged. lf v < u then qn = 1 and u is replaced by u-v as computed by the subtractor 105. In either event, v is shifted to the right one bit and the v~ u comparison is repeated to compute qn 1~ the next bit in the quotient.
This process is repeated, with the up-down counter 103 being decremented by 1 after each iteration until it contains zero. At that point, the quotient is complete and the remainder r is in the U register 101.
As an exam~le, consider dividing 1~ by 4 to produce q=3 and r=2 with k=4 being the re~ister size. Because u =
lS 14 - 1110 and v = 4 = 0100 in binary ~orm, -the V reyister 101 is left shifted only once to produce v = 1000. AEter this initialization, it is founcl that v< u so the first q~otient bit ql = 1, and u is replaced by u-v; v is re-~laced by v right shifted one bit and the up-down counter 103 i5 decremented to zero. This signals that the last quotient bit, qO, is being computed, and that after the present iteration the remainder, r, is in the U register.
The following sequence of register contents helps in follow-irg these operations.
U V counter qi ~110 0100 0 0010 ~- halt --It is seen that q = 11 in binary form ard is equivalent to q = 3, and tha-t r = 0010 in binary form and is equivalent to r = 2.

~nother method for ~enerating a trap cloor knapsack vector a IlSeS the fact that a multiplicative knapsack is easily solved iE the vector enl:ries are relatively pr;me.
Given a = (6, 11, 35, 43, lG9) and a partial product P =
2838, it is easily determined that P = 6 * 11 * 43 because 6, 11 and 43 evenly divide P bu-t 35 and 169 do not. A
multiplicative knapsack is transformed into an additive knapsack by takin~ lo~arithms. To make both vectors have reasonable values, the logarithms are taken over GF(m), the Galois (finite) field with m elements, where m is a prime nurr~er. It is also possible to use non-prime values of m, but the operations are somewhat more difficult.
A small example is a~ain helpful. Taking n=4, m=
257, a = (2, 3, 5, 7) and the base oE the logarithms to be b = 131 results ln a = (80, :L83, 81, 195). That is 1313 = 2 mod, 257; 131183 = 3 rnod 257i etc. Finding logari thms over G~ (m) is relal::ively easy if m-l has only small prime factorsO
Now, i, the deciphering device 16 is given S =
183 + 81 = 264~ it uses the deciphering key D consisting of m, a' and b, to compute S = bS mod m (10) = 131264 mod 257 = 15 = 3 * 5 ,o ,1 ,1 ,0 = al * a2 * a3 a4 which implies that x = (0, 1, 1, 0). This is because ( ~ ai * Xi) (11) (a. * x.) n b 1 1 (12) = 11 ai i mod m (13) However, it is necessary that n a i < m (14) i = 1 ,Xi ,Xi to ensure that '~i mod m equclls n ai in arithmetic over the integers.
rrhe eavesclropper 13 kno~s the enciphering key E, comprised of the vector a, but docs not kno~ tlle deciphering key D and fac2s a compu-tationally infeasible problem.
The examplc given was acjain small and only intended to illustrate the technlque. Taking n = 100, if each ai is a random, 100 bit prime number, then m would have to be approximately 10,000 bits long to ensure that (14) is met.
While a 100:1 da-ta e~pansion is accep-table in cer-tain appli-cations (e.g., secure key distribution over an insecure channel), it probably is not necessary for an opponent to be so uncertain of the al. It is even possible to use the first n primes for the ai, in which case m could be as small as 730 bits long when n = 100 and still meet condi-tion (14). As a result, there is a possible tradeoff be-tween security ~nd data expansion.
In this embodiment, the enciphering device 15 is of the same form as detàiled in Figure 2 and described above. The deciphering device 16 of ~he second embodiment i~ detailed in Figure 9. The ciphertext S and part of the deciphering key D, namely b and m, are used by the expon-er~iator 111 to compute p = bS mod m. As noted in equations (l?) to (14) and in the exa~ple, P is a partial product OL ~he {ai}, also part of the deciphering key D. The di-vider 112 divides P by ai for i = 1, 2, ... n and delivers only the remainder ri, to the comparator 113. If ri =
then ai evenly divides P and xi = 1. If ri ~ then xi =
0. The divider 112 may be implemented as detailed in -Figurc 3 and described above. The comparator 113 may be implemented as detailed in Figure 5 and described above;
although, more efficient devices exist for comparing with zero.
The exponentiator 111, for raising b to the S
power modulo m, can ~e implemented in electronic circuitry as shown in Figure 10. Figure 10 shot~s the initial con-tents of three re~isters 121, 122 and 123. The binary representation of S (Sk_1 Sk-2 5150) - -the S register 121; 1 is loaded into the R register 122;
and the binary represen-tation of b is loaded into the B
register 123, corresponc1ing to i=0. The number o-f bits k in each reqister is the least integer such that 2k > m.
If k = 200, then all three registers can be obtained from a single 1024 bit random access memor~ (P~M) such as the Intel 2102. The implementation of multiplier 124r for multiplying two numbers modulo m, has been described in .-tail in figure 3.
Re~erring to Figure 10, if the low order bit, con-taining sO, o~ the S reyister 121 equals 1 then the R
register 122 and the ~ register 123 contents are multi-plied modulo m and their product, also a k bit quantity, replaces the contents of the R register 122. If s = o, the R register 122 contents are left unchanged. In either case, the B register 123 is then loaded twice into the multiplier 124 so that the square, modulo m, of the B
- register 123 contents is com~uted. This value, b (2 ) , replaces the contents of the B register 123. The S register 121 contents are shifted one bit to the right and a O is shifted in at the left so its contents are not~ sk lSk 2 s 2s 1 ~

Tlle low or~ler bit, containing 51~ of the S register 121 is examined. If it e~uals 1 tllen, as beEore, the R
re~ister 122 and B rccJister 123 contents are ~ultiplied modulo m and their product replaces the contents of the R
re~ister 122. If the low order bit equals O then the R
register 122 contents are leEt unchanged. In either case, the contents of the B register 123 are replaced by the square, modulo m, of the previous contents. The S register 121 contents are shifted one bit to the right and a O is shited in at the left so its contents are now OOsk_ Sk-2 - S3S2 This process continues until the S register 121 contains all O's, at which point the value oE bS modulo m is stored in the R re~ister 122.
An example is helpful in Eollowiny this process.
Taking m = 23, we fincl k=5 f.rom 2k > m. If b a 7 and S =
18 then b = 718 = 162841359791t)449 = 23(70800591213497) . 18 so bs modulo m equals 18. This straightforward but laborious method of computing bS modulo m is used as a c.~ec~ to show that the method of Figure 10, shown below, yi~lds the correct result. The R register 122 and B register 1 3 contents are shown in decimal form to facilita-te under-s.anding.
i S (in binary) R B

4 00001 3 6 . 30 5 00000 18 13 ~rhe row m.lrkecl i=-0 corresponds to the initial contents of each recJister, S = ]8, R = 1 and B = b = 7. Then, as dcscril~ed above, because the ricJht most bit of S rccJister 121 is O, the R register 122 contents are left unchanged, the contcnts of the B register 123 are replaced by the square, modulo 23, of its previous contents (72 = 49 = 2 x 23 + 3 = 3 modulo 23), the contents oF the S register 121 are shifted one bit to the right, and the process con-tinues. Only when i = 1 and 4 do the right-most bit of the S register 121 contents equal 1, so only going from i = 1 to 2 and from i = 4 to 5 is the R register 122 replaced by RB modulo m. When i = 5, S - O so the process is complete and the result, 18, is in the R register 122.
Note that the same resu:Lt, 18, is obtained here as in the straightforwaxd calcu:La-tion of 718 modulo 23, but that here large numbers never resulted~
~nother way to unders~and the process is to note t~at the s re~ister 123 contains b, b2, b4, b8 and bl6 when i = 0, 1, 2, 3 and 4 respectively, and that bl3 =
bl6b2, so only these two.values need to be multiplied.
The key generator 22 used in the second e~odiment is detailed in Figure 11. A table of n small - prl`me numbers, Pi, is created and stored in source 131, ~hich may be a read only memory such as the Intel 2316E. The key source 26, as described above, generates random numbers, ei The small prime numbers from the source 131 are each raised to a different power, represented by a random number ei from key source 26, by the exponentiator 132 to generate Pi 1 for i = 1 to n~
The multiplier 133 then compu-tes the product of all the -~4-.

n e.
piei which m~y bne reprcsented as ~ Pi Tne product of all the Pi ~ Pi 1~ then is incrementcd by one by addcr 13~ to ~enerate the potential value of m. IE it is desired that m be prime, the potential value of m may be tested for primene~ss by prime tes-ter 135.
Prilne testers -For tes-ting a number m ~or primeness ~hen the factorization of m-l is known (as here, m~ Pi ~, are well ~ocurnented in the literature.

(See for instance, D. ~nuth, The ~rt of _o-rlr~ut-r-progra-mming~
vol. II, Seminumerical Algorithms, pp. 347-48.) As described in the above reference, the prime tester 135 requires only a means for exponentiating various numbers to various powers modulo m, as described in Figure 10~ When a potential value of m is found to be prime, it is output by the public key generatox of Figure 11 as the variable m. The a vector's elements, ai, can then be chosen to be the n small prime numbers, Pi, from source 131.
The base, b, of the logarithms is then selec-ted as a random number by the Xey source 26.
The elemen-ts of the vector a are computed by the logarithmic convertor 136 as the logari-thms, to the base b, of the elements oE -the a vector over GF(rn). The operation and structure of a logarithmic conver-tor 136 is described below It is well known that if p is pri~e then zP = 1 (mod p), 1 < z < p-l ~15) Corsequently arithmetic in the exponent is done modulo p-l, not modulo p. That is x x~mod p-l ) ( d ) (16) for all integers x.
The algorithm for computing logarithms mod p is best understood by first considering the special case p = 2n+1.
We are given ~, p and y, with ~ a primitive element of GF(p)~ and ~ust find x such that y =~ X(mod p). We can assume O < x <p-2, since x = p-l is indistinguishable from x = O.
When p = 2n+1, x is easily determined by finding -the binary expansion {bo, ..., bn 1} of x, The least significant bit, bo, of x is determined by raising y to the (p-l)/2 = 2n l power and applying the rule y(P~l)/2(mOd P) = {_1, b ~ 1 (17) This fact is established by noting that since a is primitive a~p~l)/2 = -1 (mod p), (18) and therefore ~p-1)/2 = (ax)(p-1)/2 = (_l)x (mod p)- (19) The next bit in the expansion of x is then determined ~y letting z = y a~bo = aX~ (mod p) (20) where n-1 1 i=1 i ~21) Clearly x1 is a multiple of 4 iE and only if ~1 - 0. IE bl =
l then x1 is divisible b~t 2, but not by 4. Reasoning as before, ~(P~1)/4(mod P) = ¦-1. b~ ~ 1 (22) T'r.e remaining bits of x are de-termined in a similar manner.
Th.s algorithm is summarized in the flow chart of Figure 12.
To aid in underst~anding this flowchart, note that at the start of the ith loop, m = (p-l )/2i+1 . (23) and x.
z = ~ 1 (mod p) ~24) where n-l x; = ~ bj2J. (25) Thus raising z to the mth power gives zm = ~x jm) ~(p-l )/2] (xj/2i) x /2i b.
= (-1) 1 = (-1) 7 (mod p), (26 so that zm = 1 (mod p) if and only if bj = O, and Z = -1 (mod p) if and only iE bi = 1~
As an e~ample, cons:ider p--17=24-~1. Then ~ = 3 is priMitive (~ = 2 is not primitive because 28 = 256 = 1, mod 17). Gi~7en y = 10 the algorithm computes x as follows (note that ~ = x 1 = 6 since 3x6 = lS = 1, mod 17):
i Z ~ m W bi It thus finds that x = 2 + 21 = 3. This is correct because = 33 = 27 - 10 (mod 17).
We now generali~e this atgorithm to arbitrary primes p. Let p - 1 = PllP22 Pnk P <P (27) be the prime factori~tion of p--L, where the Pi are distinct primes, and the ni are positive lntegers. The ~alue of x (mod pnii) will ~e determined for i = 1, ..., k and the re-sults combined via -the Chinese remainder theorem to obtain x (mod ~ pii) = x (mod p~l) = x (28) i=l.

sir.ce 0 ~ x ~p-2. The Chinese remainder theorem can be imple-men~ed in O~k log2p) operations and O(k log2p) bits of memory. (~le count a multiplication mod p as one operation.) Consider the following expansion of x (mod ~i i) n.-l .
x (mod pinj) = ~ bj pji (29) where 0 < bj < Pi -1.
The least significant coef-ficient, bo, is determined by raising y to the ~P-l)/pi power, y(p-l)/pj = ~(p-l)x/pj = y x _ (y )bo ~mod p) (30) where y; = ~(p-l)/pj (mod p) ~ ~ ~ (31) is a prirn;~ive Pith root oE unity. There are therefore only Pi possible values for y(P l)/Pi (mod p), and the resultant value uniquel~ determines bo.
The ne~t di.git, bl, in the ~ase Pi expansion oE
x (mod pnil) is determined by letting z = y ~ o = ~x~(mOd p), (32) where nj-l xl = ~ b p J (33) Now, raising z to the (p-l)/pi2 power yields z(p l)/pj2 = a(p-l)~x~/pj2 xl/p = (y )b~ ( d ~ ( Again~ there are only Pi possible values of z(P l)/Pi and this value determines bl. This process is continued to determine all the coefficients, ~?j.
The flow char-t of figure l3 su~marizes the algorithm for compu-ting the coeficients (b;) of the expansion (29).
This algorithm is used k t.imes to compute x(mocl Pi l) for i - l,2, ... k, and these results are combined by the Chinese remainder theorem to obtain x. The function gi(w) in figurel3 is defined by ` y; i = w (mod p), O<gj(w)~p~ 5) where Yi is defined in (3l).

If all prime factors, {Pi}~ of p-l are small then the gi(W~ functions are easily implemented as tables, and computing a logarithm over GF(p) requires o(log2P) operations and only minimal memory for the gi(w) tables~
The dominant computational requirement is computing w = zn, which requires O(log2p) operations. This loop is traversed k k n; times, and if all Pi are small, ~ nj is approximately ~29--~ ~ ~.

1O-~2p. Thus ~ en p-l has only smalL pLime factors it is possible to com~ute logarithms over GF(p) easily.
As an e.~amp]e, consider ~=19, ~=2, y=10. Then p-l =
2.32 and pl =2, nl=l, P2=3 and n2=2. The computation of x(mod plnl) = x(mod 2) involves compu-ting y(P l)/Pl = ~ 9 =
512 = 13 (mod 19~ so bl = 1 and x (mod 2) = 2 = 1 (i.e., x is odd). Next the flow chart of Eigure 13 is re-executed for P2 = 3 n2=2 as follows (~=10 because 2 x 10 = 20 = 1, mod 19; further Y2 = ~6 = 7 and 7 = 1, 71 = 7, and 72 = 11 (mod 19) 50 g2(l)=o~ g2(7) = 1 and g2(11) = 2):

Z B n j W b 1~ 12 2 1 11 2 so that x (mod P2 2) = x (mod 9) = 2.3 ~ 2 31 _ 8.
Knowing that x(mod 2) = ]. and that x(mod 9)=8 implies that x(mod 18) = 17. (Either the Chinese Remainder Theorem can be used, or it can be realized that x=8 or x=8+9=
17 and only 17 is odd.) As a check we find that 217=131rO72=
lo (mod 19), so that y= ~x (mod p)~
It is seen that the logarithmic convertor requires a mod p inverter for computing ~ =~ (mod p). As already noted, this can be obtained using the extended form of Euclid's algorithm, which requires the use of the divider of Figure 8, the multiplier of Figure 3 , and the comparator of Figure 5.
The logarithmic convertor also requires -the divider of Figure 8 (for computing successive values of n)~ the adder of Figure 4 (for incrementing j), the modulo p exponentiator of Figure 10 (for computing ~ and ~bj and for precomputing the gi(W) table), the modulo p multiplier of Figure 3 (for computing successive values of Z), and the comparator of Figure 5 (for determining r w}len j = Ni). 'I`he lo-J~rithlnic convertor's use of the Chinese i~mai.nder thcorcm rec~uires only devices which have alrcady been describcd (the rnultiplier of figure 3 and a modu]o m inver-ter).

In the first metllod o~ gellerating a trap door knap-sack vector, a very dif~icult knapsack problem involving a vcctor a was transEormed into a very si~p]e and easily solved knapsack problem involving a , by means of the transforrnation:
a = l/w * a mod m (36) A knapsack involvinc~ a could be solved because it was trans-formable into another knapsack involving a that was solvable.
Notice, though, that it does not matter why knapsacks invol-ving a are solvable. Thus, rather than requiring that _ _ satisfy (1), it could be required that a be transformable into another knapsack problem involving a , by the transforma-tion:
ai = 1/w * ai mod m (37) where a satisfies (1), or is otherwise easy to solve. Having done the transEormation twice, there is no problem in doing this a th;rd time; in fact, it is clear that this process may be iterated as often as desired.
I~ith each successive transformation, the structure in the publicly known vector, a, becomes more and more obscure.
In essence, we are encrypting the simple knapsack problem by the repeated application of à transformation which preserves the baslc structure of the problem. The iinal result a appears to be a collection of random numbers. The fact that the pro-blem can be easily solved has been totally obscured.
The original, easy to solve knapsack vector can meet any condition, such as (1~ which guarantees that it is easy to solve. For example it could be a multiplicative trap door knapsack. In this way it is possible to combine both of the trap door knapsack methods into a single method, which ~s pre-sumably harder to break.
It is important to consider the rate of growth of _, because this rate determines the data e~pansion involved in transmitting the n dimensional vector x as the larger quantity S.
-3~~

'ihe raLe o.~ ~3ro~tll cle--cnds orl the method of selecting the nulil}3crs~ but in a "rcasonable" ilnplementation, with n = 100, each ai will be at most 7 bits l~rger than the corresponding a'i, each a'i will be at mos-t 7 bits larger than a i~ e-tc., etc. Each successive stage of the transformation will in-crease the size of -the problem by only a small, fixed amount.
If we repeat the transformation 20 times, this will add at most 1~0 bits to each ai~ If each ai is 200 bits long to begin with, then they need only be 340 bits long after 20 stages. The knapsack vector, for n = 100, will then be at most 100*340 = 34 kilobits in size.
Usual dlgital authenticators protect against third party forgeries, but cannot be used to settle dlsputes between the -transmi.tter 11 and receiver 12 as to what message, if any, was sent. A true ~igital signature is also called a receipt because i.t allows the receiver 12 to prove that a particular message M was sent to it by the transmit-ter 11.
Trap door k~apsacks can be used t.o generate such receipts in the following manner.

If every message M in some large fixed range had an inverse image x, then it could be used -to provide receipts.
Transmitter 11 creates knapsack vectors _ and b such that _ ls a secret key, such as an easily solved knapsack vector, and that _ is a public key, such as is obtained via the relation bi = w * bi mod m . (38) ~ector _ is then either placed in a public file or transmitted to receiver 12. ~hen transmitter 11 want.s to provide a re-ceipt for message M, transmitter 11 would compute and tr-ansmit x such that b * x = M. Transmitter 11 creates x for the desired message M by solving the easily solved knapsack pro-blem.

L23~

M = l/w * M mod m (39) -- l/w * ~ xi * bi mod m (40) = l/w * ~ xi * w * bi mod m (41) ~ Xi * bi mod m (42) The receiver 12 could easily compute M from x and, by checking a date/time field (or some other redundancy in M), determine that the messaye M was authentic. Because the receiver 12 could not genera-te such an x, since it requires b which only the transmitter 11 possesses, the receiver 12 saves x as proof that transmitter 11 sent message ~1.
This method of generating receipts can be modified to work when the density of solutions (the frac-tion of messages M between O and ~ bi which have so~utions to b * x = M) is less than 1, provlded it is not too small. The messacJe M is sent :in plaintext form, or encrypted as descrihed above iE
eavesdropping is a concern, and a sequence of related one-wa~,y function~ Yl = Fl(M), Y2 = F2(M), ... are computed. The transmitter 11 then seeks to obtain an inverse image, x, for yl~ Y2, ... until one is found and appends the corres-ponding x to M as a receipt. The receiver 12 computes M
b * x and checks that M = yj~lhere i iS
witrin some acceptable range.
The sequence of one-way functions can be as simple as:
Fi(M) = F(M) -~ i (43) or Fi(M) - FtM + i~ (44) where F(*) is a one-way function. It is necessary that the range of F(*) have at least 21 values to foil trial and error attempts at forgery.

It is also possible to combine the message and receipt as a single message-receipt datum. If the acceptable range for i is between 0 and 2I-l and the message is J bits long then a single nulllber, J + I
bits long, can represent hoth the message and i. The translnitter 11 checks for a solution to b * x = S for each of the 2I values of S
which result when, for example, the first J bits of S are set equal to the Message and the last I bits of S are unconstrained. The first such solution x is conveyed to the receiver 12 as the message-receipt.
Receiver 12 recovers S by computing the dot product of the public key b and the message-receipt combination x, and retaining the first J
bits of S thus obtained. The authenticity of the message is validated by -the presence of appropriate redundancy in the message, either natural redundancy if the message is expressed in a natural language such as English, or artificial redundancy such as the addition of a date-time -Field in the message.
Redundancy ;s used here in the sense of in~ormation theory [Claude E.
Shallnon, "The Mathema-tical Theory oF Comlnunication", Bell ~ystem _echnical Jourr,al, ~ol. 27, p.379 and p. 623, 1948~ and complexity theory ~Gregory J.
Chaitin "On the Length of Programs for Computing Finite Binary Sequences", Journal of the Association for Computing Machinery , Vol. 13, p. 547, 1966]
to rneasure the structure (deviation from complete randomness and unpredicta-bili~y~ in a message. A source of messages possesses no redundancy only if all characters occur with equal probability. If it is possible to guess the characters of the message with a better than random success rate, the source possesses redundancy and the rate at which a hypothetical gambler can make his fortune grow is the quantitative measure of redundancy. [Thomas M. Cover and Roger C. King, "A Convergent Gambling Estirnate oF the Entropy oF English", Technical Report ~22, Statistics Department, Stanford University, November 1, 1976]. Humans can easily validate the message by performing a redundancy check (e.g., determine iF the message is grammatically correct English).
By simulating the gambling situation, it is possible For a machine to validate whether or not a message possesses the redundancy apprGpriate to its claimed source.
~ 3~--There are many methods for implementing ~his form of the invention. Part of the dcciphering key D could be pub]ic knowledge ra-ther than secre-t, provided the part of D which is withheld prevents the eavesdropper 13 from re-covering the plaintex-t message X.
Variations on the above described embodiment are possible. For example, in some applications, it will prove valuable to have the ith receiver ~f the system generate a trap door knapsack vec-tor a(i)asabove, and place the vector or an abbreviated representation of the vector in a public file or directory. Then, a transmitter who wishes to establish a secure channel will use a(i)asthe encipherîng key ~or transmitting to the ith receiver. The advantage is tha-t the it~l receiver, once havincJ proved his identity to the system through the use of his driver's license, finger-print, etc., can prove his identil:y to the transmitter by his ability to decipher data encrypted with enciphering key a(i). Thus, although the best ~ode contemplated Eor carrying out the present invention has been herein sho~n and described, it will-be apparent that modification and variation may be made without departing from what is regarded to be the subject matter of this invention.

Claims (17)

WHAT IS CLAIMED IS:

1. In a method of communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
providing random numbers at the receiver, generating from said random numbers a public enci-phering key at the receiver;
generating from said random numbers a secret deci-phering key at the receiver such that the secret deciphering key is directly related to and computationally infeasible to generate from the public enciphering key;
communicating the public enciphering key from the receiver to the transmitter;
processing the message and the public enciphering key at the transmitter and generating an enciphered message by an enciphering transformation, such that the enciphering transformation is easy to effect but computationally in-feasible to invert without the secret deciphering key;
transmitting the enciphered message from the trans-mitter to the receiver; and processing the enciphered message and the secret deciphering key at the receiver to transform the enciphered message with the secret deciphering key to generate the message.

2. In a method of communicating securely over an insecure communication channel as in Claim 1, further comprising:
authenticating the receiver's identity to the trans-mitter by the receiver's ability to decipher the enciphered message.

3. In a method of communicating securely over an insecure communication channel as in Claim 2 wherein the step of:
authenticating the receiver's identify includes the receiver transmitting a representation of the message to the transmitter.

4. In a method of providing a digital signature for a communicated message comprising the steps of providing random numbers at the transmitter;
generating from said random numbers a public key at the transmitter;
generating from said random numbers a secret key at the transmitter such that the secret key is directly re-lated to and computationally infeasible to generate from the public key;
processing the message to be transmitted and the secret key at the transmitter to generate a digital signa-ture at said transmitter by transforming a representation of the message with the secret key, such that the digital signature is computationally infeasible to generate from the public key;
communicating the public key to the receiver;
transmitting the message and the digital signature from the transmitter to the receiver;
receiving the message and the digital signature at the receiver and transforming said digital signature with the public key to generate a representation of the message;
and validating the digital signature by comparing the similarity of the message to the representation of the message generated from the digital signature.

5. A method of providing a message digital signature receipt for a communicated message comprising the steps of:
providing random numbers at the transmitter;
generating from said random numbers a public key at the transmitter;
generating from said random numbers a secret key at the transmitter such that the secret key is directly related to and computationally infeasible to generate from the public key;
processing the message and the secret key at the transmitter and generating a message-digital signature at said transmitter by transforming a representation of the message with the secret key, such that the message-digital signature is computationally infeasible to generate from the public key;
communicating the public key to the receiver;
transmitting the message digital signature from the transmitter to the receiver;
processing the message-digital signature and the public key at the receiver and transforming the message-digital signature with the public key; and validating the transformed message-digital signature by checking for redundancy.

6. In an apparatus for communicating securely over an in-secure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
means for generating random information at the receiver;
means for generating from said random information a public enciphering key at the receiver, means for generating from said random information a secret deciphering key such that the secret deciphering key is directly related to and computationally infeasible to generate from the public enci-phering key;
means for communicating the public enciphering key from the receiver to the transmitter;
means for enciphering a message at the transmitter having an input connected to receive said public enciphering key, having another input connected to receive said message, and serving to transform said message with said public enciphering key, such that the enciphering transformation is computationally infeasible to invert without the secret deciphering key;
means for transmitting the enciphered message from the transmitter to the receiver; and means for deciphering said enciphered message at the receiver having an input connected to receive said enciphered message, having another input connected to receive said secret deciphering key and serving to generate said message by inverting said transformation with said secret deciphering key.

7. In a method of communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
generating a secret deciphering key at the receiver by generating an n dimensional vector a', the elements of vector a', being defined by a? > ? aj for i =1,2,...n where n is an integer;
generating a public enciphering key at the receiver by generating an n dimensional vector a, the elements of vector a being defined by ai=(w * a? mod m)+km for i=1,2,...n where m and w are large integers, w is invertible modulo m, and k is an integer;
transmitting the public enciphering key from the receiver to the transmitter;
receiving the message and the public enciphering key at the transmitter and generating an enciphered message by computing the dot product of the message, represented as a vector x with each element being 0 or 1, and the public enciphering key, represented as the vector a, to represent the enciphered message S being defined by S=a*x transmitting the enciphered message from the trans-mitter to the receiver; and receiving the enciphered message and the secret deciphering key at the receiver and transforming the enci-phered message with the secret deciphering key to generate the message by computing S'-l/w*S mod m and letting xi=l if and only if [S' - ? xj * aj] ?a?

and letting xi=0 if [S' ? xj*a?]<a?
for i=n,n-1,...1.

8. In a method of communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
generating a secret deciphering key at the receiver by generating an n dimensional vector a', the elements of vector a' being defined by for i=l, 2,...n where ? and n are integers;
generating a public enciphering key at the receiver by generating an n dimensional vector a, the elements of vector a being defined by ai=(W*a? mod m)+km for i=1,2,...n where m and w are large integers, w is invertible modulo m and k is an integer;
transmitting the public enciphering key from the receiver to the transmitter;
receiving the message and the puhlic enciphering key at the transmitter and generating an enciphered message by computing the dot product of the message, represented as a vector x with each element being an integer between 0 and 1, and the public enciphering key, represented as the vector a, to represent the enciphered message S being defined by S=a*x;
transmitting the enciphered message from the trans-mitter to the receiver; and receiving the enciphered message and the secret deciphering key at the receiver and transforming the enci-phered message with the secret deciphering key to generate the message by computing S'=l/w*S mod m and letting xi be the integer part of [S'- ? xj* a?]/a?
for i=n, n-l,...l.

9. In a method of communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
generating a secret deciphering key at the receiver by generating an n dimensional vector a', the elements of vector a' being relatively prime and n being an integer;
generating a public enciphering key at the receiver by generating an n dimensional vector a, the ele-ments of vector a being defined by ai=logb a? mod m for i=1,2...n where b and m are large integers and m is a prime number such that m > ? a?

transmitting the public enciphering key from the receiver to the transmitter;

receiving the message and the public enciphering key at the transmitter and generating an enciphered message by computing the dot product of the message, represented as a factor x, and the public enciphering key, represented as the vector a, to represent the enciphered message S being defined by S=a*x;
transmitting the enciphered message from the trans-mitter to the receiver; and receiving the enciphered message and the secret deci-phering key at the receiver and transforming the enciphered message with the secret deciphering key to generate the message by computing S'=bS mod m and letting xi=l if and only if the quotient S'/ai is an integer and letting xi=0 if the quotient of S'/ai is not an integer.

10. In an apparatus for communicating securely over an in-secure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
means for generating a secret deciphering key at the receiver by generating an n dimension vector a', the elements of vector a' being defined by a? > ? aj for i = 1,2,...n where n is an integer;
means for generating a public enciphering key at the receiver by generating an n dimensional vector a, the elements of vector a being defined by ai=(w?? mod m)+km for i=1,2,...n where m and w are large integers, w is invertible modulo m, and k is an integer;
means for transmitting the public enciphering key from the receiver to the transmitter;
means for enciphering a message at the transmitter, having an input connected to receive the public enciphering key, having another input connected to receive the message, and having an output that generates an enciphered message that is a transformation of the message with the public encipher-ing key by computing the dot product of the message, repre-sented as a vector x with each element being 0 or 1, and the public enciphering key, represented as the vector a, to repre-sent the enciphered message S being defined by S=a*x means for transmitting the enciphered message from the transmitter to the receiver; and means for deciphering the enciphered message at the receiver, having an input connected to receive the enciphered message, having another input connected to receive the secret deciphering key, and having an output for generating the message by inverting the transformation with the secret deci-phering key by computing S'=l/w*S mod m and letting xi=1 if and only if and letting xi=0 if for i=n, n-1,...1.

11. In an apparatus for communicating securely over an in-secure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
means for generating a secret deciphering key at the receiver by generating an n dimensional vector a', the ele-ments of vector a' being defined by where 1 and n are integers;
means for generating a public enciphering key at the receiver by generating an n dimensional vector a, the elements of vector a being defined by ai = (w*a? mod m) + km for i=1,2 ... n where m and w are large integers, w is invertible modulo m, and k is an integer;
means for transmitting the public enciphering key from the receiver to the transmitter;
means, for enciphering a message at the transmitter, having an input connected to receive the public enciphering key, having another input connected to receive the message, and having an output that generates an enciphered message that is a transformation of the message with the public enciphering key by computing the dot product of the message, represented as a vector x with each element being an integer between 0 and 1, and the public enciphering key, represented as the vector a, to represent the enciphered message S being defined by S=a*x means for transmitting the enciphered message from the transmitter to the receiver; and means for deciphering the enciphered message at the receiver, having an input connected to receive the enciphered message, having another input connected to receive the secret deciphering key, and having an output for generating the message by inverting the transformation with the secret deci-phering key by computing S'=l/w*S mod m and letting xi be the integer part of [S' - ? xj*a?]/a?

for i=n, n-l,...l.

12. In an apparatus for communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver, the improvement characterized by:
means for generating a secret deciphering key at the receiver by generating an n dimensional vector a', the ele-ments of vector a' being relatively prime and n being an integer;

means for generating a public enciphering key at the receiver by generating an n dimensional vector a, the elements of vector a being defined by ai=logb a? mod m for i=1,2,...n where b and m are large integers and m is a prime number such that means for transmitting the public enciphering key from the receiver to the transmitter;
means,for enciphering a message at the transmitter, having an input connected to receive the public enciphering key, having another input connected to receive the message, and having an output that generates an enciphered message that is a transformation of the message with the public en-ciphering key by computing the dot product of the message, represented as a vector x with each element being 0 or 1, and the public enciphering key, represented as the vector a, to represent the enciphered message S being defined by S=a*x means for transmitting the enciphered message from the transmitter to the receiver; and means for deciphering the enciphered message at the receiver, having an input connected to receive the enciphered message, having another input connected to receive the secret deciphering key, and having an output for generating the message by inverting the transformation with the secret deci-phering key by computing S'=bS mod m and letting xi=l if and only if the quotient of S'/ai is an integer and letting xi=0 of the quotient of S'/ai is not an integer.

13. In an apparatus for enciphering a message that is to be transmitted over an insecure communication channel having an input connected to receive a message to be maintained secret, having another input connecteA to receive a public enciphering key, and having an output for generating the enciphered mes-sage, characterized by:
means for receîving the message and converting the message to a vector representation of the message;
means for receiving the public enciphering key and converting the public enciphering key to a vector representa-tion of the public enciphering key, and means for generating the enciphered message by computing the dot product of the vector representation of the message and the vector representation of the public enciphering key, having an input connected to receive the vector repre-sentation of the message, having another input connected to receive the vector representation of the public enciphering key, and having an output for generating the enciphered message.

14. In a method of communicating securely over an insecure communication channel of the type which communicates a message from a transmitter to a receiver the improvement characterized by:
generating a secret deciphering key at the receiver;
generating a public enciphering key at the receiver, such that the secret deciphering key is computationally infeas-sible to generate from the public enciphering key;
transmitting the public enciphering key from the receiver to the transmitter;
processing the message and the public enciphering key at the transmitter by computing the dot product of the message, represented as a vector, and the public enciphering key, repre-sented as a vector, to represent the enciphered message, such that the enciphering transformation is easy to effect but com-putationally infeasible to invert without the secret deciphering key;

transmitting the enciphered message from the transmitter to the receiver;
and processing the enciphered message and the secret deciphering key at the receiver and inverting said transformation by transforming the enciphered message with the secret deciphering key to generate the message.

15. In an apparatus for communicating securely over an insecure communication channel of the type which communi-cates a message from a transmitter to a receiver, the im-provement characterized by:
means for generating a secret deciphering key at the receiver;
means for generating a public enciphering key at the receiver, such that the secret deciphering key is compu-tationally infeasible to generate from the public enciphering key;
means for transmitting the public enciphering key from the receiver to the transmitter;
means for enciphering a message at the trans-mitter having an input connected to receive said public enciphering key and having another input connected to receive said message and serving to transform said message by com-puting the dot product of said message, represented as a vector, and said public enciphering key, represented as a vector, to represent said enciphered messaget such that the enciphering transformation is computationally infeasible to invert without the secret deciphering key;
means for transmitting the enciphered message from the transmitter to the receiver;
and means for deciphering said enciphered message at the receiver, said means having an input connected to receive said enciphered message and having another input connected to receive said secret deciphering key and serving to generate said message by inverting the transformation with said secret deciphering key.

16. An apparatus for deciphering an enciphered message that is received over an insecure communication channel including means for receiving the enciphered message that is enciphered by an enciphering transformation in which a message to be maintained secret is transformed with a public enciphering key, and means for receiving a secret decipher-ing key to generate the message by inverting the enciphering transformation;
means for generating the message having an input connected to receive the inverse of the enciphered message and an output for generating the message;
said secret deciphering key being computationally infeasible to generate from the public enciphering key, and said enciphering transformation being computationally in-feasible to invert without the secret deciphering key in which said means for inverting the enciphering trans-formation includes means for computing S'=l/w*S mod m; and said means for generating the message includes means for setting xi equal to the integer part of for i =n, n-l,...l whexe m and w are large integers and w is invertible modulo m,where S' is the inverse of the enciphered message S being defined by the enciphering transformation S = a*x where the message is represented as an n dimensionable vector x with each element xi being an integer between 0 and 1, where 1 is an integer, and where the public enciphering key is represented as an n dimensional vector a, the elements of a being defined by ai=(w*a? mod m) + km for i= 1,2,...n where k and n are integers and the secret deciphering key is m, w and a', where a' is an n dimensional vector, the elements of a' being defined by for i= 1,2,...n

17. An apparatus for deciphering an enciphered message that is received over an insecure communication channel including means for receiving the enciphered message that is enciphered by an enciphering transformation in which a message to be maintained secret is transformed with a public enciphering key, and means for receiving a secret deciphering key to generate the message by inverting the enciphering transformation;
means for generating the message having an input connected to receive the inverse of the enciphered message and an output for generating the message;
said secret deciphering key being computationally infeasible to generate from the public enciphering key, and said enciphering transformation being computationally infeasible to invert without the secret deciphering key in which said means for inverting the enciphering trans-formation includes means for computing S'= bS mod m; and said means for generating the message includes means for setting xi=l if and only if the quotient of S'/ai is an integer and setting xi=0 of the quotient of s'/ai is not an integer, where b and m are large integers and m is a prime number such that where n is an integer and the secret deciphering key is b, m, and a', where a' is an n dimensional vector with each ai' being relatively prime, and where S' is the inverse of the enciphered message S being defined by the enciphering transformation S = a*x where the message is represented as an n dimensional vector x with each element xi being 0 or 1, and the public encipheriny key is presented by the n dimensional vector a, the elements of a being defined by ai=logb a? mod m for i = 1,2,...n