Method of passing a cryptographic key that allows third party access to the key

[0002] This invention relates to cryptography and, more particularly, to a method of passing a cryptographic key so that an authorized third party may gain access to the key.

[0003] Practitioners in the field of cryptography first occupied themselves with trying to find a mathematical function that an adversary could not determine. Theoretically, such functions exist (e.g., scramblers). However, such devices are not secure because such devices are easily reverse-engineered in order to determine the cryptographic function.

[0004] The notion that hardware could be kept secret was abandoned. An idea was then introduced to couple a secret random entity (i.e., a cryptographic key) to the hardware in order to keep communications secure even if the hardware was reverse engineered. In this scenario, each user received a copy of the hardware. Each pair, or group, of users who wished to communicate securely would decide on a cryptographic key. For convenience, the process was such that the cryptographic key could be used for both encryption and decryption hence the terms “symmetric-key” and “symmetric-key cryptography.” The cryptographic key decided upon was then securely given to each party to the communication. Typically, this meant that the cryptographic key had to be securely delivered to each user. Such a key distribution system works well with a closed group of users consisting of a small number, but it becomes unwieldy when the number of users is large. Also, if the symmetric-key is compromised, the communications of everyone using the key is compromised. Therefore, a need arose for a solution to the key distribution problem. Public-key cryptography offers such a solution.

[0005] U.S. Pat. No. 4,200,770, entitled “CRYPTOGRAPHIC APPARATUS AND METHOD,” is a patent on the first publicly disclosed method of arriving at a secret symmetric-key between two users using a non-secure channel. U.S. Pat. No. 4,200,770, commonly referred to as the Diffie-Hellman key exchange method, is hereby incorporated by reference into the specification of the present invention. In this key exchange method, each user generates a random number that is kept secret. Each user uses their secret as an exponent to a non-secret base that is shared in common with the other user (i.e., exponentiation). Each user modulo reduces their exponentiation by a non-secret number that is shared in common with the other user. Each user transmits their modulo reduced exponentiation to the other user. Each user raises the exponentiation they receive to their secret, and each user modulo reduces this second exponentiation by the same shared modulus. This results in each user computing the same value that is known only by them. In effect, each user conceals their secret (the exponent) in a mathematical function that is believed to be unsolvable for large values (i.e., modulo reduced exponentiation). Each user transmits their buried secret to the other user. Each user raises the other user's buried secret to their secret. After a final modulo reduction, each user is in possession of the same symmetric key that an adversary cannot mathematically determine. To mathematically determine the key, an adversary must be able to determine the discreet logarithm of what at least one user transmitted, hence the name “discreet logarithm problem.” This problem is considered unsolvable, or intractable, for large values.

[0006] Here, “key exchange” is defined as each user participating in the creation of a key. Neither participant knows in advance what the final key will be. This differs from a “key pass” which entails a single user creating a key and passing it securely to the other user. The receiving user recovers, or decrypts, the key but does not alter the key in any other way.

[0007] Along with the advantages of public-key cryptography there are some disadvantages. That is, public-key cryptography involves many more steps than does symmetric-key cryptography. This means that public-key cryptography is slow compared to symmetric-key cryptography. Also, a user using the Diffie-Hellman key exchange method cannot be sure that the other user is who they claim to be. Therefore, a need arose for a method of digitally signing an electronic communication.

[0008] Taher ElGamal, in a paper entitled “A Public Key Cryptosystem and Signature Scheme Based on Discreet Logarithms,” IEEE Transactions on Information Theory, Vol. IT-31, No. 4, July 1985, pp. 469-472, proposed an encryption method and a digital signature method that incorporates the strength of the Diffie Hellman key-exchange method (i.e., the discreet logarithm problem). ElGamal's signature method has received more attention than has his encryption method. ElGamal's signature method is based on Euler's Totient function. In this method, a first user generates a long term secret exponent and “hides” it in a modulo reduced exponentiation using a publicly known base and modulus. The user binds the result to his or her identity by a certifying authority. Next, the first user computes a number using a certain parameter (e.g. a message), his long-term secret, and a second per-message secret. These two secrets are known only by the first user. The first user sends the computed number, the modulo reduced exponentiation of the “per-message secret,” and the message to the second user. The second user uses the numbers, the message, and the certified modulo reduced exponentiation to verify a mathematical relationship. If the relationship is verified then the second user is assured that the message came from the first user. This may not be true if the long-term secret is known by an adversary. ElGamal's method creates a digital signature. The computations involved here are mathematically complex and time consuming. The resulting signature is large and requires a large amount of bandwidth in order to transmit it.

[0009] In a paper entitled “Efficient Identification and Signatures for Smart Cards,” Advances in Cryptology—Proceedings of CRYPTO '89, Lecture Notes in Computer Science, No. 435, Springer-Verlag, New York, 1990, pp. 239-251, Claus Schnorr developed a variation of ElGamal's digital signature that is simpler to compute and takes up less bandwidth than ElGamal's digital signature. Schnorr uses a subgroup of the group used by ElGamal. The subgroup Schnorr uses is smaller than the group used by ElGamal. The result is a faster, less compute intensive method that requires fewer bits to be transmitted. Schnorr's method was patented as U.S. Pat. No. 4,995,082 entitled “METHOD FOR IDENTIFYING SUBSCRIBERS AND FOR GENERATING AND VERIFYING ELECTRONIC SIGNATURES IN A DATA EXCHANGE SYSTEM.” U.S. Pat. No. 4,995,082 is hereby incorporated by reference into the specification of the present invention.

[0010] The National Institute of Standards and Technology (NIST) published Federal Information Process Standard (FIPS) Publication No. 186 entitled “Digital Signature Standard” (DSS). FIPS PUB 186 is hereby incorporated by reference into the specification of the present invention. The DSS discloses a method of generating a digital signature that is secure, reasonably easy to generate and verify, and bandwidth efficient. U.S. Pat. No. 5,231,668, entitled “Digital Signature Algorithm,” (DSA) embodies DSS. U.S. Pat. No. 5,231,668 is hereby incorporated by reference into the specification of the present invention. DSA is a bandwidth efficient variant of ElGamal. DSA employs the computations of ElGamal in a subgroup of the group used by ElGamal. The subgroup used in DSA is smaller than the group used by ElGamal.

[0011] In a paper entitled “Message Recovery for Signature Schemes Based on the Discreet Logarithm Problem,” Pre-proceedings of Eurocrypt '94, pp. 175-190, Ms. Nyberg and Mr. Rueppel developed a variant of DSA that eliminates the need to send the message while allowing the recovery of the message from what is transmitted. Nyberg and Rueppel also propose a key exchange method that is based on DSA and the Diffie-Hellman key exchange method. The steps of their message-recovery method is as follows:

[0012] a) a first user generates two random integers “k₁” and “k₂,” where “k₁” and “k₂” are each less than a prime integer “q,” where “q” divides evenly into “p−1,” where “p” is a prime integer greater than “q”;

[0013] b) the first user computes “r₁=g{circumflex over ( )}(k₂−k₁) mod p,” where “{circumflex over ( )}” denotes exponentiation, and where the base “g” has order “q” in the integers modulo “p”;

[0014] c) the first user computes “r₂=r₁mod q”;

[0015] d) the first user solves the equation “1=((−x₁*r₂)+(k₁*s)) mod q,” for “s”, where “x₁” is the first user's long-term secret, and where “*” denotes multiplication;

[0016] e) the first user transmits (r₁, s) to a second user;

[0017] f) the second user computes “r₂=r₁mod q”;

[0018] g) the second user computes “t=(1/s) mod q,” and “(((g{circumflex over ( )}x₁){circumflex over ( )}r₂)*g){circumflex over ( )}t mod p,” where this last computation should equal “g{circumflex over ( )}k₁mod p”;

[0019] h) the second user then computes “(g{circumflex over ( )}k₂)*r₁mod p”, where the result should equal “g{circumflex over ( )}k₂mod p”;

[0020] i) the second user computes “key=(g{circumflex over ( )}k₂){circumflex over ( )}x₂mod p,” where “x₂” is the second user's long-term secret; and

[0021] j) the second user sends “g{circumflex over ( )}x₂mod p” to the first user; and

[0022] k) the first user computes “key=((g{circumflex over ( )}x₂) mod p){circumflex over ( )}k₂mod p.”

[0023] Note that the equation in step (d) is the same as the equation in DSA with the value “z” in DSA set to one. The pair “(r₁, s)” embodies not just the signature of a message, but includes the message itself. The second user recovers the message and verifies the source as the first user. Both users will be able to compute “key” only if they know their respective long term secrets.

[0024] The message-recovery method of Nyberg and Rueppel does not allow the recovery of a key by an authorized third party and it requires the transmission of the long value “r₁.”

[0025] In a paper entitled “META-ElGamal Signature Schemes,” 2nd ACM Conference on Computer and Communications Security, 1994, Messrs. Horster, Petersen, and Michels disclose a general equation (i.e., A=(xB+kC) mod q) for the three DSS parameters “m”, “r”, and “s.” The parameter “m” denotes the hash of a message to be signed, the signer's long-term secret “x,” and the signer's per-signature secret “k.” The parameter “r” is computed as “r=(g{circumflex over ( )}k mod p) mod q.” Horster et al. disclose six different signature equations that were generated by six different ways of substituting (m,r,s) for (A,B,C). The six different signature equations are as follows:

[0026] m=x_Ar+ksmod q, where A=m, B=r, and C=s;

[0027] m=x_As+krmod q, where A=m, B=s, and C=r;

[0028] s=x_Ar+kmmod q, where A=s, B=r, and C=m;

[0029] s=x_Am+krmod q, where A=s, B=m, and C=r;

[0030] r=x_As+kmmod q, where A=r, B=s, and C=m; and

[0031] r=x_Am+ksmod q, where A=r, B=m, and C=s.

[0032] Horster et al. also disclose a general verification equation (i.e., α^A=(y_A)^Br^Cmod p) for the general signature equation. The six different verification equations that correspond to the six signature equations above are as follows:

[0033] α^m=(y_A)^rr^smod p, where A=m, B=r, and C=s;

[0034] α^m=(y_A)^sr^rmod p, where A=m, B=s, and C=r;

[0035] α^s=(y_A)^rr^mmod p, where A=s, B=r, and C=m;

[0036] α^s=(y_A)^mr^rmod p, where A=s, B=m, and C=r;

[0037] α^r=(y_A)^sr^mmod p, where A=r, B=s, and C=m; and

[0038] α^r=(y_A)^mr^smod p, where A=r, B=m, and C=s.

[0039] The present invention improves upon these general equations by including a method of recovering the key by a third party.

[0040] A cryptographic method that allows third party access to an encrypted communication has been proposed. Such a method is called “key escrow.” Essentially, key escrow is a cryptographic method that allows a third party (e.g., a law enforcement activity) access to the key used by a first user and a second user when the third party is authorized to do so (e.g., when criminal activity is suspected and a search warrant is obtained). U.S. Pat. Appl. No. 08/528,966, entitled “A DEVICE FOR AND METHOD OF CRYPTOGRAPHY THAT ALLOWS THIRD PARTY ACCESS, now U.S. Pat. No. 5,631,961,” is an example of such a method. U.S. Pat. Appl. No. 08/528,966 is hereby incorporated by reference into the specification of the present invention. One of the problems with the proposed key-escrow methods is that the key escrow aspect of the pass or exchange is independent of the key establishment process. This separation makes the method vulnerable to attacks that would not be possible if the key escrow were made an integral part of key establishment process. The present invention discloses a method that allows a first user to pass a cryptographic key to a second user which incorporates a key-escrow feature.

[0041] It is an object of the present invention to pass a cryptographic key from a first user to a second user so that an authorized third party may gain access to the key.

[0042] It is another object of the present invention to pass a cryptographic key from a first user to a second user in a certified and bandwidth efficient manner so that an authorized third party may gain access to the key.

[0043] It is another object of the present invention to exchange a cryptographic key between a first user and a second user so that an authorized third party may gain access to the key.

[0044] It is another object of the present invention to exchange a cryptographic key between a first user and a second user in a certified and bandwidth efficient manner so that an authorized third party may gain access to the key.

[0045] The present invention is a method of passing a key between a first user and a second user in a manner that allows an authorized third party to gain access to the key.

[0046] In the present invention, key recovery is embedded into the key pass method. Key recovery allows an authorized third party to recover the key with the help of an escrow agent.

[0047] The steps of the present invention are as follows:

[0048] a) a first user generates a first random number “k_1a”;

[0049] b) the first user generates “key₁=m(k_1a)”;

[0050] c) the first user generates a second random number “k_2a”;

[0051] d) the first user computes “y₁=m(h_p2(k_2a))”;

[0052] e) the first user computes “y₂=m(H_p(k_1a));

[0053] f) the first user computes “r₁=f(y₁,k_1a)”;

[0054] g) the first user computes “z=f(y₂, key₁)”;

[0055] h) the first user computes “s=(1/k_2a) ((k_1a*z)+(x_a*r₁)) mod q,”;

[0056] i) the first user computes “G=g{circumflex over ( )}k_1amod p”;

[0057] j) the first user passes (G,z,r₁,s) to the second user;

[0058] k) the second user receives “Y=g{circumflex over ( )}x_amod p” from, for example, an independent directory/certificate server;

[0059] l) the second user computes “T=(Y{circumflex over ( )}r₁*G{circumflex over ( )}z){circumflex over ( )}((1/s) mod q) mod p”;

[0060] m) the second user computes “y₁=m(h_a2(T))”;

[0061] n) the second user computes “k_1a=(f⁻¹) (y₁, r₁),”;

[0062] o) the second user computes “key₁=m(k_1a)”;

[0063] p) a third party intercepts (G,z,r₁,s) transmitted from the first user to the second user;

[0064] q) the third party presents “G” and “z” to a key-escrow agent;

[0065] r) the key-escrow agent computes “y₂=m(H_s(G))”:

[0066] s) the key-escrow agent computes “key₂=(f⁻¹)(y₂, z), where key₂=key₁”; and

[0067] t) the key escrow agent returns “key₂” to the third party if the third party is authorized to receive “key₂”; and

[0068] u) the third party uses “key₂” to decrypt an encrypted message sent between the first user and the second user which was encrypted using “key₁.”

[0069] In an alternate embodiment, steps may be added to the method above that would allow the second user to determine if the first user is complying with escrow aspects of the method. In the method above, the second user is given or computes terms that may be used to generate other terms transmitted from the first user to the second user. The second user may compute certain terms transmitted from the first user to the second user and compare these computed terms to the terms transmitted. The method continues if the compared terms are the same and is halted otherwise. The following five steps may be inserted after step (o) above:

[0070] o1) the second user computes “y₂=m(H_p(k_1a))”;

[0071] o2) the second user computes “z=f(y₂, key);

[0072] o3) the second user compares “z” computed in step (o2) to “z” received from the first user, if they match, the method continues, otherwise the method is halted;

[0073] o4) the second user computes “G=g{circumflex over ( )}k_1amod p”; and

[0074] o5) the second user compares “G” computed in step (o4) to “G” received from the first user, if they match, the method continues, otherwise the method is halted.

[0075] In a second alternate embodiment, “z” may be formed using a portion of “key₁” instead of all of “key₁”. Also, more than one key-escrow agent may be employed, and many different scenarios are possible with respect to what these escrow agents hold. Additional certification and identification schemes may be incorporated into the present invention if desired.

[0076] A third alternate embodiment of the present invention is a key exchange method that allows an authorized third party to obtain a key exchanged between a first user and a second user. In the key-exchange method, a first user and a second user each generate and pass their own key as above to the other user. That is, the first user generates a key and passes it to the second user while the second user generates a different key and passes it to the first user. Each user then combines the two keys in an agreed upon fashion to arrive at the final key to be used to encrypt messages between the users. That is, each user combines the key that they generated and passed to the other user to the key that was passed to them by the other user. The authorized third party would then have to intercept the two key messages transmitted between the users, recover both keys, and combine them in the same manner the users did.

[0077] The preferred embodiment of the present invention results in a bandwidth efficient method of passing a key from a first user to a second user while allowing an authorized third party access to the key. The present invention is less susceptible to attack than methods that separate key establishment from key escrow.

[0078] FIG. 1 is a list of the steps of the preferred embodiment of the present invention;

[0079] FIG. 2 is a list of the steps of the first alternate embodiment of the present invention; and

[0080] FIG. 3 lists the improved generalized equations for a signature and verification of the signature and six possible variations of these equations.

[0081] The present invention is a method of passing a key between a first user and a second user in a manner that allows an authorized third party to gain access to the key. A “key pass” is defined as a method of passing a key created by a first user to a second user. A “key exchange” is defined as a method of establishing a key between a first user and a second user in a manner where both users participate in the creation of the key.

[0082] In the present invention, a key recovery access field is embedded into the key pass method. The access field is embedded into a parameter “z.” The access field allows an authorized third party to recover the key with the help of an escrow agent.

[0083] Six functions are required by the present invention (i.e., “h_p2”; “h_s2”; “H_p”; “H_s”; “f”; and “m”). The first user and the second user also share a prime modulus “p” and a base element “g,” where the order of “g mod p” is a prime number “q.”

[0084] The functions “h_p2” and “h_s2” are the public and secret functions, respectively, of the second user's public-key encryption function. These functions are related as follows: “h_p2(k_2a)=h_s2(g{circumflex over ( )}k_2amod p),” where “k_2a” is the second random number of the first user.

[0085] The functions “H_p” and “H_s” are the public and secret function, respectively, of the key escrow agent's public-key encryption function. Note that one or more key-escrow agents may be employed to each hold the same item or to each hold a portion of an item. These functions are related as follows:

[0086] “H_p(k_1a)=H_s(g{circumflex over ( )}k_1amod p),” where “k_1a” is the first random number of the first user.

[0087] The function “f” is be a secure encryption function (e.g., the Digital Encryption Standard (DES)) where the first input is a cryptographic key, where the second input is a message to be encrypted, and where the output is the encrypted message. DES is disclosed in Federal Information Process Standard Publication No. 81 (i.e., FIPS PUB 81). FIPS PUB 81 is hereby incorporated by reference into the specification of the present invention. The inverse of encryption is decryption. Therefore, if the function “f” is an encryptor then the function “f⁼¹” denotes a decryptor that may be used to decrypt a message encrypted by the function “f.”

[0088] The function “m” is a hard-to-invert hashing function (i.e., a function that maps a value to a smaller value). The function “m” outputs a bit string of length “t,” where “t” is equal to the number of bits in the cryptographic key of the encryption function “f.” It is preferred that some appropriately truncated output of the Secure Hash Algorithm (SHA) disclosed in Federal Process Standard Publication No. 180 (i.e., FIPS PUB 180) be used for the function “m.” FIPS PUB 180 is hereby incorporated by reference into the specification of the present invention. SHA outputs 160 bits. If DES is used as the encryption function “f” then a 56-bit key is required. If SHA is used as the function “m” then the function “m” must map the 160-bit output string of SHA to a 56-bit string. It is preferred that the function “m” output the middle 56 bits of the 160-bit SHA output as the DES key.

[0089] Given these functions and using the notation and parameters as in DSA, a bandwidth-efficient, self-certifying, DSA compatible, key pass method that allows an authorized third party access to the key is listed in FIG. 1 and is as follows:

[0090] a) a first user generates a first random number “k_1a,” where “k_1a” is a non-zero member of the group “Z_q”;

[0091] b) the first user generates “key₁=m(k_1a)”;

[0092] c) the first user generates a second random number “k_2q,”where “k_2a” is a non-zero member of the group “Z_q”;

[0093] d) the first user computes “y₁=m(h_p2(k_2a))”;

[0094] e) the first user computes “y²=m(H_p(k_1a));

[0095] f) the first user computes “r₁=f(y₁, k_1a)”;

[0096] g) the first user computes “z=f(y₂, key₁)”;

[0097] h) the first user computes “s=(1/k_2a) ((k_1a*z)+(x_a*r₁)) mod q,” where “x_a” is the first user's long-term secret;

[0098] i) the first user computes “G=g{circumflex over ( )}k_1amod p”;

[0099] j) the first user passes (G,z,r₁,s) to the second user;

[0100] k) the second user receives “y=g{circumflex over ( )}x_amod p” from, for example, a directory/certificate server;

[0101] l) the second user computes “T=(Y{circumflex over ( )}r₁*G{circumflex over ( )}z){circumflex over ( )}((1/s) mod q) mod p”;

[0102] m) the second user computes, “y₁=m(h_s2(T))”;

[0103] n) the second user computes “k_1a=(f⁻¹) (y₁, r₁)”;

[0104] o) the second user computes “key₁=m(k_1a)”;

[0105] p) a third party intercepts (G,z,r₁,s) transmitted from the first user to the second user;

[0106] q) the third party presents “G” and “z” to a key-escrow agent;

[0107] r) the key-escrow agent computes “y₂=m(H_s(G))”:

[0108] s) the key-escrow agent computes “key₂=(f⁻¹)(y₂, z), where key₂=key₁”; the t) the key escrow agent returns “key₂”; to the third party if the third party is authorized to receive “key₂”; and

[0109] u) the third party uses “key₂” to decrypt an encrypted message sent between the first user and the second user which was encrypted using “key₁.”

[0110] In an alternate embodiment, steps may be added to the method above that would allow the second user to determine if the first user is complying with the escrow aspects of the method. In the method above, the second user is given or computes terms that may be used to compute other terms that the first user transmitted to the second user. The second user may compute certain terms transmitted from the first user to the second user and compare them to the terms actually transmitted. The method continues if the compared terms are the same and is halted otherwise. FIG. 2 lists the steps of the alternate embodiment. Essentially, the following five steps are inserted after step (o) of the preferred embodiment above:

[0111] o1) the second user computes “y₂=m(H_p(k_1a))”;

[0112] o2) the second user computes “z=f(y₂, key₁);

[0113] o3) the second user compares “z” computed in step (o2) to “z” received from the first user, if they match, the method continues, otherwise the method is halted;

[0114] o4) the second user computes “G=g{circumflex over ( )}k_1a, mod p”; and

[0115] o5) the second user compares “G” computed in step (o4) to “G” received from the first user, if they match, the method continues, otherwise the method is halted.

[0116] In a second alternate embodiment, “z” may be formed using a portion of “key₁” instead of all of “key₁”. Any parameter based on “z” would change accordingly. In this case, the authorized third party would recover this portion of “key₁” and not all of “key₁.” Also, more than one key-escrow agent may be employed, and many different scenarios are possible with respect to what these escrow agents hold. For example, one or more key-escrow agents may return all or a portion of “key₁” to the third party. Additional certification and identification schemes may be incorporated into the present invention if desired.

[0117] A third alternate embodiment of the present invention is a key exchange method that allows an authorized third party to obtain a key exchanged between a first user and a second user. In the key-exchange method, a first user and a second user each generate and pass their own key as above to the other user. That is, the first user generates a key and passes it to the second user while the second user generates a different key and passes it to the first user. Each user then combines the two keys in an agreed upon fashion to arrive at the final key to be used to encrypt messages between the users. That is, each user combines the key that they generated and passed to the other user to the key that was passed to them by the other user. The authorized third party would then have to intercept the two key messages transmitted between the users, recover both keys, and combine them in the same manner as the users did.

[0118] Other embodiments of the present invention may be realized by generating every permutation of the parameters of the present invention (±s,±z,±r,) for the parameters (A,B,C) in the following improved generalized equations for a DSS signature and verification of a DSS signature as “k_2aA=(x_aB+k_1aC)mod q” and “T=(Y^BG^C)^{(1/A mod q)}mod p,” respectively. The signature equation (i.e., the first of the two equations shown immediately above) is solved for the signature parameter “s.” In the preferred embodiment A=s, B=r₁, and C=z. Six signature and verification equations using just the positive parameters (z,s,r₁) are as follows:

[0119] s=(k_1a)(k_2az−x_ar₁) mod q, T=((Y{circumflex over ( )}r₁)(G^s))^{(1/z mod q)}mod p, where A=z, B=r₁, and C=s;

[0120] s=(1/x_a)(k_2az−k_1ar₁) mod q, T=((

[0121] Y^s)(G{circumflex over ( )}r₁))^{(1/z mod q)}mod p, where A=z,

[0122] B=s, and C=r₁;

[0123] s=(1/k_2a)(x_ar₁+k_1az) mod q, T=((

[0124] Y{circumflex over ( )}r₁) (G^z))^{(1/s mod q)}mod p, where A=s,

[0125] B=r₁, and C=z(the preferred embodiment);

[0126] s=(1/k_2a)(x_az+k_1ar₁) mod q, T=((Y^z)

[0127] (G{circumflex over ( )}r₁))^{(1/s mod q)}mod p, where A=s,

[0128] B=z, and C=r₁;

[0129] s=(1/x_a)(k_2ar₁−k_1az) mod q, T=((Y^s)(

[0130] G^z)){circumflex over ( )}(1/r₁mod q) mod p, where

[0131] A=r₁, B=s, and C=z; and

[0132] s=(1/k_1a)(k_2ar₁−x_az) mod q, T=((Y^z)(

[0133] G^s)){circumflex over ( )}(1/r₁mod q) mod p, where

[0134] A=r₁, B=z, and C=s.

[0135] The preferred embodiment of the present invention results in a bandwidth efficient method of passing a key from a first user to a second user while allowing an authorized third party access to the key. The present invention is less susceptible to attack than methods that separate key establishment from key escrow. Also, by incorporating DSA into the present invention, a self-certification feature is obtained.