This paper describes a method for assuring that user generated public and private key pairs are cryptographically strong. This assurance is achieved by limiting the number of attempts a user can make while generating the keys. Since it takes many billions of attempts to generate so-called "weak" keys, with any significant probability of success, our method precludes users from cheating. The described method has a potential positive impact on several evolving cryptographic standards, where the strength of the keys used with public key cryptography are a matter of major concern. It has no negative impact on key generation performance. The method is simple and straightforward, and it can be easily performed with just a few computational steps.

This paper presents the details of the new Commercial Data Masking Facility (CDMF) data privacy algorithm1. When implemented appropriately, products containing the CDMF algorithm can, in general, be freely exported from the United States. A short discussion of the requirements and rationale of the new algorithm is given.

In many applications of cryptography, assuring the authenticity of communications is as important as protecting their secrecy. A well known and secure method of providing message authentication is to compute a Message Authentication Code (MAC) by encrypting the message. If only one key is used to both encrypt and authenticate a message, however, the system is subject to several forms of cryptographic attack. Techniques have also been sought for combining secrecy and authentication in only one encryption pass, using a Manipulation Detection Code generated by noncryptographic means. Previous investigations have shown that a proposed MDC technique involving block-by-block Exclusive-ORing is not secure when used with the Cipher Block Chaining (CBC) mode of operation of the Data Encryption Standard (DES]. It is shown here that the Cipher Feedback (CFEI) mode of operation exhibits similar weaknesses. A linear addition modulo 264 MDC is analyzed, including discussion of several novel attack scenarios. A Quadratic Congruential Manipulation Detection Code is proposed to avoid the problems of previous schemes.

One essential requirement of an Electronic Funds Transfer (EFT) system is that institutions must be able to join together in a common EFT network such that a member of one institution can initiate transactions at entry points in the domain of another institution. The use of such a network is defined as interchange. Cryptographic implementations are developed for such a network in such a way as to keep personal verification and message authentication processes at different institutions completely separate. This is accomplished through the combined use of user-remembered personal identification numbers (PINs), secret system keys, and intelligent secure (bank) cards on which are recorded secret personal cryptographic keys.

A set of required security criteria is developed which assures that the personal verification processes at different institutions in an interchange environment are isolated from one another. It is assumed that only information stored on the bank card and information remembered by a systerm user are employed for personal verification. Under that assumption, it is shown that only through the use of a secret quantity (a personal cryptographic key) stored on the bank card will the set of required criteria be satisfied. With a personal key, the same degree of isolation can be achieved for authentication of transaction request messages sent from the entry point to the issuer. However, authentication of transaction response messages sent from the issuer to the entry point requires a system key unknoun to the user.

With any strong cryptographic algorithm, such as the data encryption standard (DES), it is possible to devise protocols for authentication. One technique, which allows arbitrary, time-invariant quantities (such as encrypted keys and passwords) to be authenticated, is based upon a secret cryptographic (master) key residing in a host processor. Each quantity to be authenticated has a corresponding precomputed test pattern. At any later time, the test pattern can be used together with the quantity to be authenticated to generate a nonsecret verification pattern. The verification pattern can in turn be used as the basis for accepting or rejecting the quantity to be authenticated.