Allen Leonid Roginsky

Special feature: Two-phase cryptographic key recovery system

A two-phase method of key recovery which will be referred to as Secure Key Recovery (SKR) is presented. The proposed key recovery system permits a portion of the key recovery information to be generated once and then used for multiple encrypted data communications sessions and encrypted file applications. In particular, the portion of the key recovery information that is generated just once is the only portion that requires public key encryption operations. We also describe a verification mode in which the communicating parties each produce SKR recovery information independently, without checking the others so produced information. In this mode, if at least one side is correctly configured, all required recovery information is correctly produced. In addition, the communicating parties are free to include any optional recovery fields without causing a false invalidation of what the other parties sent. Further, we present a method of verification of key recovery information within a key recovery system, based on a variation of the three-party Diffie-Hellman key agreement procedure. Without communication with a trustee, the sender is able to encrypt recovery information in such a way that both the receiver and the respective trustee can decrypt it. This reduces the number of encryptions, and inherently validates the recovery information when the receiver decrypts it. The method allows full caching of all public key operations, thus further reducing computational overhead.

Efficient computation of packet CRC from partial CRCs with application to the Cells-In-Frames protocol

A Cyclic Redundancy Check (CRC) code is used by many communications protocols for packet error detection. Computation of CRC for an entire packet is easily implemented in hardware if packets are transmitted and received in contiguous form. In an ATM network, packets are fragmented into cells and, in the case of multiple virtual circuits, their transmission is overlapped, resulting in non-contiguous packets. For non-contiguous packets with a 32-bit CRC (CRC-32), as in the case of ATM Adaptation Layer 5 (AAL5), an efficient algorithm for computing the CRC for an entire packet based on combining packet fragment CRCs (e.g., cell CRCs) is developed in this paper. In this algorithm, the network hardware generates cell or partial packet CRCs and the host system software combines these CRCs into a full packet CRC. Several important properties for CRCs are described and proved, and the correctness of the algorithm developed from these properties is then also formally proved. The algorithm has direct application to the proposed Cells-In-Frames (CIF) architecture for support of ATM AAL5 services on Ethernet. When implemented in software, the algorithm is shown to be significantly faster than a table-based software computation of packet CRC-32. The algorithm is also applicable to networking devices that need to change the contents of a packet and quickly recompute the packet CRC based only on the changed portions of the packet.

New methods for shortest path selection for multimedia traffic with two delay constraints

Path selection based on two criteria, propagation delay and maximum delay jitter, is often a requirement in high-speed networks carrying multimedia traffic. Shortest path selection with multiple additive or multiplicative criteria is a NP-complete problem. Simply adding propagation and jitter delay bounds into a single delay criterion is shown to eliminate from consideration a large number of otherwise acceptable path choices. In this paper, four new solutions for polynomial-time, two-criteria path selection are presented. The first solution is a two-pass modified Bellman-Ford algorithm. The other solutions are based on a weighted single-criterion path search and are described via a novel geometric construction of the path selection problem. The new solutions are mathematically proved and their effectiveness demonstrated with a simulation experiment. Applications of the new solutions to ATM PNNI and IP routing are described.