EP1436940A2 - A key agreement protocol based on network dynamics - Google Patents

Description

A KEY AGREEMENT PROTOCOL BASED ON NETWORK DYNAMICS

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to cryptographic systems and more particularly to a method of generating an unconditionally secure cipher key based on the time differences recorded between two parties communicating over a noiseless public channel. ^{Tn ia A}pplication relates r corresponding Application f iled on the same date and entitled Hash

Functions based on Sylves ter Matrices " .

2. Discussion of the Related Art

An Achilles heel of classical cryptographic systems is that secret communication can only take place after a key is communicated in secret over a totally secure communication channel. Lomonaco describes [6,7] the matter as the "Catch 22" of cryptography, as follows.

"Catch 22. Before Alice and Bob can communicate in secret, they must first communicate in secret."

Lomonaco goes on to describe further difficulties involving the public key cryptographic systems that are currently in use. For a discussion on several other disadvantages of the Public Key Infrastructure (PKI) see U.S. General Accounting Office Report [9].

Let x be a common key that has been created for Alice and Bob. That is, x is a binary vector of length n. Then x can be used as a one-time pad, as follows. Let m be a message that Alice wishes to transmit to Bob: m is some binary vector that is also of length n. Alice encodes m as m Θ x where θ denotes bitwise addition, i.e., exclusive OR. Thus m ^@ x, not m, is broadcast over the public channel. Bob then decodes in exactly the same way. Thus Bob receives the message (m Φ x) θ x, which is m, because of the properties of bitwise addition.

Alternatively, the key x can be used in a standard symmetric key cryptosystem such as that of Rijndael [13] or Data Encryption Standard (DES) [14]. The idea now is to encode m as denotes bitwise addition, i.e., exclusive OR. Thus m ® x, not m, is broadcast over the public channel. Bob then decodes in exactly the same way. Thus Bob decodes the message (m Θ x) Φ x, which is m, because of the properties of bitwise addition.

Alternatively, the key x can be used in a standard symmetric key cryptosystem such as that of

Rijndael [12] or Data Encryption Standard (DES) [13]. The idea now is to encode m asf_x(m) where f_x denotes the Rijndael permutation with the parameter x. Then, to get the message, Bob decodes by g_x\f_x(nø] = m where g_x is the inverse offχ_

To date, practical protocols for constructing such a common key x use for their security unproven mathematical assumptions concerning the complexity of various mathematical problems such as the factoring problem, the discrete log problem, and the Diffie-Hellman problem. Another serious difficulty concerning present systems involves the very long keys that are needed for even minimal security. In his monograph R. A. Mollin [17] points out that for elliptic curves cryptography an absolute minimum of 300 bits should be used for even the most modest security requirements and 500 bits for more sensitive communication. Further, key lengths of 2048 bits are recommended for RSA in the same reference.

In [20] chapter 5, Julian Brown gives an example of a financial encryption system depending on RSA keys of 512-bit, namely the CREST system introduced in 1997 by the Bank of England. He quotes the noted cryptographer A. Lenstra concerning such codes as follows: "Keys of 512 bits might even be within the reach of cypherpunks. In principle they could crack such numbers overnight".

Randomness in Arrival Times of Network Communications

Computer networks are very complex systems formed by the superposition of several protocol layers [14]. Figure 1 shows the layers in a typical network. The following analysis of how the layers work together serves to explain the randomness in networks.

The lowest layer connects two computers, i.e., creates a channel between them, by some physical means and is called the Physical Layer. The second layer removes random physical errors (called "noise") from the channel to create an error-free communications path from one point to another. This layer, i.e., the Data Link Layer, is primarily responsible for dealing with transmission errors generated as electrical impulses (representing bits) as sent over a physical connection. Error detection techniques [15] are used to identify the transmission errors in many protocols. Once an error is detected the protocol requests a resend. Random errors in the Data Link Layer can be observed by noting timing delays.

The Medium Access Layer deals with allocating and scheduling all communications over a single channel. In a networked environment, including the Internet, many computers communicate over a single channel. Bursts in packet traffic is a well-known characteristic and is due to the uncontrollable behavior of many individual computers communicating over a single channel [16] leading to random fluctuations in transmission times.

The Network Layer deals with routing information to create a true or virtual connection between two computers. The routing is dependent on the variety of routing algorithms and the load placed on each router. These two factors makes the transmission times fluctuate randomly.

The Transport Layer interfaces with the final Application Layer to provide an end-to-end, reliable, connection-oriented byte stream from sender to receiver. To do so, the Transport Layer provides connection establishment and connection management. The times associated with Transport layer activities depend on all devices in the network and the algorithms being used. Thus, fluctuations in transmission times in the Transport Layer also occur, contributing to timing delays.

However, not only the network influences timing fluctuations. The transmitting and receiving computers have internal delays resulting from servicing network packets. Thus, even the act of observing the timings will also introduce random fluctuations. (See appendix B for an analysis of the effects of perturbations on arrival timing).

SUMMARY OF THE INVENTION

The present invention provides an efficient, practical system and method for a key agreement protocol based on network dynamics that has the strongest possible security, namely, unconditional security, and that does not require any additional hardware. Previous work in this area is either theoretical [11] or practically infeasible due the requirement for additional channels based on expensive and complicated hardware such as satellites, radio transmitter arrays and accompanying additional computer hardware to communicate with these devices [7]. All previous cryptographic keys only satisfy the weaker criterion of computational security.

The present invention introduces relative time sequences based on round-trip timings of packets between two communicating parties. These packets form the basic building blocks for creating an efficient and unconditionally secure key agreement protocol that can be used as a replacement for current symmetric and asymmetric key cryptosystems. The present invention is an unconditionally secure cryptographic system and method based on ideas that can be used in the domain of quantum encryption [1, 5 and 20 Chapter 6].. Moreover, the present invention for the first time provides a cryptographic protocol that exploits fundamental results (and their interconnectedness) in the fields of information theory, error-correction codes, block design and classical statistics. The system and method of the present invention is computationally faster, simpler and more secure than existing cryptosystems. In addition, due to the unconditional security provided by the present invention, the system and method of the present invention are invulnerable to all attacks from super-computers and even quantum computers. This is in sharp contrast to all previous protocols.

The present invention provides a protocol that uses two characteristics of network transit time: namely, its randomness, and the fact that, despite this, the average timing measured by two communicating parties will converge over a large number of repetitions. The result is that two correlated random variables are obtained by measuring the relative time a packet takes to complete a round trip with respect to a first party, Alice or A, and a round trip with respect to a second party, Bob or B.

In a preferred embodiment, A and B engage in rallying packets back and forth and calculateround-trip times individually. The packets may be used for any additional purpose since the contents of the packets are irrelevant. Only the round-trip times are of interest. Figure 2 shows one round of a relative round-trip time generator of the present invention. Figure 2 diagrammatically describes the process. PHASE 1 -Alice and Bob employ the system and method of the present invention to construct a permuted remnant bit string from a sequence of observed packet round-trip times:

Alice and Bob exchange packets over a network, record round-trip times, and each form a bit string by concatenating a pre-arranged number of low order bits of successive packet round-trip times. Once sufficient bits are concatenated, the process is stopped and both Alice and Bob apply a pre-determined permutation to their respective concatenated bit strings to form permuted remnant raw keys K_A and K_B, respectively of equal lenght.

PHASE 2- Alice and Bob employ these remnant raw keys to create a reconciled key:

Alice and Bob systematically partition their respective permuted remnant raw keys, KA and K_B, into sub-blocks, compute, exchange and compare parities for each sub-block, and, discarding the low order bit of the sub-block, re-concatenate the modified sub-blocks in their original order. In the case of blocks with mismatched parities the partition process is iterated until mismatched bits are located and deleted.

PHASE 3- Alice and Bob create an unconditionally secure pad or key from their common reconciled key:

Privacy amplification to eliminate any partial information that an eavesdropper, Eve, might have is applied by both Alice and Bob using a pre-determined proprietary hash function [4] to produce a final unconditionally secure key of a pre-determined length from the reconciled key.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a typical multi-layer computer network protocol.

FIG. 2 illustrates one rallying round between two communicating parties for generating a permuted remnant bit string by each party.

FIG. 3 illustrates mean arrival time as a function of channel noise (noise parameter). DETAILED DESCRIPTION OF THE INVENTION

In a preferred embodiment, the key agreement scheme of the present invention comprises three phases. The first phase is construction of a permuted remnant bit string wherein the two communicating parties, Alice and Bob, rally packets back and forth recording round-trip times. Some of the bits may still be different after the initial bit string construction so Alice and Bob then participate in a second phase called Information Reconciliation. The second phase results in Alice and Bob holding exactly the same key. However, Eve may have partial knowledge of the reconciled strings, in the form of Shannon bits. Therefore, a third and final phase called Privacy Amplification is performed to eliminate any partial information collected by Eve.

PHASE I - Alice and Bob rally packets back and forth to generate a bit string from truncated round-trip timings. This string is then systematically permuted. The procedure is as follows:

(i) Alice sends Bob a network packet and logs the time t_Ao_.

(ii) Bob records the time of reception as tβo and responds immediately to Alice with another network packet.

(iii) Alice records the time of reception as t_Ai, and responds immediately with a network packet.

(iv) Bob records the time of reception as tsi and responds immediately to Alice with another network packet.

(v) Alice and Bob respectively calculate

Δ* = tAl - tAO and

Depending on the quality of the network connection, only some bits of At_A and Ate are kept. The higher order bits are dropped. Typical experimental data and criteria for the truncation can be found in [18].

By taking a suitable probability distribution it can be shown that the average of Δt_A equals the average of MB. (vi) Repeat steps (i) through (v) in order to create enough bits which are then concatenated as a string of bits of a pre-determined length.

PHASE π - Once sufficient bits are created, the process is stopped. Alice and Bob must now use the relative time series to create an unconditionally secure pad or key. One skilled in the art can deduce, from a study of various papers in the list of references that there are many ways to proceed. The present invention uses an approach which, very loosely speaking, is initially related to that of Bennett et al.[l]. However in [3, 4 and 10], several changes and improvements have been indicated. These changes, based on fundamental results in algebraic coding theory, information theory, block design and classical statistics together achieve the following results:

(a) an a-priori bound on key-lengths;

(b) a method for estimating the initial and subsequent bit correlations and key-lengths;

(c) a precise procedure on how to proceed optimally at each stage;

(d) a formal proof that K_A converges to K_B, (e) a stopping rule;

(f) a verification procedure for equality; and

(g) a new systematic hash function for Privacy Amplification.

After PHASE I, Alice and Bob have their respective binary arrays K_A and KB and both perform the following steps of PHASE II:

(vii) Shuffle and partition. Alice and Bob apply a permutation to K_A and KB • They then partition the remnant raw keys into sub-blocks of length / = 4.

(viii) Parity exchange and bisective search with 1 = 4: Parities are computed and exchanged for each sub-block of length 4 by Alice and Bob. Simultaneously they discard the bottom bit of each sub-block so that no new information is revealed to Eve. If the parities agree Alice and Bob retain the three top bits of each sub-block. If the parities disagree Alice and Bob perform a bisective search discarding the bottom element in each sub-block exactly as described in [1] and [5] (see also [4]). The procedure in steps (vii) and (viii) is denoted by KAP₄ .

(ix) Estimate Correlation From the length of the new key, we can calculate the expected initial bit correlation x₀ between K_A and K_B [4]. Using xo we can calculate the present expected correlation x = φ ( xo ).

(x) Shuffle, parity exchange, bisective search with the optimal / : To the remnant keys K_A, K_B we apply a permutation/in order to separate adjacent keys. As a non-restrictive example, one such/can be implemented by shuffling the bit order from (1,2,3, — ,ή) into the order (\,p + 1, 2/7 + 1, ... , q_xp + \, 2,p + 2, 2p + 2, ..., q₂p + 2,... ,p-\, 2p-l, 3 p-\, ... , q_pΛp + p-\,p,

2p, 3 p, q_pp +p), where q_t = (n - i) I p.

Given the present correlation x we choose the optimal value for / = l(x) by using the tables in [4]. Similar to (viii), (ix) for the case / = 4, we carry out the procedure KAPi . From x, or from the new common length of the remnant keys, we calculate the expected present correlation after KAPi has been applied. We repeat (xi) until the stopping condition holds, (xi) Stopping Condition : For key length n and correlation x we have n(\-x) < ε ,a predetermined small positive number. We then proceed to the verification procedure, an example of which is as follows. (xii) Verification Procedure : Let K_A , K_B both be of length n. Let t be the smallest integer for which 2¹ ≤ n . Construct a binary matrix M = m_y, (1 < i ≤ t+\ , 1 ≤J ≤ 2' ) as follows: a. The entries m_υ, (1 < i,j < t ) are the entries of the t x t identity matrix /« • b. The (t +1)* row of M is the all-ones vector, that is nt_t+i j = 1 ( 1 ≤J ≤ 2' ). c. Denote the top / entries in the "¹ column by the binary vector v, ( 1 ≤j ≤ 2' ). Thus, vj = {m,_j | 1 ≤ i ≤ t}. Then we impose the condition that the vectors Vj are all distinct. Thus, the set { _j } equals the set of all 2' distinct binary vectors of length *^*. d. Denote the rows of M by R_l5 R₂, ..., R,₊ι . Let x, y denote the remnant keys KA, K written as row vectors of length n. Let x, denote the vectors that result when a row of zeros of length 2'-n is adjoined, on the right of x, y respectively. Thus x = (x,000..0),z = (y,000..0). e. Our verification criterion is to check that x . R, =j> . Ri, (1 ≤ i ≤ t+l ).

If the verification criterion is not satisfied we remove the first f+1 bits from K_A , KB and repeat steps (x), (xi) and check again if the verification criterion is satisfied. Eventually, it will be satisfied. At this stage Alice and Bob have confirmed that they now share the same key. Once confirmed, the final remnant raw key as transformed by Phase 2 is modified by removing the first f+1 bits from K_A = K_B ■ Our new key is re-named the "reconciled key" and phase 3, Privacy amplification is performed.

PHASE III- At this stage Alice and Bob now have a common reconciled key. In certain cases it is possible that the key is only partially secret to eavesdropper, Eve, in the sense that Eve may have some information on the reconciled key in the form of Shannon bits. Alice and Bob now begin the process of PrivacyAmplification that is the extraction of a final secret key from a partially secret one (see [1] and [2]). A well-known result of Bennett, Brassard and Robert (see [19]) shows that Eve's average information about the final secret key is less than 2^~slln 2 Shannon bits as explained below (See also Shannon [9]).

(xiii) Privacy Amplification - Let the upper-bound on Eve's number of Shannon Bits be k and let * > 0 be some security parameter that Alice and Bob may adjust as desired. Alice and Bob now apply a hash function described in "Method For The Construction Of Hash Functions Based On Sylvester Matrices, Balanced Incomplete Block Designs And Error- Correcting Codes", co-pending Irish Patent Application, (the entire contents of which is hereby included by reference as if fully set forth herein [3]) which produces a final secret key of length n - k- s from the reconciled key of length n.

The system and method of the present invention provide an unconditionally secure key agreement scheme based on network dynamics as follows. In PHASE I, Alice and Bob permute the bits of what remains of their respective raw keys, which keys incorporate delay occasioned by network noise. In PHASE II, the key from PHASE I undergoes the treatment of Lomonaco [5]. That is, in PHASE II Alice and Bob partition the remnant raw key into blocks of length /. An upper bound on the length of the final key has been estimated and the sequence of values of / that yield key lengths arbitrarily close to this upper bound has also been estimated [4]. In PHASE II, for each of these blocks, Alice and Bob publicly compare overall parity checks, making sure each time to discard the last bit of the compared block. Each time an overall parity check does not agree, Alice and Bob initiate a binary search for the error, i.e., bisecting the mismatched block into two sub-blocks, publicly comparing the parities for each of these sub-blocks, while discarding the bottom bit of each sub-block. They continue their bisective search on the sub-block for which their parities are not in agreement. This bisective search continues until the erroneous bit is located and deleted. They then proceed to the next /-block.. PHASE I is then repeated, i.e., a suitable permutation is chosen and applied to obtain the permuted remnant raw key. PHASE II is then repeated, i.e., the remnant raw key is partitioned into blocks of length /, parities are compared, etc. Precise expressions for the expected bit correlation (see below) following each step have been obtained in [4], where it is also shown that this correlation converges to 1. Moreover in [4] the expected number of steps to convergence as well as the expected length of the reconciled key are tabulated.

The probability that corresponding bits agree in the arrays K_A , KB is known as the bit correlation probability or, simply, as the bit correlation. It can be shown (see [4]) that each rotmd can be used to increase the bit-correlation. For example, if we start with a bit-correlation of 0.7 then after one round with / = 3 the bit-correlation increases to about 0.77 and then to 0.87. For / = 2 the corresponding numbers are 0.84 and 0.97. Estimates are also available for the key lengths after a round of the protocol of the present invention, for various values of/ [4].

The final secret key can now be used for a one-time pad to create perfect secrecy or can be used as a key for a symmetric key cryptosystem such as Rijndael [12] or Triple DES [19].

A simplified version of the algorithm for the values / = 2 and 3 is described in Appendix A.

It will be understood by those skilled in the art, that the above-described embodiments are but examples from which it is possible to deviate without departing from the scope of the invention as defined in the appended claims.

REFERENCE AND BIBLIOGRAPHY

The following references are hereby incorporated by reference as if fully set forth herein.

[1] Charles Bennett, Francois Bessette, Gilles Brassard, Louis Salvail, and John Smolin, Experimental quantum cryptography, EUROPCRYPT '90 (Arhus, Denmark), 1990, pp. 253- 265. [2] Charles H. Bennett, Gilles Brassard, and Jean-Marc Robert, Privacy Amplification by

Public Discussion, Siam J. of Computing 17, no.2 (1988), pp. 210-229.

[3] Aiden Bruen and David Wehlau, Method for the Construction of Hash Functions Based on Sylvester Matrices, Balanced Incomplete Block Designs, and Error-Correcting Codes, Irish Patent Co-pending Irish Patent Application.

[4] Aiden Bruen and David Wehlau, A Note On Bit-Reconciliation Algorithms, Non-Elephant Encryption Systems Technical Note 01. xx NE2, 2001. [5] Samuel J. Lomonaco, A quick glance at quantum cryptography, Cryptologia 23 (1999), no. l, pp. 1-41.

[6] , A Rosetta Stone for Quantum Mechanics With An Introduction to Quantum

Computation, quant-ph/0007045 (2000).

[7] Ueli M. Maurer, Secret Key Agreement By Public Discussion From Common Information, IEEE Transactions on Information Theory 39 no.3 (1993), pp. 733-742.

[8] United States General Accounting Office, Advances and Remaining Challenges to Adoption ofPpublic Key Infrastructure Technology, GAO 01-227 Report, February 2001,

Report to the Chairman, Subcommittee on Government Efficiency, Financial Management and Intergovernmental Relations, Committee on Government Reform, House of Representatives. [9] Claude E. Shannon, Communication Theory of Secrecy Systems, Bell System Technical

Journal 28(1949), 656-715.

[10] David Wehlau, Report for Non-Elephant Encryption, Non-Elephant Encryption Technical Note 01.08.2001.

[11] A. D. Wyner, The Wire-Tap Channel, Bell System Technical Journal 54 no.8(1975), 7555-1387.

[12] Joan Daemon and Vincent Rijnmeien, The Rijndael Block Cypher, June 1998, http://csrc.nist.gov/encryption/aes/riindael/riindael.pdf

[13] Bruce Schneier, Applied Cryptography, 2 snά Edition, John Wiley & Sons, New York, 1996, Chapter 12.

[14] Andrew Tanenbaum, Computer Networks, Prentice Hall, 1996. [15] Claude E. Shannon, A Mathematical theory of Communication, Bell System Technical

Journal 27(1948), pp. 379-423 and 623-656.

[16] Will E. Leland, Murad S. Taqq, Walter Willinger, and Daniel V. Wilson, On the Self- Similar Nature of Ethernet Traffic, Proc. SIGCOMM (San Francisco, CA; Deepinder P. Sidhu, Ed.), 1993, pp. 183-193.

[17] R. A. Mollin, An Introduction to Cryptography, Chapman & Hall/CRC, 2000. Chapter 6.

[18] Gerald Staruiala and Mario Forcinito, A Novel Application of The Entropic Transformation Concept to Cryptography, Non-Elephant Encryption, Inc. hite Paper,

November 2000.

[19] Douglas R. Stinson, Cryptography: Theory and Practice, CRC Press, 1995. [20] Julian R. Brown, The Quest for the Quantum Computer, Simon & Schuster, New York,

2001.

Appendix A - Procedure for / = 2 and 1 = 3

Let us describe in more detail the procedures for / = 2 and / = 3 in the extraction of the reconciled key described earlier.

Procedure for 7 = 2. Alice and Bob divide their bit strings K_A and KB into pairs (ao, α;)...and o, bi)... HK_A and K_B have odd lengths the last bit is dropped. Working on the blocks (ao, aϊ) and (bo, bj) we proceed as follows.

Alice announces the parity of the block namely the number ao + ai (module2^~). Bob compares the parity of his block. Then, if ao + aj (module2) equals bo+bj (rnodulel) we cancel the elements aι,bj and retain the elements ao,bo- However, if ao + aj (module 2) is different than bo+bj (module2) we cancel the four elements ao,aj,bo,bι.

Procedure for / = 3. We divide the bit strings K_A, K_B into blocks of size 3 namely (ao, a_\, ai)...and (bo, bubi)... respectively. If the size of K_A is not divisible by 3 we discard the last one or two elements ofK_A and K_B as appropriate. Working on each block of size 3, say the blocks (ao, a , ai) and (bo, b , bi) we again examine the parities and proceed as follows.

Case 1 : If the parities agree, then cancel the elements α₂, 6₂.

Case 2: If the parities disagree, then cancel the elements α₂, b₂. Then, if af=- bj, we cancel both blocks of size 3. However, if α; ≠ bj, then cancel aj.bi.

As / increases, the number of rounds needed for convergence increases, but the key-length will be longer. Optimal procedures are described in [4].

Appendix B - Perturbed Channel Model

A simplified theoretical model shows th t in a channel with noise, a per- tυrbat-øn tϋta-odxiced by an observer can be detec ed under certain conditions. We have assesse this possibility by nalyzing a mechanical syste that mimics he dynamic of e network.

T e model wor s as follows- A particle is released at he node A, the particle is driven by a potential F towards node B over a potential flic,*). Because there is therm l noise., the particle will perform a random, -wal biased by the potential towards B_r therefore if. will reach B in a finite amount of time. The aver ge arrreil time is described by the Langevin equation-.

flist-aπl'viBl time of the particle to B;

TI = ioi{t ≥ Oj≠t) = B with xi 0) = A) (2)

TA.B is calculated once for the original potential ix , hen for the 'perturbed* potential <j (x) and the difference between the two is obtainei The perturbed version of the potential is defined as

#(*) = { {x) + £{-* + * + e) x e fo c + e)

where h is the height of the potential barrier at point c € [Λ_t ] an £ is half the length over which the effect of the perturbation is s rea . In the limit € — ♦ 0, the perturbation is a Dirac 6 functi n at point c.

Solutions carried on using a simple potential φ(x.) = ctfttst sbπw that arrival time changes (increases) with the perturbation and the incre se is more noticeable as the noise ξ → 0 (Figure 3). The conditions for which the conclusion from this model can be applied to a communication channel are being actively researched at NE².

Claims

We claim:

1 ) A method of generating an unconditionally secure cryptographic key between a first and a second cryptographic station A and B, said method comprising the steps of: a) in said first and second station A and B, constructing, in a pre-arranged way from an independently recorded measurement of a given physical phenomena, a first and second correlated string L_A, LB each of a given length N (i.e., said first and second string L_A, LB constructed such that the corresponding statistical variables are not independent) of digits selected from a finite alphabet; b) in said first and second station A and B, applying a predetermined permutation g = gN to LA, L_B to obtain a first and second permuted string g(L_A) and g(Lβ), wherein g = g_H is a pre-determined permutation and then expressing g(L_A), g(Lβ) as a pre-determined concatenation U_Ϊ(=S_A), U₂, ... ,U_m and

V_J(=SB), V₂, ... ,V_m' respectively wherein S_A is a substring of said first permuted string g(LA), S_B is a substring of said second permuted string g(Lβ), and the length of Uj equals the length of Vj for 1 ≤ i < m; c) evaluating recursively P (S_A,S_B) = P/ (S_A,SB) wherein / = |SA| = |SB| is the common length of S_A and S_B, and P is a function defined on certain ordered pairs (U,V) of strings U, V having a common length s= |U| = |V|, said evaluating step further comprising the substeps of;

(i) in said first station A, transmitting to said second station B, the computed value r(S_A), of a predetermined function T on S_A, wherein T is a function mapping strings to strings that maps the null string to the null string having the property that for strings X,Y with |X| = |Y|, r(X) = r(Y)- and transmitting said value to station B;

(ii) in said second station B, transmitting to said first station A the digit 1 if T(S_A) is equal to the computed value T(S_B) and the digit 0 otherwise;

(iii) in said first and second station A and B, respectively, calculating strings f(SA), f(Sβ) wherein f is a pre-assigned function mapping strings to strings that maps the null string to the null string, maps all strings of length one to the null string and is such that for any string X the length of f(X) is less than or equal to the length of X and having the property that for strings X,Y with |X| = |Y|, |f(X)| = |f(Y)|;

(iv) in said first and second station A and B, setting

P/ (S_A,S_B) = (f(S_A),f(S_B)) in the case when T(S_A) = T(S_B);

(v) when T(S_A) ≠ T(SB), performing the substeps of: a. in said first station A, writing f(S_A) as a concatenation MA NA of strings M_A, N_Λ having λ = |N_A| = V 1 or ^lA t + Yz (when t is even or odd respectively) where t is the common length of f(SA), f(Sβ), b. in said second station B, writing f(Sβ) as a concatenation MB Nβ of strings M_B, NB having λ = |N_A| ;

(vi) in said first station A, transmitting T(N_A) to said second station B; (vii) in said second station B, transmitting to said first station A the digit 1 if

T(N_A) = r(N_B) and the digit 0 otherwise; (viii) setting ?, (S_A,S_B) = (K_\,Y_\) in the case when T(N_A) = T(N_B) wherein

Xi is a concatenation of the first component of P,-X(M_A,MB) with the string f(N_A) and Y] is a concatenation of the second component of P,.χ

(MA, MB) with f(N_B); (ix) setting P/ (S_A,S_B) = (X₂, Y2) i the case when T(N_A) ≠ T(N_B), where X₂ is a concatenation of M_A with the first component of P (N_A,NB) and Y₂ is the concatenation of Mβ with the second component of P (N_A,NB). (x) recursively calculating Pχ(N_A,Nβ), (or P,._X(M_A,MB)) by repetition of sub-steps (i) to (ix) with S_A=N_A , ) thereby obtaining P_/ (S_A,S_B). d) calculating successively P« (Ui,Vj) with k - |Uj|=|Vi| by repeating step (c) with S_A = Uj , S_B = V; and then concatenating W_l5 W₂, W₃, ... W_m to construct a first concatenated string K_A in said station A where i is the first component of the pair P_/ (Uι,Vι) = P_/ (S_A,S_B) and Wj is the first component of the pair P_/ OJ V ^ ≤ i ≤ w, ; e) calculating successively P_/j (Ui,Vj) with l = |Uj|=|Vj| by repeating step (c) with S_A ⁼ Uj , SB = Vj and then concatenating the strings Zi, Z₂, Z₃, ... Zm to construct a second concatenated string K_B of length n in said station B where Z_\ is the second component of the pair P_/ (Uι,Vι) = P_/ (S_A,SB) and Zi is the second component of the pair P_/ (Ui,Vj), with l = |Ui|=|Vi|, 2 ≤ i < m; f) from |K_A|=|K_B| calculating a bit correlation x = X(K_A,KB) from a predetermined formula using the length n = |K_A|=|KB| wherein KB is replaced by a Boolean complement K_B* (obtained by replacing 1 and 0 in KB by 0 and 1 respectively ) whenever the bit correlation between KA and KB is less than 0.5, yielding* > 0.5; g) determining whether JC(K_A,K_B) satisfies a pre-determined stopping inequality S; h) repeating steps (b) to (g) with L_A = K_A, L_B = K_B in the case that S is not satisfied; i) otherwise in the event that inequality S is satisfied, performing the substeps of;

(i) evaluating C(K_A) in said first station A where C is a pre-determined hash function defined on all non-null strings;

(ii) in said first station A, transmitting C(K_A) to said second station B;

(iii) evaluating C(KB) in said second station B;

(iv) in said second station B, transmitting to said first station A a digit 1 if

C(K_B)= C(K_A) and a digit 0 otherwise; j) in the event that C(K_A) = C(K_B), constructing Λ(K_A) = Λ(K_B), an unconditionally secure cryptographic key shared by said first and second cryptographic stations A and B, wherein Λ is a pre-determined hash function that eliminates all of an eavesdropper's potential information; and k) repeating steps (b) to (j) in the event that C(K_A) D C(KB), wherein L_A = K_A and

LB = KB_, respectively.

2) A method of generating an unconditionally secure cryptographic key between a first and second cryptographic station A and B according to claim 1, wherein step a) further comprises the substeps of: a.l) respectively providing said first and second station A and B a first secret string Ri and a second secret string R₂, R] and R₂ being correlated (i.e., the statistical variables corresponding to Ri and R₂ are not independent) and having the same length; and a.2) respectively replacing said first and second string L_Aand LB with said first and second secret string Rjand R₂.

3) A method of generating an unconditionally secure cryptographic key between a first and second cryptographic station A and B, said method comprising the method of claim 2, wherein said secret strings Rj and R₂ are obtained from the bounded storage model (of Maurer and Rabin).

4) The method of claim 1, wherein said predetermined hash function C of step i) is the syndrome of a binary linear code of minimum distance d wherein d is some predetermined positive integer.

5) The method of claim 1 , wherein step a) further comprises the substeps of: a.l) in said first and second station A and B, respectively concatenating a generated first and second random string RA and R_B with said first and second string L_A and LB to result in a first and second concatenated string L_AR_A and L_BRB; and a.2) in said first and second station A and B, respectively substituting said first concatenated string L_AR for said first string L_A and said second concatenated string LBR_B for said second string Lβ.

6) The method of claim 2, wherein the strings Ri and R₂ are replaced by the concatenated strings Ri R_A, R₂ R_B respectively wherein R_A is a random string generated in station A and R_B is a random string generated in station B with R_A and RB having the same length.

7) The method of claim 1, wherein step a) further comprises the substep of in said first and second station A and B, respectively, replacing said first and second string L_A and Lβ with the dot product modulo 2 of a generated first and second random binary string RA and RB with said first and second string L_A and L_B to form a first and second dot product string L_A ^#R_A and L_B*R_B, wherein R_A and R_B are generated random binary strings having the same length as L_A and L_B, respectively.

8) The method of claim 2, wherein the strings Ri and R₂ are replaced by the strings R^R_A, R₂ »R_B, respectively, wherein R_A is a random string generated in station A and RB is a random string generated in station B with R_A and R_B having the same length as and R , respectively.

9) A method of generating a first and second string U and V in first and second station A and B, respectively, said first and second string U and V having a predetermined bit correlation xo, 0.5 < xo< 1, said method comprising the steps of: i. conducting steps a) to f) of claim 1 to construct a first and second string KA and K_B having bit correlation x > 0.5; ii. if x < xo_, repeatedly conducting steps a) to f) of claim 1 until the bit correlation x = x (K_A K_B) is greater than or equal to xo\ and iii. if x > xo_, replacing K_A, K_B by a first and second concatenated string U = RAKA and V = RβKβ, respectively, wherein R_A and R_B is a first and second random string generated in first and second station A and B, respectively, each having a length which ensures that the bit correlation of U and V is equal to xo_.

10) A method of generating a first and second string U and V in a first and second station A and B, respectively, said first and second string having a predetermined bit correlation xo in the range of 0 < xo < 0.5, said method comprising the steps of: i. constructing a third and fourth string K_A, K_B with bit correlation Xi = 1 - Xo according to the method of claim 9; and ii. replacing KB by its Boolean complement K_B*, wherein said complement is obtained by replacing 1 and 0 in K_B by 0 and 1, respectively.

11) A method of generating a first and second string U and V in a first and second station A and B, respectively, said first and second string U and V having a predetermined bit correlation xo in the range 0.5 < xo< 1, said method comprising the steps of: i. conducting steps a) to f) of claim 2 to construct a first and second concatenated string K_A and K_B having bit correlation x > 0.5; ii. if j < xo, repeatedly conducting steps a) to f) of claim 2 until the bit correlation x = x (KA, KB) is greater than or equal to xo; and iii. if x > xo , replacing K_A, KB by a third and fourth concatenated string U= K_A RA, V = KB RB, respectively, where R_A and R_B is a first and second random string generated in said first and second station A and B, respectively, each said first and second random string having a length which ensures that the bit correlation of U and V is equal to xo-

12) A method of predicting with arbitrarily high precision the length of an unconditionally secure cryptographic key generated by the method of claim 2, said method comprising the steps of: i. conducting steps of a) to e) of claim 2 to create first and second concatenated strings

K_A and K_B; ii. calculating the initial bit correlation JC(K_A,K_B); and iii. estimating the length of an unconditionally secure cryptographic key based on this calculated correlation.

13) An unconditionally secure encryption method, said method comprising the steps of: i. generating first and second unconditionally secure keys Λ(KA) ⁼ Λ(Kβ) according to the method of claim 1; and ii. concatenating said first and second unconditionally secure keys Λ(K_A) and Λ(Kβ) to generate a one-time pad.

14) A complete cryptographic system, comprising: a standard Kerberos configuration, wherein a server authenticates a plurality of communicating parties and said parties generate an unconditionally secure cryptographic key according to the method of claim 1.

15) A complete cryptographic system, comprising: an unconditionally secure key generated by claim 1 ; and an authentication algorithm.

16) The method of claim 1 , wherein all strings are binary strings.

17) The method of claim 1 , wherein the function f maps a non-null string to that same string with the last element deleted.

18) The method of claim 1 , wherein: the alphabet is a finite abelian group G; and the function T maps a string over G to the sum of the elements in the string.

19) The method of claim 17 wherein G is the binary field and Tmaps a string to its parity.

20) The method of claim 1 , wherein the function T maps all strings to a given fixed string such that for any two strings X and Y, F(X) = T(Y).

21) The method of claim 1 , wherein: for a binary string U of length / ≥ 1, f(U) = parity of U; and for a first and second substring X and Y of LA and LB, respectively, T(X) = T(Y) such that

P_/(X,Y) = (parity(X),parity(Y)).

22) The method of claim 1 wherein: f maps a non-null string to that same string with the last element deleted; r maps a binary sting to its parity; and the strings U_I(=SA), U₂, ... ,U_m; and _I(⁼SB), V₂, ... ,V_m all have a common length /.

23) The method of claim 1, wherein: all strings are over the alphabet G, wherein G is a finite abelian group; in step a) said strings L_A and L_B are replaced by LA+R_A,L_B+RB, RAand RB being a first and second random string over G of the same length as L_A and LB and + denoting component- wise addition over G.

24) The method of claim 1, wherein:

for each i, 1 < i < m, f and T are predefined on all substrings of all iterates f(Uj), f(f(Ui)), f(f(f(U0)), ... and f(V , f(f(V ), f(f(f(Vi))), ....; f, T map the null string to the null string; and f maps all strings of length 1 to the null string.

25) The method of claim 1, wherein in step a) the physical phenomena comprises measurement by said first station A of a plurality of message round-trip times from said first station A to second station B, and measurement by said second station B of a plurality of message round-trip times from said second station B to said first station A. 26) The method of claim 1 , wherein in step a) the physical phenomenon comprises a common signal emanating from an outside transmitting source selected from at least one of a satellite, a group of satellites, a radio transmitter, and a group of radio transmitters.

27) The method of claim 1, wherein S of step g) is the inequality n(l- ) < ε where ε is a pre-determined positive number.

28) The method of claim 1 , wherein λ is a pre-determined fraction of r, said fraction lying in the range between 0 and 1.

29) A method for verifying with pre-determined probability equality of a first string Si in a first station A with a second string S₂ in a second station B, S_\ and S₂ having the same length, said method comprising the steps of: i. conducting steps a) to i) of the method of claim 2 wherein R]= Si and R₂= S ; and ii. conducting steps b) to f) of the method of claim 2 if C(K_A) ≠ C(Kβ).

30) A method for determining the correlation between a first secret string U in a first station A and a second secret string V in a second station B, said method comprising the steps of conducting steps a) through i) of the method of claim 2 wherein Rι=U and R₂=V.

31) A method for checking the equality of a first and second key U and V in a first and second station A and B, respectively, comprising the steps of: obtaining said first and second key U and V, respectively, from a public key exchange algorithm used between said first and second; and conducting the method of claim 28 wherein S1=U and S₂=V.