Root certificates generated by root certificate authorities may be bound at the time of generation. In an example, a first root certificate can include an identity of a first root certificate authority, a first key identifier associated with a first key of the first root certificate authority and an identity of a first digital signature algorithm used by the first root certificate authority. The first root certificate can also include at least one extension including a second key identifier of a second key associated with the second root certificate authority and an identity of a second digital signature algorithm used by the second root certificate authority, the second digital signature algorithm being different from the first digital signature algorithm.

Briefly, example methods, apparatuses, and/or articles of manufacture are disclosed that may be implemented, in whole or in part, using one or more processing devices to facilitate and/or support cryptographically associating a particular computing device with a new system owner based at least in part on a new system owner public key of a new system owner public/private key pair and a current system owner private key of a current system owner public/private key pair.

A method of generating a shortcut certificate for authenticating a user digital certificate generated by an issuing certification authority; the method comprising: authenticating the digital certificate of the issuing certification authority; creating the shortcut certificate for the digital certificate of the issuing certification authority when the digital certificate of the issuing certification authority is authenticated; wherein the shortcut certificate comprises a signed entry of an authentication of the issuing certification authority.

A method includes receiving a request from a certificate user to utilize a short-term private key-public key pair. The short-term private key-public key pair includes a short-term private key and a public key. The short-term private key may expire after a period less than a year in length. The method further includes generating, using a processor, the short-term private key and generating, using the processor, the public key. The method further includes requesting a public key certificate from a Certificate Authority (CA). The method also includes receiving the public key certificate from the CA and pairing the short-term private key with the public key certificate. The public key certificate may include the public key that corresponds to the short-term private key. The method further includes storing the short-term private key-public key pair to a storage.

The invention concerns a method for generating an electronic signature key and an associated public key certificate, implemented by a client unit and a server unit, the method comprising a step during which the client unit and/or the server unit generate(s) a signature key comprising a private key and a public key, and a public key certificate comprising said public key, the method being characterized in that the client unit acquires an item of biometric data of an individual, and in that the signature key and/or the public key certificate are generated from at least a portion of said biometric data, and in that the portion of biometric metric data from which the signature key and/or the public key certificate have been generated is ephemeral and is not memorized after the signature key and the public key certificate have been generated. The invention also concerns a method for transferring a message and a system designed to implement the method for generating a signature key.

An inner-product predicate encryption scheme with improved flexibility without a restriction that the dimensions of an attribute vector x.sup..fwdarw. and a predicate vector v.sup..fwdarw. should be equivalent. A ciphertext having an element c.sub.0 and an element c.sub.t for each index t included in a set I.sub.x.fwdarw. is decrypted with a decryption key having an element k.sub.0 and an element k.sub.t for each index t included in a set I.sub.v.fwdarw. by computing a product of pairing operations between corresponding pairs of basis vectors on the element c.sub.0 and the element k.sub.0 and on the element c.sub.t and the element k.sub.t.

A method includes receiving, from a certificate requestor: a request for a public key certificate and a list of a plurality of distribution addresses. The request may include a public key for the certificate requestor. The plurality of distribution addresses may belong to a plurality of third parties. The method further includes verifying an identity of the certificate requestor, and, in response to verifying the identity of the certificate requestor, retrieving a public key from the request for the public key certificate. The method may also include, in response to verifying the identity of the certificate requestor, generating the public key certificate and signing the public key certificate. The public key certificate may include the public key. The method may also include transmitting the signed public key certificate to the certificate requestor and the plurality of distribution addresses.

A method includes generating, using a processor, a private key-public key pair. The private key-public key pair may include a private key and a public key. The method also includes generating a request for a public key certificate. The request may include the public key. The method further includes sending the request for the public key certificate to a Certificate Authority (CA) and receiving the public key certificate from the CA. The public key certificate may be signed by the CA. The method also includes using the public key certificate received from the CA and transmitting the public key certificate received from the CA to a plurality of distribution addresses. The plurality of distribution addresses belong to a plurality of third parties.

A method includes, for respective queues of a plurality of queues stored in a storage: generating, using a processor, a private key—public key pair; and storing the private key—public key pair to a back of the queue. The private key—public key pair may include a private key and a public key. The method also includes receiving a request from a certificate user to utilize a private key—public key pair. The method further includes retrieving a first private key—public key pair from a front of a first queue of the plurality of queues. The method also includes using the first private key—public key pair and generating a new private key—public key pair to replace the first private key—public key pair. The method also includes storing the new private key—public key pair to a back of the first queue.

Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.