CA1311559C

CA1311559C - Method and system for personal identification

Info

Publication number: CA1311559C
Application number: CA000593848A
Authority: CA
Inventors: Frank Thomson Leighton; Silvio Micali
Original assignee: Frank Thomson Leighton; Silvio Micali; Polaroid Corporation; Primary Pdc, Inc.; Yama Capital, Llc
Current assignee: YAMA CAPITAL LLC
Priority date: 1988-03-21
Filing date: 1989-03-15
Publication date: 1992-12-15
Anticipated expiration: 2009-12-15
Also published as: EP0334616A3; EP0334616A2; DE68918971D1; EP0334616B1; JP2000358026A; DE68918971T2; JPH0228775A; US4879747A

Abstract

METHOD AND SYSTEM
FOR PERSONAL IDENTIFICATION

ABSTRACT OF THE DISCLOSURE
The method and system of the invention utilizes a private key of a public-key cryptosystem key pair to encrypt a non-secret password into a digital signature. The password and the digital signature are then encoded and stored on a magnetic stripe or other memory device of the card. To effect a transaction, the digital signature on a received card must be shown to have been generated from the password on the received card. The password preferably includes a digitized photograph of the authorized cardholder which is capable of being displayed at the transaction terminal. This enables the operator of the terminal to verify the identity of the cardholder by visual inspection.

Description

~311~9 METHOD AND SYSTEM
~OR PERSONAL IDENTIFICATION

TECHNIC~L ~IELD
The present invention relates generally to personal identification schemes and more particularly to a method and system for issuing authorized personal identification cards and for preventing unauthorized use thereof during transaction processing.

BAC~GROUND OF THE INVENTION
Password-based protection schemes for credit cards or other personal identification cards are well-known in the prior art. Such cards typically include a memory comprising a magnetic tape or other storage media affi~ed to the card.
They may also include a data processing capability in the form of a microprocessor and an associated control program. In operation, a card issuer initially stores in the memory a personal identification number, i.e., a secret password, as well as a value representing a magimum dollar amount. To effect a transaction, the card is placed in a terminal and the user is required to input his or her password. If the terminal verifies a match between the user-inputted password and the password stored on the card, the transaction is allowed to proceed. The value of the transaction is then ~3~5~
subtracted from the value remaining on the card, and the resulting value represents the available user credit.
Technigues have also been described in the prior art for protecting against the illegitimate issuance of credit cards such as the type described above. In UOS. Patent No.
4,453,074 to Weinstein, each such card has stored therein a code which is the encryption of a concatenation of a user's secret password and a common reference te~t. The encryption is derived in an initiali~ation terminal through the use of a private key associated with the public key of a public-k~y cryptosystem key pair. In operation, a cardholder presents his or her card to a transaction terminal. The terminal decrypts the stored code on the card in accordance with the public key of the public-key cryptosystem pair. A transaction is effected only if the stored code decrypts into the user password, inputted on a keyboard by the cardholder, and the common reference text.
While the method described in the Weinstein patent provides an adequate protection scheme for preventing the fraudulent issuance of credit cards, this scheme requires each user to have a secret or ~private" password which must be memorized and inputted into the transaction terminal.
Weinstein also requires additional circuitry for concatenating the user's secret password with the common reference te~t.
This latter requirement, while purportedly required to insure 1 3 ~

the inteyrity of the protection scheme, increases the comple~ity and the cost of the system.
It would therefore be desirable to prsvide an improved method for issuing personal identification cards using a public-key cryptosystem in which a ~secret~ password need not be memorized by the authorized user or concatenated with a common reference te~t to maintain the system security.

~3~3~9 ~RIEF SUMMARY OF THE INVENTION
The present invention describes a method and system for issuing authorized personal identification cards and for preventing the unauthorized use thereof using a public-key cryptosystem.
According to one feature of the invention, each authorized user of a card is assigned a password having a portion thereof which is generated from a representation of some non-secret or ~public~ characteristic of the user. The password is then processed to produce a digital "signature"
which, along with the password, is thereafter stored on the card. To authorize a transaction at a transaction terminal, the digital signature from a received card must first be shown to have been generated from the password on the received card. The password is also processed at the transaction terminal to display a representation of the "public"
characteristic encoded thereon. The public characteristic is then veri~ied by an operator of the transaction terminal before a transaction is authorized.
It is very difficult to create a valid signature for any personal data without the proper private key, although it is simple for anyone to verify whether or not the signature for a password on the card is authentic, even without the private key. Only a card issuer can thus make a valid card and only a user with matching personal characteristics can use the card.

In the preferred embodiment, the password includes data representing a pictorial representation of a physical characteristic (e.g., the face, fingerprint, voice sample or the like~ of the authorized user. Alternatively, or in 5addition to the pictorial representation data, the password may contain other data pertinent to the user, such as the user's age, address, nationality, security clearance, bank account balance, employer, proof of ownership, or the like.
The password may also include one or more codewords, each of 10the codewords authorizing a specific transaction such as permission to receive certain funds on a certain date, permission to see classified documents, permission to enter into a country on a certain date (i.e., a visa), attestation to perform certain acts, or the like. Although not meant to 15be limiting, the personal identification card may be a credit card, a driver's license, a passport, a membership card, an age verification card, a bank card, a security clearance card, a corporate identification card or a national identification card.
20In the preferred embodiment, a method for issuing an authorized personal identification card comprises the steps of generating the pictorial representation of a physical characteristic of the authorized user, processing the pictorial representation to generate a password, mapping the 25password with a predetermined function to generate a mapped password, digitally signing the mapped password with a private key of a public-key cryptosystem pair to generate a sigDature corresponding to the mapped password, encoding the password and the signature with a predetermined function to generate an encoded password/signature, and storing the encoded password/signature or. a personal identification card.
To enable an authorized user of the personal identification card to effect a transaction using a transaction terminal, the subject invention describes a method comprising the steps of receiving the personal identification card at the transaction terminal, decoding the encoded password/signature of the received personal identification card to generate a received password and a received signature, mapping the received password with the predetermined function to generate a mapped password for the received personal identification card, and digitally verifying, using the public key of the public-key cryptosystem pair, whether the received signature can be generated from the mapped password for the received personal identification card. If the received signature can be generated from the mapped password using the public key, the method continues by generating an indication that the received signature is valid. A pictorial representation is then generated from the received password, and the pictorial representation and the indication are then displayed on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.
Preferably, the digital signing routine of the method includes the steps of multiplying the mapped password ~Q~ by each of the four factors ~1 modulo ~M~ and +2 modulo "M , where M~Pl-P2. As used herein, ~M" refers to the public key of the public-key cryptosystem pair and (Pl,P2) refers to the private key thereof, where ~pln an~ ~P2" are secret prime numbers which are preselected such that only one of the our values +Q mod M and +2Q mod M is a quadratic residue modulo ~M". According to the digital signing routine, the four values +Q mod M and +2Q mod M are evaluated to determine which of these values is a quadratic residue modulo "Mn. The square root of the quadratic residue is then computed to generate the 1~ signature. Because the square root com~utation is eztremely difficult to carry out without knowing the factorization o the secret prime numbers of the private key, unauthorized third parties are not capable of producing a card "signature"
which, when digitally verified at the transaction terminal, can be shown to have been generated from the mapped password on the received personal identification card.
In accordance with yet another feature of the invention, a system for issuing authorized personal identification cards and for preventing unauthorized use thereof includes a 2~ plurality of issuing transaction terminals, each of the issuing transaction terminals being uniquely associated with one issuer of personal identification cards. Each issuer is assigned or selects its own public-key cryptosystem key pair which may or may not be different from the public-key cryptosystem key pair of every other issuer in the system.
This arrangement, especially suited to a passport control system or the like, enables the operator of a transaction terminal to verify signatures from one or more of the issuers.
According to a further feature of the invention, a unique personal identification card is provided for effecting transactions via at least one transaction terminal. The identification card preferably includes a body portion and a memory within the body portion for storing a password and a signature derived from the password. The password includes a portion thereof which is g~nerated from a pictorial representation of a non-secret characteristic of the authorized user, such as the user's face. The signature is derived from the password wîth the private key of a public-key cryptosystem pair.

11 3 ~
BRIEF DESCRIPTION OF TNE DRAWINGS
For a more complete understanding of the present invention and the advantages thereof, reference is now made to the following Description taken in conjunction with the accompanying Drawings in which:
FIGURE l is a schematic representation of one type of personal identification card according to the invention, the card having a picture of a physical characteristic of an authorized user of the identification card;
~IGURE lA is a diagrammatic representation of a portion of a magnetic stripe of the personal identification card of FIGURE l showing a ~password" generated in part from the picture on the identification card;
FIGURE 2 is a general flowchart diagram of the preferred method of the present invention for issuing an authorized personal identification card such as shown in FIGURE l;
FIGURE 3 is a detailed flowchart diagram of the digital signing routine of FIGURE 2;
FIGURE 3A is a flowchart diagram of a routine for selecting the secret prime numbers of the private key (Pl,P2);
FIGURE 4 is a general flowchart diagram of the preferred method of the present invention for preventing unauthorized use of the personal identification card of FIGURE l which is issued according to the method of FIGURE 2;
FIGURE 5 is a detailed flowchart diagram of the digital verifying routine of FIGURE 4; and 1311~39 FIGURE 6 is a block diagram of a representative multi-issuer system according to the present invention.

~ 3 ~ 9 DETAILED DESCRIPTION
With reference now to the drawings wherein like reference numerals designate like or similar parts or steps, FIGURE 1 is a schematic representation of a personal identification card 10 for use according to the presen~ invention for effecting transactions via a transaction terminal. As noted above, the term ~personal identification card~ according to the present invention is to be read expansively and is deemed to cover credit cards or other commonly known forms of identification such as a passport, a driver's license, a membership card, an age identification card, a security clearance card, a corporate identification card, a national identification card, or the like.
Personal identification card 10 in FIGURE 1 is a driver's license. Card 10 includes a body portion 12 having a display 14 and a memory 16. Although not meant to be limiting, the memory 16 is preferably a magnetic stripe or similar media, or an electronic memory such as a PROM, affixed to or embedaed in the card in a known manner. The personal identification card may or may not include an integral microprocessor embedded in the body portion. As seen in FIGURE 1, the display 14 of the personal identification card 10 supports a pictorial representation 18 of a physical characteristic of the authorized user; e.g., the user's face. Of course, the display 14 may also display pictorial representations of other `"` ~3.1L~3~

physical features of the user such as the user's fingerprint or palm print.
Referring now to PlGURE lA, according to the present invention the memory 16 of the personal identification card 10 preferably includes a ~password~ 20 unique to the authorized user and having a portion 20a thereof which is generated from a representation of some non-secret or ~public~ characteristic of the user. As used herein, the term ~non-secret" refers to the fact that the representation of the authorized user, such as the user's face, is readily ascertainable by viewing and comparing the personal identification card and the authorized user directly. In the preferred embodiment, the section 20a of the password is a digital bitstream representing a digitized version of the pictorial representation 18 on the personal identification card 10.
As also seen in FIGURE lA, the password 20 may include a portion 20b having data representing one or more personal facts about the authorized user such as the user's age, address, nationality, security clearance, employer, bank account balance, eye color, height, weight, mother~s maiden name, or any other such information. This information may or may not be public. Moreover, the password 20 may further include a portion 20c having one or more codewords, each of the codewords authorizing a specific transaction such as permission to enter a country on a certain date, permission to ~. 3 ~

receive certain funds on a certain date, permission to review certain classified documents, or one or more other such specific transactions. Of course, the password 20 may include ona or more of the predetermined types of data, 20a, 20b, and/or 20c, shown in FIGURE lA.
As also seen in FIGURE lA, the memory 16 of the personal identification card 10 also includes a signature 22, which, as will be described in more detail below, is derived from the password 20 using the private key of a "public-key cryptosystem~ key pair. A public-key cryptosystemr is a well known security scheme which includes two "keys," one key which is public (or at least the key-pair owner does not really care if it becomes public) and one key which is private or non-public. All such public-key cryptosystem pairs include a common feature -- the private key cannot be determined from the public key.
Referring now to FIGURE 2, a general flowchart diagram is shown of the preferred method of the present invention for issuing an authorized personal identification card 10 such as shown in FIGURE 1. At step 30, the card issuer collects the necessary personal data from a card applicant. Although not meant to be limiting, this data preferably includes a pictorial representation of a physical characteristic of the authorized user. For example, the data may include a photograph of the card applicant. At step 32, the photograph, ~ 3 ~ 9 other personal data and/or code authorizations are processed to generate a password as described above in FIGURE lA.
At step 34, the password is mapped with a predetermined one-way function "F~ to generate a mapped password "Q" which may have a length substantially less than the length of the password. This "mapping" step is typically required to reduce the length of the digital bitstream comprising the password, especially when a digitized photograph of the authorized user is stored therein. By way of example only, the predetermined one-way function "F" may be any one or more of several well-known hashing functions such as one obtainable from the DES scheme or the Goldwasser, Micali & Rivest scheme.
Alternatively, the function "F~ may be an identity function which simply transfers the password through step 34 without modification. The identity function might be used where the password length is sufficiently smaller than the available storage capability of the memory 16.
At step 36, the method continues to ~digitally sign" the mapped password "Q" with a private key (Pl,P2) of a public-key cryptosystem pair to generate a so-called "signature". As will be described in more detail below, in the preferred embodiment upl~ and "P2" are secret prime numbers and the public-key cryptosystem pair includes a public key "M~ which is equal to ~Pl-P2n. At step 38, the method encodes the password (as opposed to the mapped password) and the signature ~ 3 1 ~

with an error-correcting code to generate an encoded password/signature. Step 38 insures that the card 10 will be usable even if some of its data is destroyed. A~ step 40, the encoded password/signature is stored on the personal 5identification card in the manner substantially as shown in FIGURE lA.
Although not shown in detail in FIGURE 2, it should be appreciated that the card issuer may digitally sign one or more digital signatures on the card 10 at one or more 10different times using different public-key cryptosystem pair keys. The card could then function as a passport with each signature derived from a different cryptosystem key pair corresponding to a different country (i.e., a visa). It may also be desirable in the method of FIGURE 2 to include an 1~additional encryption step wherein the password is encrypted with a predetermined function prior to the mapping step and/or where the signature itself is encrypted. This enables the card to carry information which is desired to be maintained highly confidential even if the card were lost or stolen.
20Referring now to FIGURE 3, a detailed flowchart diagram is shown of the preferred digital signing routine of the present invention. As described above, "N" is the public key of the public-key cryptosystem and (Pl,P2) is the private key thereof. According to the routine, the secret prime numbers 25"Pl" and ~P2" are selected at step 4~ such that when the mapped password Q is multiplied by four predetermined factors, ~1 modulo ~M" and ~2 modulo ~M,~ one and only one of the resulting values ~Q mod M and t2Q mod M is a quadratic residue modulo ~Mn. The security of the preferred digital signing routine is based primarily on the fact that is it extremely difficult to compute the square root of the quadratic residue modulo" M" without knowing the factorization of ~ - Pl-P2.
Referring back to FIGURE 3, at step 44 the mapped password ~Q" is multiplied by each of the factors ~1 mod M and ~o ~2 mod M. The routine continues at step 46, wherein each of the resulting values IQ mod M and +2Q mod M are evaluated to locate the quadratic residue mod "M". When this value is located, the routine computes the square root thereof at step 48 to generate the digital signature.
Although not shown in detail, it should be appreciated that the private key may include any number of secret prime numbers (Pl~P2~P3~ Pn) Preferably, the secret prime numbers are selected according to the routine shown in FIGURE 3A. At step 35, an n-bit random number ~lN is generated. The number of bits "n" needs to be large enough (e.g., 250 bits) such that it is difficult to factor "M". At step 37, xl is incremented to be congruent to a predetermined value, e.g., ~3 mod 3~. At step 39, a test is made to determine if xl is prime. If so, then the routine continues at stPp 41 by setting ~1 - Pl. If ~l-is not prime, then xl is 131~

incremented at step 43 (by setting ~1 ~ xl ~ 8) and the routine returns to step 39. Once Pl is selected, the routine continues at step 45 to generate another n-bit random number ~2~. At step 47, x2 is incremented to be congruent with a second predetermined value, e.g., "7 mod 8~. At step 49, a test is made to determine if ~2 is prime. If so, then the routine continues at step 51 by setting x2 - P2. If x2 is not prime, then ~2 is incremented at step 53 (by setting ~2 - ~2 1 8) and the routine returns to step 49. Once P2 is selected, the public key ~M~ is set equal to Pl-P2 at step 55.
It is also desirable to store Pl and P2 in the issuing terminal responsible for computing signatures. Moreover, it - is possible to distribute the private key (Pl,P2) from one terminal to another without any person being able to discern 1~ the key by using another public-key cryptosystem pair (for which the private key is known only to the receiving terminal).
Moreover, while the digital signing routine of FIGURE 3 is preferred, other schemes, such as RSA, the Goldwasser, Micali ~ Rivest schemP and/or the Rabin scheme, may be used. Such schemes may also require knowledge of the public key, although the routine of FIGURE 3 does not. In any case, the process o generating the "signature" is fast if the private key is known but is prohibitively slow otherwise. Any attempt to issue counterfeit cards is complicated further by the use of a `` ~ 3 ~ 3 9 one-way function nF~ to hash the password into the mapped password ~Q~. In this way, it becomes virtually impossible for a counterfeiter to mount a chosen-te~ attack on the card generation scheme even if the counterf~iter could somehow obtain signatures for fake personal data.
Referring now to FIGURE 4, a general flowchart diagram is shown of a preferred method for preventing unauthorized use of the personal identification card lO issued according to the routines of FIGURES 2-3. At step 50, the personal identifica-tion card is received at a transaction terminal. At step 52,the encoded password/signature is decoded to generate a received password and a received signature. Preferably, the method includes a step 54 wherein errors in the received password and received signature are corrected in accordance with well-known techniques. At step 56, the received password is mapped, with the same predetermined function "F" used at the issuing terminal, to generate a mapped password "QRn for the received personal identification card.
The routine then continues at step 58 to verify that the received signature is "valid". In particular, the method digitally verifies, using the public key of the public-key cryptosystem pair, whether the received signature can be generated from the mapped password ~QR~. If so, the method continues at step 60 to generate an indication that the 2~ received signature is valid. At step 62, a representation is .? '3 9 generated from data in the received password. This repre-sentation will be a picture if the original password stored on the card included a digitized photograph of the authorized cardholder. Of course, step 62 can be performed in parallel with steps 5~ and 60 so that the picture is immediately dis-played while the signature verification takes place. Referring back to FIGURE 4, at step 64, the method displays either the pictorial representation or the indication, or both, on a display of the transaction terminal. This display is then verified by an operator of the terminal at step 66 to insure that the cardholder is authorized to effect a transaction.
It should be appreciated that the personal identification card generated according to the method of FIGURE 2 can be used in any situation requiring user identification. For e~ample, and not by way of limitation, the authorized user can present the card to an authorized salesperson for charging a purchase.
The salesperson would enter the card into the transaction terminal which is capable of reading the data from the card's memory, verifying that the (digital) signature on the card is valid, and displaying on the display screen information derived from the password. The salesperson can therefore be assured that the cardholder's identity is as claimed and proceed with the charge.
Referring now to FIGURE 5, a detailed flowchart is shown of the preferred digital verification routine of FIGURE 3. At 13~L3a9 step 68, the routine multiplies the mapped password ~QR" from the received personal identification card by each of the factors +l mod M and ~2 mo~ ~. The method continues at step 70 by squaring modulo "M" the received signature to generate a value ~X . At step 72, a test is made to determine whether ~X" equals either +QR mod M or ~2QR mod M. If so, the routine continues at step 74 to generate the indication that the received signature is valid. If ~n does not equal any one of these four factors, the signature is invalid and the trans-action is inhibited.
Of course, the method and system of the present invention is easily adaptable to a multi-issuer scenario where several parties desire to issue cards using different cryptosystem pairs, but where verifiers (i.e., operators of transaction terminals) need to authenticate a card from any of the issuers. This can be accomplished by encoding the public key used by each issuer into each transaction terminal and then requiring the operator thereof to enter into the terminal both the identity of the issuer along with the card itself; alter-natively, the identity of the card issuer can be encoded on the card. This type of system is shown in FIGURE 6, wherein a plurality of issuing terminals 76a...76n are provided for one or more independent issuers of authorized personal identi-fication cards. Each of the independent issuers is assigned or selects a distinctive public-key cryptosystem pair unknown ~31~9 to the other issuers. As noted above, the public key of each such pair is then encoded into each of the one or more trans-action terminals 78a...78n which are shared by all of the issuers.
The system of FIGURE 6 is useful for passport control, national identification cards, or multi-company credit cards, although such applications are not meant to be limiting. In operation of a passport system, for e~ample, each country would have complete autonomy over the personal identification cards it issues, but a single transaction terminal would be used to authenticate the signature (which could include a visa) of any country.
Although not described in detail, it can be appreciated by those skilled in the art that the method and system of the present invention can be readily implemented with preexisting hardware and software. In the preferred embodiment, and as shown in FIGURE 6, each of the issuing terminals 76 includes a microcomputer 80 and associated memory devices 82 for storing operating programs and application programs for carrying out the method steps of FIGURE 2. Input/output devices, such as a keyboard 84 and display 86, are provided for interfacing the terminal to the card issuer. Of course, one or more of the method steps (e.g., the digital signing step, the mapping step and the encoding step) can be implemented in either gate array logic chips or software. Likewise, each of the transaction 131 1~9 terminals 78 preferably includes a microprocessor 88, associ-ated memory 90, and appropriate input/output devices such as cardreader 92, keyboard 94 and display 96.
While the above discussion relates specifically to protection schemes for personal identification cards, it should be appreciated that the password~signature security routines of the present invention may also be used where the personal data is transmitted over a communications channel as opposed to being stored on an identification card per se.
Returning back to FIGURE 6, this aspect of the invention is achieved by providing a communications channel lO0, e.g., a telephone link via modems, between an issuing terminal 76b and a transaction terminal 78a.
In operation, the method steps of FIGVRE 2 would be the same as previously described except that step 40 is deleted and a step of transmitting the encoded password/signature over the communications channel lO0 is substituted therefor.
Likewise, step 50 of the verification routine in FIGURE 4 is deleted and is substituted with a step whereby the information provided over the communications channel lO0 is received at the transaction terminal and then processed according to the remainder of the steps in FIGURE 4. In this way, the password/signature method is used for personal identification where the medium for supporting and transmitting the password and the signature is the communications channel itself rather than the identification card.

1 3 ~ 9 Although the invention has been described and illustrated in detail, the same is by way of example only and should not be taken by way of limitation. The spirit and scope of the present in~ention are limited only by the terms of the appended claims.

Claims

1. A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of:
generating a password having a portion thereof which is non-secret;
mapping the password using a predetermined function "F"
to generate a mapped password;
digitally signing the mapped password with a private key of a public-key cryptosystem pair to generate a signature corresponding to the mapped password;
encoding the password and the signature to generate an encoded password/ signature;
storing the encoded password/signature on the personal identification card;
receiving the personal identification card at the transaction terminal;
decoding the encoded password/signature on the received personal identification card to generate a received password and a received signature;
mapping the received password with the predetermined function "F" to generate a mapped password "QR" for the received personal identification card;
digitally verifying, using the public key "M" of the public-key cryptosystem pair, whether the received signature can be generated from the mapped password for the received personal identification card;
if the received signature can be generated from the mapped password using the public key, generating an indication that the received signature is valid;
generating a representation from the received password;
and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

2. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the password includes data representing a pictorial representation of a physical characteristic of the authorized user.

3. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the password includes data representing one or more personal facts about the authorized user.

4. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the password includes one or more codewords, each of the codewords authorizing a specific transaction.

5. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the password includes data representing a pictorial representation of a physical characteristic of the authorized user, data representing one or more personal facts about the authorized user, and at least one codeword authorizing a specific transaction using the personal identification card.

6. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the predetermined function "F" is an identity function.

7. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the predetermined function "F" is a hashing function based on a DES scheme.

8. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the encoding step includes the step of:
encoding the password and the signature with an error-correcting code.

9. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the decoding step includes the step of:
correcting errors in the received password and in the received signature decoded from the encoded password/signature.

10. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 1 wherein the digital signing step includes the steps of:
multiplying the mapped password "Q" by each of the factors ?1 mod M and ?2 mod M;
determining which of the four values ?Q mod M and ?2Q mod M is a quadratic residue modulo M, where "M" equals "P1.P2" and P1 and P2 are secret prime numbers which are preselected such that only one of the four values ?Q mod M and ?2Q mod M is a quadratic residue modulo "M"; and computing the square root of the quadratic residue to generate the signature.

11. The method for enabling an authorized user of a personal identification card to effect a transaction as described in Claim 10 wherein the digitally verifying step includes the steps of:
multiplying the mapped password "QR" from the received personal identification card by each of the factors ?1 mod M
and ?2 mod M;
squaring modulo "M" the received signature to generate a value "X";
determining whether "X" equals either ?QR mod M or ?2QR
mod M; and if "X" equals either ?QR mod M or ?2QR mod M, generating the indication that the received signature is valid.

12. A method for issuing a personal identification card for an authorized user of the personal identification card, comprising the steps of:
generating a pictorial representation of a physical characteristic of the authorized user;
processing the pictorial representation to generate a password;
mapping the password with a predetermined one-way function to generate a mapped password "Q" having a length substantially less than the length of the password;
digitally signing the mapped password "Q" with a private key (P1,P2) of a first public-key cryptosystem pair to generate a first signature, where P1 and P2 are secret prime numbers and the first public-key cryptosystem pair includes a public key "M" which is equal to P1.P2;
encoding the password and the first signature with an error-correcting code to generate an encoded password/signature; and storing the encoded password/signature on the personal identification card.

13. The method for issuing a personal identification card as described in Claim 12 further including the steps of:
digitally signing the mapped password with a private key of a second public-key cryptosystem pair to generate a second signature; and encoding the second signature along with the password and the first signature.

14. The method for issuing a personal identification card as described in Claim 12 further including the step of:
augmenting the password to include data representing one or more personal facts about the authorized user.

15. The method for issuing a personal identification card as described in Claim 12 further including the step of:
augmenting the password to include one or more codewords, each of said codewords authorizing a specific transaction using the personal identification card.

16. The method for issuing a personal identification card as described in Claim 15 wherein the personal identification card is a passport and each of the cryptosystem pairs corresponds to a different country.

17. The method for issuing a personal identification card as described in Claim 12 wherein the digital signing step includes the steps of:
multiplying the mapped password "Q" by each of the predetermined factors ?1 mod M and ?2mod M;
determining which of the values ?Q mod M and ?2Q mod M is a quadratic residue modulo "M", where the secret prime numbers P1 and P2 which are preselected such that only one of the four values ?Q mod M and ?2Q mod M is a quadratic residue modulo "M"; and computing the square root of the quadratic residue modulo "M" to generate the first signature.

18. The method for issuing a personal identification card as described in Claim 12 further including the step of:
encrypting the password with a predetermined function prior to the mapping step.

19. A system for issuing authorized personal identification cards and for presenting unauthorized use thereof; comprising:
issuing terminal means for issuing a plurality of personal identification cards, each of said cards having stored therein a password with a portion thereof representing a non-secret characteristic of an authorized user of the card, each of said cards also having stored therein a signature derived from the password using a private key of a public-key cryptosystem pair; and transaction terminal means including at least one transaction terminal for receiving a personal identification card offered to effect a transaction using the transaction terminal, the personal identification card having a received password and a received signature, wherein the transaction terminal comprises means, using the public key of the public-key cryptosystem pair, for verifying that the received signature can be generated from the received password, means for generating a representation from the received password, and means for displaying the representation and an indication of whether the received signature can be generated from the received password to enable an operator of the transaction terminal to verify that the user of the offered personal identification card is authorized to effect a transaction.

20. The system as described in Claim 19 wherein the issuing terminal means includes at least one issuing terminal for one or more independent issuers of authorized personal identification cards, each of the independent issuers having a distinctive public-key cryptosystem pair unknown to the other issuers.

21. A system for allowing authorized users of personal identification cards to effect transactions via at least one transaction terminal comprising a plurality of said cards each having stored therein a signature which is the digital sign of a password associated with the respective user, the signature stored in each of said cards having been derived with the same private key of a public-key cryptosystem pair; and at least one transaction terminal having means for controlling (1) the retrieval of the password and the signature stored in an inserted card, (2) the digital verification of the retrieved signature with the use of the public key of the public-key cryptosystem pair, (3) the generation of a pictorial representation from the retrieved password, and (4) the effecting of a transaction only if the retrieved signature is verified and the pictorial representation matches the user.

22. A terminal for initializing personal identification cards to be used with at least one transaction terminal, each card having a memory therein, comprising means for assigning a password having a portion thereof which is non-secret to a user whose card is to be initialized, means for deriving a digital signature from at least a portion of the assigned password, the signature for each user being derived with use of the same private key of a public-key cryptosystem pair, and means for controlling the storing in a user card of the respective derived digital signature.

23. A personal identification card, for use in effecting transactions via at least one transaction terminal, comprising a body portion, a memory within said body portion for storing a signature, said signature being the digital sign of a password having at least a portion thereof being non-secret and being associated with the respective card user, said signature having been derived from the password with the private key of a public-key cryptosystem pair.

24. A method for personal identification, comprising the steps of:
generating a password having a portion thereof which is non-secret;
mapping the password using a predetermined function "F"
to generate a mapped password;
digitally signing the mapped password with a private key of a public-key cryptosystem pair to generate a signature corresponding to the mapped password;
encoding the password and the signature to generate an encoded password/ signature;
transmitting the encoded password/signature over a communications channel;
receiving the encoded password/signature at a transaction terminal;
decoding the received encoded password/signature to generate a received password and a received signature;
mapping the received password with the predetermined function "F" to generate a mapped password "QR";
digitally verifying, using the public key "M" of the public-key cryptosystem pair, whether the received signature can be generated from the mapped password;
if the received signature can be generated from the mapped password using the public key, generating an indication that the received signature is valid;

generating a representation from the received password;
and displaying the representation and the indication on a display of the transaction terminal to enable an operator thereof to verify that the user is authorized to effect a transaction.

8800362/000001D:T-644

25. A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, comprising the steps of:
generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret;
digitally signing the first data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the first data string, the public-key cryptosystem pair also having a public key M;
storing the first data string and the signature on the personal identification card;
receiving the personal identification card at the transaction terminal;
digitally verifying, using the public key M of the public-key cryptosystem pair, whether the signature on the personal identification card received at the transaction terminal can be generated from the first data string;
if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid;
generating a representation from the first data string;
and displaying the representation and the indication on a display of the transaction terminal to enable on operator thereof to verify that the user is authorized to effect a transaction using the personal identification card.

26. A method for generating a personal identification card for use by an authorized user thereof to effect a transaction using a transaction terminal, comprising the steps of:
generating a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret;
digitally signing the first data string with a private key of a public-key cryptosystem pair to generate a signature corresponding to the first data string, the public-key cryptosystem pair also having a public key M; and storing the first data string and the signature on the personal identification card.

27. A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having stored therein a first data string having a portion thereof which is derived from a physical characteristic of the authorized user and need not be retained secret, and a signature of the first data string derived from a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also having a public key M, comprising the steps of:
receiving the personal identification card at the transaction terminal;
digitally verifying, using the public key M of the public-key cryptosystem pair, wether the signature on the personal identification card received at the transaction terminal can be generated from the first data string:

if the signature can be generated from the first data string using the public key, generating an indication that the signature is valid;
generating a representation from the first data string;
and displaying the representation and the indication on a display of the transaction terminal to enable an operator hereof to verify that the user is authorized to effect a transaction using the personal identification card.

28. A method for enabling an authorized user of a personal identification card to effect a transaction using a transaction terminal, the personal identification card having a representation derived from a physical characteristic of the authorized user and which need not be retained secret, and a signature of the representation derived from a private key of a public-key cryptosystem pair, the public-key cryptosystem pair also including a public key, comprising the steps of:
receiving the personal identification card at the transaction terminal;
digitally verifying, using the public key, whether the signature on the personal identification card received at the transaction terminal can be generated from the representation;
if the signature can be generated from the representation using the public key, comparing the representation and the authorized user; and effecting the transaction if the representation matches the physical characteristic of the authorized user.

29. The method as described in Claim 28 wherein the representation is a photograph of the physical characteristic.

30. The method as described in Claim 28 further including the step of generating an indication that the signature is valid if the signature can be generated from the representation using the public key.

31. The method as described in Claim 30 further including the step of displaying the indication.