VERIFIABLE, LEAK-RESISTANT AUTHENTICATION

Methods and devices to encrypt and decrypt sensitive data to in a manner that provides secunty from external monitoring attacks is disclosed The encrypting device has access to a base secret cryptographic value (key) that is also known to the decrypting device The sensitive data are decomposed into segments, and each segment is encrypted with a separate encryption key denved from the base key and a message identifier to create a set of encrypted segments The encrypting device uses the base cryptographic value to create validators that prove that the encrypted segments for this message identifier were created by a device with access to the base key The decrypting device, upon receiving an encrypted segments uses validators to verify the message identifier and that the encrypted segment are unmodified.