Method and system for communicating secrets

Abstract

A method for communicating a secret (k 0 ,k 1 The method includes sending information identifying a secret selectable by a recipient and receiving a first public key (U) of an elliptic curve cryptographic system. i ), the first public key corresponding to the first secret (S i ), and the first private key (m) is accessible to the recipient. 1‑i ), the second public key (U 1‑i ) corresponds to a second secret that is not selected by the recipient for access, wherein the corresponding second private key is not available to the recipient. 0 ,X 1 ) The encrypted first secret and the second secret are sent to a recipient, wherein the recipient can access the first secret through the first private key, and the second secret is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

Description

Technical Field

[0001] The present disclosure relates to a computer-implemented system and method, and more particularly, to a computer-implemented system and method for transferring digital assets. The present invention is particularly suitable for, but not limited to, a blockchain-based data transmission system. Background Art

[0002] In the case of exchanging data between parties, it is often desirable that the recipient of a data file be able to access only a selected one or a limited number of files, without the sender of the data being able to know which file was accessed. This arrangement is known as Oblivious Transfer and is referred to below with reference to Figures 1 to 3 Give a description.

[0003] Reference Figure 1 , "Forgotten Transfer" is a method for controlling access to a resource (a file, a database record, or any other digital asset) and transferring that resource with enhanced privacy. The basic problem of Forgotten Transfer is to define a mechanism where the sender should not know which file the receiver has opened among many files sent to him. Alice is the sender, Bob is the receiver, m is the message, and b is the index of the message. Alice sends many messages and Bob selects the message he wishes to receive and decode. Alice does not know which one Bob has selected.

[0004] Reference Figure 2 , we can define the basic mechanism by considering the Diffie-Hellman (DH) key exchange

[10] . From the CDH (Core Diffie Hellman) key exchange, we can see that Figure 2 As shown, it is clear which keys are being exchanged and therefore, according to the Diffie-Hellman protocol, it is clear which message will be decrypted. C is the encrypted message, E is the encryption function using the private key K and the parameters of the message m, and D is the decryption function using the parameters of the encrypted message C and the private key K. In some cases, a third party knowing which message is being decrypted may result in reduced data security, which may result in unauthorized third parties accessing the data.

[0005] Now refer to Figure 3 , describes a variation of the DH mechanism to accommodate forgetful transmission. As can be seen, the receiver sends multiple keys back to the sender, only one of which is the real key, the others are "virtual" or redundant keys. Figure 3 The arrangement shown is similar to Figure 2The main difference between the standard Core Diffie-Hellman (CDH) protocol shown is that a key is passed back from Bob to Alice that depends on the value of bit "b". This calculation is done by Bob. Alice then constructs two keys based on the key she received from Bob. Alice sends these two keys back to Bob. Bob is then able to decrypt the message received from Alice using the key he received from Alice and the key calculated from the previous value Alice passed to him. Figure 2 The same arrangement is used, E is the encryption algorithm and D is the decryption algorithm. Bob can only decrypt one of the message pairs, and the other combinations are "dummy" messages and therefore do not work.

[0006] As can be seen, using a variation of the Diffie-Hellman mechanism, Alice remains "oblivious" to the message that Bob decrypted. In this example, Bob can only decrypt one of the two possible messages.

[0007] Therefore, it is expected to improve data security by providing a forget transfer mechanism applicable to blockchain.

[0008] Such an improved solution has now been designed. Summary of the invention

[0009] Hence, according to the present disclosure, there is provided a method and system as defined in the appended claims.

[0010] A method of communicating at least one secret from a sender to a receiver may be provided, the method comprising:

[0011] sending information from a sender to a receiver, the information identifying a plurality of secrets selectable by the receiver;

[0012] receiving at the sender from the recipient at least one first public key, the first public key corresponding to a respective first said secret selected by the recipient for access, wherein the or each first public key is part of a public / private key pair of an elliptic curve cryptosystem, a first private key corresponding to the first public key being accessible to the recipient;

[0013] receiving at the sender from the recipient at least one second public key, the second public key corresponding to a respective second said secret not selected for access by the recipient, wherein the or each second public key is a public key of the elliptic curve cryptosystem and a respective second private key corresponding to the second public key is not available to the recipient;

[0014] Sending at least one of the first secrets encrypted by the corresponding first public key from the sending party to the receiving party; and

[0015] Sending at least one of the second secrets encrypted by the corresponding second public key from the sending party to the receiving party;

[0016] The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0017] A method of receiving at least one secret sent from a sender to a receiver may be provided, the method comprising:

[0018] receiving, at a recipient, information identifying a plurality of secrets selectable by the recipient;

[0019] sending, from the receiving party to the sending party, at least one first public key, the first public key corresponding to a respective first said secret selected by the receiving party for access, wherein the or each first public key is part of a public / private key pair of an elliptic curve cryptosystem, the first private key corresponding to the first public key being accessible to the receiving party;

[0020] sending, from the receiving party to the sending party, at least one second public key, the second public key corresponding to a respective second said secret not selected by the receiving party for access, wherein the or each second public key is a public key of the said elliptic curve cryptosystem and the respective second private key corresponding to the second public key is not available to the receiving party;

[0021] receiving, at a receiving party, from a sending party at least one of the first secrets encrypted by the corresponding first public key; and

[0022] receiving, at a receiving party, from a sending party at least one of the second secrets encrypted by a corresponding second public key;

[0023] The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0024] A system may be provided comprising:

[0025] Processor; and

[0026] A memory includes executable instructions that, due to execution by the processor, cause the system to perform any embodiment of the computer-implemented method described herein.

[0027] A non-transitory computer-readable storage medium having executable instructions stored thereon may be provided, the executable instructions, which due to execution by a processor of a computer system, cause the computer system to perform at least an embodiment of the computer-implemented method described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Various embodiments according to the present disclosure will be described with reference to the accompanying drawings, in which:

[0029] Figure 1 shows the transmission of messages between a sender and a receiver;

[0030] Figure 2 shows the operation of the Diffie Hellman key exchange;

[0031] Figure 3 Show the operating principle of forget transfer;

[0032] Figure 4 and Figure 5 The forgetting transfer process is shown;

[0033] Figure 6 is a schematic diagram illustrating a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION

[0034] Reference Figure 4 , shows a method for the forgetful transfer process from sender Bob to receiver Alice. Bob first creates n keys: {k1, k2, ..., k n}. Through international patent application WO2017 / 145016 They are deterministically created as subkeys of the Elliptic Curve Digital Signature Algorithm (ECDSA) master key k0 using the method disclosed in . These n keys will be used to encrypt n different values. Alice attempts to access one and only one of these values ​​without letting Bob know which value was chosen. Bob attempts to ensure that Alice has access to only one value and one key in each exchange.

[0035] The process begins with Alice and Bob setting the curve parameters for the Elliptic Curve Cryptography (ECC) / Elliptic Curve Digital Signature Algorithm (ECDSA) system.

[0036] According to the ECDSA mechanism

[0037] d A Q B =d A d B G=d B d A G=d B Q A

[0038] where Alice calculates the point.

[0039] (x K ,y k ) = d A QB

[0040] And Bob calculates the points.

[0041] (x K ,y K ) = d B Q A

[0042] x K is a shared secret.

[0043] d A and d B These are Alice and Bob's private keys respectively.

[0044] Q A and Q B They are public keys respectively.

[0045] Based on this basic algorithm, a method can be created to swap pairs of numbers. This logic can be repeated log2(n) times to select one of the n values. This process is done by ensuring that only one pair of swapped keys is valid.

[0046] This first step allows Alice to choose one and only one value from the 2 possible choices k0 and k1.

[0047] 1. Alice and Bob first reach consensus on the value C. They use an ECDSA exchange to select a hash of the current block height and a secret generated from their master key. This exchange is described in more detail in international patent application WO2017 / 145016,

[0048] C=h(BH|S) or C=h(BH|S|Blockhash)

[0049] Where h() is the hash function and | is the concatenation operator.

[0050] BH is the block height.

[0051] S is a shared secret generated, for example, by the method disclosed in international patent application WO2017 / 145016.

[0052] Blockhash = Block hash

[0053] Note that any random value can be used, but the block height is a good source of externally agreed randomness.

[0054] 2. Alice chooses a value. She keeps this value secret to herself. This value (i) represents Bob’s iThe key that was created.

[0055] 3. Alice then uses the method of international patent application WO2017 / 145016 from her master key pair d A / Q A Create a subkey in and now have Q A0 , where Q A It's Q A0 The master key.

[0056] Alice will first use an ECDSA exchange to let Bob know Q A0 . Bob will encrypt. Bob's choice of k for Alice i Encryption is performed.

[0057] To ensure that Bob does not know whether Alice chose i=0 or 1, Alice also creates a decoy public key Q A1 .

[0058] 4. Bob doesn’t know which is the true value.

[0059] When Alice wishes to use private key d A0 Decrypt the selected value

[0060] Alice creates subkey: d A0 , corresponding to the public key Q A0 =(X A0 ,y A0 )

[0061] Alice Knows A0 And therefore know Q A0

[0062] Alice also knows:

[0063] d A0 Q A1 =d A0 d A1 G=d A1 d A0 G

[0064] =Q A0 d A1

[0065] Alice knows d A0 , but cannot calculate d A1 .

[0066] Next, Bob needs

[0067] C3x A0 =d A0 Q A1

[0068] =d A1 Q A0

[0069] Alice knows d A0 And we can calculate Q A1 .Q A0 Yes A0 of and known to Alice.

[0070] 5. Alice gives Bob two keys.

[0071] Q A0

[0072] Q A1

[0073] Even if Alice can decode only A0 Encrypted information. That is, Alice has A0 The private key d A0 , but not for Q A1 The private key d A1 .

[0074] 6. Bob encrypts k to Alice i In this example, k0 is the one that Alice can encrypt. That is, when Bob encrypts k0 into Q A0 And k i Encrypted to Q A1 At this time, Bob does not know whether Alice wants k0 or k i , but knows that she will have only the key d needed to decrypt the packet A0 or A1 one of the.

[0075] 7. Bob chooses two random values ​​r0 and r1. Bob calculates two keys:

[0076] Q r0 =r0G

[0077] Q r1 =r1G

[0078] And send these to Alice.

[0079] 8. Bob calculates:

[0080] h(Q A0 )as well as

[0081] h(Q A1 )

[0082] 9. Bob creates a public key.

[0083] Q AB0 =(h(QA0 )+r0)G

[0084] Q AB1 =(h(Q A1 )+r1)G

[0085] Bob uses Q AB0 and Q AB1 Encrypt k0 and k i . Bob sends Q to Alice r0 and Q r1 :

[0086] Q r0 =r0G

[0087] Q r1 =r1G.

[0088] 10. Alice cannot invert to get r0 or r1.

[0089] 11. Alice needs to decide, but can only decrypt one value. (A blank key is useless.) Both Alice and Bob are subject to the following constraints: Alice can choose to decrypt (receive) either k0 or k1, but not both, and Bob does not know which one, so he can send both to her.

[0090] In a 2-choose-1 system, Alice has two secrets but is only trying to reveal one of them. At the same time, Bob does not want Alice to know which of the two secrets he wants. Bob is only interested in one of Alice's secrets but does not want Alice to know which one. Bob only receives an answer when Alice does not know what Bob wants answered. Figure 5 The operation of the non-interactive oblivious transfer protocol is shown, which begins with Alice sending two values ​​to Bob: k0 and k1. These are sent based on Bob's public and private keys, enabling Bob to extract one and only one of the two keys.

[0091] Using a finite field Z with (p) as prime number p All values ​​are between 0 and (p-1), and all computations are done modulo p.

[0092] The general form of an elliptic curve equation is:

[0093] y 2 mod p=(x 3 +ax+b)mod p.

[0094] The set of points (x, y) that satisfy the elliptic curve equation is represented by E p (a, b) is given. The order r of a point T = (x1, y1) on an elliptic curve is defined as the smallest positive integer r such that:

[0095] rT=0, where 0 is the point at infinity.

[0096] Point G is E p The base point in (a, b). This value is chosen so that the order r is very large. The security of the system is based on the difficult elliptic curve discrete logarithm problem (ECDLP). Solving the ECDLP for a point Q is equivalent to solving for an integer k such that

[0097] Q=kP (or Q=kG)

[0098] Where Q and P are known.

[0099] Alice and Bob both use the same elliptic curve and base point G. Alice chooses two values ​​k0 and k1, and generates two points P0 and P1

[0100] P0=k0G

[0101] P1=k1G.

[0102] The values ​​k0 and k1 are unknown to Bob and serve as secret keys held by Alice. These values ​​can be determined using the exchange process described in international patent application WO2017 / 145016.

[0103] If Alice has the master key k sa , then the values ​​k0 and k1 can be connected to k sa

[0104] k sa +v0=k0

[0105] k sa +v1=k1

[0106] where v0 and v1 are values ​​known to Alice. This process can be done before the Forget Transfer message is exchanged.

[0107] The protocol is defined as follows:

[0108] Reference Figure 5 , starting with base point G and points P0 and P1.

[0109] Let: P = P0 + P1

[0110] and i∈{0,1}.

[0111] 1. Bob creates a public key (U0, U1) by choosing a random integer m and setting it as follows:

[0112] U i =mG,

[0113] Among them U irepresents which of U0 or U1 corresponds to k0 or k1 that Bob has chosen. Bob sends the public keys U0 and U1 to Alice.

[0114] Next, let U b =mG-P i

[0115] U 1-i =P 1-i -U b

[0116] Bob's private key is m. m can be derived using a process as described in international patent application WO2017 / 145016.

[0117] 2. Alice chooses two random integers a0 and a1 and calculates:

[0118] V0=a0G

[0119] as well as

[0120] V1=a1G

[0121] Alice then calculates:

[0122] W0=a0U0

[0123] as well as

[0124] W1=a1U1

[0125] Alice sends the values ​​V0, V1 to Bob.

[0126] Alice then calculates:

[0127]

[0128] as well as

[0129]

[0130] in Represents the secret value S through a dedicated OR cipher i The binary representation of W is encrypted. i The binary representation of is used as the encryption key.

[0131] Alice also sends X0 and X1 to Bob.

[0132] 3. Bob calculates the value:

[0133] mV i =ma i G=W i

[0134] This allows him to i Extract as

[0135]

[0136] S i is the i-th secret.

[0137] It should be noted that Bob cannot extract S 1-i Because he cannot calculate n, where U 1-i =nG. Alice does not know which value of U0 or U1 equals mG, allowing Bob to determine the value of m. Therefore, Alice does not know which of the two secrets Bob received.

[0138] Alice can verify that Bob's public key is correctly formed by

[0139] 1. Check U i +U 1-i =P

[0140] 2. Calculate U b =U i -P i

[0141] This is used to verify whether it is U 1-i -P 1-i Negative number

[0142] The security aspects of the protocol are as follows:

[0143] 1. Alice cannot tell which of the two secrets Bob has received.

[0144] 2. If the discrete logarithm problem (DLP) holds for elliptic curves, then the security of the protocol holds.

[0145] 3. If Alice follows the protocol, then Bob cannot discover one of her secrets.

[0146] The system allows for fair control of the exchange. Bob and Alice can exchange information without knowing what is being exchanged. This can be used to control all browsing of data or information, access to databases and other records (e.g., medical files), and the information can be sliced ​​and diced and leaked bit by bit, with records of which parties saw what information. It can eliminate the need for trusted servers or third parties.

[0147] Now turn to Figure 6, provides an illustrative simplified block diagram of a computing device 2600 that can be used to practice at least one embodiment of the present disclosure. In various embodiments, the computing device 2600 can be used to implement any of the systems shown and described above. For example, the computing device 2600 can be configured to function as a data server, a network server, a portable computing device, a personal computer, or any electronic computing device. Figure 6 As shown in , the computing device 2600 may include: one or more processors, a cache memory having one or more levels; and a memory controller (collectively labeled 2602), which may be configured to communicate with a storage subsystem 2606 including a storage subsystem 2608 file storage subsystem 2610. The storage subsystem 2608 may include a dynamic random access memory (DRAM) 2618 and a read-only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 may be used to store information. The processor 2602 may be used to provide the steps or functions of any embodiment described in the present disclosure.

[0148] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0149] The bus subsystem 2604 may provide a mechanism for enabling the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple busses.

[0150] The network interface subsystem 2616 may provide an interface with other computing devices and networks. The network interface subsystem 2616 may serve as an interface for receiving data from other systems and transmitting data from the computing device 2600 to other systems. For example, the network interface subsystem 2616 may enable a data technician to connect the device to a network so that the data technician may be able to transmit data to and receive data from the device at a remote location, such as a data center.

[0151] The user interface input devices 2612 may include one or more user input devices, such as a keyboard; a pointing device, such as an integrated mouse, trackball, touch pad, or graphics tablet; a scanner; a barcode scanner; a touch screen included in a display; an audio input device, such as a voice recognition system, a microphone; and other types of input devices. In general, the use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into the computing device 2600.

[0152] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as a liquid crystal display (LCD), a light emitting diode (LED) display, or a projector or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface to facilitate user interaction with an application that executes the processes described herein and variations therein, when such interaction may be appropriate.

[0153] The storage subsystem 2606 may provide a computer-readable storage medium for storing basic programming and data structures that may provide the functions of at least one embodiment of the present disclosure. When executed by one or more processors, an application (program, code module, instruction) may provide the functions of one or more embodiments of the present disclosure and may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 may additionally provide a repository for storing data used according to the present disclosure. For example, the storage subsystem 2608 and the cache memory 2602 may provide volatile storage for programs and data. The file storage subsystem 2610 may provide permanent (non-volatile) storage for programs and data, and may include flash memory, one or more solid-state drives, one or more magnetic hard drives, one or more floppy disk drives with associated removable media, one or more optical drives (such as CD-ROM or DVD or Blu-ray) with associated removable media and other similar storage media. Such programs and data may include programs for executing the steps of one or more embodiments described in the present disclosure.

[0154] The computing device 2600 may be of various types, including a portable computer device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that may be connected to the computing device 2600 via one or more ports (e.g., USB, a headphone jack, a lightning connector, etc.). The device that may be connected to the computing device 2600 may include a plurality of ports configured to accept fiber optic connectors. Thus, the device may be configured to convert optical signals into electrical signals that may be transmitted through the port connecting the device to the computing device 2600 for processing. Due to the ever-changing nature of computers and networks, the Figure 6 The description of the computing device 2600 depicted in FIG. 2 is intended only as a specific example for the purpose of illustrating a preferred embodiment of the device. Figure 6 Many other configurations are possible with more or fewer components than the system depicted in FIG.

[0155] Listed Example Embodiments

[0156] Examples of embodiments of the present disclosure may be described in terms of the following:

[0157] 1. A method for transmitting at least one secret from a sender to a receiver, the method comprising:

[0158] sending information from a sender to a receiver, the information identifying a plurality of secrets selectable by the receiver;

[0159] receiving at the sender from the recipient at least one first public key, the first public key corresponding to a respective first said secret selected by the recipient for access, wherein the or each first public key is part of a public / private key pair of an elliptic curve cryptosystem, a first private key corresponding to the first public key being accessible to the recipient;

[0160] receiving at the sender from the recipient at least one second public key, the second public key corresponding to a respective second said secret not selected for access by the recipient, wherein the or each second public key is a public key of the elliptic curve cryptosystem and a respective second private key corresponding to the second public key is not available to the recipient;

[0161] Sending at least one of the first secrets encrypted by the corresponding first public key from the sending party to the receiving party; and

[0162] Sending at least one of the second secrets encrypted by the corresponding second public key from the sending party to the receiving party;

[0163] The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0164] This provides the advantage that the data security of the method is increased by allowing the recipient to access only a limited number of messages while preventing the sender from knowing which message or messages the recipient has accessed.

[0165] 2. The method according to clause 1 further includes: encrypting at least one of the first secrets by the corresponding first public key, and encrypting at least one of the second secrets by the corresponding second public key.

[0166] 3. The method according to clause 2, wherein at least one of the first secrets and at least one of the second secrets are encrypted by corresponding dedicated or passwords.

[0167] This provides the advantage of being able to encrypt and decrypt quickly and efficiently.

[0168] 4. A method according to clause 3, wherein at least one of the private or secret keys has a corresponding encryption key based on the corresponding first public key or second public key.

[0169] 5. A method according to clause 4, wherein at least one of the cryptographic keys comprises the corresponding first public key or second public key multiplied by a scalar elliptic curve point multiplication with a corresponding first cryptographic integer or second cryptographic integer known to the sender.

[0170] 6. The method according to clause 5 further comprises: sending at least one of the first encrypted integer and / or the second encrypted integer encrypted by the corresponding first public key or second public key from the sending party to the receiving party.

[0171] 7. A method according to any of the preceding clauses, wherein at least one of the first secrets is encrypted by a corresponding third public key, the third public key comprising a corresponding first masking term added to the corresponding first encrypted term by elliptic curve point addition, the first masking term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding first masking integer known to the sender.

[0172] 8. The method of clause 7, wherein at least one of the first encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding third encrypted integer based on the corresponding first public key.

[0173] 9. The method of clause 8, wherein at least one of the third encrypted integers is a hash value of the corresponding first public key.

[0174] 10. A method according to any one of clauses 7 to 9, wherein at least one of the second secrets is encrypted by a corresponding fourth public key, the fourth public key comprising a corresponding second masking term added to the corresponding second encrypted term by elliptic curve point addition, the second masking term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding second masking integer known to the sender.

[0175] 11. The method of clause 10, wherein at least one of the second encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding fourth encrypted integer based on the corresponding second public key.

[0176] 12. The method of clause 11, wherein at least one of the fourth encrypted integers is a hash value of the corresponding second public key.

[0177] 13. A method according to any of the preceding clauses, wherein at least one of the first public key and / or the second public key is determinable from the corresponding second public key and / or the first public key.

[0178] 14. A method according to any of the preceding clauses, further comprising: generating at least one third secret to be shared between the sender and the receiver.

[0179] 15. The method according to clauses 13 and 14, wherein at least one of the first public key and / or the second public key is based on the corresponding second public key and / or the first public key and at least one of the third secrets.

[0180] 16. The method according to any of the preceding clauses further includes: at the sender, checking the consistency of at least one of the first public key and / or the second public key received from the receiver with the corresponding second public key and / or the first public key received from the receiver.

[0181] 17. A method according to any of the preceding clauses, wherein the result of a scalar multiplication of at least one of the first public key and the second private key is equal to the result of a scalar multiplication of the corresponding second public key and the corresponding first private key.

[0182] 18. A method according to any of the preceding clauses, wherein at least one of the first private key and at least one of the second private key are deterministically derived from a private key of the elliptic curve cryptosystem known to the sender.

[0183] 19. A method of receiving at least one secret sent from a sender to a receiver, the method comprising:

[0184] receiving, at a recipient, information identifying a plurality of secrets selectable by the recipient;

[0185] sending, from the receiving party to the sending party, at least one first public key, the first public key corresponding to a respective first said secret selected by the receiving party for access, wherein the or each first public key is part of a public / private key pair of an elliptic curve cryptosystem, a first private key corresponding to the first public key being accessible to the receiving party;

[0186] sending, from the receiving party to the sending party, at least one second public key, the second public key corresponding to a respective second said secret not selected by the receiving party for access, wherein the or each second public key is a public key of the elliptic curve cryptosystem and a respective second private key corresponding to the second public key is not available to the receiving party;

[0187] receiving, at a receiving party, from a sending party at least one of the first secrets encrypted by the corresponding first public key; and

[0188] receiving, at a receiving party, from a sending party at least one of the second secrets encrypted by a corresponding second public key;

[0189] The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0190] 20. The method according to clause 19, wherein at least one of the first secrets and at least one of the second secrets are encrypted by means of a corresponding dedicated or password.

[0191] 21. The method of clause 20, wherein at least one of the private or secret keys has a corresponding encryption key based on the corresponding first public key or second public key.

[0192] 22. A method according to clause 21, wherein at least one of the cryptographic keys comprises the corresponding first public key or second public key multiplied by a scalar elliptic curve point multiplication with a corresponding first cryptographic integer or second cryptographic integer known to the sender.

[0193] 23. The method according to clause 22, further comprising: receiving at the receiving party from the sending party at least one of the first encrypted integer and / or the second encrypted integer encrypted by the corresponding first public key or second public key.

[0194] 24. A method according to any one of clauses 19 to 23, wherein at least one of the first secrets is encrypted by a corresponding third public key, the third public key comprising a corresponding first masking term added to the corresponding first encrypted term by elliptic curve point addition, the first masking term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding first masking integer known to the sender.

[0195] 25. The method of clause 24, wherein at least one of the first encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding third encrypted integer based on the corresponding first public key.

[0196] 26. The method of clause 25, wherein at least one of the third encrypted integers is a hash value of the corresponding first public key.

[0197] 27. A method according to any one of clauses 24 to 26, wherein at least one of the second secrets is encrypted by a corresponding fourth public key, the fourth public key comprising a corresponding second masking term added to the corresponding second encrypted term by elliptic curve point addition, the second masking term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding second integer known to the sender.

[0198] 28. The method of clause 27, wherein at least one of the second encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding fourth encrypted integer based on the corresponding second public key.

[0199] 29. The method of clause 28, wherein at least one of the fourth encrypted integers is a hash value of the corresponding second public key.

[0200] 30. A method according to any of clauses 19 to 29, wherein at least one of the first public key and / or the second public key is determinable from the corresponding second public key and / or the first public key.

[0201] 31. A method according to any of clauses 19 to 30, further comprising generating at least one third secret to be shared between the sender and the receiver.

[0202] 32. A method according to clauses 30 and 31, wherein at least one of the first public key and / or the second public key is based on the corresponding second public key and / or the first public key and at least one of the third secrets.

[0203] 33. A method according to any of clauses 19 to 32, wherein the result of a scalar multiplication of at least one of the first public key and the second private key is equal to the result of a scalar multiplication of the corresponding second public key and the corresponding first private key.

[0204] A computer implemented system arranged to perform a method according to any of the preceding clauses.

[0205] It should be noted that the above embodiments illustrate rather than limit the present invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the present invention as defined by the appended claims. In the claims, any reference numerals placed in brackets shall not be interpreted as limiting the claims. The words "comprises" and "comprising" etc. do not exclude the presence of elements or steps other than those listed in any claim or the entire specification. In this specification, "comprises" means "including or consisting of..." and "comprising" means "including or consisting of...". The singular reference of an element does not exclude the plural reference of such elements, and vice versa. The present invention can be implemented by hardware comprising a plurality of different elements and by appropriately programmed computers. In a device claim that lists a plurality of devices, a plurality of these devices may be embodied by one and the same hardware item. The fact that certain measures are recorded in mutually different dependent claims does not mean that the combination of these measures cannot be used to obtain benefits.

[0206] 1 reference

[0207] [1] "Generalized Oblivious Transfer Protocol",Partha Sarathi Roy,Department of Pure mathematics,University Cacutta India

[0208] [2] "Generalized oblivious transfer by secret sharing" Tamir Tassa

[0209] [3]"Computationally secure oblivious transfer"Moni Naor,Benny Pinkas

[0210] [4] "The simplest protocol for oblivious transfer" Tung Chou andClaudio Orlandi

[0211] [5] "Smooth projective hashing and two message oblivious transfer" YuriTauman KAlai MIT

[0212] [6]“Oblivious Transfer with Access Control”Jan Camenisch,MariaDubovitskaya,Gregory Neven

[0213] [7]“Practical Fully Simulatable Oblivious Transfer with Sub-linearcommunication”BingSheng Zhang,Helger Lipmaa,Cong Wang,Kuri Ren

[0214] [8]Rabin(1981)for papers on oblivious transfer

[0215] [9]Bellare M.;Micalli,S.

[1989] “Non-Interactive Oblivious Transfer andApplications”:Proc.On Adv in Cryptography CRYPTO 89.PP 547-557.

[0216]

[10] Diffie, W. ; Hellman, M. (1976). "New directions in cryptography" (PDF). IEEE Transactions on Information Theory .22(6):644–654. doi : 10.1109 / TIT.1976.1055638 .

[0217]

[11] Prof Bill Buchanan,www.asecuritysite.com

[0218]

[12] Boneh,Franklin,“Identity-Based Encryption from the Weil Pairing”.Appears in SIAM J.of Computing,Vol.32,No.3,pp.586-615,2003.An extendedabstract of this paper appears in the Proceedings of Crypto 2001,volume 2139of Lecture Notes in Computer Science,pages 213–229,Springer-Verlag,2001.“Bilinear paring”.

Claims

1. A method for transmitting a secret from a sender to a receiver, the method comprising: generating a secret value collaboratively between a sender and a receiver; sending information from a sender to a receiver, the information identifying a plurality of secrets selectable by the receiver; receiving at the sender at least one first public key from the recipient, the first public key corresponding to a respective first secret selected by the recipient for access, wherein the or each first public key is part of a public-private key pair of an elliptic curve cryptosystem, a first private key corresponding to the first public key is accessible to the recipient, and wherein the first public key has been generated by the recipient from its respective public-private key pair; receiving at the sender at least one second public key from the recipient, the second public key corresponding to a respective second secret not selected by the recipient for access, wherein the or each second public key is a public key of the elliptic curve cryptosystem, a respective second private key corresponding to the second public key is not available to the recipient, and wherein the second public key has been generated by the recipient from the first public key and the secret value; Sending at least one of the first secrets encrypted by the corresponding first public key from the sending party to the receiving party; and Sending at least one of the second secrets encrypted by the corresponding second public key from the sending party to the receiving party; The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot identify which secret the recipient has selected.

2. The method according to claim 1, further comprising: At least one of the first secrets is encrypted by a corresponding first public key, and at least one of the second secrets is encrypted by a corresponding second public key.

3. The method according to claim 2, wherein: At least one of the first secrets and at least one of the second secrets are encrypted by means of a corresponding dedicated OR cipher.

4. The method according to claim 3, wherein: At least one of the private OR ciphers uses a key corresponding to the first public key or the second public key as an encryption key.

5. The method according to claim 4, wherein: At least one of the cryptographic keys comprises the corresponding first public key or second public key multiplied by a scalar elliptic curve point multiplication with a corresponding first cryptographic integer or second cryptographic integer known to the sender.

6. The method according to claim 5, further comprising: At least one of the first encrypted integer and / or the second encrypted integer encrypted by the corresponding first public key or second public key is sent from the sending party to the receiving party.

7. The method according to any one of claims 1 to 6, wherein: At least one of the first secrets is encrypted by a corresponding third public key, the third public key comprising a corresponding first masked term added to the corresponding first encrypted term by elliptic curve point addition, the first masked term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding first masked integer known to the sender, the first masked integer being a first random value selected by the sender.

8. The method according to claim 7, wherein: At least one of the first encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding third encrypted integer based on the corresponding first public key.

9. The method according to claim 8, wherein: At least one of the third encrypted integers is a hash value of the corresponding first public key.

10. The method according to claim 7, wherein: At least one of the second secrets is encrypted by a corresponding fourth public key, the fourth public key comprising a corresponding second masked term added to the corresponding second encrypted term by elliptic curve point addition, the second masked term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding second masked integer known to the sender, the second masked integer being a second random value selected by the sender.

11. The method according to claim 10, wherein: At least one of the second encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding fourth encrypted integer based on the corresponding second public key.

12. The method according to claim 11, wherein: At least one of the fourth encrypted integers is a hash value of the corresponding second public key.

13. The method according to any one of claims 1 to 6, wherein: At least one of the first public key and / or the second public key can be determined from the corresponding second public key and / or the first public key.

14. The method according to any one of claims 1 to 6, further comprising: At the sender, at least one of the first public key and / or the second public key received from the receiver is checked for consistency with the corresponding second public key and / or first public key received from the receiver.

15. The method according to any one of claims 1 to 6, wherein: A result of a scalar multiplication of at least one of the first public key and the second private key is equal to a result of a scalar multiplication of a corresponding second public key and a corresponding first private key.

16. The method according to any one of claims 1 to 6, wherein: At least one of the first private key and at least one of the second private key are deterministically derived from a private key of the elliptic curve cryptography system known to a sender.

17. A method for receiving a secret sent from a sender to a receiver, the method comprising: generating a secret value collaboratively between a sender and a receiver; receiving, at a recipient, information identifying a plurality of secrets selectable by the recipient; sending at least one first public key from the receiving party to the sending party, the first public key corresponding to a respective first secret selected by the receiving party for access, wherein the or each first public key is part of a public-private key pair of an elliptic curve cryptosystem, a first private key corresponding to the first public key is accessible to the receiving party, and wherein the first public key has been generated by the receiving party from its respective public-private key pair; sending, from the receiving party to the sending party, at least one second public key, the second public key corresponding to a respective second secret not selected by the receiving party for access, wherein the or each second public key is a public key of the elliptic curve cryptosystem, a respective second private key corresponding to the second public key is not available to the receiving party, and wherein the second public key has been generated by the receiving party from the first public key and the secret value; receiving, at a receiving party, from a sending party at least one of the first secrets encrypted by the corresponding first public key; and receiving, at a receiving party, from a sending party at least one of the second secrets encrypted by a corresponding second public key; The first secret or each of the first secrets is accessible to the recipient through the corresponding first private key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot identify which secret the recipient has selected.

18. The method according to claim 17, wherein: At least one of the first secrets and at least one of the second secrets are encrypted by means of a corresponding dedicated OR cipher.

19. The method according to claim 18, wherein: At least one of the private OR ciphers uses a key corresponding to the first public key or the second public key as an encryption key.

20. The method according to claim 19, wherein: At least one of the cryptographic keys comprises the corresponding first public key or second public key multiplied by a scalar elliptic curve point multiplication with a corresponding first cryptographic integer or second cryptographic integer known to the sender.

21. The method according to claim 20, further comprising: At least one of the first encrypted integer and / or the second encrypted integer encrypted by the corresponding first public key or second public key is received at the receiving party from the sending party.

22. The method according to any one of claims 17 to 21, wherein: At least one of the first secrets is encrypted by a corresponding third public key, the third public key comprising a corresponding first masked term added to the corresponding first encrypted term by elliptic curve point addition, the first masked term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding first masked integer known to the sender, the first masked integer being a first random value selected by the sender.

23. The method according to claim 22, wherein: At least one of the first encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding third encrypted integer based on the corresponding first public key.

24. The method according to claim 23, wherein: At least one of the third encrypted integers is a hash value of the corresponding first public key.

25. The method according to claim 22, wherein: At least one of the second secrets is encrypted by a corresponding fourth public key, the fourth public key comprising a corresponding second masked term added to the corresponding second encrypted term by elliptic curve point addition, the second masked term comprising the result of a scalar multiplication of an elliptic curve generator point of an elliptic curve cryptosystem and a corresponding second masked integer known to the sender, the second masked integer being a second random value selected by the sender.

26. The method according to claim 25, wherein: At least one of the second encrypted terms comprises a result of a scalar multiplication of an elliptic curve generator point and a corresponding fourth encrypted integer based on the corresponding second public key.

27. The method according to claim 26, wherein: At least one of the fourth encrypted integers is a hash value of the corresponding second public key.

28. The method according to any one of claims 17 to 21, wherein: At least one of the first public key and / or the second public key can be determined from the corresponding second public key and / or the first public key.

29. The method according to any one of claims 17 to 21, wherein: A result of a scalar multiplication of at least one of the first public key and the second private key is equal to a result of a scalar multiplication of a corresponding second public key and a corresponding first private key.

30. A system comprising: processor; as well as A memory comprising executable instructions which, due to execution by a processor, cause the system to perform a method according to any one of the preceding claims.

Images