Computer-implemented system and method for distributing digitally signed data shares

Abstract

The present invention discloses a computer-implemented method for distributing a shared secret among a plurality of participants. The method comprises a mapping step, wherein a plurality of inputs of the mapping step are mapped to respective elliptic curve points of an elliptic curve cryptographic system shared by the participants. In a first encryption step, a plurality of the elliptic curve points are encrypted by a public key of a public-private key pair of the elliptic curve cryptographic system to provide an output suitable for decryption by a corresponding private key of the public-private key pair; in a second encryption step, a plurality of parts of at least one input to the second encryption step are multiplied by corresponding terms of a sequence known to the participant. In a secret sharing step, a plurality of shares of the input to the secret sharing step are distributed to a plurality of the participants, so that the input is accessible to a threshold number of the shares and inaccessible to less than the threshold number of the shares.

Description

Technical Field

[0001] The present disclosure relates generally to secret sharing and more particularly to allocating shares of digitally signed data. The present disclosure is particularly suitable for, but not limited to, allocating shares of signed blockchain transactions. Background Art

[0002] As used herein, the term "blockchain" encompasses all forms of computer-based electronic distributed ledgers. These ledgers include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variants thereof. It should be noted that alternative blockchain implementations and protocols also fall within the scope of this disclosure. The term "user" herein may refer to a person or a processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a decentralized, distributed computer-based system consisting of blocks, which in turn consist of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and includes at least one input and at least one output. Each block contains a hash of the previous block, so blocks are linked together to create a permanent and unchangeable record of all transactions written to the blockchain since its creation. Transactions include small programs embedded in their inputs and outputs, called scripts, which specify how and by whom the outputs of the transaction can be accessed. On some platforms, these scripts are written using a stack-based scripting language.

[0004] In order for a transaction to be written to the blockchain, it must be "validated". Network nodes work to ensure that each transaction is valid, and invalid transactions are rejected by the network. The software client installed on the node performs this validation work on the unspent transaction output (UTXO) by executing its locking and unlocking scripts. If the execution of the locking and unlocking scripts evaluates to true, the transaction is valid and the transaction is written to the blockchain. Therefore, in order for a transaction to be written to the blockchain, the transaction must: i) be validated by the first node that receives the transaction - if the transaction passes validation, this node relays it to other nodes in the network; ii) be added to a new block that is constructed; iii) be mined, that is, added to the public ledger of past transactions.

[0005] Digital entrepreneurs have begun to explore how to implement new systems using cryptographically secure systems and data that can be stored on blockchain. It would be very beneficial if blockchain could be used to automate tasks and processes. Such solutions would be able to leverage the advantages of blockchain (e.g., permanent and tamper-proof records of events, distributed processing, etc.), while also making its applications more widespread.

[0006] Blockchain technology utilizes secret sharing techniques in its implementation, such as distributing shares of a password or digital signature, to enable threshold signing of transactions.

[0007] Existing secret sharing techniques, such as threshold signature techniques, do not scale well because the generated private keys are packed into data structures with little or no ordering or organization. Summary of the invention

[0008] Therefore, there is a need to provide an improved secret sharing method that can be more efficiently expanded.

[0009] Such an improved solution has now been devised.

[0010] According to the present disclosure, a computer-implemented method of distributing a shared secret among a plurality of participants may be provided, the method comprising:

[0011] a first mapping step, wherein a plurality of inputs input to the first mapping step are mapped to corresponding elliptic curve points of an elliptic curve of an elliptic curve cryptosystem common to the participants;

[0012] a first encryption step, wherein a plurality of said elliptic curve points are encrypted by a public key of a public-private key pair of said elliptic curve cryptosystem to provide an output suitable for decryption by a corresponding private key of said public-private key pair;

[0013] a second encryption step, wherein portions of at least one input to said second encryption step are multiplied by corresponding terms of a sequence known to said participant; and

[0014] A secret sharing step wherein multiple shares of an input to the secret sharing step are distributed to multiple participants such that the input is accessible to a threshold number of the shares and inaccessible to less than the threshold number of the shares.

[0015] This provides the advantage of increased security since the shared secret is disguised as an elliptic curve point and is therefore more difficult to detect by unauthorized parties.

[0016] At least one input to the secret sharing step may be based on an output of the first encryption step or the second encryption step.

[0017] At least one input to the first encryption step may be based on a shared secret, at least one input to the second encryption step may be based on an output of the first encryption step, and at least one input to the secret sharing step may be based on an output of the second encryption step.

[0018] At least one input to the second encryption step may be based on a shared secret, at least one input to the first encryption step may be based on an output of the second encryption step, and at least one input to the secret sharing step may be based on an output of the first encryption step.

[0019] At least one input to the first encryption step may be based on an output of the secret sharing step or the second encryption step.

[0020] This provides the advantage of improving the computational efficiency of the procedure by performing the secret sharing step before at least one of the other steps.

[0021] At least one input of the secret sharing step may be based on a shared secret, at least one input of the second encryption step may be based on an output of the secret sharing step, and at least one input of the first encryption step may be based on an output of the second encryption step.

[0022] At least one input to the second encryption step may be based on a shared secret, at least one input to the secret sharing step may be based on an output of the second encryption step, and at least one input to the first encryption step may be based on an output of the secret sharing step.

[0023] At least one input to the second encryption step may be based on the secret sharing step or an output of the first encryption step.

[0024] At least one input of the secret sharing step may be based on a shared secret, at least one input of the first encryption step may be based on an output of the secret sharing step, and at least one input of the second encryption step may be based on an output of the first encryption step.

[0025] At least one input to the first encryption step may be based on a shared secret, at least one input to the secret sharing step may be based on an output of the first encryption step, and at least one input to the second encryption step may be based on an output of the secret sharing step.

[0026] The second encryption step may include performing a knapsack algorithm.

[0027] This offers the advantage of increasing the efficiency of the method.

[0028] Said second encryption step may comprise basing said sequence on a Stern sequence.

[0029] This provides the advantage of increased efficiency by reducing the time complexity of executing the algorithm.

[0030] The second encryption step may comprise comprising said sequence to the power of a term known to said participant.

[0031] The terms may be based on information shared among the participants.

[0032] The second encryption step may comprise a super-incrementing sequence.

[0033] This provides the advantage of being able to decrypt the shared secret more efficiently.

[0034] The first mapping step may include determining an elliptic curve point having coordinates based on the input.

[0035] The coordinates may be based on the input multiplied by a quantity known to the participant.

[0036] This provides the advantage of increased safety.

[0037] The first encryption step may include determining a term comprising an elliptic curve point multiplied by an integer representing an input to the first encryption step.

[0038] The first encryption step may include determining a term based on a temporary key and a public key of a participant.

[0039] The method may further include sending to at least one participant an elliptic curve point based on a generator point of the elliptic curve cryptosystem multiplied by a temporary key, and an elliptic curve point based on a participant public key multiplied by the temporary key.

[0040] The shared secret may be digital signature information.

[0041] The digital signature information may be a blockchain transaction.

[0042] The present disclosure also provides a system, comprising:

[0043] Processor; and

[0044] A memory containing executable instructions that, when executed by a processor, cause the system to perform any embodiment of the computer-implemented method described herein.

[0045] The present disclosure also provides a non-transitory computer-readable storage medium having executable instructions stored thereon. When a processor of a computer system executes the executable instructions, the computer system is caused to at least perform an embodiment of the computer-implemented method described herein.

[0046] The present disclosure ensures confidentiality, authentication, non-repudiation, and adds information recovery and convertibility in digital signatures. The present disclosure enables secure transmission of data (e.g., records in secret or key scripts). The present disclosure can also protect against attacks such as key-only attacks and message attacks in banking systems. In general, embodiments of the present disclosure are directed to processes that enable integration of external messages related to transactions and information for other purposes.

[0047] The key distribution and key share efficient packaging mechanism of the disclosed embodiment introduces nonlinearity in the process of storing key data, which enhances the degree of security in the encryption protocol by increasing the spreading and confusion steps. The efficient packaging of key shares also makes the solution scalable effectively. The distribution characteristics of key shares can enable an operating model including escrow services, where the escrow agent acts as a forwarding agent without any cryptographic secrets, while still being able to monitor, verify, send and receive information. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] These and other aspects of the present disclosure will become apparent from and will be elucidated with reference to the embodiments described herein. Embodiments of the present disclosure will now be described by way of example only and with reference to the accompanying drawings, in which:

[0049] Figure 1 is a schematic diagram embodying the process of distributing digital signature information shares of the present disclosure;

[0050] Figure 2 yes Figure 1 A partial detailed diagram of the process shown;

[0051] Figure 3 yes Figure 1 The signature generation step of the process shown;

[0052] Figure 4 yes Figure 1 The encryption steps of the process shown;

[0053] Figure 5 is used to obtain Figure 1 The process shown is the process of recovering information encrypted with a digital signature;

[0054] Figure 6 is used for Figure 5 The decryption process of the process shown; and

[0055] Figure 7 is a schematic diagram illustrating a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION

[0056] Preferred Embodiments

[0057] Reference Figure 1 , which describes the process of distributing shares of a digitally signed message among multiple participants. Initially, digital information m (where m is a hash of information M such as a blockchain transaction) is input into an elliptic curve digital signature algorithm (ECDSA) in step 10. Those skilled in the art will appreciate that ECDSA generates a public and private key pair and a temporary key that is a random integer, and provides a digital signature (r, s) in a manner described in more detail below. In a mapping step 20, the digital signature (r, s) is mapped to an elliptic curve point of an elliptic curve cryptosystem shared by the participants. Then, a first encryption step 30 in the form of a knapsack algorithm is applied to the elliptic curve point generated in step 20 to generate an encrypted version (R, S) of the digital signature (r, s); a second encryption step 40 in the form of elliptic curve cryptography (ECC) encryption is applied to the encrypted version (R, S) of the digital signature (r, s) to provide a doubly encrypted version (P) of the digital signature (r, s). R ,P S Alternatively, the first encryption step 20 may be an elliptic curve cryptography (ECC) encryption step and the second encryption step 40 may be a knapsack algorithm. Finally, a secret sharing step 50 such as Shamir's secret sharing is applied to the doubly encrypted version (P R ,P S ). ECC encryption can be performed by the Koblitz method described in detail below.

[0058] The technology of the disclosed embodiments enables the distribution of key shares among participants in a sharing scheme. This further enables a distribution mechanism for decryption of information and recovery of information. The same mechanism can also be used to encrypt information. This will be described in more detail below. The technology uses a backpack algorithm, such as "Different Methods for Solving the 0 / 1 Knapsack Problem" disclosed by Maya Hristakeva, Department of Computer Science, Simpson College, Indianola, IA 50125hristake@simpson.edu, to optimize the data packing problem so that the key shares can be packed and distributed as efficiently as possible.

[0059] All variants of the knapsack algorithm and standard solutions defined in "Different Approaches to Solving the 0 / 1 Knapsack Problem" disclosed by Maya Hristakeva, Department of Computer Science, Simpson College, Indianola, IA 50125 hristake@simpson.edu Some variants of the search are performed on the configuration space. The search of the configuration space can be made systematic and exhaustive by seeding the ratios with which the knapsack algorithm is initialized using a Stern sequence. This affects the operational efficiency of the algorithm because the Stern sequence can be used to generate all possible rational fractions at once. If the fraction values ​​are restricted to values ​​less than 1, they can be used as packing ratios for the knapsack algorithm, and this constitutes an exhaustive search for all possible ratios of the key share. Signature generation is performed from arbitrary data information.

[0060] Advantages of the Preferred Embodiment

[0061] Some blockchains allow information to be digitally signed in its current format. The present disclosure introduces the proposed backpack ECC method to extend this to allow signature retrieval and decryption, as described in more detail below. Therefore, the same mechanism can also be used for information retrieval.

[0062] In the disclosed scheme, the signed ciphertext may be sent to a set of verifiers who then decrypt the ciphertext according to a (t,n) threshold scheme, where any n of the n verifiers in the set can decrypt and recover the information, see, for example, Hsu CL and Wu TC (1998), Authenticated encryption schemes with (t,n) shared authentication, IEEE Proceedings - Computers and Digital Technology, Vol. 145, No. 2, pp. 117-120. This improves the confidentiality of data transmission and allows the integration of encrypted sessions.

[0063] Elliptic curve cryptography (ECC) (see, e.g., Koblitz N. (1987), "Elliptic Curve Cryptography", Mathematics of Computation, pp. 203-209) provides a secure method for exchanging encrypted messages. Elliptic curve cryptography (unlike other known encryption methods, such as RSA) does not require secret domain parameters. Some applications of this procedure will include public key indication, which has simultaneous verification of self-certifying public key cryptosystems. With the introduction of the knapsack algorithm, the scheme of the present disclosure is introduced into the encryption process in a non-linear manner. The reason for creating non-linearity is that the key messages that make up the encryption process are packaged in a space-saving manner, rather than in the order in which the messages are used. This provides a higher level of security for the encrypted information that is placed into the knapsack algorithm before sending it to the recipient. The recipient can then decrypt using a reverse knapsack process to recover the information.

[0064] Initial domain parameters are set in some blockchain protocols. The information exchange used in this scheme can be used as a secure authentication mechanism, whose ID is based on the user's secret key. This allows for a challenge-response mechanism between the user and the server, see for example Nyberg K. and Rueppel RA (1993), "A new signature scheme based on DSA with message recovery", ACM Computer and Communications Security, Vol. 1, pp. 58-61.

[0065] The base public key held by the client can be extended using the multi-signature method detailed below.

[0066] In this way, the client's public key can be recalculated as needed and for each authentication session, see, for example, Huang et al., "FPGA Implementation of Elliptic Curve Cryptography for Future Secure Network Transactions," Conference Paper, January 2007. The creation of the digital signature follows the ECDSA(r,s) signing process.

[0067] Encryption Method

[0068] Reference Figure 2 , which describes the message flow generally used for the information encryption process. As can be seen from the message flow, there is an optional branch 70. Optional branch 70 makes it possible to further enhance the security of the encryption method by segmenting the (R, S) pair before performing backpack encryption. The details are as follows.

[0069] ECDSA Signature

[0070] Reference Figure 3 , which describes in detail Figure 1 and Figure 2 The digital signature of step 10. Unless a special form of open signature is created when a network node can request a transaction, the information (M) in the transaction exchange part is signed by the sender of the information and incorporates the address of the recipient. The calculation of the r value in the ECDSA signature is as follows. If the r value is equal to 0, another random number k is selected when calculating the s value, as shown below.

[0071]

[0072] where d A is the sender's private key.

[0073] Some blockchains use the SHA256 algorithm and sign the hash of the information, thus:

[0074] m=Hash256(M).

[0075] The signature generation process is as follows Figure 3Then, the digital signature of the transaction (r, s) is used as step 30 ( Figure 1 and Figure 2 ), and the detailed description of the backpack sequence can be found in Rajaram Ramasamy R, Prabakar MA, Devi M.I and Suguna M (2009), "Backpack-based ECC encryption and decryption", International Journal of Network Security, Vol. 9, No. 3, pp. 218-226. Thus, after the coded value (R, S) is created, the coded value is encrypted using ECC in step 40. Thus, the encrypted point (P) associated with the R value and the S value is returned. R ,P S ).

[0076] The process of converting (r,s) using the knapsack algorithm is shown in Method 1 below. The sequence used in the knapsack algorithm should be a super increasing sequence, which helps to solve the problem more easily. A super increasing sequence is defined as the next item in the sequence being greater than the sum of all previous items. To solve a super increasing knapsack sequence, the total weight of the knapsack is compared with the maximum weight and the sequence. When the total weight is less than the maximum weight, it is not in the knapsack. When the total weight is greater than the maximum weight, it is in the knapsack. The algorithm subtracts the maximum weight from the total weight and compares it with the next largest number. This process is repeated until the total reaches zero. There is no solution when the total does not reach zero. This is a characteristic of a super increasing sequence.

[0077] Knapsack algorithm using Stern sequences

[0078] The general knapsack problem and its algorithmic solution are described in "Different Approaches to Solving the 0 / 1 Knapsack Problem" by Maya Hristakeva, Department of Computer Science, Simpson College, Indiana, IA 50125 (hristake@simpson.edu). It can be seen that all standard solutions to the knapsack problem involve searching the configuration space. A variant of the knapsack algorithm is defined as follows. The "knapsack sequence" in this algorithm is calculated by multiplying the value of an integer K (K is defined below), where "p" refers to the prime number (the order of the elliptic curve) used in the original place in the modular operation, "k" refers to the secret integer (temporary key), and m L is the length of the binary bit string. The "ν" value is unique for each authentication client, and the new temporary value k is kept secret.

[0079] Modified Stern sequences are used to reduce the time complexity. A more detailed description of Stern sequences is given in Reznick (2008), "Regularity of Stern Enumerations of Rational Numbers", Journal of Integer Sequences.

[0080] The value K = Hash(k) is used in the reverse knapsack algorithm. It is computationally infeasible to determine the value of k based on the hash value K.

[0081] Knapsack Algorithm

[0082] Described in detail here Figure 1 , 2 and steps 30 of 4 of the knapsack algorithm shown in FIG.

[0083] First define the sequence

[0084] where i∈{0,...,m L}.

[0085] ν is calculated by multiplying ν=p+K, where p is the "prime number" used in the modular operation and K=Hash(k) is the secret integer. L refers to the length of the binary bit string.

[0086] The ν value is unique to each key, and therefore address, and is updated at each new deterministic exchange.

[0087] The K=Hash(k) value should be sent along with the signatures (r,s) to be used in the reverse knapsack algorithm. This should be sent between the parties using the standard multi-signature method (see below). Using this method and the multi-signature method a series of random values ​​can be generated, not just a temporary k value that is used as a random integer.

[0088] A modified Stern sequence is used in the knapsack algorithm as this reduces the time complexity by sorting the rational values ​​between 0 and 1, thus making the rational values ​​easy to search.

[0089] Stern sequence (for more details see Stern, MA "On the theoretical function of numbers" J.reine angew. Mathematics 55, 193-220, 1858):

[0090] Stern(1)=1

[0091] Stern(ν) = Stern(ν / 2) - if ν is even

[0092] Stern(ν)=Stern((ν-1) / 2)+Stern((ν+1) / 2) - if ν is an odd number

[0093] The ratios of the values ​​in the Stern sequence can be used to create a binary tree whose leaves constitute all rational fractions. This is the Stern-Brochet tree. Once a set of rational values ​​has been enumerated, it can be traversed in order of size. Then, the subset of rational values ​​less than or equal to 1 can be considered. This enumeration and sorting can be used to improve the search efficiency of the knapsack algorithm.

[0094] Consider the binary tree generated by the following iteration a,b→a,a+b; a+b,b, (1) starting from the root 1 1. The numbers a,a+b and a+b,b are called the left and right children of a and b respectively; ab is also called the parent of its children. The concept of generation is defined as follows: the roots 1,1 constitute the first generation; the (n+1)th generation is the set of all children of the elements of the nth generation. The binary tree obtained by this iteration is called a Calkin-Wilf tree.

[0095] The principle of the Stern-Brochot tree is as follows.

[0096] According to the knapsack algorithm, equation (3) is used to calculate R. The knapsack sequence is represented as a i , the binary value of r is represented by x i express.

[0097] The S value of the system is given by equation (4).

[0098]

[0099] The (R,S) value can be encrypted using an elliptic curve function.

[0100] Other values ​​can be exchanged for K. These values ​​do not need to be related to the original k random value used in the signature. However, the integration of K=Hash(k) allows the creation of additional script forms later. The use of (R,S) produces a form of double encryption. This provides authentication and confidentiality for subsequent information exchange. In a form similar to the Menezes-Vanstone elliptic curve algorithm (see Nyberg K. and Rueppel RA (1993), "A new signature scheme based on DSA to provide information recovery", ACM Computer and Communications Security, Volume 1, Pages 58-61), the input is segmented into blocks of approximately 160 bits. Partial blocks are corrected or segmented using the ECC algorithm input with the recipient's public key. An escrow agent or cloud server is used for exchange. Each segment is also encrypted using the public key of the system.

[0101] The signature is sent to a server or other cloud node. The system can also be an escrow agent or other third party. The third party or cloud server cannot decrypt the signature because it requires the private key of the final recipient. The ECC encryption algorithm is shown below.

[0102] In the disclosed ECC encryption algorithm version, the input is first converted into a point on the elliptic curve using the Koblitz method. The Koblitz method is described in Koblitz N. (1987), "Elliptic Curve Cryptosystems", Computational Mathematics, pp. 203-209, and Padma Bh et al. / (IJCSE) International Journal of Computer Science and Engineering, Vol. 02, No. 05, 2010, 1904-1907, which utilizes the Koblitz method to implement information encoding and decoding in elliptic curve cryptography.

[0103] Definition of Stern-Brochet Tree

[0104] This section describes how to generate rational numbers using Stern-Brochet trees.

[0105]

[0106] As can be seen from the figure above, rational numbers can be arranged in the form of a tree. The relationship between leaves is that they all come from the top element, which is (1 / 1).

[0107] By considering this value as a vector and multiplying it by the left matrix L or the right matrix R, we can generate leaves that are consecutive on the tree. The matrices L and R are defined as follows:

[0108]

[0109] And the structure presented is as follows:

[0110]

[0111] By recursively applying the matrices L and R, it can be seen that further branches of the tree can be generated. The items at any given level of the tree can then be read from left to right, and an ordering of rational numbers can be generated. Those values ​​to the left of the center line (aligned with matrix I) are between 0 and 1. The values ​​to the right of the center line are greater than 1.

[0112] Multi-signature method

[0113] This section introduces a multi-signature mechanism using ECSDA as the underlying technology.

[0114] For the sake of clarity, the following description is made using an example, in which the two parties involved in secret sharing are a certain type of Internet service provider (hereinafter referred to as the "server") and the client of the server (hereinafter referred to as the "client"). The described method can be used for any two parties (for example, see variant V2).

[0115] It is assumed that all parties have the ability to perform ECC operations. The Client may use software provided by the Server, or software provided by a third-party encryption service provider, for this purpose.

[0116] Phase 1: Registration

[0117] 1) All parties agree to use a common generator, G, based on a standard ECC system, such as secp256k1.

[0118] 2) The server generates a public / private key pair using secp256k1 and publishes its public key (for example, on the official website):

[0119] Server private key 1 = V MS (Keeping confidential by the server)

[0120] Server public key 1 = P MS (public)

[0121] in:

[0122] V stands for private key (kept secret by the owner of the key)

[0123] P stands for public key (disclosed to everyone)

[0124] In subscript:

[0125] M refers to the "Master Key"

[0126] S means the key belongs to the server

[0127] Note that in ECC, the public key is derived from the private key by using elliptic curve point multiplication as shown below:

[0128] P MS =V MS XG

[0129] The private key is a random integer within the allowed range specified by the ECC system.

[0130] a. The client uses secp256k1 to generate a public / private key pair:

[0131] Client private key 1 = V MC (Confidential by the client)

[0132] Client public key 1 = P MC (This is the client's master key)

[0133] again:

[0134] P MC =V MC XG

[0135] b. The client registers its master public key (PMC ). This happens, for example, when a client registers with a server as a persistent user. The client also has access to the server's publicly available master public key, P MS .

[0136] The registration phase occurs only once, at initial setup. Afterwards, the master key is reused in a secure manner to generate one-time symmetric encryption keys.

[0137] Phase 2: Session Initiation

[0138] 3) The client creates a "message" and sends it to the server, which uses a standard algorithm to create a hash of the message, resulting in a 256-bit integer:

[0139] Information = M (UnixTime + Nonce)

[0140] Information hash value = SHA-256(M)0

[0141] The choice of information to generate the shared secret is arbitrary, but the choice of (UnixTime+Nonce) is useful for certain intended applications (see Example 1).

[0142] 4) The client calculates the secondary private key as follows:

[0143] Client private key #2 = V 2C =V MC +SHA-256(M) scalar addition

[0144] It should be noted that in this case, the secondary private key is not a random number, but is deterministically derived from the primary public key. Using this method, its paired public key (P 2C ) can be obtained from the client master key (P MC ) is derived as follows:

[0145] P 2C =V 2C XG (by definition)

[0146] =(V MC +SHA-256(M))XG (by replacing V 2C )

[0147] =V MC X G+SHA-256(M)XG (ECC algebra is distribution algebra)

[0148] =P MC +SHA-256(M)XG (by definition, V MC XG=P MC )

[0149] It should be noted that the "+" operator refers to the addition of elliptic curve points.

[0150] Therefore, although the client's secondary private key (V 2C ) remains secret, but once the master key and information M are known, the secondary public key can be easily derived.

[0151] 5) Client uses V 2C Sign the message M and send it to the server

[0152] Signed message = Sig-V 2C <m>

[0153] For more details on the Elliptic Curve Digital Signature Algorithm (ECDSA), see:

[0154] https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorithm; http: / / cs.ucsb.edu / ~koc / ccs130h / notes / ecdsa-cert.pdf

[0155] This step represents the only transmission required to establish a shared secret between the client and the server and initiate a secure communication session. The server will use the received information M to generate its own secondary public / private key pair. This allows the client to immediately calculate the server's secondary public key:

[0156] 6) The client uses the same technique as in step 4) to calculate the server's secondary public key (P 2S ):

[0157] P 2S =P MS +SHA-256(M)XG

[0158] 7) The server receives the client information and independently calculates the hash value of M = SHA-256 (M)

[0159] 8) The server calculates the client's secondary public key (P 2C ).

[0160] 9) The server calculates P 2C Verify the client's signature (Sig-V 2C ).

[0161] For more details, see:

[0162] https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorithm;

[0163] http: / / cs.ucsb.edu / ~koc / ccs130h / notes / ecdsa-cert.pdf

[0164] At this time, the server may also perform further checks based on the content of the information M according to any agreed conditions (for example, in Embodiment 1).

[0165] 10) The server calculates the secondary private key as follows:

[0166] V 2S =V MS +SHA-256(M)

[0167] The same technique as in step 4) can be used to verify V 2S With P 2S It should be noted that the server's secondary private key (V 2S ) remains secret and only the server knows the private key.

[0168] 11) The client and server now have each other's secondary public key, and can each independently compute the shared secret S using its own secondary private key as follows:

[0169] The server calculates S=V 2S XP 2C

[0170] Client calculation S = V 2C XP 2S

[0171] Verification that both calculations yield the same value is as follows:

[0172] (i)V 2S XP 2C =V 2S X(V 2C XG)

[0173] =(V 2S XV 2C )XG

[0174] (ii) V 2C XP 2S =V 2C X(V 2S XG)

[0175] =(V 2C XV 2S )XG

[0176] The ECC algebra is commutative, so:

[0177] (V 2S XV 2C )XG=(V 2C XV 2S )XG

[0178] Therefore, equations (i) and (ii) are equivalent.

[0179] The shared secret S is an elliptic curve point (x S ,y S ) format. This can be converted to any standard key format using a standard public operation agreed upon by both parties. For example, x S The value is a 256-bit integer, which can be used as an AES 256 For any application that requires a key of this length, it can also be converted to a 160-bit integer using RIPEMD160 00. Note that once the shared secret S is calculated, there is no need to keep the secondary private key (V 2C and V 2S ), nor does it need to be stored (although it depends on the specific application, as long as the secondary private key is as secure as the primary private key, it can be stored). Furthermore, the shared secret itself only needs to exist during the communication session, and can be discarded immediately after the session without being stored (although it can be recalculated at any time).

[0180] The second phase in this protocol can be repeated multiple times to generate a continuous shared secret for a single purpose. Alternatively, the same shared secret can be reused. In the latter case, the actual secret will not be stored for security reasons, because the actual secret can be recalculated from the public message and the private key of the existing secret (for example, as shown in Example 2).

[0181] Method 1 — Knapsack Algorithm

[0182] This section describes how to use Figure 1 , 2 The backpack algorithm of step 30 of step 4 optimizes the packing of ECDSA signatures, and for more detailed description, see "Further Extension of the Backpack Program". As described above, the nonlinear packing procedure of the backpack algorithm increases the security of key sharing.

[0183] enter :-(r,s)

[0184] -Backpack sequence

[0185] Output :-(R,S) in the form of a larger integer.

[0186] method :

[0187] 1) Convert (r,s) to binary form

[0188] 2) Generate backpack sequence

[0189] 3) Calculate (R, S)

[0190] Signature Extension

[0191] This method can be extended beyond the signing process by signing the entire message. In this method, the message shared and encrypted between the parties is digitally signed without the need for a hash of the message. That is, the entire message is signed, creating a larger version of the (r,s) signature pair.

[0192] The knapsack algorithm is again used to encode the (R, S) values. In most cases, it is preferred to use a hash of the message, but in some cases the entire signed message may be present.

[0193] The (R, S) value should be segmented into multiple blocks before being double encrypted using the sender's private key and the server or escrow agent's public key.

[0194] When the server receives the signature, it decrypts it using the private key it maintains. Then, it encrypts it using the public key of the final recipient. After this process, the signature is sent from the server or proxy to the recipient.

[0195] Single character ECC algorithm implementation details

[0196] This method describes the Figure 1 , 2 The ECC encryption step 40 of 4 is used to encrypt a single character, which can be summarized as a character stream.

[0197] Choose a base point G from the elliptic curve.

[0198] G has the equation y 2 =x 3 The [x, y] coordinates of +ax+b.

[0199] The base point minimizes the x and y values ​​while complying with EC, that is, the point on the elliptic curve that minimizes the x and y values.

[0200] In the ECC method, a random integer k (k < p) is selected and needs to be kept secret.

[0201] kG is then evaluated through a series of additions and doublings, as is standard in elliptic curve algebra.

[0202] The source is specified as host A and the destination is specified as host B.

[0203] Select the private key of host B, called n B k and n B Can be generated by a random number generator to provide confidence.

[0204] B's public key is evaluated as follows

[0205] P B =n B G. (3)

[0206] In order for A to encrypt and transmit alphabetic characters to B, the following operations are performed.

[0207] For example, if A wants to send the character "S".

[0208] Then, the ASCII value of the character "S" is used to modify any point P m , as shown below: P′ m =SP m

[0209] P m is an affine point, i.e. an arbitrary origin for the ECC calculation and encoding. This is done differently from the base point G to preserve its individual identity. m is a point on the elliptic curve. m The coordinates of the points should fit an elliptic curve.

[0210] This conversion is done for two purposes. First, the single-valued ASCII is converted to the x,y coordinates of the EC. Second, it is completely disguised for potential hackers.

[0211] In the next step of ECC, it is necessary to evaluate kP B , where P B is the public key of user B. In order to make the results converge quickly, the optimal number of doublings and additions in the sequence should be planned according to the value of k. Then, by m With kP B Add, that is, P′ m +kP B , derive the encrypted information.

[0212] This will produce a set of coordinates x 2 ,y 2 Then, kG is included as the first element of the encrypted version, which is another set of coordinates x 1 ,y 1 . Therefore, the entire encrypted version for storage or transmission consists of two sets of coordinates as follows:

[0213] C m =(kG,P′ m +kP B )

[0214] kG→x 1 ,y 1

[0215] P′ m +kP B →x 2 ,y 2

[0216] Therefore, the modified plaintext has been encrypted by applying the ECC method.

[0217] Further expansion of the backpack program

[0218] The backpack program introduces thorough dispersion and confusion to prevent brute force attack attempts.

[0219] The backpack program uses a series of i Vector.

[0220] There are several ways to generate these vectors. For example, one might have a sequence of powers of n that looks like this:

[0221] a i =1,n,n 2 , n 3 , ..., n m Where 1≤i≤m.

[0222] Here, for simplicity, n is a random integer less than 10, or involves p and k integers for calculation. p is a prime number used in the modular operation, k is a secret integer, and m is the length of the binary bit string.

[0223] The information is encrypted following the backpack process as follows:

[0224] Assume x i is one of the coordinate points, which can be represented in binary form as:

[0225] x i =b 1 ,b 2 ,...,b m 1≤i≤m, where b 1 , b 2 , ... are the binary coefficients of the expansion terms

[0226] According to the knapsack algorithm, the cumulative sum S[x 1 ], which is defined as the vector dot product of the binary form of the xi coordinate point and the sequence defined above, as follows:

[0227]

[0228] In the final encrypted version, the coordinate x i By its equivalent term S[x 1 ]replace.

[0229] Similarly, y 1 , x 2 ,y 2 Other coordinates are converted using the backpack algorithm, so the encrypted information should be expressed as

[0230] C m =((S[x 1 ],S[y 1 ]), S[x 2 ],S[y 2 ])).

[0231] It should be noted that two pairs of integers represent one character in a message. Accordingly, the total message will be represented by the same number of pairs of integers as the number of characters in the message.

[0232] The receiver B has all the relevant information to reverse the backpack program and recover the bit pattern of the coordinates. For example, B knows a i sequence, its own secret key n B And the base point G, a, b, and p values ​​of the elliptic curve. B receives the encrypted information, C m =((S[x 1 ],S[y 1 ]), (S[x 2 ],S[y 2 ])).

[0233] To reverse the knapsack process, Figure 5 and Figure 6 In step 90, for example, consider

[0234]

[0235] It is the knapsack representation of x1. The value of x1 is recovered iteratively as follows:

[0236] Determine S[x 1 ]-n m .

[0237] If the value is positive, that is, S[x 1 ]-n m >0, then in (m) th The position is assigned a binary bit 1 and the current value is replaced by S[x 1 ]=S[x 1 ]-n m However, if the value is negative, a 0 bit is assigned and S[x 1 ] remains unchanged.

[0238] At this time, from S[x 1 ] minus n from the current value of m-1 Depending on whether it is positive or negative, the value 1 or 0 is assigned to the relevant bit position. This subtraction process continues until a i until the sequence is exhausted. This will restore x 1 The binary bit pattern of .

[0239] Then, for y 1 , x 2 and 2 Repeat these steps. Remember that kG is given by x 1 ,y 1 It means that P′ m +kP B Use x 2 ,y 2 In order to get from P′ m +kP B Extract P′ m , B applies its secret key n B And multiply by kG, so

[0240] n B kG=kP B .

[0241] From P′ m +kP B Subtract from , and we get P′ m , as shown below:

[0242] P′ m =P′ m +kP B -nB K G.

[0243] Subtraction also involves ECC doubling and addition, where the only difference is that the negative term has a negative sign before the y-coordinate. R ,y R The new values ​​of are the same. All occurrences of y are replaced by -y.

[0244] This will produce P′ m Then, we can get from P′ m =SP m The ASCII value of "S" is retrieved from the elliptic curve cryptography lookup table of ASCII values.

[0245] ECC encryption algorithm

[0246] This section introduces a method for combining the ECC encryption algorithm, the Koblitz algorithm, and the knapsack algorithm.

[0247] enter :-(R, S)

[0248] - The recipient's public key P B

[0249] -Random integer K used by the sender = Hash(k)

[0250] -Elliptic curve base point G

[0251] Output : The encryption point of each of R and S

[0252] method:

[0253] Explanation for The method used for S is exactly the same.

[0254] 1) Koblitz method Figure 1 The mapping step 20 is used to identify a unique elliptic curve point corresponding to R. This is done by identifying a point with x coordinate x∈Z p The algorithm is implemented by finding a point on the elliptic curve such that λR<x≤λR+1 for some constant λ agreed upon between the sender and the receiver. If such a point does not exist, then try λR<x≤λR+2, etc.

[0255] 2) The sender generates a random number K. This can be chosen as K = Hash(k).

[0256] 3) The sender sends the encrypted ciphertext

[0257]

[0258] To the recipient. Click is the encrypted point corresponding to R, and point Allows the recipient to decrypt the point, as described in more detail below.

[0259] Decryption

[0260] Figure 5 and 6 The information flow in the decryption procedure of step 80 is as follows.

[0261] The rest of this section (Decryption) describes the mechanics of each step.

[0262] Information recovery

[0263] The signature of the message received by the server can be decrypted using the server's private key. Once decrypted, the message is encrypted using a secret key shared between the cloud server and the final recipient. This allows a server or agent to act as an escrow or forwarding agent without knowing any cryptographic secrets while still being able to monitor and authenticate the sender and receiver. The exchange of values ​​is accomplished through a secret sharing method, which is detailed in the "Secret Value Sharing" section below.

[0264] The cloud server can also act as a certification authority when creating an ID-based encryption scheme. The details of the ECC decryption algorithm are shown below. The receiver is able to recover (R,S) using the private key input to the ECC decryption algorithm. This allows the receiver to decode the elliptic curve point back to the message.

[0265] ECC decryption algorithm

[0266] Shows Figure 5 and 6 The operation of the ECC decryption algorithm in step 80.

[0267] enter :- from the sender in the form of The ciphertext.

[0268] - The recipient's private key d B

[0269] Output :-Decrypted data R (or S)

[0270] method:

[0271] 1) KG is the first point, The second point

[0272] 2) Calculation

[0273] 3) Decode the point using Koblitz's method. This can be done by identifying the largest integer R that is less than (x-1) / λ.

[0274] The (R,S) values ​​are used as input to a reverse knapsack algorithm to recover the (R,S) values ​​through an iterative process using the values.

[0275]

[0276] when When the value is positive, at m L th Position is assigned binary bit 1.

[0277] Then set the current value of R to:

[0278]

[0279] In case the result is negative, bit 0 is assigned and the value of R remains unchanged. Next, subtract the current value of R from This iterative process continues by switching the binary value 0 or 1 as defined above until there are no more values ​​in the sequence. The result returned is the binary bit pattern associated with the value of R. Then, the conversion back to binary form of (r,s) is completed using Equation 5 to recover the information.

[0280] The information can then be recovered using Equation 5. The information may be in ASCII format or any other encoding including non-text input.

[0281]

[0282] Secret value sharing

[0283] A fundamental problem in cryptography is establishing a shared secret between parties across an insecure network. For example, in symmetric key cryptography (see https: / / en.wikipedia.org / wiki / Symmetric-key_algorithm), such as that used by AES (see

[0284] https: / / aesencryption.net / ), a single secret key is shared by both parties. The disadvantage is that the secret key must first be securely transmitted between the two parties in some way. Since the transmission of the key is usually done electronically over a communication system such as the Internet, the sharing step can introduce catastrophic vulnerabilities. Because symmetric key protocols are simple and widely used, there is a need for the ability to securely share secret keys across non-secure networks.

[0285] Diffie-Hellman key exchange (see

[0286] Existing protocols such as the Diffie%E2%80%93Hellman_key_exchange protocol (https: / / en.wikipedia.org / wiki / Diffie%E2%80%93Hellman_key_exchange) and the three-pass protocol (see https: / / en.wikipedia.org / wiki / Three-pass_protocol for details) can securely share secrets in an insecure network. However, these methods are computationally expensive in the case of constantly generating and sharing new secrets. The present embodiment provides an efficient and low-cost method for secure secret sharing. Furthermore, the described technology allows multiple secure secret keys to be generated and conveniently managed based on a single master key.

[0287] The main contents of the process of this embodiment are as follows:

[0288] 1. This method utilizes the properties of "Elliptic Curve Cryptography" (ECC) (see https: / / en.wikipedia.org / wiki / Elliptic-curve_cryptography for details) and "Elliptic Curve Arithmetic". There are several cryptographic standards that use elliptic curves, as described by an independent organization called the Efficient Cryptography Standards Group (SECG) (http: / / www.secg.org / ).

[0289] 2. ECC is used to generate cryptographic key pairs for asymmetric cryptography (see https: / / searchsecurity.techtarget.com / definition / asymmetric-cryptography for details), where one key is publicly available and the other is kept secret. This embodiment enables each party to independently compute the same secret key based on its own asymmetric key pair generated by an agreed ECC standard such as secp256k1. Security is derived from the fact that the shared secret is computed by each party but never transmitted.

[0290] 3. Efficiency comes from combining multiple steps into one and using less expensive computations to derive new keys. After the initial setup phase of establishing the master key, each subsequent creation of a new secret key is efficient and repeatable.

[0291] Technical Description

[0292] For the sake of clarity, the following description is made using an example in which the two parties involved in secret sharing are a certain type of Internet service provider (hereinafter referred to as the "server") and a client of the server (hereinafter referred to as the "client"). The described method can be used for any two parties (for example, see variant V2 below).

[0293] It is assumed that all parties have the ability to perform ECC operations. The Client may use software provided by the Server, or software provided by a third-party encryption service provider, for this purpose.

[0294] Phase 1: Registration

[0295] 12) All parties agree to use a common generator G based on a standard ECC system, such as secp256k1.

[0296] 13) The server generates a public / private key pair using secp256k1 and publishes its public key (for example, on its official website):

[0297] Server private key 1 = V MS (Keeping confidential by the server)

[0298] Server public key 1 = P MS (public)

[0299] in:

[0300] V stands for private key (kept secret by the owner of the key)

[0301] P stands for public key (disclosed to everyone)

[0302] In subscript:

[0303] M refers to "Master Key"

[0304] S means the key belongs to the server

[0305] Note that in ECC, the public key is derived from the private key by using elliptic curve point multiplication as shown below:

[0306] P MS =V MS XG

[0307] The private key is a random integer within the allowed range specified by the ECC system.

[0308] 14) The client generates a public / private key pair using secp256k1:

[0309] Client private key 1 = V MC (Confidential by the client)

[0310] Client public key 1 = P MC (This is the client's master key)

[0311] again:

[0312] P MC =V MC XG

[0313] 15) The client registers its master public key (P MC ). This happens, for example, when a client registers with a server as a persistent user. The client also has access to the server's publicly available master public key P MS .

[0314] The registration phase occurs only once, at initial setup. Afterwards, the master key is reused in a secure manner to generate one-time symmetric encryption keys.

[0315] Phase 2: Session Initiation

[0316] 16) The client creates a "message", sends it to the server, and uses a standard algorithm to create a hash value for the message, resulting in a 256-bit integer:

[0317] Information = M (UnixTime + Nonce)

[0318] The choice of information to generate the shared secret is arbitrary, but the choice of (UnixTime+Nonce) is useful for certain intended applications (see, for example, Example 1).

[0319] Information hash value = SHA-256(M)

[0320] For more details see: https: / / hash.online-convert.com / sha256-generator

[0321] 17) The client calculates the secondary private key as follows:

[0322] Client private key #2 = V 2C =V MC +SHA-256(M) scalar addition

[0323] It should be noted that in this case, the secondary private key is not a random number, but is deterministically derived from the primary public key. Using this method, its paired public key (P 2C ) can be obtained from the client master key (P MC ) is derived as follows:

[0324] P 2C =V 2C XG (by definition)

[0325] =(V MC +SHA-256(M))XG(by replacing V 2C )

[0326] =V MC X G+SHA-256(M)X(ECC algebra is distribution algebra)

[0327] =P MC +SHA-256(M)XG(by definition, V MC XG=P MC )

[0328] (Note that the "+" operator refers to the addition of elliptic curve points.)

[0329] Therefore, although the client's secondary private key (V 2C ) remains secret, but once the master key and information M are known, the secondary public key can be easily derived.

[0330] 18) Client uses V 2C Sign the message M and send it to the server

[0331] Signed message = Sig-V 2C <m>ECDSA

[0332] (https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorith m)

[0333] This step represents the only transmission required to establish a shared secret between the client and the server and initiate a secure communication session. The server will use the received information M to generate its own secondary public / private key pair. This allows the client to immediately calculate the server's secondary public key:

[0334] 19) The client uses the same technique as step (4) to calculate the server's secondary public key (P 2S ):

[0335] P 2S =P MS +SHA-256(M)XG

[0336] 20) The server receives the client information and independently calculates the hash value of M = SHA-256 (M)

[0337] 21) The server calculates the client's secondary public key (P 2C ).

[0338] 22) The server calculates the P 2C Verify the client's signature (Sig-V 2C ). At this time, the server may also perform further checks based on the content of the information M according to any agreed conditions (for example, see Example 1).

[0339] 23) The server calculates the secondary private key as follows:

[0340] V 2S =V MS +SHA-256(M)

[0341] The same technique as step (4) can be used to verify V 2S With P 2S It should be noted that the server's secondary private key (V 2S ) remains secret and only the server knows the private key.

[0342] 24) The client and server now have each other's secondary public key and can each independently compute the shared secret S using its own secondary private key as follows:

[0343] The server calculates S=V 2S XP 2C

[0344] Client calculation S = V 2C XP 2S

[0345] Verification that these two calculations yield the same value is as follows:

[0346] (i)V 2S XP 2C =V 2S X(V 2C XG)

[0347] =(V 2S XV 2C )XG

[0348] (ii) V 2C XP 2S =V 2C X(V 2S XG)

[0349] =(V 2C XV 2S )XG

[0350] The ECC algebra is commutative, so:

[0351] (V 2S XV 2C )XG=(V 2C XV 2S )XG

[0352] Therefore, equations (i) and (ii) are equivalent.

[0353] The shared secret S is an elliptic curve point (x S ,y S ) format. This can be converted to any standard key format using a standard public operation agreed upon by both parties. For example, x S The value is a 256-bit integer, which can be used as an AES 256 For any application that requires a key of this length, it can also be converted to a 160-bit integer using RIPEMD160 (http: / / homes.esat.kuleuven.be / ~bosselae / ripemd160.html). It should be noted that once the shared secret S is calculated, there is no need to keep the secondary private key (V 2C and V 2S ), nor does it need to be stored (although it depends on the specific application, as long as the secondary private key is as secure as the primary private key, it can be stored). Furthermore, the shared secret itself only needs to exist during the communication session, and can be discarded immediately after the session without being stored (although it can be recalculated at any time).

[0354] The second phase in this protocol can be repeated multiple times to generate a continuous shared secret for a single purpose. Alternatively, the same shared secret can be reused. In the latter case, the actual secret will not be stored for security reasons, as it can be recalculated from public information and the existing secret-keeping private key (e.g., as shown in Example 2).

[0355] Variants

[0356] This section describes the hashing variant methods.

[0357] V1: Hash level

[0358] By prior agreement between the parties, instead of repeating the second phase to generate successive single-purpose keys, the hash hierarchy can be established by both parties by reusing previously used hashes of information (SHA-256(M)). In effect, the hash of the information can be the information of the next generation (M'). Doing so allows the calculation of successive shared secrets without the need for further protocol establishment transmissions. The second generation shared secret (S') can be calculated as follows.

[0359] V1.i Both parties calculate the second generation hash value:

[0360] M'=SHA-256(M)

[0361] Hash'=SHA-256(SHA-256(M))

[0362] V1.ii The client calculates another generation of public key of the server:

[0363] P 2S '=P MS +Hash'X G

[0364] V1.iii The server calculates another generation of the client's public key:

[0365] P 2C '=P MC +Hash'X G

[0366] V1.iv Both parties calculate their own second-generation private key:

[0367] V 2C '=V MC +SHA-256(M')

[0368] V 2S '=V MS +SHA-256(M')

[0369] V1.v The server and client each calculate the next generation shared secret:

[0370] The server calculates S' = V 2S 'XP 2C '

[0371] The client calculates S' = V 2C 'XP 2S '

[0372] Further generations (S", S'", etc.) can be calculated in the same way to create a chain hierarchy. This technique requires both the server and the client to keep track of the original information or the original calculated hash value (SHA-256(M)) and which party it is associated with. Since this is well-known information, there are no security issues regarding the retention of this information. Therefore, this information may be saved to a "hash table" (linking the hash value to the public key) and distributed freely on the network (for example, using a torrent). It should be noted that if any single shared secret in the hierarchy is ever compromised, as long as the private key remains secure, it will not affect the security of any other secret keys in the hierarchy.

[0373] In addition to the chain (linear) hierarchy described above, it is also possible to create a hierarchy in the form of a tree structure. Branching of the tree can be done in several ways, three of which are described here.

[0374] (i) Master Key Generation. First, it should be noted that in the chain hierarchy, each new "link" (public / private key pair) is generated by adding a piece of information that has been reused many times to the original master key. That is (for clarity, only the private key is shown):

[0375] (ii)

[0376] V 2C =V MC +SHA-256(M)

[0377] V 2C ' =V MC +SHA-256(SHA-256(M))

[0378] V 2C ” =V MC +SHA-256(SHA-256(SHA-256(M)))

[0379] etc.

[0380] For the purpose of creating branches, any key can be used as a sub-master key. For example, V 2C 'Used as a sub-master key:

[0381] V 3C =V 2C '+SHA-256(M)

[0382] V 3C ' =V 2C '+SHA-256(SHA-256(M))

[0383] (iii) Logical association. In this approach, all nodes (public / private key pairs) in the tree are generated as a chain (or in any other way - as shown in (iii) below), and the logical relationship between the nodes in the tree is maintained by a table, where each node is simply associated with its parent node using a pointer.

[0384] (iv) Information diversity. New private / public key pairs can be generated by introducing new information M at any point in the chain or tree. The information itself can be arbitrary or carry some meaning or function (e.g., it may be related to a "real" bank account number, etc.). Of course, any new information must be kept securely.

[0385] Using a tree structure, many keys for different purposes can be provided, such as authentication keys, encryption keys, signature keys, payment keys, etc., all linked to a single securely maintained master key. Each of these can be used to create a shared secret with another party.

[0386] V2: Peer-to-Peer Secret Sharing

[0387] This embodiment can be used between two peers, rather than between a server and a client. In the example described in the technical description above, the server acts as a party that the client trusts. The server must authenticate the client's credentials to allow the client to access its system. The server does this by verifying the client's signed message. In a peer-to-peer situation, the peers must establish trust in each other, i.e., the "client" must also authenticate the "server's" credentials. This can be accomplished through a two-way process in which both parties perform the message signing and verification steps (steps (0-(9) in the technical description).

[0388] In the peer-to-peer case, after the client sends the signed message M to the server, the server uses its calculated secondary private key V 2S Sign the same message and send it back to the client:

[0389] V2.iSigned information = Sig-V 2S <m>ECDSA

[0390] Then, the client uses the server's secondary public key P calculated in step (0) 2S Verify the server's signature.

[0391] Now go to Figure 7 , provides an illustrative simplified block diagram of a computing device 2600 that can be used to implement at least one embodiment of the present disclosure. In various embodiments, the computing device 2600 can be used to implement any of the systems shown and described above. For example, the computing device 2600 can be configured to function as a data server, a network server, a portable computing device, a personal computer, or any electronic computing device. Figure 7 As shown, computing device 2600 may include one or more processors with one or more levels of cache and a memory controller (collectively referred to as 2602), which may be configured to communicate with a storage subsystem 2606 including a main memory 2608 and a permanent memory 2610. As shown, main memory 2608 may include dynamic random access memory (DRAM) 2618 and read-only memory (ROM) 2620. Storage subsystem 2606 and cache memory 2602 may be used to store information, such as details associated with transactions and blocks described in the present disclosure. Processor 2602 may be used to provide the steps or functions of any embodiment described in the present disclosure.

[0392] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0393] The bus subsystem 2604 may provide a mechanism for enabling the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple busses.

[0394] The network interface subsystem 2616 can provide an interface to other computing devices and networks. The network interface subsystem 2616 can serve as an interface for receiving data from the computing device 2600 and transmitting data to other systems. For example, the network interface subsystem 2616 can enable a data technician to connect the device to a network, so that the data technician can send data to the device and receive data from the device at a remote location (e.g., a data center).

[0395] The user interface input devices 2612 may include one or more user input devices, such as a keyboard; a pointing device, such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touch screen included in a display; an audio input device, such as a voice recognition system, a microphone; and other types of input devices. In general, the use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information to the computing device 2600.

[0396] One or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display (e.g., an audio output device, etc.). The display subsystem may be a cathode ray tube (CRT), a flat panel device (e.g., a liquid crystal display (LCD)), a light emitting diode (LED) display, or a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. For example, one or more user interface output devices 2614 may be used to present a user interface to facilitate user interaction with an application program that performs the described processes and variations therein (when such interaction may be appropriate).

[0397] The storage subsystem 2606 may provide a computer-readable storage medium for storing basic programming and data structures that may provide the functionality of at least one embodiment of the present disclosure. When executed by one or more processors, an application (program, code module, instruction) may provide the functionality of one or more embodiments of the present disclosure and may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 may additionally provide a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage 2610 may provide permanent (non-volatile) storage for programs and data, and may include flash memory, one or more solid-state drives, one or more magnetic hard drives, one or more floppy disk drives with associated removable media, one or more optical drives with associated removable media (e.g., CD-ROM or DVD or Blu-ray), and other similar storage media. Such programs and data may include programs for executing the steps of one or more embodiments as described in the present disclosure and data associated with transactions and blocks described in the present disclosure.

[0398] The computing device 2600 may be of various types, including a portable computer device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that may be connected to the computing device 2600 via one or more ports (e.g., USB, headphone jack, lightning connector, etc.). The device that may be connected to the computing device 2600 may include a plurality of ports configured to accept fiber optic connectors. Thus, the device may be configured to convert optical signals into electrical signals that may be transmitted via the port that connects the device to the computing device 2600 for processing. Due to the ever-changing nature of computers and networks, Figure 7 The depiction of computing device 2600 is intended only to illustrate a specific example of a preferred embodiment of the device. Figure 7 There are many other configurations with more or fewer components of the systems shown.

[0399] It should be noted that the above embodiments illustrate rather than limit the present invention, and those skilled in the art will be able to design many alternative embodiments without departing from the scope of the present disclosure defined in the appended claims. In the claims, any figure marks in brackets shall not be interpreted as limiting the claims. The words "including" and the like do not exclude the presence of elements or steps other than those listed as a whole in any claim or the specification. In this specification, "including" means "including or consisting of...". The singular form of an element does not exclude the plural form of such elements, and vice versa. The present disclosure may be implemented by hardware comprising several different elements and by appropriately programmed computers. In a device claim that lists several devices, several of these devices may be embodied by the same hardware. The fact that certain measures are cited in mutually different dependent claims does not mean that a combination of these measures cannot be used to advantage.

[0400] References

[0401] 1. Chen TS, Huang GS, Liu TP and Chung YF (2002), "Digital signature scheme based on elliptic curve cryptosystem identification protocol", IEEE Proceedings TENCON '02, pp. 192-195

[0402] 2. Hsu CL and Wu TC (1998), "Authenticated encryption scheme with (t,n) shared authentication", IEEE Proceedings - Computers and Digital Technology, Vol. 145, No. 2, pp. 117-120.

[0403] 3. Graham, RL; Knuth, DE; and Patashnik, O. Concrete Mathematics: Foundations for Computer Science, 2nd ed., Reading, MA: Addison-Wesley, pp. 116-117, 1994.

[0404] 4. Koblitz N. (1987), "Elliptic Curve Cryptography", Computational Mathematics, pp. 203-209.

[0405] 5. Nyberg K. and Rueppel RA (1993), "A new signature scheme based on DSA providing message recovery", ACM Computer and Communications Security, vol. 1, pp. 58-61.

[0406] 6. Rajaram Ramasamy R, Prabakar MA, Devi MI and Suguna M (2009), "Backpack-based ECC encryption and decryption", International Journal of Network Security, Vol. 9, No. 3, pp. 218-226.

[0407] 7. Rajaram Ramasamy R. and Amutha Prabakar M. (2011), "Digital Signature Scheme Using Knapsack-based ECC Information Recovery", International Journal of Cyber ​​Security, Vol. 12, No. 1, pp. 15, 20.

[0408] 8. Reznick (2008), "Regularity of Stern enumerations of rational numbers", Journal of Integer Sequences. 9. Stern, M.A. "On number-theoretic functions", J. Reine Angew. Mathematics 55, 193-220, 1858.

[0409] 10. Different Approaches to Solving the 0 / 1 Knapsack Problem, Maya Hristakeva, Department of Computer Science, Simpson College, Indianola, IA 50125, hristake@simpson.edu

[0410] 11. Huang et al., "FPGA Implementation of Elliptic Curve Cryptography for Future Secure Network Transactions," Conference Paper, January 2007.

[0411] 1a. Symmetric key cryptography: https: / / en.wikipedia.org / wiki / Symmetric-key_algorithm 2a. AES encryption: http: / / aesencryption.net /

[0412] 3a.Diffie-Hellman key exchange:

[0413] https: / / en.wikipedia.org / wiki / Diffie%E2%80%93Hellman_key_exchange4a. Three-pass protocol: https: / / en.wikipedia.org / wiki / Three-pass_protocol5a. Elliptic curve cryptography:

[0414] https: / / en.wikipedia.org / wiki / Elliptic_curve_cryptography

[0415] 6a. Standards for Efficient Cryptography Group (SECG): http: / / www.secg.org /

[0416] 7a. Asymmetric cryptography: http: / / searchsecurity.techtarget.com / definition / asymmetric-cryptography

[0417] 8a. SHA-256 algorithm: http: / / hash.online-convert.com / sha256-generator 9a. Elliptic Curve Digital Signature Algorithm (ECDSA):

[0418] https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorithm; http: / / cs.ucsb.edu / ~koc / ccs130h / notes / ecdsa-cert.pdf

[0419] 10a.RIPEMD160 algorithm:

[0420] http: / / homes.esat.kuleuven.be / ~bosselae / ripemd160.html

[0421] 4aa. Padma Bh et al. / (IJCSE) International Journal of Computer Science and Engineering, Vol. 02, No. 05, 2010, 1904-1907, Encoding and decoding information in elliptic curve cryptography using Koblitz method< / m> < / m> < / m>

Claims

1. A computer-implemented method for distributing a shared secret among a plurality of participants, the method comprising: a first mapping step, wherein a plurality of inputs of the first mapping step are mapped to respective elliptic curve points of an elliptic curve of an elliptic curve cryptographic system common to the participants; a first encryption step, wherein a plurality of said elliptic curve points are encrypted by a public key of a public-private key pair of said elliptic curve cryptosystem to provide an output suitable for decryption by a corresponding private key of said public-private key pair; a second encryption step, wherein a plurality of portions of at least one input to the second encryption step are multiplied by corresponding terms of a sequence known to the participants, wherein the second encryption step comprises a sequence raised to powers of terms known to the participants and the terms are based on information shared between the participants; as well as A secret sharing step wherein multiple shares of an input to said secret sharing step are distributed to multiple said participants such that said input is accessible to a threshold number of said shares and inaccessible to less than said threshold number of said shares.

2. The method according to claim 1, wherein: At least one input to the secret sharing step is based on an output of the first encryption step or the second encryption step.

3. The method according to claim 2, wherein: At least one input to the first encryption step is based on a shared secret, at least one input to the second encryption step is based on an output of the first encryption step, and at least one input to the secret sharing step is based on an output of the second encryption step.

4. The method according to claim 2, wherein: At least one input to the second encryption step is based on a shared secret, at least one input to the first encryption step is based on an output of the second encryption step, and at least one input to the secret sharing step is based on an output of the first encryption step.

5. The method according to claim 1, wherein: At least one input of the first encryption step is based on an output of the secret sharing step or the second encryption step.

6. The method according to claim 5, wherein: At least one input of the secret sharing step is based on a shared secret, at least one input of the second encryption step is based on an output of the secret sharing step, and at least one input of the first encryption step is based on an output of the second encryption step.

7. The method according to claim 5, wherein: At least one input to the second encryption step is based on a shared secret, at least one input to the secret sharing step is based on an output of the second encryption step, and at least one input to the first encryption step is based on an output of the secret sharing step.

8. The method according to claim 1, wherein: At least one input of the second encryption step is based on the secret sharing step or the output of the first encryption step.

9. The method according to claim 8, wherein: At least one input of the secret sharing step is based on a shared secret, at least one input of the first encryption step is based on an output of the secret sharing step, and at least one input of the second encryption step is based on the output of the first encryption step.

10. The method according to claim 8, wherein: At least one input to the first encryption step is based on a shared secret, at least one input to the secret sharing step is based on an output of the first encryption step, and at least one input to the second encryption step is based on an output of the secret sharing step.

11. The method according to claim 1, wherein: The second encryption step includes performing a knapsack algorithm.

12. The method according to claim 1, wherein: The sequence included in the second encryption step is based on a Stern sequence.

13. The method according to claim 1, wherein: The second encryption step comprises a super-incremental sequence.

14. The method according to claim 1, wherein: The first mapping step includes determining an elliptic curve point having coordinates based on the input.

15. The method according to claim 14, wherein: The coordinates are based on the input multiplied by a quantity known to the participant.

16. The method according to claim 1, wherein: The first encryption step includes determining a term comprising an elliptic curve point multiplied by an integer, the integer representing an input to the first encryption step.

17. The method according to claim 1, wherein: The first encryption step comprises determining a term based on a temporary key and a public key of a participant.

18. The method of claim 17, further comprising sending to at least one participant an elliptic curve point based on a generator point of the elliptic curve cryptosystem multiplied by a temporary key, and an elliptic curve point based on a participant public key multiplied by the temporary key.

19. The method according to claim 1, wherein: The shared secret is digital signature information.

20. The method according to claim 19, wherein: The digital signature information is a blockchain transaction.

21. A computer-implemented system comprising: processor; as well as A memory comprising executable instructions, wherein when the processor executes the executable instructions, the system is caused to perform any embodiment of the computer-implemented method according to any one of claims 1 to 20.

22. A non-transitory computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor of a computer system, causes the computer system to at least perform an implementation of the method according to any one of claims 1 to 20.

Images