Adaptive attack-resistant distributed symmetric encryption

Abstract

Systems and methods for adaptive attack resistance and amortized distributed symmetric cryptography are disclosed. A client computer can communicate with several cryptographic devices to encrypt or decrypt data. Each cryptographic device can possess one or more secret shares corresponding to one or more different secret values, which can be used in the process of encrypting or decrypting data. The client computer can generate one or more promises and transmit those promises to the cryptographic devices. Each cryptographic device can generate partial computations based on the promises and their respective secret shares. The partial computations can be transmitted to the client computer. The client computer can use the partial computations to generate a cryptographic key or a bulk key. The client computer can use the cryptographic key or one or more message keys derived from the bulk key to encrypt one or more messages or decrypt ciphertext.

Description

[0001] Cross-references to related applications

[0002] This application is an international patent application that claims the benefit of U.S. Patent Application No. 16 / 861,138, filed April 28, 2020, and U.S. Application No. 63 / 019,938, filed May 4, 2020, the entire contents of which are incorporated herein by reference for all purposes. Background Technology

[0003] "Cryptography as a Service" can refer to the process by which one entity performs cryptographic operations on behalf of another. For example, a server computer can encrypt data (such as sensitive medical records or other private documents) on behalf of a client computer. Later, when the client computer wants to retrieve the encrypted data, it can communicate with the server computer to decrypt it. Alternatively or additionally, the client computer can transmit encrypted data to another client computer. This other client computer can then communicate with the server computer to decrypt the encrypted data. Therefore, cryptography as a Service can be used to protect data across time or space. Cryptography as a service may be desirable because servers may be better equipped than client computers to store sensitive cryptographic information, such as secret cryptographic keys.

[0004] Some cryptographic operations can be categorized as symmetric or asymmetric. Symmetric cryptography uses the same key to encrypt and decrypt data. Asymmetric cryptography uses two keys. Data encrypted with one key must be decrypted with the other, and vice versa. Asymmetric cryptography is typically much slower than symmetric cryptography, in some cases by three to five orders of magnitude. Therefore, symmetric cryptography is generally preferred for high-speed or high-throughput cryptography-as-a-service applications.

[0005] Distributed cryptography using a shared secret is a technique that can be used to implement cryptography as a service. Instead of a single server computer performing cryptography for client computers, a distributed network of cryptographic devices (e.g., server computers) can collectively perform cryptography for client computers. Cryptographic materials, such as the secret key or shared secret, can be divided into secret shares and distributed among the cryptographic devices. Those cryptographic devices and client computers can then collectively perform encryption or decryption using their respective secret shares. Distributed cryptography offers security benefits compared to conventional cryptography because it is much more difficult for an attacker to obtain the shared secret. An attacker would have to obtain multiple secret shares to reconstruct the secret key or shared secret, or otherwise compromise the cryptographic system.

[0006] Although distributed symmetric cryptosystems are generally more secure than similar non-distributed systems, they remain vulnerable to attack. Hackers may attempt to compromise one or more cryptographic devices in a distributed symmetric cryptosystem to obtain their secret shares and / or damage the system. Cryptographic attacks are sometimes classified into different attack models. Some attacks are “static attacks,” while others are “dynamic attacks” or “adaptive attacks.” Many traditional distributed symmetric cryptographic systems are vulnerable to both dynamic and adaptive attacks.

[0007] Therefore, distributed symmetric encryption needs to be improved to cope with dynamic attacks.

[0008] Furthermore, distributed cryptography can suffer from latency issues when dealing with large amounts of data. This is because the client computer is communicating with each cryptographic device in the cryptographic array to obtain each data element the client computer wants to encrypt. Some existing solutions to this latency problem expose cryptographic keys or other cryptographic materials, increasing the risk of encrypted data being exposed.

[0009] Therefore, there is an additional need to improve distributed symmetric encryption to address latency or other performance issues, especially when dealing with large amounts of data. Summary of the Invention

[0010] Various implementations address improvements to distributed symmetric cryptography. Exemplary improvements may include protecting distributed symmetric cryptographic systems from adaptive cryptographic attacks. Such improved systems may include "Adaptive Anti-Attack Distributed Symmetric Encryption" or "AdapDiSE" systems. Implementations also provide improvements to the speed and efficiency of distributed symmetric cryptography, particularly by enabling client computers to generate symmetric cryptographic keys in batches. Such improved systems may include "Amortized Distributed Symmetric Encryption" or "AmorTiSE" systems.

[0011] In the implementation scheme, the client computer and multiple cryptographic devices from a network of cryptographic devices can work together to generate a symmetric cryptographic key. In the AdapDiSE system, the client computer can use this key to encrypt or decrypt messages (e.g., sensitive medical records). In the AmorTiSE system, the client computer can use this cryptographic key, or "batch key," to derive one or more message keys using pair-based cryptography and bilinear pairing. The client computer can use these message keys to encrypt a set of messages. For example, the client computer can encrypt multiple medical records corresponding to different patients, each encrypted using a different message key derived from the same batch key.

[0012] The obtained ciphertext can be stored locally on the client computer or on a storage server (e.g., a cloud server). Later, the client computer and cryptographic devices can decrypt the ciphertext to produce a message. In another use case, a client computer can send one or more ciphertexts to another client computer, or allow another client computer to access the ciphertexts via a storage server. The other client computer and cryptographic devices can then decrypt the ciphertexts and retrieve the message, thus enabling the message to be securely transmitted between client computers over insecure networks such as the Internet.

[0013] More specifically, during the encryption or decryption process, the cryptographic device may provide partial computations to the client computer. These partial computations can be derived from a secret share stored in each cryptographic device. The client computer can combine these partial computations to generate a symmetric encryption key. The client computer can use the symmetric key to encrypt messages or decrypt ciphertext, or derive one or more message keys for encrypting a set of messages.

[0014] In the AdapDiSE system, each cryptographic device can have multiple secret shares derived from different secret values. In some implementations, each cryptographic device can have a first secret share derived from a first secret value and a second secret share derived from a second secret value. Each cryptographic device can generate partial computations derived from each secret share (e.g., a first partial computation generated from the first secret share and a second partial computation generated from the second secret share). These partial computations can be combined and provided to a client computer, which can then use the partial computations to generate a cryptographic key.

[0015] The advantage of using multiple secret shares and multiple secret values ​​is that the distributed computation used to generate the cryptographic key is not tied to any particular set (or "tuple") of secret values ​​or secret shares. Instead, there exists an exponentially large number of secret values ​​and secret shares that could also have been used to generate the cryptographic key. Therefore, even if an attacker possesses unlimited computational resources, it is impossible for the attacker to determine the exact secret value or secret share. Thus, even when performing an adaptive attack, the attacker cannot determine the secret share. In contrast, in non-adaptive distributed cryptographic systems, distributed computation can be tied to a specific secret, allowing attackers to use adaptive attacks that may exploit correlations between different parts of the computation. As a result, an attacker may be able to obtain sensitive cryptographic material or otherwise compromise the non-adaptive cryptographic system.

[0016] Some implementations provide additional security features, such as using verification signatures to verify the legitimate use of the distributed cryptosystem, using log files to record or track the use of the distributed system, and using honest verifier zero-knowledge (HVZK) proofs to verify partial computations.

[0017] As an example, during AdapDiSE encryption, the client computer and the cryptographic device can generate partial signatures, which can be combined to form a verification signature. During decryption, the client computer can provide the verification signature to the cryptographic device. The cryptographic device can use a verification key to verify the verification signature. If the verification signature is valid, the cryptographic device can determine that the client computer is performing a legitimate decryption operation. The presence or absence of the verification signature can indicate to the cryptographic device, respectively, that the client computer is decrypting or encrypting a message. However, the client computer can also transmit an indicator to the cryptographic device indicating whether it is encrypting or decrypting data. The cryptographic device can log the indicator or verification signature in a log file as a record instructing the client computer to encrypt or decrypt messages.

[0018] Furthermore, the client computer can use HVZK proofs to verify partial computations transmitted by the cryptographic device. The client computer can retrieve checksums from a trusted server or its own memory. These checksums correspond to a secret share for each partial computation. Using these checksums, the client computer can verify that the partial computation is legitimate. The client computer cannot determine the secret share from the checksums or the partial computation. In this way, the secret share is even protected against attacks from malicious client computers.

[0019] One implementation relates to a method comprising, performed by a computer system: generating a first commitment using a message and a first hash function; generating a second commitment using the message and a second hash function; transmitting a request including the first commitment and the second commitment to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a first plurality of secret shares generated from a first secret value and a second plurality of secret shares generated from a second secret value; receiving a plurality of partial computations from the plurality of cryptographic devices, wherein each of the plurality of partial computations is generated by a corresponding cryptographic device among the plurality of cryptographic devices using a corresponding first partial computation and a corresponding second partial computation, wherein the corresponding first partial computation is generated using a corresponding first secret share and the first commitment, and wherein the corresponding second partial computation is generated using a corresponding second secret share and the second commitment; generating a cryptographic key based on the plurality of partial computations; generating ciphertext by encrypting the message using the cryptographic key; and generating a payload including the ciphertext, the first commitment, and the second commitment.

[0020] Another embodiment relates to a method comprising, performed by a computer system: receiving a payload comprising ciphertext, a first promise, and a second promise; transmitting a request comprising the first promise and the second promise to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a first plurality of secret shares generated from a first secret value and a second plurality of secret shares generated from a second secret value; receiving a plurality of partial computations from the plurality of cryptographic devices, wherein each of the plurality of partial computations is generated by a corresponding cryptographic device among the plurality of cryptographic devices using a corresponding first partial computation and a corresponding second partial computation, wherein the corresponding first partial computation is generated using a corresponding first secret share and the first promise, and wherein the corresponding second partial computation is generated using a corresponding second secret share and the second promise; generating a cryptographic key based on the plurality of partial computations; and decrypting the ciphertext using the cryptographic key to generate a message.

[0021] Another embodiment relates to a method comprising, performed by a cryptographic device: receiving a request from a client computer, the request including a first commitment generated using a message and a first hash function, and a second commitment generated using the message and a second hash function; generating a first partial computation based on a first secret share and the first commitment; generating a second partial computation based on a second secret share and the second commitment; generating a partial computation by combining the first partial computation and the second partial computation; and transmitting the partial computation to the client computer such that the client computer is able to: (1) generate a cryptographic key using the partial computation; (2) encrypt the message using the cryptographic key to generate ciphertext; and (3) generate a payload including the ciphertext, the first commitment, and the second commitment.

[0022] Another embodiment relates to a method comprising, performed by an encryption device: transmitting a request including an input value to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a plurality of secret shares generated from a secret value, wherein the input value includes an identifier corresponding to the encryption device or a hash corresponding to the identifier of the encryption device; receiving a plurality of partial computations from the plurality of cryptographic devices, wherein the plurality of partial computations are generated by the plurality of cryptographic devices using the plurality of secret shares and the input value; generating a bulk key based on the plurality of partial computations; and for each message in a set of messages: generating a commitment using the message and a random value; generating a hash of the commitment using the commitment and a second hash function; performing bilinear pairing between the bulk key and the hash of the commitment to obtain a message key; generating ciphertext by encrypting the message and the random value using the message key; and generating a payload including the ciphertext, an identifier corresponding to the encryption device, and the commitment, thereby generating a set of payloads for the set of messages.

[0023] Another embodiment relates to a method comprising being performed by a decryption device: receiving a payload including ciphertext corresponding to a message, a commitment, and an identifier corresponding to an encryption device; transmitting a request including one or more input values ​​to a plurality of cryptographic devices, each of the plurality of cryptographic devices storing a plurality of secret shares generated from secret values; receiving a plurality of partial computations from the plurality of cryptographic devices, wherein the plurality of partial computations are generated by the plurality of cryptographic devices using the result of the plurality of secret shares and the one or more input values ​​or bilinear pairings between the one or more input values; generating a message key based on the plurality of partial computations; and decrypting the ciphertext to obtain the message.

[0024] Another implementation relates to a method comprising, performed by a cryptographic device: receiving from an encryption device a request including an input value, wherein the input value includes an identifier corresponding to the encryption device or a hash corresponding to the identifier of the encryption device; generating a partial computation based on a secret share generated from a secret value and the input value; and transmitting the partial computation to the encryption device such that the encryption device is able to: (1) generate a bulk key using the partial computation; (2) for each message in a set of messages, generate a message key using the result of a bilinear pairing between the bulk key and a hash of a commitment generated from the message and a random value; (3) for each message in the set of messages, generate ciphertext by encrypting the message and the random value using the message key; and (4) for each message in the set of messages, generate a payload including the ciphertext, the identifier corresponding to the encryption device, and the commitment generated from the message and the random value, thereby generating a set of payloads for the set of messages.

[0025] These and other embodiments of this disclosure are described in detail below. For example, other embodiments relate to systems, devices, and computer-readable media associated with the methods described herein.

[0026] Before discussing specific embodiments of the present invention, some terms may be described in detail.

[0027] the term

[0028] A "server computer" can include a powerful computer or a cluster of computers. For example, a server computer can include a mainframe, a small cluster of computers, or a group of servers operating as a single unit. In one example, a server computer can include a database server coupled to a web server. A server computer can include one or more computing devices and can use any of a variety of computing architectures, arrangements, and compilations to serve requests from one or more client computers.

[0029] "Memory" can be any suitable one or more devices capable of storing electronic data. Suitable memory can include non-transitory computer-readable media that stores instructions executable by a processor to implement desired methods. Examples of memory can include one or more memory chips, disk drives, etc. Such memory can be operated using any suitable electrical, optical, and / or magnetic modes of operation.

[0030] "Processor" can refer to any suitable one or more data computing devices. A processor can include one or more microprocessors working together to achieve a desired function. A processor can include a CPU, which includes at least one high-speed data processor sufficient to execute program components for performing user and / or system-generated requests. The CPU can be a microprocessor such as AMD's Athlon, Duron, and / or Opteron; IBM and / or Motorola's PowerPC; IBM and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and / or XScale; and / or similar processors.

[0031] The term "cryptographic key" can include data used in encryption or decryption. For example, a cryptographic key can refer to the product of two large prime numbers. Cryptographic keys are used in cryptosystems such as RSA (Rivest, Shamir, Adleman) or AES (Advanced Encryption Standard) and can be used to encrypt plaintext and produce ciphertext output, or to decrypt ciphertext and produce plaintext output. Cryptographic keys can be symmetric, in which case the same key is used for both encryption and decryption, or they can be asymmetric, in which case different keys are used for both encryption and decryption.

[0032] The term "bulk key" can include data used in encryption or decryption. A bulk key can be used to generate one or more "message keys," which can correspond to cryptographic keys that can be used to encrypt or decrypt messages corresponding to those message keys.

[0033] The term "plaintext" can refer to unencrypted or plaintext text. For example, this can refer to text that can be read by a human or computer without any processing, such as the phrase "Hello, how have you been?" Numbers or other symbols may also be suitable as plaintext.

[0034] The term "ciphertext" can refer to text in an encrypted form. For example, it can refer to text that must be decrypted before it can be read by a human or computer. Ciphertext can be generated using any cryptographic algorithm or cryptographic system (such as RSA or AES).

[0035] "Client computer" can refer to a computer that uses services from other computers or devices, such as server computers. Client computers can connect to these other computers or devices via a network such as the Internet. As an example, a client computer may include a laptop computer that connects to an image hosting server to view images stored on the image hosting server.

[0036] A “cryptographic device” can refer to any device capable of performing cryptographic operations, including encryption and decryption. Cryptographic devices can participate in distributed or multi-party cryptography. Examples of cryptographic devices include server computers, hardware security modules, desktop computers, laptops, smartphones, smartwatches, or other portable electronic devices. Cryptographic devices can possess a “secret” or a “secret share.”

[0037] A "proxy device" can refer to a device that acts as a proxy. A proxy device can perform operations on behalf of other devices. For example, a proxy device can receive and transmit messages or other data on behalf of other devices. A proxy device used to route communication between other devices in a network of devices can be called a "hub device".

[0038] The term "multi-party computation" refers to a computation performed by multiple parties. Each party, such as a computer, server, or cryptographic device, may have some computational inputs. The parties can use these inputs to collaboratively compute the output of the computation.

[0039] The term "secure multi-party computation" can refer to secure multi-party computation. In some cases, "secure multi-party computation" means multi-party computation in which the parties do not share information or other inputs with each other. An example is Yao's Millionaires' problem, in which two millionaires want to determine who is richer without revealing their wealth to each other.

[0040] A "secret value" or "secret" can refer to a value or thing that is hidden as part of a cryptographic process. The security of a cryptographic process may depend on keeping a secret value hidden. A secret may include a cryptographic key or a "secret share." The exposure of a secret may allow parties other than the intended recipients to encrypt or decrypt messages.

[0041] A "shared secret" can refer to a secret value or thing shared among multiple parties. For example, a shared secret could be a cryptographic key that is divided so that each of the multiple parties possesses a portion of the key. As an example, each party could possess 64 bits of a shared secret that includes a 128-bit cryptographic key.

[0042] A "secret share" can refer to a value derived from a shared secret. As an example, a secret share can include the first 64 bits of a 128-bit secret value. A secret share can also include a secret value combined with numbers or other data. In some cases, multiple secret shares can be combined to reproduce a shared secret.

[0043] A hash function can refer to any function that can be used to map data of arbitrary length or size to data of fixed length or size. Hash functions can also be used to obfuscate data by replacing it with its corresponding hash value. Hash functions can be used to generate "commitment" or "commitment message" data that can be used to assess the integrity of encrypted data.

[0044] A "commitment" or "commitment message" can refer to data that can be used to verify that an action has been committed to. In the context of cryptography, a commitment can refer to a message that can be used to verify that an encrypted message has not been tampered with. Before the message is encrypted, a commitment can be generated based on the message, for example, via a hash function. This commitment can be sent along with the encrypted message. Once the message is decrypted, the recipient can use the same hash function to generate their own commitment message. The received commitment message can be compared with the generated commitment message to verify the integrity of the encrypted message.

[0045] A "pseudo-random function" can refer to a deterministic function that produces seemingly random outputs. Pseudo-random functions can include collision-resistant hash functions and elliptic curve groups. A pseudo-random function approximates a random oracle and is an ideal cryptographic primitive that maps an input to a random output in its output domain. Pseudo-random functions can be constructed using a pseudo-random number generator.

[0046] A "random number" or "cryptographic random number" can refer to a value (e.g., a number) that can be used in a cryptographic process, preferably a finite number of times. A random number can be derived, wholly or partially, from other data such as a hash value or commitment. A "random number" can include numbers that have been generated randomly or pseudo-randomly and can be used in conjunction with a cryptographic hash function. Using random numbers can prevent certain forms of cryptographic attacks, such as "replay attacks."

[0047] The term "bilinear pairing" can refer to a function that maps inputs from two mathematical groups to a third mathematical group. e It is bilinear (i.e.) It is non-degenerate and can be computed in an efficient manner. Weil pairing and Tate pairing are examples of bilinear pairings.

[0048] A "zero-knowledge proof of knowledge by an honest verifier" (also known as an HVZK proof) can refer to a zero-knowledge proof of knowledge performed by an honest verifier entity. An honest verifier entity is an entity (e.g., a client computer) that participates in a cryptographic protocol non-maliciously (e.g., without altering its inputs or outputs) and in accordance with the protocol rules. HVZK proofs can be used to verify the legitimacy of information (such as a secret share) without requiring any other information about that information.

[0049] A "verification value" can refer to data used to verify calculations, facts, or knowledge. An example of a verification value is a non-interactive zero-knowledge proof of knowledge, as discussed above. Another example of a verification value is a cryptographic key. As an example, a private cryptographic key can be used to verify the identity of a person or computer possessing that key by signing or encrypting data using that private cryptographic key. A verification value that includes a cryptographic key can be called a "verification key".

[0050] A "validation share" can refer to a portion of a validation value or data derived from a validation value. Multiple validation shares can be combined in a certain way to produce a corresponding validation value. For example, the product of a set of validation shares may equal the corresponding validation value.

[0051] "Signature," "digital signature," or "signature verification" can refer to data used to verify the authenticity of data using cryptography. A computer can digitally sign data by encrypting it using a cryptographic key (i.e., a private key) known only to that computer. Other computers can verify the signature by decrypting the data using a publicly known cryptographic key corresponding to that computer (i.e., a public key). Signature verification can be used to verify the origin or authenticity of signed data.

[0052] A "partial signature" can refer to a portion of a digital signature. A partial signature can be used to reconstruct a digital signature when combined with other partial signatures. For example, the XOR of multiple partial signatures can be used to reconstruct a digital signature.

[0053] "Partial computation" can refer to a portion of a computation. Multiple partial computations can be combined to produce the output of a computation. For example, the volumes of multiple solids can include partial computations of the total volume of those solids, and these partial computations can be combined by addition. Partial computations can be generated by multiple parties or cryptographic devices participating in multi-party computations.

[0054] A "message" can refer to any data that can be transmitted between two entities. A message can include plaintext or ciphertext data. A message can include alphanumeric sequences (e.g., "hello123") or any other data (e.g., an image or video file). Messages can be transmitted between computers or other entities.

[0055] "Payload" refers to the information in the transmitted message. The payload excludes automatically generated metadata. A payload may include multiple data elements. For example, a payload corresponding to human vital statistics may include three data values ​​corresponding to a person's weight, height, and age.

[0056] A "key generation seed" can refer to a value or other data used to generate a cryptographic key. For example, a key generation seed can be a number, such as "12034024". The key generation seed can be used as input to a random or pseudo-random function to generate a cryptographic key. The key generation function can be consistent; that is, the same key generation seed generates the same cryptographic key.

[0057] A "log file" can be a data file that stores records of information. For example, a log file can include usage records of a specific service (such as distributed cryptography). Log files can include additional information such as the time associated with the use of the service, the identifier associated with the client using the service, and the nature of the service use (e.g., whether the client is encrypting or decrypting data). Attached Figure Description

[0058] Figure 1 A system block diagram of an exemplary distributed symmetric cryptography system according to some implementation schemes is shown.

[0059] Figure 2 A system block diagram of an exemplary client computer according to some implementation schemes is shown.

[0060] Figure 3 A system block diagram of an exemplary cryptographic device according to some implementation schemes is shown.

[0061] Figure 4 A system block diagram of an exemplary secret share and verification share provision system according to some implementation schemes is shown.

[0062] Figure 5 A sequence diagram of an exemplary process for providing secret shares and verification shares according to some implementation schemes is shown.

[0063] Figure 6A A hybrid sequence diagram of the first part of an exemplary method for adaptive attack-resistant distributed symmetric encryption according to some implementation schemes is shown.

[0064] Figure 6B A hybrid sequence diagram of the second part of an exemplary method for adaptive attack-resistant distributed symmetric encryption according to some implementation schemes is shown.

[0065] Figure 7A A hybrid sequence diagram of the first part of an exemplary method for adaptive attack-resistant distributed symmetric decryption according to some implementation schemes is shown.

[0066] Figure 7B A hybrid sequence diagram of the second part of an exemplary method for adaptive attack-resistant distributed symmetric decryption according to some implementation schemes is shown.

[0067] Figure 8AA mixed sequence diagram of the first part of an exemplary method for amortized distributed symmetric encryption according to some implementation schemes is shown.

[0068] Figure 8B A hybrid sequence diagram of the second part of an exemplary method for amortized distributed symmetric encryption according to some implementation schemes is shown.

[0069] Figure 9A A mixed sequence diagram of the first part of an exemplary method for amortized distributed symmetric decryption according to some implementation schemes is shown.

[0070] Figure 9B A hybrid sequence diagram of the second part of an exemplary method for amortized distributed symmetric decryption according to some implementation schemes is shown.

[0071] Figure 10 A hybrid sequence diagram of methods for updating secret shares in the AmorTiSE system is shown.

[0072] Figure 11 An exemplary computer system according to some implementation schemes is shown. Detailed Implementation

[0073] I. Introduction

[0074] Some implementations involve improvements to distributed symmetric cryptography, including distributed symmetric encryption-as-a-service and distributed symmetric decryption-as-a-service. Some implementations are associated with the "AdapDiSE" system, which can use multiple distinct secret values ​​and multiple distinct secret shares derived from those secret values. As explained further below, the use of multiple secret shares can make distributed symmetric cryptosystems resistant to adaptive attacks.

[0075] Some implementations are associated with the "AmorTiSE" system, which uses bilinear pairing and message keys derived from a bulk key. In distributed symmetric cryptography, keys are generated from a distributed pseudo-random function (described in more detail in Section II) to encrypt or decrypt messages. This can be inefficient when the client computer has a large number of messages to encrypt, such as when the client has a large dataset or is attempting to encrypt a data stream, because the client computer and the cryptographic device must execute the distributed pseudo-random function protocol for each message the client computer wants to encrypt. This problem becomes more severe when the client computer and the cryptographic device are far apart, resulting in large cumulative latency delays. To address this, the client computer and the cryptographic device can execute a single instance of the distributed pseudo-random function protocol to generate a bulk key. The client computer can then independently generate any number of message keys based on the bulk key. As a result, the number of communications with the cryptographic device is reduced, increasing the speed and efficiency of the encryption process.

[0076] In some implementations, client computers and multiple cryptographic devices in a network of cryptographic devices can work together to encrypt messages or decrypt ciphertext. Not all cryptographic devices in the network need to participate; only a threshold number are required. For example, in a network with ten cryptographic devices, perhaps only seven need to participate. This property can be referred to as "…". n Winning t (For example, taking 7 out of 10) Threshold authentication encryption. The client computer and multiple cryptographic devices can execute a protocol corresponding to a distributed pseudo-random function to generate an output value. The client computer can use this output value to generate a cryptographic key for encrypting messages or decrypting ciphertext. However, the distributed pseudo-random function protocol and key generation process can vary in the AdapDiSE and AmorTiSE systems. These two systems, which can be combined, will be described in more detail below.

[0077] A.AdapDiSE

[0078] During distributed symmetric encryption, a client computer can generate a first promise and a second promise using a first hash function, a second hash function, a message, and an optional random value. The first promise may include a hash of the message (or the message and a random value) generated using the first hash function. The second promise may include a hash of the message (or the message and a random value) generated using the second hash function. The client computer may select hash functions from a plurality of hash functions, for example, using a random selection process, before generating the first and second promises. The client computer may select multiple cryptographic devices to participate in the distributed symmetric encryption operation and may transmit promises to these participating cryptographic devices.

[0079] Each cryptographic device may store multiple secret shares used in distributed symmetric cryptography. Optionally, the cryptographic device may also store verification shares. In some implementations, each cryptographic device may store a first secret share and a second secret share. The first secret share can be derived from a first secret value, and the second secret share can be derived from a second secret value. Each participating cryptographic device can use a first commitment and the corresponding first secret share to generate a corresponding first partial computation. Similarly, each participating cryptographic device can use a second commitment and the corresponding second secret share to generate a corresponding second partial computation. Participating cryptographic devices may each generate a partial computation by combining their respective first and second partial computations (e.g., by calculating the product of the first and second partial computations).

[0080] Optionally, the cryptographic device may generate multiple partial signatures using a first promise and / or a second promise, along with their respective verification shares. These verification shares may correspond to or be derived from a verification value. The client computer may combine the partial signatures to generate a verification signature. Later (e.g., during a decryption operation), the client computer may provide the verification signature to the cryptographic device. The cryptographic device may use the verification signature to verify the legitimacy of the client computer's request.

[0081] After generating multiple partial computations, the participating cryptographic devices can transmit these computations (and optionally, multiple partial signatures) to the client computer. The client computer can combine or otherwise use the partial computations to generate a cryptographic key, and combine the partial signatures to generate a verification signature. The client computer can use the cryptographic key to encrypt a message to produce ciphertext, and then generate a payload that includes the ciphertext and other information (e.g., first and second commitments, random values ​​used to generate the first and second commitments, verification signature, hash identifier, etc.). The hash identifier can be used to identify the first and second hash functions used to generate the first and second commitments, respectively.

[0082] The client computer can perform additional steps during the decryption process, such as verifying partial computations received from the cryptographic device. The client computer can verify these partial computations using checksums corresponding to the secret shares used to generate them. This verification can be performed using HVZK proofs.

[0083] To decrypt the ciphertext, a client computer (which may be the same client computer that encrypted the message or different client computers) may transmit a first and second promise (and optionally, a verification signature) to multiple additional cryptographic devices. These additional cryptographic devices may also include a threshold number of cryptographic devices. No single, some, or all of the additional cryptographic devices may be the same as the multiple cryptographic devices involved in the encryption. Each of the multiple additional cryptographic devices may possess a first secret share, a second secret share, a verification share, and a verification key. The verification key may include a public key corresponding to the verification value, which includes the private key.

[0084] Optionally, multiple cryptographic devices can be attached to verify the signature using a verification key. If the signature is valid, the attached cryptographic devices can generate additional partial computations and transmit these computations to the client computer. The client computer can use these computations to generate a cryptographic key, which is then used to decrypt the ciphertext and generate a message. In these ways, the client computer and cryptographic devices can perform distributed symmetric decryption.

[0085] B.AmorTiSE

[0086] In the AmorTiSE system, during distributed symmetric encryption, a client computer may possess a set of messages that it (or its operator) wants to encrypt. The client computer can generate the input value (i.e., the hash) using a first hash function and an identifier corresponding to the client computer. The client computer can select multiple cryptographic devices to participate in the distributed symmetric encryption operation and can transmit the input value to the participating cryptographic devices.

[0087] Each cryptographic device can store a secret share used in distributed symmetric cryptography. Each participating cryptographic device can use the input value and its respective secret share to generate partial computations, thereby generating multiple partial computations. The participating cryptographic devices can transmit the multiple partial computations to the client computer. The client computer can combine or otherwise use the multiple partial computations to generate a bulk key.

[0088] The client computer can generate a commitment for each message in the message set it wants to encrypt. Then, for each message, the client computer can generate a message key using bilinear pairing, a bulk key, and the commitment. The client computer can use each of these message keys to encrypt its respective message, generating a set of ciphertexts. The client computer can generate a payload corresponding to each ciphertext, including the ciphertext, an identifier corresponding to the client computer, and the commitment, thus generating a set of payloads. These payloads can be stored locally, transferred to a storage server for storage, or transferred to another client computer.

[0089] To decrypt the ciphertext, the client computer (which can be the same client computer that encrypted the corresponding message or different client computers) can first retrieve the payload corresponding to the ciphertext. The client computer can generate a random number using bilinear pairings, identifiers, and commitments. This random number can be transmitted to multiple additional cryptographic devices (e.g., cryptographic devices including a threshold number). No single additional cryptographic device, some additional cryptographic devices, or all additional cryptographic devices can be the same as the multiple cryptographic devices involved in the encryption. Each of the multiple additional cryptographic devices can possess a secret share.

[0090] Multiple cryptographic devices can be appended to generate multiple appended computations using random numbers and their respective secret shares. These appended computations can be transmitted to a client computer. The client computer can combine these appended computations to generate a message key, and then use that message key to decrypt the ciphertext, thereby producing the message.

[0091] C. Password attack

[0092] Before describing the implementation scheme in more detail, it may be helpful to briefly outline static, dynamic, and adaptive attacks. In a static attack, an attacker attempts, or may succeed in, compromising one or more cryptographic devices simultaneously (or nearly simultaneously) at a single moment. However, attackers typically attempt to compromise devices multiple times over a period of time.

[0093] In contrast, in dynamic attacks, an attacker may attempt or successfully compromise one or more cryptographic devices over a period of time. An attacker might compromise a single cryptographic device, use that device to participate in cryptographic operations, then compromise another cryptographic device, and so on. Adaptive attacks are a variant of dynamic attacks in which the attacker adjusts or modifies their attack behavior over a period of time. For example, an attacker might use information gathered during cryptographic operations to modify their attack behavior.

[0094] For example, in a distributed cryptographic system comprising four cryptographic devices "A", "B", "C", and "D", an attacker can first attack and compromise cryptographic device "A". The compromised cryptographic device "A" can then participate in distributed cryptographic operations (without revealing its compromised nature). Later, the attacker can choose to attack device "B", "C", or "D" based on the results of these cryptographic operations.

[0095] Typically, attackers have greater flexibility in adaptive attacks than in static attacks. This gives adaptive attackers a relative advantage compared to static attackers. Therefore, adaptive attacks are more likely to successfully breach distributed symmetric cryptographic systems than static attacks. Furthermore, while some distributed symmetric cryptographic systems have been proven secure against static attacks, they cannot be proven secure against dynamic attacks. This potential vulnerability could allow attackers or other malicious entities to obtain and decrypt sensitive encrypted information (e.g., medical records or financial information).

[0096] However, as mentioned above, the AdapDiSE system uses multiple distinct secret shares stored on the cryptographic device to perform distributed symmetric cryptography. The use of multiple secret shares is a security improvement over traditional distributed symmetric cryptosystems because it protects distributed symmetric cryptosystems from adaptive attacks. By generating and combining multiple partial computations using multiple independent secret shares, the cryptographic device protects those secret shares from being determined by an adaptive attacker. This might not be the case in distributed cryptosystems, where each cryptographic device possesses only a single secret share. When only a single secret share is used to generate partial computations, an adaptive attacker might be able to identify correlations from the partial computations because only one secret can produce said partial computation. In contrast, when multiple secret shares are used to generate partial computations, there could be an exponential number of first and second secret share pairs that could produce the same partial computation. As an analogy, equations... X + 2 = 7 There is only one solution ( X = 5 ), and the equation X + Y + 2 = 7 for( X, Y The system has infinitely many solutions because it is an underdetermined system (i.e., the number of equations in the system is less than the number of variables). The first equation is analogous to the case where each cryptographic device has only a single share of the secret, while the second equation is analogous to the case where each cryptographic device has two shares of the secret.

[0097] Some implementation schemes are described in more detail below with reference to the figures. Concepts such as secret sharing, distributed pseudo-random functions, and bilinear pairing will be introduced in Section II. References Figure 1 An exemplary distributed cryptographic network is described in Section III. (Reference) Figure 2 An exemplary client computer is described in Section III. (Reference) Figure 3 An exemplary cryptographic device is described in Section III. (Reference) Figure 4 and Figure 5 Exemplary systems and methods for distributing secret shares are described in Section IV. (References) Figure 6A , Figure 6B , Figure 7A and Figure 7B A method for adaptive, attack-resistant distributed symmetric cryptography is described in Section V. (Reference) Figure 8A , Figure 8B , Figure 9A and Figure 9B Methods for amortizing distributed symmetric cryptography are described in Section V. (See references) Figure 10 Section VI describes methods and systems for updating the secret share in amortized distributed symmetric cryptography. (References) Figure 11 Computer systems are described in Section VII.

[0098] II. Overview of Distributed Symmetric Cryptography

[0099] Both AdapDiSE and AmorTiSE systems implement distributed symmetric cryptography using various distributed pseudorandom functions. As mentioned above, each cryptographic device can possess one or more secret shares and a verification share. These secret and verification shares can be derived from the secret and verification values, respectively. During the execution of the distributed pseudorandom function, the cryptographic devices use their respective secret shares and one or more input values ​​(e.g., a promise or a hash of a promise) provided by the client computer to generate partial computations sent to the client computer. The client computer combines these partial computations to compute the output of the pseudorandom function. This output can be used to derive a cryptographic key (in AdapDiSE) or a bulk key for encrypting messages, which can be used to derive message keys (AmorTiSE) using bilinear pairing. These message keys can be used to encrypt a set of messages. The following subsections describe some concepts used to implement AdapDiSE and AmorTiSE in more detail.

[0100] A. Secret Shares and Verified Shares

[0101] As mentioned above, secret shares can be derived from a shared secret (also known as a secret value). Secret shares can be used to perform cryptographic operations. For example, secret shares can be used to generate cryptographic keys. Secret shares can be combined in some ways to reproduce the shared secret from which those secret shares were derived. In some cryptographic applications, using secret shares may be preferable to using a single secret value because a malicious user would have to steal multiple secret shares to copy and obtain the shared secret. In contrast, in non-distributed cryptographic systems, a malicious user only needs to steal a single secret value to obtain the shared secret.

[0102] A verification share can be similar to a secret share. A verification share can correspond to a verification value, similar to how a secret share corresponds to a secret value. Verification shares can be combined in some way to reproduce the verification value. In some implementations, methods for generating, distributing, or combining verification shares can also be used to generate, distribute, or combine verification shares.

[0103] The verification share can be used to generate a verification signature, which can be used to verify distributed symmetric cryptographic operations. As an example, in some implementations, the cryptographic device verifies the verification signature during distributed symmetric decryption. The presence of the verification signature indicates to the cryptographic device that the client computer is performing a decryption operation.

[0104] Secret shares and verified shares can have several useful optional attributes. One such attribute is " n Winning t "Attribute. This attribute indicates the total..." n In a secret share or verified sharet One secret share or verification share is sufficient to reproduce the secret value or verification value. Which secret shares are used to reproduce the secret value may not be important; only a minimum is required. t A secret share.

[0105] There are many technologies that can be used to implement secret sharing, especially n Winning t Secret sharing. The Shamir secret sharing scheme is a non-limiting example discussed below. However, other suitable secret sharing techniques are equally applicable (e.g., the Blakley scheme, the Chinese Remainder Theorem, etc.).

[0106] Typically, Shamir secret sharing involves encoding a secret value (or, alternatively, a verification value) into a polynomial. P(x) = a 0 + a 1 x + a 2 x 2 + … + a k x k The coefficients. Secret shares or verification shares may include differences in the polynomial (pairing). x , P(x) (Value). A shared secret or verified value can be obtained from a secret share or a verified share by interpolating the polynomial using a secret share or a verified share. Lagrange interpolation is one such method.

[0107] k polynomial of degree P ( x ) can include k +1 coefficient a 0 , a 1 … a k While the secret value or verification value can be encoded as any coefficient, it is sometimes preferable to encode the secret value or verification value as a zero-order coefficient. a 0 In the middle. This can be achieved by using a secret value or a verification value as a polynomial. P ( x coefficients in ) a 0 To encode the secret value or verification value into zero-order coefficientsa 0 Other coefficients can be selected in any appropriate manner (e.g., randomly). a 1 , a 2 … a k The value of the secret value. S Encoded into zero-order coefficients a 0 In the middle, then in x = Polynomial estimated at 0 P ( x This is equivalent to sharing a secret, that is... P (0) = a 0 = S .

[0108] Shamir Secret Sharing requires... k +1 unique point to uniquely define k polynomial of degree P ( x The fact that... Once... P ( x If it is uniquely defined, then it can be in x Specific values ​​(e.g., x = 0) estimation P ( x ), in order to determine the secret value. Therefore, k +1 represents the minimum or threshold number of points required to interpolate the polynomial and determine the secret or verification value. t When secret shares are distributed to multiple cryptographic devices, in order to reach a threshold number of secret shares, at least a threshold number... t Those cryptographic devices must participate.

[0109] Furthermore, because the secret value (or verification share) comprises points on a polynomial (which can be infinitely many), Shamir's secret sharing can provide an arbitrarily large number of secret shares for any given threshold. This means that for any given threshold, a network of cryptographic devices can have an arbitrarily large number of cryptographic devices.

[0110] As described above, in some embodiments, the cryptographic device may have a first secret share and a second secret share derived from a first secret value and a second secret value, respectively. This can be achieved by encoding the first secret value into a first polynomial. P 1 ( x And encode the second secret value into the second polynomial. P 2 ( xIn (as described above), then for P 1 ( x Sampling is performed to generate points that include the first secret share, and... P 2 ( x Sampling is performed to generate points that include the second secret share. A polynomial can be used... x Any value ( x = Sampling is performed at (excluding 0), provided that no two cryptographic devices receive the corresponding... x The same secret share of the same value.

[0111] One technique that can be used is to use a unique serial number or device identifier corresponding to a specific cryptographic device as... x The value. The cryptographic device with serial number "18723" can receive values ​​including (18723, ...). P (18723)) secret share ( x , P ( x The cryptographic device with serial number "99123" can receive data including (99123, ...). P (99123)) secret share. Because the serial number or device identifier is unique, it is guaranteed that two cryptographic devices have different secret shares.

[0112] B. Lagrange interpolation

[0113] Lagrange interpolation is an interpolation technique used to determine polynomials based on sampled values. P(x) And therefore, the secret value (or verification value). S Lagrange interpolation can be used to determine, and the Lagrange interpolation can be used to include pairing ( x j , P ( x j The secret share or verification share of the value and the polynomial P ( x Related to (). The above refers to () x j , P ( x j The j-th secret share corresponds to the 1 / j-th secret share. The Lagrange form of the polynomial is given by the following formula:

[0114] (1)

[0115] in l j ( x) is the j-th Lagrange polynomial (i.e., corresponding to the j-th secret share). Lagrange polynomial l j ( x It is defined by the following formula:

[0116] (2)

[0117] in x j It corresponds to the j-th secret share (or verification value). x Value, and x p It is the first p Secret share (or verification value) x value.

[0118] because P (0) equals the zeroth order coefficient a 0 Therefore, if the secret value or the verification value S Encoded to a 0 In the middle, it can be done by substitution. x = 0 to simplify the above formula:

[0119] (3)

[0120] (4)

[0121] Shamir secret shares can be used to distribute secret shares or verification values ​​to multiple cryptographic devices. These secret shares or verification shares can include pair values ​​( x j , P ( x j The unique point given. Using these secret shares or verification values ​​of the threshold number, the Lagrange multiplier can be calculated. l j and its value P ( x j Used together to determine the secret value (or verification value) S As shown above.

[0122] It is worth noting that the Lagrange coefficient l j Only depends on the corresponding cryptographic device x Value. As mentioned above, xThese values ​​can include a unique serial number or identifier corresponding to each cryptographic device, and therefore can be known before any polynomial is generated. Thus, the Lagrange coefficients corresponding to each cryptographic device can be pre-calculated. l j .

[0123] Furthermore, because of the Lagrange coefficient l j Independent of any polynomial P ( x Therefore, a single Lagrange coefficient can be used for multiple different polynomials. P 1 ( x )and P 2 ( x As a result, the individual Lagrange coefficients l j It can correspond to a cryptographic device that has any number of secret shares derived from any number of different secret values.

[0124] Using Shamir secret sharing, the secret or verification value can be reconstructed regardless of which secret or verification share is used. Therefore, different cryptographic devices can participate in distributed cryptographic operations each time and still produce the same shared secret or verification value. However, to protect or obfuscate the secret or verification value, it is sometimes better to generate a value from the shared secret or verification value, rather than the secret or verification value itself. This can be achieved using distributed pseudo-random functions, as described below.

[0125] C. Pseudo-random and distributed pseudo-random functions

[0126] A pseudo-random function is a function that produces an output where the relationship between the input and the output appears random. The advantage of using pseudo-random functions is that the input is difficult to determine given the output, and therefore pseudo-random functions can be used with fuzzy inputs.

[0127] In the hypothetical cryptographic application, the secret value S It can include a cryptographic key. When and if the secret value S From its composition secret share s 0 、s 1 …s t If the shared secret is reconstructed, it can be used to encrypt or decrypt data. However, this may be undesirable because the reconstructed secret could be stolen and used by malicious actors. Instead, it is better to use the shared secret as input to a pseudo-random function, and then use the output of the pseudo-random function to generate the cryptographic key. In this way, the secret value... SIt will not be exposed to attackers or other malicious users.

[0128] A distributed pseudorandom function can refer to a pseudorandom function that can be computed in a distributed manner. As an example, multiple cryptographic devices can compute multiple parts of the computation. These parts can be combined to produce the output of a pseudorandom function. Combinations of these parts can be equivalent to the output of a corresponding non-distributed pseudorandom function (e.g., a function where a single cryptographic device directly produces the output of a pseudorandom function).

[0129] Any seemingly random and consistent pseudo-random function can be used as the basis for a distributed pseudo-random function. Notable examples of pseudo-random functions are hash functions, the Advanced Encryption Standard (AES) cryptosystem, and elliptic curve cryptography. Elliptic curve cryptography will be described below for the purpose of illustrating some implementation schemes; however, it should be understood that any suitable pseudo-random function can be used to implement such schemes.

[0130] Elliptic curves satisfy the equation y 2 = x 3 + ax + b Any curve over a finite field. Elliptic curve cryptography is typically performed using elliptic curves over finite fields. An example of a finite field is an integer modulo... p ,in p It is a prime number. (Integer modulo) p Including from 0 to p -1 for every integer. Elliptic curve groups can be derived from their order. q The order is defined as the number of elements in the group. The decisional Diffie-Hellman hypothesis holds for these elliptic curve groups.

[0131] Like many other cryptosystems, elliptic curve cryptography relies on a mathematical problem with a computationally infeasible solution. Currently, there is no efficient solution to the "elliptic curve discrete logarithm problem" for elliptic curve cryptography. Given the origin of the elliptic curve... A and the product point on the elliptic curve C Determine the multiplicand point B So that the dot product method A B = C Establishing it is extremely difficult. The actual result is that as long as... B If kept secret, the message can be converted into points. A And with point B Perform a dot product to produce the product point. C .

[0132] The decisional Diffie-Hellman hypothesis states that, in the case of generators g prime order p multiplication group G In, for random and independent a and b ,value g a , g b and g ab They all seem to be from the group G The randomly selected element. In other words, it is difficult to determine. g a , g b and g ab The multiplication relationship between them (i.e., g ab equal g a and g b (product).

[0133] In fact, two points on an elliptic curve can be multiplied to produce a third point, and the relationship between the two points and the third point appears to be random. Therefore, if a value can represent a point, that value can be multiplied by another value to produce a third value, and the relationship between these three values ​​appears to be random. Thus, elliptic curves can be used as the basis for pseudo-random functions in distributed pseudo-random functions.

[0134] D. Bilinear pairing

[0135] Some implementations of amortized distributed symmetric encryption can use pairwise cryptography, particularly bilinear pairing, to generate message keys for encrypting messages or decrypting corresponding ciphertext. After deriving a bulk key using a distributed pseudo-random function, the client computer can use the bulk key to derive a message key using bilinear pairing. This message key can then be used to encrypt messages. Similarly, during decryption, the client computer can use bilinear pairing to generate random numbers, which can be used as input to a distributed pseudo-random function to generate a message key. This message key can then be used to decrypt the corresponding ciphertext.

[0136] Bilinear pairing Will come from two groups G 0 and G 1 The input is mapped to the third group G TIn implementation schemes, these groups may include prime numbers in which the decisive Diffie-Hellman assumption holds. p The multiplicative cyclic group. This bilinear pairing. e It can be valid, computable, and non-degenerate.

[0137] For bilinear pairing e And for G 0 any P and G 1 In Q : This property allows consistent message keys to be generated from a batch key (generated from a distributed pseudo-random function) or directly from a distributed pseudo-random function. This allows a client computer to derive multiple message keys during the encryption of multiple messages and a single message key during the decryption of the ciphertext.

[0138] As an example, a client computer can use a distributed pseudo-random function to derive a bulk key. bk The client identifier Hash H 0 ( id ) as input, where H 0 It maps the input to G 0 The hash function. Then the batch key. bk = H 0 ( id ) S ,in S It is used to export secret shares. s 0 ...s n The secret value. Client computers can use bulk keys. bk The message promise hash of the bilinear pairing and random value h i = Com( m i || r i ),Right now H 1 ( h i )(in H 1 It maps the input to G 1 (hash function) to calculate the hash of the message m i Corresponding message key mk .Then (Through the bilinear properties mentioned above). Then, the message key. mk Can be used to encrypt messages m i To generate ciphertext c i This ciphertext c i It can be stored, for example, on a storage server, for later decryption.

[0139] Subsequently, the client computer can retrieve the ciphertext. c i And communicate with cryptographic devices to verify the ciphertext. c i Perform distributed pseudo-random decryption. The client computer can use a hash including the client identifier. H 0 ( id Hash of promises H 1 ( h i Random numbers of a bilinear mapping. μ Transmit to the cryptographic device, instead of the client identifier. H 0 ( id The hash of ) is transmitted to the cryptographic device, that is: So the result of the distributed pseudo-random function is... Message key mk Then it can be used to decrypt ciphertext. c i To generate messages m i In this way, bilinear pairing can be used to derive a consistent symmetric message key, which is used to encrypt messages and decrypt ciphertext.

[0140] E. Application

[0141] In some implementations, elliptic curve cryptography can be used in a distributed manner to encrypt values, which can then be used as cryptographic keys, or alternatively, to generate cryptographic keys. These values ​​may include cryptographic commitments, which in turn may include hash data. In some implementations, corresponding to adaptive attack-resistant encryption, the client computer and cryptographic device can use distributed elliptic curve cryptography to encrypt the first commitment using multiple secret shares. H 1 ( m ) and second commitment H 2 ( m (That is, corresponding to the input message)m (The hash value). These cryptographic commitments can be called partial computations. As shown below, partial computations can be combined to produce a result using the first secret value. S 1 The First Promise of Encryption H 1 ( m An equivalent value, and the value obtained by using the second secret value. S 2 The Second Promise of Encryption H 2 ( m The equivalent second value proves that elliptic curve cryptography can be used as a distributed pseudo-random function.

[0142] In some implementations corresponding to amortized distributed symmetric encryption, the client computer and cryptographic device can alternatively encrypt the client identifier. id The commitment (i.e., H ( id Instead of a commitment to encrypt input messages. H ( m This cryptographic commitment can be used to generate message keys, which can be used to encrypt individual messages using, for example, bilinear pairing as described further below. m 1 ...m n .

[0143] item H n ( m ) Sn This can be used to represent the use of elliptic curve cryptography. n Secret Value S n Encrypted n promise H n ( m (For example, a first promise encrypted using a first secret value or a second promise encrypted using a second secret value). The item This can be used to represent partial calculations, which include the use of the first... n promise s n,i, The corresponding number i The secret share encryption of the first n promise H n ( m In elliptic curve cryptography, H n ( m ) Sn Equivalent to the first n promiseH n ( m (and itself) S n Second, and partial calculation Equivalent to the first n promise H n ( m (and itself) s n,i Each hash function. H n Inputs can be mapped to different groups of output values, such as different addition or multiplication cyclic groups. For example, the first hash function... H 0 The input can be mapped to a multiplication loop group. G 0 ,Right now Second hash function H 1 The input can be mapped to a multiplication loop group. G 1 ,Right now ,etc.

[0144] H ( m ) Sn and The relationship between them can be shown using formula (4): (5)

[0145] in s n,i It corresponds to the first n The secret value of the first i Secret share, and λ i It corresponds to the first i The first cryptographic device i Lagrange coefficients (see formula (3)). Therefore, using the first... n Secret Value S n Encrypted n Commitment (i.e., H n ( m ) Sn This is equivalent to encrypting with a secret share and using the Lagrange multiplier to the power of the first digit. n Product of commitments This demonstrates one way that Shamir secret sharing and elliptic curve cryptography can be used together to implement distributed pseudo-random functions.

[0146] Furthermore, since a set of Lagrange coefficients can be used for any number of polynomials, partial computations corresponding to different commitments and secret shares can be combined before computing the distributed pseudo-random function. For example, the first and second partial computations can be combined by computing the product of the two partial computations:

[0147] (6)

[0148] in Is using the corresponding number i The first secret share of the cryptographic device encrypts the first promise, and Is using the corresponding number i The second secret share of the cryptographic device is encrypted with a second promise.

[0149] Use this combination to replace part of the calculation in equation (5). produce:

[0150]

[0151]

[0152]

[0153] Therefore, the output of a distributed pseudorandom function with multiplied partially combined inputs (e.g., as in equation (6)) is equivalent to the product of the partially combined outputs. Furthermore, the first secret value... S 1 Second secret value S 2 Blurred by this product. Knowing the first commitment. Second commitment Sum of products The value is insufficient to determine the first secret value. S 1 Or the second secret value S 2 Because, given the first and second commitments, there exists an infinite number of possible products. S 1 , S 2 Yes. In this way, the secret value and the secret share are even protected from adaptive attackers.

[0154] In some implementations, the client computer can use the output of a distributed pseudo-random function to generate cryptographic keys that can be used for encryption and decryption. Assuming a consistent commitment is used for both encryption and decryption, the same cryptographic key can be generated and used to encrypt messages and decrypt corresponding ciphertext.

[0155] In summary, in the context of some implementations, each cryptographic device can possess one or more secret shares corresponding to different secret values. In amortized distributed symmetric cryptography, each cryptographic device can possess one secret share. In adaptive attack-resistant distributed symmetric cryptography, each cryptographic device can possess two secret shares corresponding to two different secret values. s 1,i and s 2,i A threshold number of cryptographic devices can participate in multi-party cryptographic operations. A client computer can possess one or more messages that it wants to encrypt. m 1 ...m n The client computer can generate messages. m or client identifier id The client computer makes a commitment and transmits it to a cryptographic device. The cryptographic device can then generate partial computations corresponding to this commitment and transmit them back to the client computer. The client computer can combine these partial computations to produce the output of a distributed pseudo-random function. The output of the distributed pseudo-random function can be used to derive one or more keys.

[0156] In adaptive attack-resistant distributed symmetric cryptography, the client computer can possess a single message. m The client computer can use two different hash functions. H 1 ( m )and H 2 ( m Generate message m The two promises are made and transmitted to the participating cryptographic devices. Each participating cryptographic device can then use its corresponding share of the secret. s 1,i and s 2,i To Encrypt Promises H 1 ( m )and H 2 ( m Each cryptographic device generates a first part of the computation during the process. Part Two Calculations Cryptographic devices can combine their respective first and second parts for computation (e.g., by calculating the product). Each part of the calculation is generated.

[0157] Subsequently, the participating cryptographic devices can compute multiple parts. The data is transmitted to the client computer. The client computer can determine the computation corresponding to multiple parts. Lagrange coefficient λ i The client computer can use its corresponding Lagrange coefficients. λ i Multiple parts are exponentially calculated to produce multiple intermediate calculations. The client computer can combine these intermediate calculations by calculating their product. The product of the intermediate calculations can be equivalent to a first promise encrypted using a first secret value and a second secret value, respectively. H 1 ( m ) and second commitment H 2 ( m The product of ) (i.e., The intermediate product can be used as a seed for key generation to produce a cryptographic key. This cryptographic key can be used to encrypt messages on a client computer and generate ciphertext. The same process occurs when the ciphertext is to be decrypted, and the same cryptographic key is generated. The ciphertext can be decrypted using the cryptographic key to generate the message. m .

[0158] In some implementations, a similar method can be used to generate verification signatures. The client computer can then transmit the message... m promise H n ( m (or multiple commitments) are transmitted to multiple cryptographic devices, which can use elliptic curve cryptography to encrypt the commitments using each of their respective verification shares. H n (m) Multiple partial signatures are generated. These multiple cryptographic devices can transmit the multiple partial signatures to a client computer. The client computer can determine multiple Lagrange coefficients corresponding to the multiple partial signatures. λ i Then, each partial signature is raised to the power of its corresponding Lagrange coefficient to generate multiple intermediate signatures. The client computer can generate a verification signature as the product of these intermediate signatures. The verification signature can be equivalent to a commitment encrypted using a verification value. H n (m) In some implementations, a partial signature can be generated using only a single commitment, such as a first commitment or a second commitment. In other cases, similar to the generation of partial computations described above, a first commitment and a second commitment can be used to generate a partial signature.

[0159] The verification value and verification key can include an asymmetric cryptographic key pair. That is, the verification value can include a secret or private cryptographic key, while the verification key can include a public cryptographic key, or vice versa. To verify the verification signature, the cryptographic device can use the verification key to decrypt the verification signature to generate a first promise, a second promise, or a combination thereof. If the resulting promise matches the promise received from the client computer, the verification signature is valid.

[0160] The foregoing example is intended as a non-restrictive illustration of how shared secrets and distributed pseudo-random functions can be used to perform distributed symmetric cryptography according to some implementation schemes. Implementation schemes may use any suitable pseudo-random function (such as AES, hash functions, etc.) and any suitable secret-sharing technique (e.g., the Blakley scheme, the Chinese Remainder Theorem, etc.).

[0161] III. Distributed Cryptographic Networks

[0162] A. System Block Diagram

[0163] Figure 1 A system block diagram of an exemplary distributed cryptographic network 100 according to some embodiments is shown. The exemplary distributed cryptographic network may include cryptographic devices 102-108, client computers 110 and 112, an insecure network 114, a trusted external server 116, and an optional proxy device 118. Additionally, the cryptographic device network may include a storage server 120.

[0164] Although only four cryptographic devices 102 to 108 are shown, the implementation can be practiced with any number of cryptographic devices. Similarly, although only two client computers 110 and 112 are shown, the implementation can be practiced with any number of client computers.

[0165] Figure 1 Computers and devices can communicate with each other via a communication network, which can take any suitable form and may include any and / or a combination of the following: direct interconnection; the Internet; a local area network (LAN); a metropolitan area network (MAN); an Operational Mission as a Node on the Internet (OMNI); a secure custom connection; a wide area network (WAN); a wireless network (e.g., employing protocols such as, but not limited to, Wireless Application Protocol (WAP), I-mode, etc.). Messages between computers and devices can be transmitted using secure communication protocols such as, but not limited to: File Transfer Protocol (FTP); Hypertext Transfer Protocol (HTTP); Secure Hypertext Transfer Protocol (HTTPS), Secure Sockets Layer (SSL), ISO (e.g., ISO 8583), etc.

[0166] A distributed cryptographic network enables client computers 110 and 112 to encrypt messages or decrypt ciphertext using cryptographic material (secret shares) securely stored by cryptographic devices 102-108. Client computers 110 and 112 can communicate directly with cryptographic devices 102-108 via a network (such as the Internet or an insecure network 114) or via an optional proxy device 118. Client computers 110-112 may possess the message to be encrypted (“plaintext message” or “plaintext”) or the message to be decrypted (“ciphertext message” or “ciphertext”), as well as the hardware, software, code, or instructions that enable client computers 110-112 to participate in distributed symmetric cryptographic processes.

[0167] Each cryptographic device 102-108 may have one or more secret shares (e.g., a secret share, or a first secret share and a second secret share), and may optionally have a verification share. The secret shares and verification shares can be derived from one or more secret values ​​(e.g., a secret value, or a first secret value and a second secret value) and a verification value. The secret value and verification value can be shared among cryptographic devices 102-108; for example, the secret shares and verification shares can be derived from the secret value and the verification value. The verification value may correspond to a verification key, which cryptographic devices 102-108 can use to verify a verification signature generated using the verification share. A threshold number of secret shares allows for the reconstruction of the secret value, and a threshold number of verification shares allows for the reconstruction of the verification value. The threshold number may be less than the total number of cryptographic devices 102-108. For example, if there are twenty cryptographic devices 102-108, the threshold number may be 14 cryptographic devices, or any other suitable number of cryptographic devices.

[0168] Cryptographic devices 102-108 can be organized into a cryptographic device network. This cryptographic device network may include a local area network connected to a larger computer network such as the Internet or an insecure network 114. Communication between the cryptographic device network and external computers (e.g., client computers 110 and 112) may be mediated by a proxy device 118, which may include a network server communicating with client computers 110 and 112 via any suitable means (e.g., an application programming interface, API).

[0169] A cryptographic device network can be organized into any suitable networking structure. For example, a cryptographic device network may include a “chain” structure, thereby organizing cryptographic devices into a linear sequence of cryptographic devices. Communication from client computer 110 to a cryptographic device (e.g., cryptographic device 108) may pass through all preceding cryptographic devices (e.g., cryptographic devices 102-106) and proxy devices 118 before reaching the intended recipient (e.g., cryptographic device 108). Alternatively, a cryptographic device network may include a “tree” structure, where different branches include different sets of cryptographic devices (e.g., one branch may include cryptographic devices 102 and 104, while another branch may include cryptographic devices 106 and 108). A cryptographic device network may include any number of proxy devices 118, which may act as proxies for cryptographic devices or other proxy devices 118.

[0170] Insecure network 114 may include a computer network through which client computers 110 and 112 communicate with each other. Insecure network 114 may include a network such as the Internet. Client computers, such as client computer 110, may communicate with cryptographic devices 102-108 to encrypt messages, enabling the encrypted messages to be securely transmitted to client computer 112 via insecure network 114. Client computer 112 may then communicate with cryptographic devices 102-108 to decrypt the messages.

[0171] As an example, client computers 110 and 112 may comprise medical record systems in different hospitals. These hospitals may not have the capability to encrypt medical records themselves. Thus, to comply with patient confidentiality rules, these hospitals may encrypt medical records using their respective client computers 110 or 112 and cryptographic devices 102-108 before storing the medical records in a medical record database (e.g., storage server 120). When the medical record needs to be decrypted (i.e., before the doctor and the patient corresponding to the medical record meet), client computer 110 or 112 may communicate with cryptographic devices 102-108 to decrypt the medical record. As another example, if a patient is being transferred from a first hospital to a second hospital, the client computer corresponding to the first hospital (e.g., client computer 110) may transfer the encrypted medical record to the client computer corresponding to the second hospital (e.g., client computer 112). The client computer corresponding to the second hospital may decrypt the medical record using a different set of cryptographic devices provided by communicating with cryptographic devices 102-108 or using the same master key.

[0172] Trusted external server 116 may provide or otherwise provide secret shares and verification shares to cryptographic devices 102-108. Trusted external server 116 may also publish checksums that client computers 110 and 112 can use to verify partial computations received from any of the cryptographic devices 102-108. Trusted external server 116 may communicate directly with cryptographic devices 102-108 via proxy device 118 or via insecure network 114. Similarly, client computers 110 and 112 may retrieve published checksums from trusted external server 116 directly, via proxy device 118, or via insecure network 114.

[0173] B. Using multiple secrets

[0174] As mentioned above, some implementations use multiple secret values ​​(e.g., a shared secret) and multiple secret shares to protect distributed symmetric cryptosystems from adaptive attacks. Each cryptographic device (e.g., Figure 1 Cryptographic devices 102-108 in the code can have multiple secret shares. For example, cryptographic devices... i You can have two secret shares: and Secret values ​​sampled independently S 1 and S 2. Export.

[0175] Cryptographic devices can use these secret shares and commitments provided by the client computer to generate partial computations. These partial computations can be generated as part of a distributed pseudo-random function. As described in Section II above, a distributed pseudo-random function can include a function capable of being computed in a distributed manner and producing outputs that appear random. Some cryptographic systems, such as elliptic curve cryptography systems, are examples of pseudo-random functions. The function is distributed because the partial computations generated by each cryptographic device can be combined to produce a single output.

[0176] For example, the client computer can make the first commitment h 1 and Second Commitment h 2. Transmitted to multiple cryptographic devices. Each cryptographic device can use these promises and their corresponding share of the secret. and Generate two parts of calculation and ,in It corresponds to the first i The first cryptographic device n Partial computation. Cryptographic devices can use performance evaluation functions (e.g., described as...) DPRF.Eval)These partial computations are generated using a distributed pseudo-random function. In some implementations, partial computations can be generated by encrypting each commitment with a corresponding secret share using elliptic curve cryptography. Mathematically, this can be represented as... .

[0177] Each cryptographic device can then combine the partial computations it generates to produce a single partial computation. For example, if the cryptographic device i Two parts of the calculation were generated. and It can then combine these two parts of the calculation to produce a single part of the calculation. y i Cryptographic devices can be used for this purpose. DPRF . Combine Function. In some implementations, the combination part of the calculation may include the product calculated by the calculation part, i.e. .

[0178] Each cryptographic device can send its combined partial computations to a client computer, which can then combine all those partial computations and use the result to generate a cryptographic key. Furthermore, secret shares... s n,i The combination of partial computations performed by the cryptographic device is hidden to prevent malicious client computers or eavesdroppers from determining the secret shares used to generate those partial computations.

[0179] After receiving partial computation, the client computer can use its own... DPRF.Combine Function combination calculation y i To generate a password key or password key seed. Used by the client computer. DPRF.Combine Functions that can be used with cryptographic devices DPRF . Combine The functions are different. The client computer can first use its corresponding Lagrange coefficients. λ i The calculation is performed by exponentiation of each part and then combined into a single calculation. The item This can be referred to as intermediate computation. The client computer may have previously received the data from a trusted external server (e.g., from...). Figure 1 The trusted external server (116) receives these Lagrange coefficients. The client computer can then combine the intermediate calculations by calculating the product: The obtained value y It can be used as a seed for a cryptographic key or a key generation algorithm. The algorithm can then be used to generate a cryptographic key.

[0180] Storage server 120 may include a server computer or other database capable of storing payloads. These payloads may include sets of information, including ciphertext. Client computers 110 and 112 may communicate with storage server 120 to store payloads in or retrieve payloads from storage server 120.

[0181] C. Client Computer

[0182] As described above, a client computer may include a computer system that communicates with a distributed symmetric cryptographic system (e.g., a network of cryptographic devices) to encrypt messages or decrypt ciphertext. The client computer may include a personal computer or a communication device associated with a user. These devices may include, for example, laptops, desktop computers, smartphones, tablets, smartwatches, PDAs, etc. The client computer may also include a server computer or host computer associated with an organization (e.g., an enterprise).

[0183] Figure 2 An exemplary client computer 200 is shown. The client computer 200 may include a processor 202, a communication interface 204, and a computer-readable medium 206.

[0184] 1. Processing, communicating, and storing

[0185] Processor 202 may include any suitable one or more data computing devices. Processor 202 is capable of interpreting code and executing instructions stored on computer-readable medium 206. Processor 202 may include a central processing unit (CPU) operating on a reduced instruction set, and may include a single-core or multi-core processor. Processor 202 may include an arithmetic logic unit (ALU) and cache memory, which may be used by processor 202 to execute code or other functions.

[0186] Communication interface 204 may include any interface through which client computer 200 can communicate with other computers or devices. Examples of communication interfaces include wired interfaces such as USB, Ethernet, or FireWire. Examples also include interfaces for wireless communication, such as Bluetooth or Wi-Fi receivers. Client computer 200 may have multiple communication interfaces 204. As an example, client computer 200, including a smartphone, may communicate via a micro USB port, a cellular receiver, a Bluetooth receiver, and a Wi-Fi receiver.

[0187] Client computer 200 can communicate with other devices or computers via communication interface 204 through one or more secure and authenticated peer-to-peer channels. These channels can use standard public key infrastructure. For example, client computer 200 and cryptographic devices can exchange symmetric keys and / or key shares via their communication interfaces. This key exchange may include a Diffie-Hellman key exchange. After exchanging cryptographic keys, client computer 200 and cryptographic devices can communicate using standard authenticated encryption schemes over public channels (such as insecure networks) to encrypt any message with the cryptographic keys. Other authentication methods, such as digital signatures, may also be used.

[0188] Computer-readable medium 206 may include hardware that may have code, data, or instructions that can be interpreted by processor 202. Computer-readable medium 206 may store or otherwise include multiple software modules, including a communication module 208, a random number generation module 210, a commitment module 212, a selection module 214, a partial calculation module 216, a cryptography module 218, and a verification module 220.

[0189] 2. Communication module

[0190] The communication module 208 may include or contain code, instructions, routines, subroutines, etc., which can be used by the processor 202 to enable the client computer 200 to communicate with other computers or devices, including other client computers, cryptographic devices, and trusted external servers, using any appropriate communication protocol. The communication module 208 may include code or instructions executable by the processor 202 for sending, receiving, formatting, and interpreting requests, messages, payloads, and other data.

[0191] For example, communication module 208 may include code that enables client computer 200 to transmit requests for cryptographic services (e.g., encryption or decryption) to multiple client computers. These requests may include commitments (including a first commitment and a second commitment), signature verification, random values, identifier hashes, etc.

[0192] As another example, communication module 208 may include code enabling client computer 200 to format a payload including ciphertext, a first promise, a second promise, and optional random values, a verification signature, and a hash indicator. Alternatively, communication module 208 may include code enabling client computer 200 to format a payload including ciphertext, a promise, and an identifier corresponding to client computer 200. Furthermore, communication module 208 may include code enabling client computer 200 to transmit a payload to another client computer or other receiver (such as a storage server). Similarly, communication module 208 may include code enabling client computer 200 to receive a payload including ciphertext, a first promise, a second promise, and optional random values, a verification signature, and a hash indicator, or optionally a payload including ciphertext, a promise, and an identifier corresponding to an encryption device. Additionally, communication module 208 may include code enabling client computer 200 to decipher elements of a message, request, or payload (e.g., determining which element in the payload is ciphertext, which element is the first promise, etc.).

[0193] 3. Random Number Generation Module

[0194] The random number generation module 210 may include or contain code, instructions, routines, subroutines, etc., that can be used by the processor 202 to generate random or pseudo-random numbers. These random numbers may include cryptographically secure pseudo-random numbers, and the code may include one or more pseudo-random number generation algorithms that meet cryptographic security requirements. These requirements may include, for example, passing a "next-bit test" and a "state compromise extension test." Examples of cryptographically secure random number generators include the Yarrow, ChaCha20, and Fortuna algorithms.

[0195] The random number generation module 210 can communicate with other modules or hardware in the client computer 200 to generate random or pseudo-random numbers. As an example, the random number generation module 210 can retrieve the system time (e.g., current year, month, day, hour, etc.) to seed a pseudo-random number generation algorithm.

[0196] Random or pseudo-random numbers can be used to "blind" (i.e., obfuscate) messages for encryption or to generate commitments. A message can be combined with random or pseudo-random numbers in some way to obfuscate it. As an example, the message "hello" can be concatenated with the random number 12345 to produce the blinded message "hello12345". Alternatively, the bitwise XOR function can be used to blind a message using random numbers. By blinding the message with random numbers, the client computer 200 can protect itself from some cryptographic attacks, including replay attacks. Therefore, the client computer 200 can use the message and random values ​​(e.g., ...) to...H ( m | r Generate commitments, rather than just based on messages. m Generate the first or second commitment H ( m Additionally, instead of encrypted messages... m The client computer 200 can encrypt messages. m and random values r .

[0197] 4. Commitment Module

[0198] The commitment module 212 may include code or instructions used by the processor 202 to select a hash function, generate commitments (e.g., a first commitment and a second commitment) using the hash function, and identify or determine the hash function based on a hash indicator.

[0199] The commitment module 212 may include a list or store of different hash functions (e.g., SHA-256, SHA3, BLAKE2, etc.) that can be used to generate commitments. The commitment module 212 may include code that enables the processor 202 to select any number (e.g., two) of hash functions from this list or store. In some embodiments, the commitment module 212 may include code that allows random selection of hash functions. In other cases, the commitment module 212 may include code that allows selection of hash functions based on any suitable criteria (e.g., based on user preference, security score, etc.).

[0200] The commitment module 212 may include code that enables the processor to execute a selected hash function using the message and a random value as input. The client computer can use the resulting hash value as a commitment. The commitment module 212 may additionally include code that enables the client computer 200 to use the commitment to verify the correctness of the decrypted message. If the commitment generated using the decrypted ciphertext matches the commitment generated using the corresponding plaintext, the client computer can determine that the message was not modified during encryption.

[0201] Furthermore, the commitment module 212 may include code that enables the processor 202 to identify or determine a hash function based on a hash indicator. The hash indicator may include an identifier that uniquely identifies a particular hash function. For example, the name of the hash function (e.g., “BLAKE2”) may be used to identify the corresponding hash function. The client computer 200 may use the commitment module 212 to identify the hash function used to generate one or more commitments generated using plaintext messages, so that those commitments can be verified later using the decrypted ciphertext.

[0202] 5. Select Module

[0203] Optional selection module 214 may include code or instructions used by processor 202 to select a threshold number of cryptographic devices from the cryptographic devices in the cryptographic device network. The threshold number of cryptographic devices may include the number of cryptographic devices necessary to reproduce the secret value and / or verification value from the secret share and verification share stored on those cryptographic devices. In some embodiments, client computer 200 may not select cryptographic devices from the cryptographic devices in the cryptographic device network. Alternatively, client computer 200 may communicate with an agent device, and the agent device may perform the selection process. Alternatively, the participating cryptographic devices may be pre-selected or static, and client computer 200 may not need to select participating cryptographic devices. In this case, selection module 214 may be optional.

[0204] As an example, selection module 214 may include code implementing a random selection algorithm. Selection module 214 may include a list of cryptographic devices in a network of cryptographic devices. Selection module 214 may select from the list without replacement until a threshold number of cryptographic devices have been selected. Alternatively, selection module 214 may include code capable of implementing rule-based selection of cryptographic devices. For example, selection module 214 may determine a threat score associated with each cryptographic device. The threat score may correspond to the probability that a given cryptographic device has been compromised by a hacker or malicious user. Selection module 214 may select the cryptographic devices with the lowest threat scores up to a threshold number, or randomly select from cryptographic devices with threat scores below a certain value.

[0205] As an alternative, selection module 214 may include code that allows selection of cryptographic devices based on computational load. Some cryptographic devices in a network may already be performing distributed symmetric cryptography on behalf of other client computers and may therefore have higher computational loads. Client computer 200 can use selection module 214 to select a threshold number of cryptographic devices with lower computational loads to improve the throughput of the distributed symmetric cryptography system.

[0206] 6. Partial Calculation Modules

[0207] The partial computation module 216 may include code or instructions that enable the processor 202 to manipulate or process partial and intermediate computations to perform distributed symmetric cryptography. This may include generating intermediate computations based on partial computations, and combining partial computations to generate cryptographic keys or key generation seeds. Additionally, the partial computation module 216 may include code that enables the processor 202 to generate verification signatures based on partial signatures.

[0208] The partial calculation module 216 may include code that allows the combination of partial calculations and partial signatures using any suitable method, function, or algorithm. As an example, partial calculations can be combined by calculating the sum or product (or any other combination) of the partial calculations. The partial calculation module 216 may also include code that implements polynomial interpolation (such as the calculation of Lagrange coefficients). These Lagrange coefficients may correspond to partial calculations. Additionally, the partial calculation module 216 may include code capable of implementing exponentiation and modular exponentiation. For example, the client computer 200 can use the partial calculation module 216 to calculate multiple Lagrange coefficients corresponding to multiple partial calculations. The client computer 200 can then use the partial calculation module 216 to exponentiate those partial calculations using the multiple Lagrange coefficients to generate multiple intermediate calculations. For example, the partial calculation module 216 can be used to use the Lagrange coefficient λ i and partial calculations y i To calculate intermediate calculations Subsequently, the client computer 200 can perform those intermediate calculations. y The product of (i.e., Combine the calculations into sections. Intermediate calculations. y The product of these can be used as a cryptographic key or as a key generation seed. Client computer 200 can use cryptographic module 218 to input this key generation seed into a key generation algorithm to generate a cryptographic key that can be used to encrypt or decrypt messages.

[0209] Similarly, commitment module 212 may include code that enables client computer 200 to generate verification signature from partial signature using a technique similar to that described above for generating a seed from a partial computation key (e.g., using interpolation of Lagrange polynomials).

[0210] 7. Cryptography Module

[0211] The cryptography module 218 may include code or instructions that enable the processor 202 to generate cryptographic keys and perform other cryptographic operations, including encrypting messages and decrypting ciphertext using the cryptographic keys. These cryptographic keys may be generated from a key generation seed. Key generation depends on the specific cryptographic system used to perform the cryptography. For example, for the "AES-128-CBC" cryptographic system (an AES block cipher with a 128-bit key operating in cipher block-linked mode), the key generation algorithm may accept a password or key generation seed as input and produce a 128-bit key for use in the AES block cipher.

[0212] Client computer 200 can use cryptographic module 218 to generate cryptographic keys for encrypting messages or decrypting ciphertext. The key generation seed used by cryptographic module 218 can be derived, in whole or in part, from partial computations received from a cryptographic device. The key generation seed can include the product of intermediate computations generated by exponentiation of the partial computations using their corresponding Lagrange coefficients. These partial computations can be generated by the cryptographic device using a first promise received from client computer 200, a second promise received from client computer 200, and a first and a second secret share, as described above in Section I. Therefore, the key generation seed and the cryptographic key can be indirectly derived from the secret shares, since the secret shares are used to generate partial computations, which are used to generate intermediate computations, which can then be combined and used as the key generation seed.

[0213] Additionally, client computer 200 can use cryptographic module 218 to perform functions associated with pair-based cryptography, including the evaluation of bilinear pairings. Client computer 200 can use bilinear pairings to map bulk keys to individual message keys used for encrypting or decrypting messages.

[0214] 8. Verification Module

[0215] Verification module 220 may include code or instructions executable by processor 202 for verifying portions of the computation using checksums. These checksums may have been provided by a trusted external server (e.g., from...). Figure 1 The verification value is published by a trusted external server 116. Each verification value may correspond to a secret share stored by cryptographic devices in a network of cryptographic devices. Client computer 200 may use code or instructions stored in verification module 220 to perform honest verifier zero-knowledge (HVZK) proofs to verify the legitimacy of partial computations. Verification module 220 may include code or instructions capable of implementing any suitable implementation of HVZK proofs, including the Schnorr protocol and Fiat-Shamir.

[0216] D. Cryptographic devices

[0217] Figure 3An exemplary cryptographic device 300 according to some embodiments is shown. Cryptographic device 300 may include a computer or another device in a cryptographic device network. In some embodiments, cryptographic device 300 may include a server computer. Cryptographic device 300 may store one or more secret shares and verification shares derived from one or more secret values ​​and verification values. Additionally, cryptographic device 300 may store a verification key used to verify a verification signature. The cryptographic device may use the secret shares and verification shares to generate partial computations and partial signatures using a distributed pseudo-random function. The partial computations may be used by a client computer to generate a cryptographic key. The cryptographic key may be used by the client computer to encrypt or decrypt messages. Cryptographic device 300 may include a processor 302, a communication interface 304, and a computer-readable medium 306.

[0218] 1. Processing, communicating, and storing

[0219] Processor 302 may include any suitable one or more data computing devices. Processor 302 is capable of interpreting code and executing instructions stored on computer-readable medium 306. Processor 302 may include a central processing unit (CPU) operating on a reduced instruction set architecture and may include a single-core or multi-core processor. Processor 302 may include an arithmetic logic unit (ALU) and cache memory. These components may be used by processor 302 to execute code or other functions.

[0220] Communication interface 304 may include any interface through which cryptographic device 300 can communicate with other computers or devices. Examples of communication interfaces include wired interfaces such as USB, Ethernet, or FireWire. Examples also include interfaces for wireless communication, such as Bluetooth or Wi-Fi receivers. Cryptographic device 300 may have multiple communication interfaces 304, such as micro USB ports, Ethernet ports, cellular receivers, Bluetooth receivers, etc.

[0221] Cryptographic device 300 can communicate with other devices or computers via communication interface 304 through one or more secure and authenticated peer-to-peer channels. These channels can use standard public key infrastructure. For example, cryptographic device 300 and client computers can exchange symmetric keys through their communication interfaces. This key exchange may include a Diffie-Hellman key exchange. After exchanging cryptographic keys, cryptographic device 300 and client computers can communicate using standard authenticated encryption schemes over public channels (e.g., insecure networks) to encrypt any message with the cryptographic keys. Other authentication methods, such as digital signatures, may also be used. By performing this key exchange, communication between cryptographic device 300 and client computers (e.g., commitment, partial computation, partial signature, signature verification, etc.) can be encrypted, thereby allowing cryptographic device 300 and client computers to communicate securely over insecure networks.

[0222] Computer-readable medium 306 may include hardware that may possess or store code, data, or instructions interpretable by processor 302. Computer-readable medium 306 may store or otherwise include multiple software modules, including a communication module 308, a distributed pseudo-random function module 310, a verification module 312, and a secure memory 314. The secure memory element may store a secret share 316, a verification share 318, and a verification key 320.

[0223] 2. Communication module

[0224] The communication module 308 may include or contain code or instructions that can be used by the processor 302 to enable the cryptographic device 300 to communicate with other computers or devices (including client computers, proxy devices, and trusted external servers) using any suitable communication protocol. The communication module 308 may include code or instructions executable by the processor 302 for receiving requests for cryptographic services from client computers (e.g., requests to perform encryption or decryption), receiving commitments and verifying signatures from client computers, and transmitting partially computed and partially signed data to client computers.

[0225] Furthermore, the communication module 308 may include code that enables the cryptographic device 300 to communicate with and receive secret shares and verification shares from the trusted external server. This communication can be implemented during the secret share provision phase, which is performed prior to distributed symmetric encryption or decryption.

[0226] 3. Distributed pseudo-random function module

[0227] The distributed pseudo-random function module 310 may include code for evaluating a pseudo-random function (PRF) or a distributed pseudo-random function (DPRF). For example, this may include performing cryptographic operations associated with elliptic curve cryptography, block ciphers such as AES, or hash functions such as SHA-2.

[0228] As an example, the distributed pseudo-random function module 310 may include code usable by the processor 302 to implement elliptic curve cryptography under the decisional Diffie-Hellman assumption. Elliptic curve cryptography can be used to generate partial computations based on commitments (e.g., a first commitment and a second commitment) and a secret share 316. These partial computations can be combined into a single partial computation and transmitted to a client computer. The client computer can use this partial computation, along with other partial computations received from other cryptographic devices, to generate a cryptographic key that can be used to encrypt messages or decrypt ciphertext, for example, as described in Section I above.

[0229] Therefore, processor 302 can use distributed pseudo-random function module 310 to utilize messages. m First promise H 1 ( m ) and the second commitment of the message H 2 ( m The processor 302 can use the message as input to perform elliptic curve cryptography. Alternatively, the processor 302 can use the distributed pseudo-random function module 310 to use the message. m and two independent random values r 1 and r 2 Used as input to generate the first commitment H 1 ( m , r 1 ) and second commitment H 2 ( m , r 2 These commitments can be transformed into points in an elliptic curve group, each point being multiplied by a corresponding secret multiplicand (e.g., the first and second secret shares of secret share 316) to produce product points. Product points may include partial computations, which can be combined into a single partial computation (e.g., by calculating the product) and transmitted to the client computer. Given the same commitment inputs and the same secret share 316, the resulting partial computations will be identical, enabling the partial computations to be used to generate consistent encryption and decryption keys.

[0230] Additionally, the distributed pseudo-random function module 310 may include code that can be used by the processor 302 to perform operations associated with pair-based cryptography, including the evaluation of a bilinear map. For example, a cryptographic device may use a bilinear map to generate random numbers based on the hash of an identifier and the hash of a commitment, and then use said random numbers as input to a cryptographic function (such as an elliptic curve cryptography function).

[0231] 4. Verification Module

[0232] Verification module 312 may include code or instructions executable by processor 302 for generating a partial signature and verifying the verification signature. As described above, cryptographic device 300 can use the verification signature to determine whether a client computer is legitimately using a distributed symmetric cryptography system, and whether the client computer is encrypting or decrypting data. The presence of a valid verification signature indicates that the client computer is decrypting data, because cryptographic device 300 can verify the verification signature during distributed symmetric decryption.

[0233] Verification module 312 can use verification share 318 (stored in secure memory 314) to generate a partial signature based on one or more commitments (e.g., a first commitment and / or a second commitment) received from the client computer. Verification module 312 can generate a partial signature by encrypting the commitment using its corresponding verification share 318 and elliptic curve cryptography. Alternatively, verification module 312 can generate a partial signature by encrypting the commitment using its corresponding verification share 318 and any suitable form of homomorphic cryptography. As another alternative, verification module 312 can generate a partial signature using one or more commitments, verification share 318, and a suitable Message Authentication Code (MAC) algorithm.

[0234] Cryptographic device 300 can transmit a partial signature to a client computer, which can also receive multiple additional partial signatures from other cryptographic devices. The client computer can combine these partial signatures to generate a verification signature. The client computer can then store the verification signature. At another time, when the client computer wants to decrypt the ciphertext, it can transmit the verification signature to cryptographic device 300. Cryptographic device 300 can then verify the verification signature using verification module 312 and verification key 320. Verification key 320 may correspond to a verification value used to generate verification share 318 and other verification shares belonging to other cryptographic devices. In some embodiments, verification key 320 and verification value may include an asymmetric key pair. As an example, verification key 320 may include a public cryptographic key, and the verification value corresponding to verification share 318 may include a private cryptographic key.

[0235] Signature verification may include one or more commitments encrypted using the verification value. H n ( m The verification signature can be decrypted using the verification key 320 to generate one or more commitments. H n ( mCryptographic device 300 can use verification module 312 to decrypt the verification signature using verification key 320 and compare the resulting promise with the promise received from the client computer. If the two promises match, the verification signature is likely valid. Alternatively, cryptographic device 300 can use verification module 312 to verify the verification signature using any other suitable method, such as methods based on paired friendly elliptic curves, message authentication codes (MAC), hash message authentication codes (HMAC), etc. Exemplary techniques for verifying signatures can be found in: [1] Boldyreva A. (2003) “Threshold Signatures, Multisignatures and BlindSignatures Based on the Gap-Diffie-Hellman-Group Signature Scheme.” from Desmedt YG (ed.) Public Key Cryptography — PKC 2003. PKC 2003. LectureNotes in Computer Science, Vol. 2567. Springer, Berlin, Heidelberg; [2] VictorShoup. 2000. “Practical threshold signatures.” from Proceedings of the 19th International Conference on Cryptography Theory and Applications (EUROCRYPT'00). Springer-Verlag, Berlin, Heidelberg, 207–220; and [3] Naor M., Pinkas B., Reingold O. (1999) Distributed Pseudo-randomFunctions and KDCs. From: Stern J. (ed.) Advances in Cryptology — EUROCRYPT '99. EUROCRYPT 1999. Lecture Notes in Computer Science, Vol. 1592. Springer, Berlin, Heidelberg.

[0236] 5. Secure storage

[0237] Secure memory 314 may include a memory region of computer-readable medium 306 or a separate memory element. Secure memory 314 may store sensitive cryptographic material in a manner that makes it difficult for unauthorized individuals (e.g., hackers) to retrieve it. As an example, data stored in secure memory 314 may be stored in encrypted form. Secure memory 314 may store one or more secret shares 316 derived from one or more secret values ​​(e.g., a first secret value and a second secret value). Additionally, secure memory 314 may store verification shares 318 derived from verification values, and a verification key 320 corresponding to said verification values. Cryptographic device 300 may use secret shares 316 to generate partial computations for generating cryptographic keys. Similarly, cryptographic device 300 may use verification shares 318 to derive partial signatures for generating verification signatures. Cryptographic device 300 may use verification key 320 to verify verification signatures generated from multiple partial signatures.

[0238] IV. Generating and distributing secret shares and verification values

[0239] Before describing methods for adaptive anti-attack and amortized symmetric cryptography, it may be helpful to describe methods that can be used to distribute secret shares and verification shares to cryptographic devices in a network of cryptographic devices.

[0240] For illustrative purposes, the following text refers to... Figure 4 and Figure 5 This describes a non-limiting example of the generation and distribution of secret shares and verification shares. However, it should be understood that any suitable method can be used to generate secret shares and verification shares and distribute them to cryptographic devices.

[0241] Figure 4 A secret and verification share distribution system 400 is illustrated, comprising a trusted external server 402, a communication network 404, and a cryptographic device network 412. The cryptographic device network 412 may include optional proxy devices 406 and cryptographic devices 408-410. It is noteworthy that although only two cryptographic devices 408 and 410 are shown, the cryptographic device network 412 may include any number of cryptographic devices.

[0242] Trusted external server 402 may include a server computer capable of generating and distributing secret shares, verification shares, and verification keys. Trusted external server 402 is capable of communicating with cryptographic devices 408-410 or proxy device 406 via communication network 404. Trusted external server 402 may possess a processor and computer-readable medium and is capable of performing any operations necessary to generate secret values, secret shares, verification values, or verification shares according to any suitable secret sharing scheme (e.g., using Shamir's secret sharing, as described above). As an example, trusted external server 402 may generate a key corresponding to the first polynomial.P 1 ( x ) and the second polynomial P 2 ( x The coefficients of the polynomial are random numbers. Two of these random numbers (e.g., with the polynomial) are random numbers. P 1 ( x )and P 2 ( x The random number associated with the zero-order coefficient of ) can be interpreted into a first secret value and a second secret value, respectively. To generate secret shares, a trusted external server 402 can... x The polynomial is evaluated at different values. For example, by evaluating the serial number or unique identifier corresponding to cryptographic devices 408-410. x The value is evaluated by a polynomial. Secret shares can be distributed to cryptographic devices 408-410 via communication network 404, the secret shares comprising their respective... x The polynomial evaluated at the value.

[0243] The communication network 404 may include a network such as the Internet or a cellular communication network, through which devices, computers, and servers can communicate with each other. The communication network 404 may be secure or insecure. A trusted external server 402 may communicate with the cryptographic device network 412 via the communication network 404; for example, the trusted external server 402 may transmit a secret share, a verification share, and a verification key to the cryptographic device network via the communication network 404.

[0244] Cryptographic device network 412 may include cryptographic devices 408 and 410, and proxy device 406. Proxy device 406 may act as a gateway, mediating communication between cryptographic devices 408 and 410 and computers, devices, or servers outside cryptographic device network 412 (e.g., trusted external server 402). Secret shares or verification shares may be transmitted from trusted external server 402 to proxy device 406 via communication network 404. Proxy device 406 may distribute secret shares to their respective cryptographic devices 408-410.

[0245] Cryptographic devices 408-410 are basically similar to the reference above. Figure 1 and Figure 3The cryptographic device described herein may have a processor, a communication interface, and a computer-readable medium. The computer-readable medium may have or include several software modules used by cryptographic devices 408 and 410 to perform distributed symmetric cryptography. Cryptographic devices 408 and 410 may additionally include secure memory elements. Cryptographic devices 408 and 410 may store secret shares, verification shares, and verification keys received from a trusted external server 402 in their respective secure memory elements.

[0246] Figure 5 A sequence diagram detailing an exemplary method 500 is shown, by which secret shares, verification values, and verification keys can be generated and distributed. It should be understood that the implementation scheme can be practiced through any suitable method for generating and distributing secret shares, verification shares, and verification keys, and therefore... Figure 5 The exemplary methods described are intended to be non-limiting. Although Figure 4 The communication network 404 is not explicitly shown, but communication between the cryptographic device network 502 and the trusted external server 504 can traverse the communication network. Similarly, although... Figure 4 The proxy device 406 is not shown, but communication to the cryptographic device network 502 can be received by the proxy device representing the cryptographic device network 502.

[0247] Steps 506 and 508 are two steps in the handshake process between the cryptographic device network 502 and the trusted external server 504. Some communication protocols, such as Transmission Control Protocol (TCP), use a handshake process to establish rules or characteristics for future communication between participating computers. As an example, if the communication between the cryptographic device network 502 and the trusted external server 504 is encrypted, steps 506 and 508 may involve the exchange of encryption keys between the cryptographic device network 502 and the trusted external server 504.

[0248] For example, cryptographic device network 502 (or proxy device) may possess a symmetric cryptographic key that can be used to encrypt and decrypt messages sent between cryptographic device network 502 and trusted external server 504. Trusted external server 504 may possess the private key from a public-private key pair. Cryptographic device network 502 can use the public key from the public-private key pair to encrypt the symmetric cryptographic key, and then transmit the symmetric cryptographic key to trusted external server 504. Using the private key, trusted external server 504 can decrypt the symmetric cryptographic key. At this point, both cryptographic device network 502 and trusted external server 504 possess the symmetric cryptographic key. Cryptographic device network 502 and trusted external server 504 can use the symmetric cryptographic key to encrypt and decrypt any future communications between them.

[0249] In step 510, the cryptographic device network 502 may transmit information necessary to complete the generation and distribution process of secret shares and verification shares. This may include information such as the number of devices in the cryptographic device network, the threshold number of devices in the cryptographic device network, address information, the number of secret shares requested by each device (e.g., one or two), and any requested sample values ​​(such as the serial number or unique identifier of the cryptographic device in the cryptographic device network 502). The address information may include a numeric address associated with each cryptographic device in the cryptographic device network 502, such as an IP address or MAC address. The requested sample values ​​may correspond to those used for polynomial... P n (x) Sampling is performed to generate secret shares or verification values. x A specific value. For example, the sample value could be 5, and the secret share corresponding to the sample value could include (5, P 1 (5)) and (5, P 2 (5)).

[0250] As an example, in step 510, the cryptographic device network 502 may transmit a series of packets, each packet containing a requested sample value and the address of each cryptographic device corresponding to the requested sample value, such as an IP address or MAC address. Additionally, the packets may include information such as TCP or UDP port information on which cryptographic devices in the cryptographic device network 502 communicate.

[0251] In step 512, the trusted external server 504 may generate one or more secret values ​​(e.g., a secret value or a first secret value and a second secret value), a verification value, and a verification key. The method by which the trusted external server 504 generates the secret values ​​depends on the secret-sharing method used and the distributed pseudo-random function used during distributed symmetric cryptography. Similarly, the method used to generate the verification value and verification key depends on the specific method used to verify the verification signature using the verification key. In some embodiments, the one or more secret values ​​may include random numbers, and the trusted external server 504 may use a cryptographically secure random number generator to generate the secret values. In some embodiments, the verification value and verification key may include an asymmetric key pair, and the verification value and verification key may be generated using any appropriate method for generating asymmetric key pairs according to any suitable cryptosystem (e.g., RSA).

[0252] In step 514, the trusted external server 504 can generate one or more polynomials corresponding to one or more secret values ​​(e.g., a polynomial corresponding to a first secret value or a first polynomial and a second polynomial corresponding to a second secret value) and a polynomial corresponding to a verification value. The trusted external server can encode the secret values ​​into one coefficient of their respective polynomials and encode the verification value into one coefficient of the verification value polynomial. In some embodiments, the secret values ​​and verification values ​​can be encoded into the zeroth-order coefficients of their respective polynomials. The trusted external server 504 can use any suitable technique to generate other coefficients of the polynomials (e.g., first-order to second-order coefficients). n (Order coefficients). For example, other coefficients may include random or pseudo-random numbers.

[0253] The properties of the polynomial (e.g., how coefficients may be included) may be entirely or partially based on the information received by the trusted external server 504 in step 510 (e.g., the number of secret shares and verification shares). As described above, it is necessary to k +1 unique point to uniquely define k The first and second polynomials can have the same number of coefficients as the threshold number of the secret share requested in step 510. Similarly, the verification value polynomial can have the same number of coefficients as the threshold number of the verification share requested in step 510.

[0254] In step 516, the trusted external server 504 can generate a secret share and a verification share based on the corresponding polynomial. The trusted external server 504 can... x The unique value is sampled from one or more secret value polynomials and verification share polynomials to generate the corresponding... P(x) Values. These pairs ( x, P(x) The value may include a secret share. x The value may include a preferred sample value provided to the trusted external server 504 in step 510 (e.g., a serial number or device identifier associated with a cryptographic device in the cryptographic device network 502).

[0255] In step 518, the trusted external server 504 may publish a checksum corresponding to the secret share. Client computers can use these checksums to verify partial computations received from cryptographic devices in the cryptographic device network 502. Client computers can use these checksums to perform honest verifier zero-knowledge (HVZK) proofs to verify partial computations without needing to know anything about the secret share. The checksums may include those corresponding to each cryptographic device. u i , v i The generator of the secret share g The modulus of, whereg Elliptic curve groups are used to implement distributed pseudo-random functions. G generator, u i It corresponds to the first i The first secret share of the cryptographic device, and v i It corresponds to the first i The second secret share of the cryptographic device. That is, corresponding to the... i The verification value of a cryptographic device can include a checksum. g ui , g vi A trusted external server may publish these verification values ​​for each cryptographic device in the cryptographic device network 502. Publishing these verification values ​​may include making them readily available to client computers, for example, by transmitting the verification values ​​to the client computers, or by making the verification values ​​available on a public network server.

[0256] In step 520, the trusted external server 504 can use the routing or address information provided in step 510 to transmit the secret share, verification share, and verification key to the cryptographic devices in the cryptographic device network 502. In this way, each cryptographic device in the cryptographic device network 502 can receive its corresponding secret share and verification share, as well as the verification key common to all cryptographic devices.

[0257] Figure 5 The exemplary method is a non-limiting example of a secret share generation and distribution process. Many variations exist that may be apparent to those skilled in the art. As another example, a cryptographic device may receive its corresponding secret share via a cryptographic method such as inadvertent transmission. As yet another example, a network of cryptographic devices 502 may generate secret shares using methods such as secure multi-party computation without the assistance of a trusted external server 504.

[0258] V. Distributed Symmetric Cryptography

[0259] The following text is for reference only. Figures 6A to 7B Describe an adaptive, attack-resistant distributed symmetric cryptographic method. Figures 6A to 6B A sequence diagram of an exemplary method for performing adaptive, attack-resistant distributed symmetric encryption is shown, while Figures 7A to 7B A sequence diagram of an exemplary method for performing adaptive, attack-resistant distributed symmetric decryption is shown. Similarly, references are made below. Figures 8A to 9B Describe an amortized distributed symmetric encryption method. Figures 8A to 8B A sequence diagram of an exemplary method for performing amortized distributed symmetric encryption is shown, while Figures 9A to 9BA sequence diagram of an exemplary method for performing amortized distributed symmetric decryption is shown.

[0260] As described above, the implementation achieves adaptive resistance to attacks by generating multiple partial computations corresponding to multiple secret shares (generated from multiple respective secret values). In some implementations, each cryptographic device uses two secret values ​​and two secret shares; however, the implementation can be implemented with any number of secret values ​​and secret shares. The partial computations generated by the cryptographic devices (e.g., a first partial computation and a second partial computation) can be combined by those cryptographic devices (e.g., by calculating the product of the partial computations), and the resulting single partial computation is then transmitted to the client computer. Even if the client computer (or a malicious eavesdropper) knows the commitment used to generate the corresponding partial computations and the resulting combination, the client computer or the malicious eavesdropper cannot determine the secret shares from this known information because there are an exponentially large number of potential secret shares that can produce the resulting combination. In this way, the secret shares are protected from attackers, even attackers using sophisticated adaptive attacks.

[0261] A. Adaptive anti-attack encryption

[0262] Figure 6A The first part of an exemplary method for adaptive attack-resistant distributed symmetric encryption according to some implementation schemes is shown. Figure 6A A client computer 602 and three cryptographic devices 604-608 are shown, along with several steps 610-616 associated with the exemplary method. Although proxy devices and communication networks are not shown, in some embodiments, communication between the client computer 602 and the cryptographic devices 604-608 may be mediated or transmitted via proxy devices and / or communication networks.

[0263] In step 610, the client computer 602 can select a first hash function. H 1 Second hash function H 2 The client computer 602 can later use these hash functions to generate the first and second commitments. The client computer 602 can select these hash functions from a plurality of hash functions. The client computer 602 can store a list of hash functions, a database, or other repository in memory (e.g., in the commitment module). The client computer 602 can use any suitable method (e.g., based on the preferences, trust scores, etc. of the client associated with the client computer) to select these hash functions. In some implementations, these hash functions can be selected randomly. Random selection of hash functions can be advantageous because it makes it difficult or impossible for an attacker to determine the hash function from their obtained commitments.

[0264] In step 612, the client computer 602 can use the first hash function. H 1 Second hash function H 2 Generate the first commitment h 1 Second commitment h 2 The first and second commitments can be made by providing messages respectively. m It is generated as input to the first and second hash functions. In some implementations, one or more random values ​​may be used additionally. r To generate a commitment. In addition to a random value, the client computer 602 can also hash the message, instead of hashing the message alone (e.g., by cascading the message and the random value). The random value can obfuscate or hide the message, protecting it from certain forms of cryptographic attacks (e.g., replay attacks).

[0265] In step 614, the client computer 602 can select multiple cryptographic devices (e.g., a predetermined threshold number of participating cryptographic devices). This threshold number of cryptographic devices can include the minimum number of participating cryptographic devices required to perform distributed symmetric encryption, or it can be all cryptographic devices provided with a secret share. Figure 6A In this configuration, client computer 602 selects cryptographic devices 604 and 606. Client computer 602 can select participating cryptographic devices by any suitable means or selection criteria. For example, client computer 602 can select participating cryptographic devices randomly or based on a trust or security score. The trust or security score can relate to the likelihood that a particular cryptographic device has been hacked or that the relative security of the device's hardware has been compromised (e.g., the trust score can depend on whether the cryptographic device has secure storage or a trusted platform module). Client computer 602 can use a proxy device (not shown) to select participating cryptographic devices. Client computer 602 can transmit a request to the proxy device requesting a threshold number of participating cryptographic devices. The proxy device can then select participating cryptographic devices on behalf of client computer 602.

[0266] In step 616, the client computer 602 may transmit a first commitment to multiple participating cryptographic devices (i.e., cryptographic device 604 and cryptographic device 606). h 1 Second commitment h 2 The client computer 602 can transmit the request via a proxy device, causing the client computer to transmit a first promise and a second promise to the proxy device, and the proxy device to transmit the first promise and the second promise to multiple participating cryptographic devices.

[0267] Figure 6B The second part of an exemplary method for distributed symmetric encryption according to some implementation schemes is shown. In step 618, the participating cryptographic devices (i.e., cryptographic devices 604 and 606) can each generate the first part of the computation. y n,1 Part Two Calculations y n,2 The participating cryptographic devices can then combine their respective first and second part computations to produce a partial computation. y n .

[0268] Each participating cryptographic device can use its own first secret share. u n And the first commitment h 1 The first part of the calculation to generate them y n,1 The participating cryptographic devices can use DPRF.Eval A function is used to generate these first-part computations, which evaluates a distributed pseudo-random function using a first commitment and a first secret share as parameters. In some implementations, the distributed pseudo-random function may include an elliptic curve cryptographic function that implements elliptic curve cryptography. That is, the cryptographic device can use... DPRF.Eval The functions use their respective first secret shares as keys to encrypt the first promise. Thus, each cryptographic device 604 and 606 can produce the first part of the computation.

[0269] The corresponding second secret share can be used in a similar manner. v n Second commitment h 2 To generate the second part of the calculation y n,2 As an example, cryptographic devices 604 and 606 can use DPRF.Eval Functions (such as elliptic curve cryptography functions) use a second secret share as a key to encrypt a second promise, thereby producing a second part of the computation.

[0270] As described above, in some implementations, the first part calculates y n,1 The second part calculates y n,2 Random functions can be generated by evaluating distributed pseudo-random functions such as elliptic curve cryptography functions. This can include cryptographic devices 604 and 606 using a first secret share. s n,1 Second secret share s n,2 Encryption First Commitment h1 Second commitment h 2 This is done to generate the first and second part of the computation, respectively. In elliptic curve cryptography, this can include transforming the first and second commitments into points in the elliptic curve group, and then exponentiating those points using the first and second secret shares, i.e., and .

[0271] Cryptographic devices 604 and 606 can each combine their respective first parts to perform calculations. y n,1 Part Two Calculations y n,2 To generate partial calculations y n Client computer 602 can use these components to calculate and generate a key later. Cryptographic devices 604 and 606 can use... DPRF.Combine ( y n,1 , y n,2 The function takes the corresponding first and second part calculations as input to produce the output part calculation. In some implementations, DPRF.Combine Functions can include product functions that compute the product of two partial computations. For example, cryptographic devices 604 and 606 can use the following formula to generate their respective partial computations. y n : .

[0272] Optionally, in step 620, cryptographic devices 604 and 606 may each use the first promise. h 1 and / or a second commitment h 2 and verification share sk' n To generate the corresponding partial signature z n Cryptographic devices can use threshold authentication partial signature functions (...). TA.PartSign This is used to generate a signature for each part. TA.PartSign The first and / or second commitments, along with the verification share, can be taken as input, and a partial signature can be generated as output. In some implementations, TA . PartSign The function can include a distributed pseudo-random function. As an example... TA.PartSign The function can include elliptic curve cryptography functions. This function can use the verification share to encrypt the first promise and / or the second promise to produce a partial signature.

[0273] In step 622, cryptographic devices 604 and 606 can compute their respective parts. y n And optionally their respective partial signatures z n The data is transmitted to client computer 602. In some embodiments, client computer 602 may receive this plurality of partial computations and multiple partial signatures from a proxy device, wherein the proxy device receives the plurality of partial computations and multiple partial signatures from participating cryptographic devices 604 and 606.

[0274] In step 624, the client computer 602 can retrieve multiple check values. g un and g vn And use multiple check values ​​to verify part of the calculation. y n As per the above reference. Figure 5 The trusted external server that generates the secret value and secret share can publish verification values. The client computer can retrieve these published verification values ​​from the trusted external server, for example, via a network request. The client computer 602 can perform honest verifier zero-knowledge (HVZK) proofs to verify these partial computations. The client computer 602 can use... check The function is used to perform the HVZK proof. check The function can perform HVZK proofs according to any suitable protocol (e.g., the Schnorr protocol, Fiat-Shamir, etc.). The client computer 602 can call the HVZK proof process in parallel for each checksum (e.g., for...). g un Call an HVZK proof procedure, and for g vn (Invoking another HVZK proof procedure). More details about HVZK proofs and the techniques for performing HVZK proofs can be found in [4] Faust et al., “On the Non-malleability of the Fiat-Shamir Transform,” Cryptology ePrint Archive, Report 2012 / 704, 2012, and [5] Agrawal, Mohassel, Mukherjee and Rindal, “DiSE: Distributed Symmetric-key Encryption,” Cryptology ePrint Archive, Report 2018 / 727, 2018. Based on the descriptions in this disclosure and these references, those skilled in the art will understand how to implement HVZK proofs in this content.

[0275] In step 626, the client computer 602 can combine multiple computational components to generate a cryptographic key. y The client computer 602 can use this password key to encrypt messages. m The client computer 602 can be used. DPRF.Combine ( y 1 , y 2 ) A function is used to combine partial computations, which can take multiple partial computations as input and generate a symmetric cryptographic key or a key generation seed that can be used to generate a symmetric cryptographic key. This is executed by the client computer 602. DPRF.Combine The function can be similar to that executed by cryptographic devices 604 and 606. DPRF.Combine A function, because it is used to combine multiple partial computations into a single output. In some implementations, two functions combine partial computations by calculating the product of the partial computations. However, the function executed by the client computer 602... DPRF.Combine The function can first be calculated by using each part. y n The corresponding Lagrange coefficient λ n Take its power (i.e., λ n (ie, This generates intermediate calculations, and then the product of those intermediate calculations is calculated. In some implementations, a formula can be used. To calculate DPRF.Combine function output y .

[0276] In some implementations, client computer 602 may use Lagrange interpolation to generate intermediate computations. These intermediate computations can then be combined to generate a cryptographic key or a key generation seed. Client computer 602 may use the corresponding Lagrange coefficients as described in Section II above. λ n Calculate each part in a multi-part calculation y n Exponentiation (i.e., This is done to generate multiple intermediate calculations. These Lagrange coefficients λ n These can correspond to cryptographic devices 604 and 606, which generate multiple parts of the computation. The Lagrange coefficients may have been generated by a trusted external server during the secret share provision process (see above). Figure 5 (Description). Prior to the distributed symmetric encryption process, the client computer 602 may have already received these Lagrange coefficients from a trusted external server.

[0277] As mentioned above, multiple intermediate calculations can be combined by multiplying them. These multiple intermediate calculations can be equivalent to using the first secret value separately. S 1 Second secret value S 2 The First Promise of Encryption h 1 Second commitment h 2 The product of the intermediate computations. In some implementations, the combination of intermediate computations can be used as a symmetric cryptographic key. In other implementations, the combination of intermediate computations can be used as a key generation seed. The key generation seed can be input into a key generation function to generate a cryptographic key. y .

[0278] In step 628, the client computer 602 can base its signature on multiple partial signatures. z n Generate verification signature z The client computer can use a partial signature as input. TA.CombineSig Functions. In some implementations, combining partial signatures to generate a verification signature can be similar to combining partial computations to generate a cryptographic key. In some implementations, generating a verification signature may involve computing the product of the partial signatures.

[0279] In step 630, the client computer 602 can use the password key y Encrypted messages m To generate ciphertext e The client computer can perform this encryption using any suitable symmetric cryptosystem, such as AES. Alternatively, the client computer can encrypt the message using a key. m and random values r To generate ciphertext. This involves generating the first commitment using random values. h 1 Second commitment h 2 It may be useful in one or both of these situations.

[0280] In step 632, the client computer 602 can generate ciphertext. e First Commitment h 1 Second commitment h 2 The payload. Optionally, the payload may additionally include a signature verification function. z Random value rThe payload may include the ciphertext and all the data needed to decrypt it (e.g., the first and second promises). It may also include data needed to verify the legitimate use of the distributed cryptosystem (verifying the signature) and data needed to verify or otherwise validate the promises (random values ​​and hash indicators). The hash indicator may include an identifier indicating which hash functions were used to generate the first and second promises. For example, the hash indicator may include the string "SHA-256, BLAKE2", indicating that the first promise was generated using the SHA-256 hash algorithm and the second promise was generated using the BLAKE2 hash algorithm.

[0281] Client computer 602 can store the payload (locally or on a storage server) and decrypt it later. For example, client computer 602 may include a hospital computer system, and the message may include sensitive medical records. Client computer 602 can encrypt the medical records and generate a payload to securely store the sensitive medical records in a medical database. Later (e.g., during a patient's visit), client computer 602 can retrieve the payload to decrypt the ciphertext and retrieve the medical records.

[0282] Alternatively, client computer 602 can transmit the payload to another client computer, which can use the information in the payload to decrypt the ciphertext and retrieve the message. This can be useful, for example, when the message includes sensitive payment information. Client computer 602 may include a payment terminal associated with a merchant. When a customer uses client computer 602 to make a payment, the client computer can encrypt the customer's payment information and generate a payload, then send the payload to the bank computer corresponding to the customer (e.g., a bank maintaining an account on behalf of the customer). The bank computer can use the information in the payload to decrypt the customer's payment information and make the payment between the merchant and the customer.

[0283] B. Adaptive Anti-Attack Decryption

[0284] Figure 7A The first part of an exemplary method for adaptive attack-resistant distributed symmetric decryption according to some implementation schemes is shown. Figure 7A The diagram shows a client computer 702 and three cryptographic devices 704, 706, and 708. The client computer 702 can be from... Figure 6A and Figure 6B The same client computer 602 or a different client computer. Similarly, cryptographic devices 704-708 can be used with... Figure 6A and Figure 6BThe cryptographic devices 604-608 may be the same as or different from the cryptographic devices 704-708. Although the proxy device and communication network are not shown, in some embodiments, communication between the client computer 702 and the cryptographic devices 704-708 may be mediated or transmitted via the proxy device and / or communication network.

[0285] In step 710, the client computer 702 can receive the encrypted text. e First Commitment h 1 Second commitment h 2 The payload. Messages may have already been used. m and the first hash function H 1 The first commitment was generated. h 1 (as referenced) Figure 6A (as described above). Similarly, the message and the second hash function may have already been used. H 2 A second commitment was generated. h 2 The payload may additionally include a signature verification tool. z Random value r And hash indicator. Client computer 702 can be from another client computer (e.g., from...) Figure 6A and Figure 6B The client computer 602 receives this payload. Alternatively, the client computer 702 may have initially generated the payload and can receive it by retrieving it from memory.

[0286] In step 712, the client computer 702 can select a predetermined threshold number of participating cryptographic devices. The threshold number of cryptographic devices may include the minimum number of participating cryptographic devices required to perform distributed symmetric decryption. Figure 7A In this process, client computer 702 selects cryptographic devices 704 and 708. It is worth noting that the same cryptographic devices used to generate the ciphertext (e.g., cryptographic devices 604 and 606) do not need to participate in decrypting the ciphertext.

[0287] Client computer 702 may select participating cryptographic devices by any suitable means or selection criteria. For example, client computer 702 may select participating cryptographic devices randomly or based on a trust score or security score. For example, a trust or security score may relate to the likelihood that a particular cryptographic device has been hacked or that the relative security of the device's hardware has been compromised (e.g., a trust score may depend on whether the cryptographic device has secure storage or a trusted platform module). Client computer 702 may use a proxy device (not shown) to select participating cryptographic devices. Client computer 702 may transmit a request to the proxy device requesting a threshold number of participating cryptographic devices. The proxy device may then select participating cryptographic devices on behalf of client computer 702.

[0288] In step 714, the client computer may transmit a first commitment to each of the multiple cryptographic devices (i.e., the participating cryptographic devices 704 and 708). h 1 Second commitment h 2 The decryption request may additionally include signature verification. z The client computer 702 can transmit requests via a proxy device, causing the client computer to transmit a first promise and a second promise to the proxy device, and the proxy device to transmit the first promise and the second promise to multiple participating cryptographic devices.

[0289] Figure 7B The second part of an exemplary method for distributed symmetric decryption according to some implementation schemes is shown. In step 716, optionally, the participating cryptographic devices (i.e., cryptographic devices 704 and 708) can use the verification key. vk And the first commitment h 1 and / or a second commitment h 2 To verify the signature z The participating cryptographic devices can use VerSig A function is used to verify the signature, taking the signature, the key, and a first and / or second promise as input. If the signature is valid, then... VerSig The function can produce an output of 1 or "TRUE", while if the signature verification is invalid, the function can produce an output of 0 or "FALSE".

[0290] In some implementations, the signature verification process may include using a verification key to decrypt the verification signature in order to generate an additional commitment. h a The participating cryptographic devices can then add commitments. h a With the first commitmenth 1 Second commitment h 2 and / or combinations thereof (e.g., first commitment) h 1 Second commitment h 2 The product of the signatures is compared. The signature verification process can depend on the process used to generate the verification signature. For example, if the signature verification is based solely on the first promise... h 1 If generated, the signature verification process may include the first commitment. h 1 With additional commitments h a Compare them.

[0291] In some implementations, signature verification may include a commitment (e.g., a first commitment or a second commitment) encrypted with a verification value. A verification key may correspond to the verification value. For example, the verification key may include a public key corresponding to the verification value of a private key. Participating cryptographic devices can verify the signature by decrypting it using the verification key and then comparing the output to the first or second commitment. If the output matches the first or second commitment, the signature is valid.

[0292] In step 718, the participating cryptographic devices can each generate the first part of the computation. y n,1 Part Two Calculations y n,2 The participating cryptographic devices can then combine their respective first and second part computations to produce a partial computation. y n .

[0293] For reference Figure 6B Each participating cryptographic device may use its own first secret share. u n And the first commitment h 1 The first part of the calculation to generate them y n,1 The participating cryptographic devices can use DPRF.Eval A function is used to generate these first-part computations, which evaluates a distributed pseudo-random function using a first commitment and a first secret share as parameters. In some implementations, the distributed pseudo-random function may include an elliptic curve cryptographic function that implements elliptic curve cryptography. That is, the cryptographic device can use... DPRF.Eval The functions use their respective first secret shares as keys to encrypt the first promise. Thus, each cryptographic device 604 and 606 can produce the first part of the computation.

[0294] The corresponding second secret share can be used in a similar manner. v n Second commitment h 2 To generate the second part of the calculation y n,2 As an example, cryptographic devices 704 and 708 can use... DPRF.Eval Functions (such as elliptic curve cryptography functions) use a second secret share as a key to encrypt a second promise, thereby producing a second part of the computation.

[0295] As described above, in some implementations, the first part calculates y n,1 The second part calculates y n,2 Random functions can be generated by evaluating distributed pseudo-random functions such as elliptic curve cryptography functions. This can include cryptographic devices 704 and 708 using a first secret share. s n,1 Second secret share s n,2 Encryption First Commitment h 1 Second commitment h 2 This is done to generate the first and second part of the computation, respectively. In elliptic curve cryptography, this can include transforming the first and second commitments into points in the elliptic curve group, and then exponentiating those points using the first and second secret shares, i.e., and .

[0296] Cryptographic devices 704 and 708 can each combine their respective first parts for computation. y n,1 Part Two Calculations y n,2 To generate partial calculations y n Client computer 702 can use these components to calculate and generate keys later. Cryptographic devices 704 and 708 can use... DPRF.Combine ( y n,1 , y n,2 The function takes the corresponding first and second part calculations as input to produce the output part calculation. In some implementations, DPRF.Combine Functions can include product functions that compute the product of two partial computations. For example, cryptographic devices 704 and 708 can use the following formula to generate their respective partial computations. .

[0297] In step 720, cryptographic devices 704 and 708 may optionally record in the log file the message that the client computer 702 wants to decrypt. m Cryptographic devices 704 and 708 can be based on signature verification. z The presence of a signature determines whether the client computer (702) wants to decrypt the message, because performing encryption may not require signature verification. Logging client computer behavior into a log file helps prevent abuse of distributed cryptographic systems and can be useful for security auditing.

[0298] In step 722, cryptographic devices 704 and 708 can compute their respective parts. y n The computation is transmitted to the client computer 702. In some embodiments, the client computer 702 may receive this computation from a proxy device, wherein the proxy device receives this computation from participating cryptographic devices 704 and 708.

[0299] In some implementations, the partial computation received by the client computer 702 in step 722 may be referred to as "additional partial computation," for example, because it is a partial computation other than that used in the distributed encryption process (e.g., in...). Figure 6B Step 622 in the process is received outside of the partial computation received by the client computer 602. This may be the case when the client computer 702 is using a network of cryptographic devices to decrypt data it previously encrypted (e.g., a sensitive file stored on a hard drive). In this case, the term "additional partial computation" distinguishes it from the partial computation used in encryption and decryption; however, it should be understood that one or more additional partial computations may be the same as one or more partial computations used in encryption (e.g., if the same cryptographic device is involved in both encryption and decryption operations).

[0300] In step 724, the client computer 702 can retrieve multiple check values. g un and g vn And use multiple check values ​​to verify part of the calculation. y n As per the above reference. Figure 5 The trusted external server that generates the secret value and secret share can publish verification values. The client computer can retrieve these published verification values ​​from the trusted external server, for example, via a network request. The client computer 702 can perform honest verifier zero-knowledge (HVZK) proofs to verify these partial computations. The client computer 702 can use... check The function performs the HVZK proof. The client computer 702 can call the HVZK proof process in parallel for each checksum (e.g., for...). gun Call an HVZK proof procedure, and for g vn (Call another HVZK proof procedure). check The function can be found in the reference above. Figure 6A , Figure 6B Any appropriate protocol described (e.g., Schnorr protocol, Fiat-Shamir, etc.) to perform HVZK proofs.

[0301] In step 726, the client computer 702 can combine multiple computational components to generate a cryptographic key. y The client computer 702 can use the aforementioned cryptographic key to decrypt the ciphertext. e In order to generate messages m The client computer 702 can be used. DPRF.Combine ( y 1 , y 3 A function is used to combine partial computations, which can take multiple partial computations as input and generate a symmetric cryptographic key or a key generation seed that can be used to generate a symmetric cryptographic key. This is executed by the client computer 702. DPRF.Combine The function can be similar to that executed by cryptographic devices 704 and 708. DPRF.Combine A function, because it is used to combine multiple partial computations into a single output. In some implementations, two functions combine partial computations by calculating the product of the partial computations. However, the function executed by the client computer 702... DPRF.Combine The function can first be calculated by using each part. y n The corresponding Lagrange coefficient λ n Take its power (i.e., This is used to generate intermediate calculations, and then the product of those intermediate calculations is calculated. In some implementations, a formula can be used. To calculate DPRF.Combine function output y .

[0302] These intermediate calculations can then be combined to generate a cryptographic key or a key generation seed. The client computer 702 can use the corresponding Lagrange coefficients as described in Section I above. λ n Calculate each part in a multi-part calculation y n Exponentiation (i.e., This is done to generate multiple intermediate calculations. These Lagrange coefficients λ nThis could correspond to cryptographic devices 704 and 708, which generate multiple parts of the computation. The Lagrange coefficients may have been generated by a trusted external server during the secret share provision process (see above). Figure 5 (Description). Prior to the distributed symmetric encryption process, the client computer 702 may have already received these Lagrange coefficients from a trusted external server.

[0303] As mentioned above, multiple intermediate calculations can be combined by multiplying them. These multiple intermediate calculations can be equivalent to using the first secret value separately. S 1 Second secret value S 2 The First Promise of Encryption h 1 Second commitment h 2 The product of the intermediate computations. In some implementations, the combination of intermediate computations can be used as a symmetric cryptographic key. In other implementations, the combination of intermediate computations can be used as a key generation seed. The key generation seed can be input into a key generation function to generate a cryptographic key. y .

[0304] In step 728, the client computer 702 can use the password key. y Decrypting the ciphertext e To generate messages m The client computer can perform this encryption using any suitable symmetric cryptosystem, such as AES. Optionally, the client computer can generate a message and a random value by decrypting the ciphertext. r The random value can be used in later steps to verify the first commitment. h 1 Second commitment h 2 .

[0305] In optional step 730, the client computer 702 may use a hash indicator to determine the hash used to generate the first commitment. h 1 First hash function H 1 and used to generate second commitments h 2 The second hash function H 2 A hash indicator can uniquely identify the first hash function and the second hash function. For example, a hash indicator can include a string such as "BLAKE2, SHA-256" indicating that the first hash function is the BLAKE2 hash function and the second hash function is the SHA-256 hash function.

[0306] In optional step 732, the client computer 702 can verify the first commitment. h 1 Second commitment h 2 With messages m Consistent. Client computer 702 can generate a third commitment. h 3 and the fourth commitment h 4 To perform this verification, you can use a message, a first hash function (identified in optional step 730), and an optional random value. r A third commitment is generated. A fourth commitment can be generated using the message and the second hash function (identified in optional step 730) and an optional random value. Because the first and third commitments are generated using the same hash function, the same message, and the optional same random value, they should be equal. Similarly, because the second and fourth commitments are generated using the same hash function, the same message, and the optional same random value, they should be equal. Therefore, the client computer 702 can verify the message by comparing the first commitment with the third commitment and by comparing the second commitment with the fourth commitment. If the commitments do not match, it may indicate that the message has been tampered with.

[0307] C. Amortization Encryption

[0308] Figure 8A The first part of an exemplary method for amortized distributed symmetric encryption according to some implementations is shown. This first part may involve preliminary steps to establish the values ​​required for subsequent encryption steps and includes an initial request for a cryptographic device. Figure 8B The second part of an exemplary method for amortized distributed symmetric encryption according to some implementation schemes is shown. This second part may involve distributed computation and the use of partial computation to generate batch keys and message keys for encrypting payloads.

[0309] Figure 8A An encryption device 802 (e.g., a client computer) and three cryptographic devices 804-808 are shown. Figure 8A Steps 810-816 associated with the exemplary method are also shown. Although the proxy device and communication network are not shown, communication between the encryption device 802 and the cryptographic devices 804-808 may be mediated or transmitted via the proxy device and / or the communication network.

[0310] In step 810, the encryption device 802 may optionally generate an input value (sometimes represented as...). τThis input value can include a hash corresponding to the identifier of the encryption device 802. The encryption device 802 can use the first hash function. H 0 The input value is generated using the identifier `id`. (Hash function) H 0 Identifiers can be mapped to the first multiplication loop group. G 0 This hashing step can alternatively be performed by a cryptographic device. Thus, step 810 can be optional, and the input value can alternatively include an identifier corresponding to the cryptographic device 802.

[0311] In step 812, the encryption device 802 can select multiple cryptographic devices (e.g., a predetermined threshold number of participating cryptographic devices). This threshold number of cryptographic devices can include the minimum number of participating cryptographic devices required to perform distributed symmetric encryption, or it can include all cryptographic devices that have been provided with a secret share. Figure 8A In this configuration, encryption device 802 selects cryptographic devices 804 and 806. Encryption device 802 can select participating cryptographic devices by any suitable means or selection criteria. For example, encryption device 802 can select participating cryptographic devices randomly or based on a "trust score" or "security score." For example, a trust score or security score can relate to the likelihood that a particular cryptographic device has been hacked or that the relative security of the device's hardware has been compromised (e.g., a trust score can depend on whether the cryptographic device has secure storage or a trusted platform module). Encryption device 802 can use a proxy device (not shown) to select participating cryptographic devices, for example, by transmitting a request to the proxy device for a threshold number of participating cryptographic devices. The proxy device can then select participating cryptographic devices on behalf of encryption device 802.

[0312] In step 814, encryption device 802 may transmit an encryption request, including an input value, to each of the multiple participating cryptographic devices (i.e., cryptographic devices 804 and 806). As described above, the input value may include data using a first hash function. H 0 The hash corresponds to the identifier of the encryption device 802, or the identifier of the encryption device 802. The encryption device 802 can transmit a request via a proxy device, causing the encryption device 802 to transmit the input value to the proxy device, and the proxy device to transmit the input value to multiple participating cryptographic devices.

[0313] In step 816, the participating cryptographic devices may optionally use the input value and the first hash function. H 0Generate a hash of the identifier. If the encryption device 802 does not perform step 810, and if the input value includes an identifier corresponding to the encryption device 802 instead of a hash of that identifier, then step 816 can be performed. Before generating the hash of the identifier, the participating cryptographic devices can verify or evaluate whether the input value belongs to a predetermined multiplicative cyclic group, for example... G 0 If the input value does indeed belong to a predetermined multiplicative cyclic group, this indicates that the input value includes the hash of the identifier. If the input value does not belong to a predetermined multiplicative cyclic group, this indicates that the input value includes only the identifier. If necessary, the cryptographic device can then proceed to generate the hash of the identifier.

[0314] Figure 8B The second part of an exemplary method for amortized distributed symmetric encryption according to some implementation schemes is shown.

[0315] In step 818, the participating cryptographic devices (i.e., cryptographic devices 804 and 806) can each generate a partial computation. h i Each participating cryptographic device can use its own share of the secret. sk i and identifier H 0 The hash of (id) is used to generate their respective partial computations. h i The participating cryptographic devices can use DPRF.Eval A function is used to generate these partial computations, which evaluates a distributed pseudo-random function using a hash of the secret share and the identifier as parameters. In some implementations, the distributed pseudo-random function may include an elliptic curve cryptographic function that implements elliptic curve cryptography. That is, the cryptographic device can use... DPRF.Eval The functions use their respective secret shares as cryptographic keys to encrypt the hash of the identifier. In this way, each cryptographic device 804 and 806 can produce a partial computation.

[0316] In step 820, cryptographic devices 804 and 806 can compute their respective parts. h i The data is transmitted to encryption device 802. In some implementations, encryption device 802 may receive multiple parts of computation from a proxy device, wherein the proxy device receives multiple parts of computation from participating cryptographic devices 804 and 806.

[0317] In step 822, the encryption device 802 can calculate and generate a batch key based on multiple parts. bk Encryption device 802 can generate bulk keys by combining multiple computational components, for example, using... DPRF.Combine ( h1 , h 2 A function that takes multiple computational components as input and generates a batch key, the batch key including a symmetric cryptographic key or a key generation seed that can be used to generate a symmetric cryptographic key. In some implementations, DPRF.Combine A function can combine its partial calculations by multiplying the products of those partial calculations. Or, DPRF.Combine The function can first be calculated by using each part. h i The corresponding Lagrange coefficient λ i Take its power (i.e., This is used to generate intermediate calculations, and then the product of those intermediate calculations is calculated. In some implementations, a formula can be used. To calculate the batch key.

[0318] As described above, in some implementations, cryptographic device 802 may use Lagrange interpolation to generate intermediate computations, as described in Section II. The Lagrange coefficients may correspond to cryptographic devices 804 and 806 used to generate multiple partial computations. The Lagrange coefficients may have already been generated by a trusted external server during the secret share provision process (see above reference). Figure 5 (Description). Prior to the distributed symmetric encryption process, the encryption device 802 may have already received these Lagrange coefficients from a trusted external server.

[0319] Steps 824-832 are for each message in the set of messages that the encryption device 802 wants to encrypt. m i A series of steps are performed. In step 824, the encryption device 802 can generate a random value using any suitable means. r i This includes, for example, a cryptographically secure random number generator. Then, the encryption device 802 can use the message... m i and random values r i To generate commitments α i ,Right now, α i = Com( m i || r i This promise α i It can then be used to generate messages. m i message key mk i .

[0320] In step 826, the encryption device 802 may first use the commitment α i Second hash function H 1 Hash for generating commitments H 1 ( α i The second hash function can map commitments to a multiplicative cyclic group. G 1 Then, the encryption device 802 can use the bulk key. bk Hash with commitment H 1 ( α i Perform bilinear pairing between ) e To export the corresponding message m i message key mk i ,Right now, mk i = e ( bk , H 1 ( α i As described in Section II above, the use of bilinear pairing allows distributed symmetric cryptographic systems to generate consistent message keys during encryption and decryption operations.

[0321] In step 828, the encryption device 802 can use the message key. mk i Encrypted messages m i and random values r i To generate ciphertext c i In some implementations, the encryption device 802 can use a pseudo-random generator PRG() and an XOR function ⊕ to generate ciphertext. c i The encryption device 802 can use a pseudo-random generator PRG() and a message key. mk i To generate the first value, namely, PRG( mk i Encryption device 802 can generate messages. m i and random values r i The second value of the cascade, namely, ( m i || ri The encryption device 802 can then generate ciphertext by calculating the XOR of the first and second values. c i ,Right now, c i = PRG( mk i )⊕( m i || r i ).

[0322] In step 830, the encryption device 802 can generate ciphertext. c i The identifier corresponding to the encrypted device "id" and the commitment α i effective payload p i Payload p i This can then include data groups or tuples containing these three values, i.e. p i = (id, α i , c i When dealing with each message in the set of messages. m i During steps 824-830, the encryption device 802 can thereby generate a set of payloads for the set of messages. These payloads may include information that can be used to decrypt their corresponding ciphertexts during amortized distributed symmetric decryption operations, as referenced below. Figure 9A and Figure 9B As stated above.

[0323] In step 832, the encryption device 802 may optionally transfer the set of payloads to a storage device, such as a storage server 834. The storage server 834 may include a cloud database or other suitable data storage server. Storing the payload in the storage server 834 allows the encryption device 802 or another device 804 to retrieve and decrypt the payload later, without having to store the payload locally. This can be advantageous because it can reduce the compliance burden on the encryption device 802 for certain applications, such as PCI compliance when the ciphertext corresponds to payment information.

[0324] However, in some implementations, the encryption device 802 may store the payload locally if preferred for the owner or operator of the encryption device 802. Alternatively, the encryption device 802 may transmit the payload to a decryption device (e.g., another client computer). The decryption device can use the information in the payload to decrypt the ciphertext and retrieve the message. This can be useful when the message includes sensitive payment information. As an example, the encryption device may include a payment terminal associated with a merchant. When a customer uses the encryption device 802 to make a payment, the encryption device 802 may encrypt the customer's payment information and generate a payload, which is then sent to the bank computer corresponding to those customers (e.g., a bank maintaining accounts on behalf of those customers). The bank computer can use the information in the payload to decrypt the customer's payment information and make the payment between the merchant and the customer.

[0325] D. Deciphering Amortization

[0326] Figure 9A The first part of an exemplary method for amortized distributed symmetric decryption according to some implementations is shown. This first part may involve preliminary steps to establish the values ​​required for subsequent decryption steps and includes sending input values ​​to a cryptographic device. Figure 9B The second part of an exemplary method for amortized distributed symmetric decryption according to some implementation schemes is shown. This second part may involve distributed computation and using partial computation to generate the message key for decrypting the payload.

[0327] Figure 9A The diagram shows a decryption device 902 (e.g., a client computer), three cryptographic devices 904-908, and a storage server 910. Figure 9A Steps 912-920 associated with the exemplary method are also shown. Although the proxy device and communication network are not shown, communication between the decryption device 902 and the cryptographic devices 904-908 may be mediated or transmitted via the proxy device and / or the communication network.

[0328] In step 912, the decryption device 902 can receive messages corresponding to the message. m ciphertext c effective payload p The payload may additionally include commitments. αAnd an identifier corresponding to the encryption device "id". In some implementations, the decryption device 902 may transmit a request message requesting a payload to the storage server 910. Subsequently, the storage server 910 may transmit the payload to the decryption device 902. The request message may include information allowing the storage server 910 to query a database or other suitable data structure to identify the payload. For example, the decryption device 902 may provide the storage server with an identifier and a timestamp, enabling the storage server 910 to query the database for a payload corresponding to the identifier and the timestamp. Alternatively, the decryption device 902 may receive the payload directly from another client computer, such as the encryption device, or the decryption device 902 may have already stored the payload locally and retrieve it from its own memory elements (e.g., if the decryption device 902 has previously encrypted the payload).

[0329] In optional step 914, the decryption device 902 can generate the input value (sometimes represented as...). τ The input value can be used as input to a distributed pseudo-random function used to generate the message key. This input value can include random numbers. μ Alternatively, there can be two input values, including an identifier (id) and a commitment. α or the hash of the identifier H 0 (id) and hash of commitment H 1 ( α If the random number is generated by a cryptographic device rather than a decryption device. μ (For example, in optional step 920), this may be the case.

[0330] Decryption devices can calculate the hash of the identifier. H 0 (id) hash with commitment H 1 ( α Bilinear pairing between ) e The result is used to generate random numbers μ c, that is, Hash of identifiers H 0 (id) can be hashed using the first hash function. H 0 The hash is generated using () and an identifier corresponding to the encryption device ID. First hash function H 0 () can map its input to the first multiplication cyclic group. G 0 A second hash function can be used. H 1 () and commitmentα To generate a hash of commitments H 1 ( α Second hash function H 1 () can map its input to the second multiplication cyclic group. G 1 .

[0331] In step 916, the decryption device 902 can select multiple cryptographic devices (e.g., a predetermined threshold number of participating cryptographic devices). This threshold number of participating cryptographic devices can include the minimum number of participating cryptographic devices required to perform distributed symmetric encryption, or it can include all cryptographic devices that have been provided with a share of the secret. Figure 9A In this process, decryption device 902 selects cryptographic devices 904 and 908. It is worth noting that the selected cryptographic devices 904 and 908 do not need to participate in the generation of the payload. p The encryption process. Decryption device 902 can select participating cryptographic devices by any suitable means or selection criteria. For example, decryption device 902 can select participating cryptographic devices randomly or based on a "trust score" or "security score." For example, a trust score or security score can relate to the likelihood that a particular cryptographic device has been hacked or that the relative security of the device's hardware has been compromised (e.g., a trust score can depend on whether the cryptographic device has secure storage or a trusted platform module). Decryption device 902 can use a proxy device (not shown) to select participating cryptographic devices, for example, by transmitting a request to the proxy device for a threshold number of participating cryptographic devices. The proxy device can then select participating cryptographic devices on behalf of decryption device 902.

[0332] In step 918, decryption device 902 may transmit a decryption request, comprising one or more input values, to each of the participating cryptographic devices (i.e., cryptographic devices 904 and 908). This request may also be referred to as an "additional request" to distinguish it from the request transmitted during the encryption process. The input value may include a random number. μ Or the identifier id and commitment α One or more input values ​​may depend on whether the decryption device 902 generates a random number in optional step 914. μ Or does the decryption device 902 rely on a cryptographic device to generate random numbers? μ The decryption device 902 can transmit requests via a proxy device, causing the decryption device to transmit one or more input values ​​to the proxy device, and the proxy device to transmit one or more input values ​​to multiple participating cryptographic devices.

[0333] In optional step 920, the participating cryptographic devices can generate random numbers. μ If decryption device 902 does not perform step 914, this step can be performed by the participating cryptographic devices. For example, in step 914, a random number... μ Hash of identifiers H 0 (id)(using the first hash function) H 0 ()) Generation and commitment hash H 1 ( α Bilinear pairings between (generated using the second hash function) e The result is that, .

[0334] Figure 9B The second part of an exemplary method for amortized distributed symmetric decryption according to some implementation schemes is shown.

[0335] In step 922, the participating cryptographic devices (i.e., cryptographic devices 904 and 908) can each use their respective secret share and random number. μ Generate part calculation h i ( Figure 9B The diagram shows the corresponding cryptographic device 904. h 1 And corresponding to cryptographic device 908 h 2 Multiple participating cryptographic devices can generate multiple secret shares based on the secret value and one or more input values ​​received in step 918. sk i ( sk 1 and sk 3 This is used to generate partial computations. Partial computations are generated directly from one or more input values ​​(i.e., one or more input values ​​include random numbers). μ Or indirectly, because a cryptographic device can first generate random numbers using one or more input values. μ (That is, in optional step 920).

[0336] The participating cryptographic devices can be used DPRF.Eval A function is used to generate these partial computations, the function using secret shares and random numbers. μ The distributed pseudo-random function is used as an independent variable to evaluate the distributed pseudo-random function. In some implementations, the distributed pseudo-random function may include an elliptic curve cryptographic function that implements elliptic curve cryptography. That is, the cryptographic device can use... DPRF.Eval Functions use their respective secret shares sk iUsed as a cryptographic key to encrypt random numbers μ In this way, each cryptographic device, 904 and 908, can generate a portion of the computation. h 1 and h 3 .

[0337] In step 924, cryptographic devices 904 and 908 can compute their respective parts. h i The data is transmitted to decryption device 902. In some implementations, decryption device 902 may receive multiple parts of the computation from a proxy device, wherein the proxy device receives multiple parts of the computation from participating cryptographic devices 904 and 908.

[0338] In step 926, the decryption device can calculate and generate a message key based on multiple parts. mk This message key can be called the additional message key to distinguish it from the message key generated during the encryption process. The decryption device 902 can, for example, use... DPRF.Combine ( h 1 , h 3 A function combines multiple computational components to generate a message key; the function can take multiple computational components as input and produce a message key. In some implementations, DPRF.Combine A function can combine its partial calculations by multiplying the products of those partial calculations. Or, DPRF.Combine The function can first be calculated by using each part. h i The corresponding Lagrange coefficient λ i Take its power (i.e., λ i (ie, This is used to generate intermediate calculations, and then the product of those intermediate calculations is calculated. In some implementations, a formula can be used. To calculate the message key.

[0339] As described above, in some implementations, decryption device 902 may use Lagrange interpolation to generate intermediate computations, as described in Section II. The Lagrange coefficients may correspond to cryptographic devices 904 and 908 used to generate multiple partial computations. The Lagrange coefficients may have already been generated by a trusted external server during the secret share provision process (see above reference). Figure 5 (Description). The decryption device 902 may have received these Lagrange coefficients from a trusted external server before the distributed symmetric encryption process.

[0340] In step 928, the decryption device 902 can decrypt the ciphertext.c (Sometimes called "additional ciphertext"), so that the message key can be used. mk Received information m and random values r In some implementations, the decryption device 902 can use a pseudo-random generator PRG() and the XOR function ⊕ to decrypt the ciphertext. c For example, using the formula ( m || r ) = PRG( mk )⊕ c .

[0341] Decrypting the message m Afterwards, the decryption device 902 can verify that the decryption process was correctly executed in steps 930 and 932.

[0342] In step 930, the decryption device 902 can use the message m and random values r Generate a second commitment α’ ,Right now, α’ =Com( m || r If the message and random value are correctly decrypted, the promise generated by the decryption device 902 should be equal to the original promise. α .

[0343] In step 932, the decryption device 902 can decrypt the promise by comparing the commitment. α With the second commitment α’ To verify the message m It was successfully decrypted.

[0344] VI. Amortization Secret Share Update Process

[0345] In the AmorTiSE system, regularly updating the secret value and secret share can be advantageous. This update process can improve system security by reducing the probability that an attacker could recover the secret value and decrypt the ciphertext.

[0346] Similar to the process of providing secret shares (see above) Figure 4 As described in Section IV, a trusted external server can generate a new secret value (sometimes called an "attached secret value"), then derive an additional secret share from the additional secret value (e.g., using a Shamir secret share), and distribute the additional secret share to cryptographic devices in the network of cryptographic devices. The cryptographic devices can then use the additional secret share in future encryption and decryption operations.

[0347] Furthermore, in order to decrypt previously encrypted ciphertext, a trusted external server can generate an update token. This update token can be transmitted to a storage server storing the payload corresponding to the previously encrypted ciphertext. The storage server can use this update token to update the payload corresponding to the ciphertext encrypted using the old secret share. Specifically, the storage server can use the update token to update the commitments corresponding to the payload by performing a group exponentiation on those commitments using the update token.

[0348] To generate an update token, the trusted external server can first collect old secret shares from participating cryptographic devices. Using the old secret shares, the trusted external server can generate secret values ​​for deriving these secret shares, for example, using Lagrange interpolation. The trusted external server can then generate an update token based on the old secret values ​​and an additional secret value. The update token may include, for example, a ratio of the old secret value to the additional secret value.

[0349] Figure 10 A mixed sequence diagram is shown, detailing the secret share update process according to some implementation schemes. Figure 10 A secret share distribution system 1000 is illustrated, comprising a trusted external server 1002, a communication network 1004, and a cryptographic device network 1012, the cryptographic device network including optional proxy devices 1006 and multiple cryptographic devices, including cryptographic devices 1008 to 1010. Additionally, the secret share distribution system 1000 includes a storage server 1014.

[0350] In step 1016, the trusted external server 1002 may transmit a request to update the secret value to the cryptographic device network 1012 via a communication network 1004 (e.g., the Internet) and via an optional proxy device 1006. The request may be a request for a secret share, which the trusted external server 1002 can use to generate the secret value and an update token. The request may be digitally signed or include trusted external server credentials. This digital signature or credentials can prove that the request originates from the trusted external server 1002 and not from a hacker or other malicious actor. The request may also be encrypted.

[0351] In step 1018, the cryptographic devices in the cryptographic device network 1012, including cryptographic devices 1008 and 1010, can transmit their respective secret shares to the trusted external server 1002 via the communication network 1004. Before transmitting their respective secret shares, the cryptographic devices in the cryptographic device network 1012 can verify that the request to update the secret value is legitimate, for example, by verifying the digital signature or credentials included in the request. The cryptographic devices can encrypt their respective secret shares to securely transmit the secret shares via the communication network 1004. Alternatively, the cryptographic devices can transmit their respective secret shares to a proxy device 1006, and the proxy device 1006 can transmit the secret shares to the trusted external server 1002 via the communication network 1004. In some embodiments, the trusted external server 1002 may already have a copy of the secret value used to generate the secret shares. In these embodiments, step 1018 is optional.

[0352] In step 1020, the trusted external server 1002 can generate a secret value using a secret share received from a cryptographic device in the cryptographic device network 1012. Depending on the secret sharing scheme used, different techniques can be used to generate the secret value. For example, if the Shamir secret sharing scheme is used to generate the secret share, the trusted external server 1002 can use a polynomial interpolation technique (such as Lagrange interpolation) to generate the secret value, as described in Section II above. In some embodiments, the trusted external server 1002 may already have a copy of the secret value used to generate the secret share. In these embodiments, step 1020 is optional.

[0353] In step 1022, the trusted external server 1002 can generate an additional secret value and, based on the additional secret value, generate multiple additional secret shares. The trusted external server 1002 can use any suitable technique to generate the additional secret value, such as using a cryptographically secure random number generator. The trusted external server 1002 can use techniques such as Shamir secret sharing to generate additional secret shares based on the additional secret value. For example, the trusted external server can encode the additional secret value into a polynomial, then sample the polynomial at multiple different input values, and then use the resulting points (i.e., input-output pairs) as additional secret shares.

[0354] In step 1024, the trusted external server 1002 can generate an update token based on the secret value and an additional secret value. In some implementations, the update token Δ is equal to the secret value. S With additional secret value S’ The ratio, i.e., Δ = S / S’ .

[0355] In step 1026, the trusted external server 1002 may transmit an update token to the storage server 1014 via the communication network 1004. The trusted external server 1002 may also transmit a digital signature or credential indicating that the update token originates from the trusted external server 1002. The trusted external server 1002 may additionally transmit an identifier that the storage server 1014 can use to identify the set of payloads that the update token can be used to update.

[0356] In step 1028, storage server 1014 can use an update token to update one or more commitments corresponding to one or more payloads. Storage server 1014 can use any information included with the update token to identify these commitments and payloads. For example, storage server 1014 can receive an identifier that storage server 1014 can use to query the database to identify the relevant payload. Storage server 1014 can update the commitments by performing a group exponentiation on the commitments using the update token. That is, for commitments... α id effective payload c id And for the update token Δ, the storage server can use Δ: right α id Perform group exponentiation, then use the payload c id The commitment Replacement commitment α id This allows for the renewal of one or more commitments.

[0357] In step 1030, the trusted external server 1002 may transmit an additional secret share to cryptographic devices in the cryptographic device network 1012 via the communication network 1004 and an optional proxy device 1006. The additional secret share may be encrypted for secure transmission via these intermediaries.

[0358] In step 1032, the cryptographic devices in the cryptographic device network 1012, including cryptographic devices 1008 and 1010, can store additional secret shares in their respective secure memory elements (e.g., from...). Figure 3 In the secure memory element 314). Cryptographic devices can selectively delete old secret shares from their secure memory elements to complete the update process.

[0359] VII. Computer System

[0360] Any computer system mentioned in this article can utilize any suitable number of subsystems. Examples of such subsystems are... Figure 11The computer system 1100 is shown in the diagram. In some embodiments, the computer system includes a single computer device, wherein a subsystem may be a component of the computer device. In other embodiments, the computer system may include multiple computer devices having internal components, each of which is a subsystem. The computer system may include desktop and laptop computers, tablet computers, mobile phones, and other mobile devices.

[0361] Figure 11 The subsystems shown are interconnected via system bus 1112. Additional subsystems are shown, such as printer 1108, keyboard 1118, storage device 1120, monitor 1124 (e.g., display screen, such as LED) coupled to display adapter 1114, etc. Peripheral devices and input / output (I / O) devices coupled to I / O controller 1102 can be connected via various means known in the art, such as input / output (I / O) port 1116 (e.g., USB, FireWire). ® The system 700 is connected to a computer system. For example, I / O port 1116 or external interface 1122 (e.g., Ethernet, Wi-Fi, etc.) can be used to connect computer system 700 to a wide area network (such as the Internet), a mouse input device, or a scanner. Interconnection via system bus 1112 allows central processing unit 1106 to communicate with each subsystem and control the execution of multiple instructions from system memory 1104 or storage device 1120 (e.g., a fixed disk such as a hard disk drive or optical disc), as well as the exchange of information between subsystems. System memory 1104 and / or storage device 1120 may be embodied in a computer-readable medium. Another subsystem is data collection device 1110, such as a camera, microphone, accelerometer, etc. Any data mentioned herein can be output from one component to another and can be output to the user.

[0362] A computer system may include multiple identical components or subsystems, for example, connected together via an external interface 1122, an internal interface, or via a removable storage device that can be connected to and removed from one component. In some embodiments, the computer system, subsystem, or device may communicate over a network. In such cases, one computer may be considered a client and another computer may be considered a server, where each computer may be part of the same computer system. The client and server may each include multiple systems, subsystems, or components.

[0363] Various aspects of the implementation scheme can be implemented using hardware circuitry (e.g., application-specific integrated circuits or field-programmable gate arrays) and / or in a modular or integrated manner using computer software in the form of control logic via a generally programmable processor. As used herein, the processor may include a single-core processor, a multi-core processor on the same integrated chip, or multiple processing units on a single circuit board or networked, as well as dedicated hardware. Based on the disclosure and teachings provided herein, those skilled in the art will recognize and understand other ways and / or methods of implementing the embodiments of this disclosure using hardware and combinations of hardware and software.

[0364] Any software component or function described in this application may be implemented as processor-executable software code using any suitable computer language such as Java, C, C++, C#, Objective-C, Swift, or a scripting language such as Perl or Python, employing conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer-readable medium for storage and / or transmission. Suitable media include random access memory (RAM), read-only memory (ROM), magnetic media (such as hard disk drives or floppy disks), or optical media (such as optical discs (CDs) or DVDs (Digital Universal Discs)), flash memory, etc. The computer-readable medium may be any combination of such storage or transmission devices.

[0365] Such programs can also be encoded and transmitted using carrier signals suitable for transmission over wired, optical, and / or wireless networks conforming to various protocols, including the Internet. Therefore, computer-readable media according to embodiments of the invention can be created using data signals encoded with such programs. Computer-readable media encoded with program code can be packaged with compatible devices or provided separately from other devices (e.g., downloaded via the Internet). Any such computer-readable medium can reside on or within a single computer product (e.g., a hard disk drive, CD, or an entire computer system) and can exist on or within different computer products within a system or network. The computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0366] Any method described herein can be performed, wholly or partially, by a computer system including one or more processors that can be configured to perform these steps. Therefore, embodiments may involve a computer system configured to perform the steps of any method described herein, possibly having different components that perform corresponding steps or groups of corresponding steps. Although presented as numbered steps, the steps of the methods herein may be performed simultaneously or in different orders. Furthermore, portions of these steps may be used in conjunction with portions of other steps from other methods. Similarly, all or part of a step may be optional. Additionally, any step of any method may be performed using modules, circuitry, or other means for performing these steps.

[0367] Specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of the embodiments of the invention. However, other embodiments of the invention may relate to specific embodiments associated with each individual aspect, or specific combinations of these individual aspects. The description of exemplary embodiments of the invention above has been presented for purposes of illustration and description. It is not intended to be exhaustive, or to limit the invention to the precise forms described; many modifications and variations are possible in accordance with the teachings above. These embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling those skilled in the art to best utilize the invention in various embodiments and to make various modifications suitable for the particular intended use.

[0368] The above description is illustrative and not restrictive. Many variations of the invention will become apparent to those skilled in the art upon reading this disclosure. Therefore, the scope of the invention should not be determined by reference to the above description, but rather by reference to the pending claims and their full scope or equivalents.

[0369] Without departing from the scope of the invention, one or more features of any embodiment may be combined with one or more features of any other embodiment.

[0370] Unless explicitly indicated otherwise, the use of “a / kind” or “the” is intended to mean “a / kind or a plurality of / kinds”. Unless explicitly indicated otherwise, the use of “or” is intended to mean “inclusive or” rather than “exclusive or”.

[0371] All patents, patent applications, publications, and descriptions mentioned herein are incorporated herein by reference in their entirety for all purposes. They are not acknowledged as prior art.

Claims

1. A method for encryption, the method comprising being performed by a computer system: The first commitment is generated using the message and the first hash function; The second commitment is generated using the message and the second hash function; The request, including the first commitment and the second commitment, is transmitted to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a first plurality of secret shares generated from a first secret value and a second plurality of secret shares generated from a second secret value; Multiple partial calculations are received from the plurality of cryptographic devices, wherein each of the plurality of partial calculations is generated by a corresponding cryptographic device among the plurality of cryptographic devices using a corresponding first partial calculation and a corresponding second partial calculation, wherein the corresponding first partial calculation is generated using a corresponding first secret share and a first commitment, and wherein the corresponding second partial calculation is generated using a corresponding second secret share and a second commitment; A cryptographic key is generated based on the aforementioned multiple components; Ciphertext is generated by encrypting the message using the cryptographic key; as well as Generate a payload that includes the ciphertext, the first commitment, and the second commitment.

2. The method of claim 1, wherein the payload further includes a signature verification function, and further includes: Receive multiple partial signatures from the plurality of cryptographic devices, wherein each of the plurality of partial signatures is generated by a corresponding cryptographic device among the plurality of cryptographic devices using a corresponding verification share among a plurality of verification shares and the first commitment and / or the second commitment; as well as The verification signature is generated based on the multiple partial signatures.

3. The method of claim 1, further comprising, after receiving the plurality of partial computations from the plurality of cryptographic devices: Multiple check values ​​are retrieved, and these multiple check values ​​correspond to the multiple part calculations; and The multiple check values ​​are used to verify the multiple partial calculations.

4. The method of claim 1, wherein: Generating the first commitment also includes generating the first commitment by additionally using random values; Generating the second commitment also includes generating the second commitment by additionally using the random value; and Generating ciphertext by encrypting the message using the cryptographic key includes generating ciphertext by encrypting the message and the random value using the cryptographic key.

5. The method of claim 1, further comprising, before generating the first commitment and the second commitment: The first hash function and the second hash function are randomly selected from a plurality of hash functions.

6. The method of claim 1, wherein: Transmitting the first and second commitments to the plurality of cryptographic devices includes transmitting the first and second commitments to a proxy device, wherein the proxy device transmits the first and second commitments to the plurality of cryptographic devices; and Receiving the plurality of partial computations from the plurality of cryptographic devices includes receiving the plurality of partial computations from the proxy device, wherein the proxy device receives the plurality of partial computations from the plurality of cryptographic devices.

7. The method of claim 1, wherein the plurality of cryptographic devices includes at least a predetermined threshold number of cryptographic devices, and wherein the predetermined threshold number of cryptographic devices is less than the total number of cryptographic devices.

8. The method of claim 1, wherein generating the cryptographic key based on the plurality of parts comprises: The corresponding Lagrange coefficients are used to power each of the multiple partial calculations to generate multiple intermediate calculations. Calculate the product of the multiple intermediate calculations; as well as The cryptographic key is generated based on the product of the multiple intermediate calculations.

9. The method of claim 1, further comprising: The first commitment and the second commitment are transmitted to each of a plurality of additional cryptographic devices, the plurality of additional cryptographic devices storing a third plurality of secret shares generated from the first secret value and a fourth plurality of secret shares generated from the second secret value; Multiple additional part calculations are received from the plurality of additional cryptographic devices, wherein each of the plurality of additional part calculations is generated by a corresponding additional cryptographic device among the plurality of additional cryptographic devices using a corresponding third part calculation and a corresponding fourth part calculation, wherein the corresponding third part calculation is generated using a corresponding third secret share and the first commitment, and wherein the corresponding fourth part calculation is generated using a corresponding fourth secret share and the second commitment; The cryptographic key is generated based on the multiple additional components; as well as The ciphertext is decrypted using the cryptographic key to generate the message.

10. The method of claim 9, wherein: One or more of the plurality of cryptographic devices are the same as one or more of the plurality of additional cryptographic devices; One or more of the first secret shares in the first plurality of secret shares are identical to one or more of the fourth secret shares in the fourth plurality of secret shares; and One or more of the second secret shares in the second plurality of secret shares are the same as one or more of the fourth secret shares in the fourth plurality of secret shares.

11. A method for decryption, the method comprising being performed by a computer system: Receive a payload comprising ciphertext, a first commitment, and a second commitment, wherein the first commitment is generated using a message and a first hash function, and the second commitment is generated using the message and the second hash function; The request, including the first commitment and the second commitment, is transmitted to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a first plurality of secret shares generated from a first secret value and a second plurality of secret shares generated from a second secret value; Multiple partial calculations are received from the plurality of cryptographic devices, wherein each of the plurality of partial calculations is generated by a corresponding cryptographic device among the plurality of cryptographic devices using a corresponding first partial calculation and a corresponding second partial calculation, wherein the corresponding first partial calculation is generated using a corresponding first secret share and a first commitment, and wherein the corresponding second partial calculation is generated using a corresponding second secret share and a second commitment; A cryptographic key is generated based on the aforementioned multiple components; as well as The ciphertext is decrypted using the cryptographic key to generate the message.

12. The method of claim 11, wherein: The payload also includes a verification signature; The request further includes the signature verification; and The plurality of cryptographic devices use a verification key, the first commitment, and / or the second commitment to verify the verification signature.

13. The method of claim 11, wherein the payload further includes a hash indicator, and wherein the method further comprises: The hash indicator is used to determine the first hash function and the second hash function; A third commitment is generated using the message and the first hash function; The fourth commitment is generated using the message and the second hash function; as well as The message is verified by comparing the first commitment with the third commitment and by comparing the second commitment with the fourth commitment.

14. The method of claim 13, wherein: In addition to the message and the first hash function, a random value is used to generate the first commitment; In addition to the message and the second hash function, the random value is also used to generate the second commitment; In addition to the message and the first hash function, the random value is also used to generate the third commitment; and In addition to the message and the second hash function, the random value is also used to generate the fourth commitment.

15. A method for enabling encryption, the method comprising being performed by a cryptographic device: A request is received from a client computer, the request including a first commitment generated using a message and a first hash function, and a second commitment generated using the message and a second hash function; The first part of the calculation is generated based on the first secret share and the first commitment; The second part of the calculation is generated based on the second secret share and the second commitment; Partial calculations are generated by combining the first part of the calculation and the second part of the calculation. as well as The partial computation is transmitted to the client computer, thereby enabling the client computer to: (1) generate a cryptographic key using the partial computation, (2) encrypt the message using the cryptographic key to generate ciphertext, and (3) generate a payload including the ciphertext, the first commitment, and the second commitment.

16. The method of claim 15, further comprising receiving the first secret share and the second secret share from a trusted external server before receiving the request from the client computer, wherein the trusted external server also transmits one or more other secret shares to one or more other cryptographic devices.

17. The method of claim 15, further comprising: A partial signature is generated based on the first commitment and / or the second commitment and the verification share; as well as The partial signature is transmitted to the client computer, enabling the client computer to generate a verification signature using the partial signature.

18. The method of claim 17, further comprising: Receive the verification signature, the first commitment, and the second commitment from the client computer; The verification signature is verified using the verification key and the first commitment and / or the second commitment; The first part of the calculation is generated based on the first commitment and the first secret share; The second part of the calculation is generated based on the second commitment and the second secret share; The partial computation is generated by combining the first commitment and the second commitment; as well as The partial computation is transmitted to the client computer, whereby the client computer uses the partial computation to generate the cryptographic key and uses the cryptographic key to decrypt the ciphertext to produce the message.

19. The method of claim 18, wherein verifying the verification signature using the verification key and the first commitment and / or the second commitment comprises: Use the verification key to decrypt the verification signature to generate an additional commitment; as well as The additional commitment is compared with the first commitment, the second commitment, and / or a combination thereof.

20. The method of claim 18, further comprising: Receive an indicator from the client computer indicating that the client computer wants to decrypt the message; as well as The client computer records the message it wants to decrypt in a log file.

21. A method for encryption, the method comprising being performed by an encryption device: A request including an input value is transmitted to each of a plurality of cryptographic devices, the plurality of cryptographic devices storing a plurality of secret shares generated from a secret value, wherein the input value includes an identifier corresponding to the cryptographic device or a hash corresponding to the identifier of the cryptographic device; Receive multiple partial calculations from the plurality of cryptographic devices, wherein the plurality of partial calculations are generated by the plurality of cryptographic devices using the plurality of secret shares and the input value; A batch key is generated based on the aforementioned multiple components; as well as For each message in a set of messages: A commitment is generated using the message and the random value; The hash of the commitment is generated using the commitment and the second hash function; A bilinear pairing is performed between the bulk key and the hash of the commitment to obtain the message key; Ciphertext is generated by encrypting the message and the random value using the message key; and Generate a payload including the ciphertext, the identifier corresponding to the encryption device, and the commitment, thereby generating a set of payloads for the set of messages.

22. The method of claim 21, wherein the input value includes the identifier corresponding to the encryption device, and wherein the plurality of cryptographic devices use the identifier corresponding to the encryption device and a first hash function to generate the hash corresponding to the identifier of the encryption device.

23. The method of claim 21, wherein the input value comprises the hash corresponding to the identifier of the cryptographic device, and wherein the method further comprises: The hash of the identifier is generated using the identifier corresponding to the encryption device and the first hash function.

24. The method of claim 21, further comprising: The set of payloads is transmitted to the storage device.

25. The method of claim 21, wherein generating the batch key based on the plurality of parts comprises: Each part is exponentiated using the corresponding Lagrange coefficients, thus generating multiple intermediate calculations; Calculate the product of the intermediate calculations; as well as The batch key is generated based on the product of the multiple intermediate calculations.

26. The method of claim 21, wherein generating the ciphertext by encrypting the message and the random value using the message key comprises: A first value is generated using a pseudo-random generator and the message key; Generate a second value that is a concatenation of the message and the random value; as well as The ciphertext is generated by calculating the XOR of the first value and the second value.

27. The method of claim 21, further comprising: A random number is generated by calculating the result of a bilinear pairing between the hash of the identifier corresponding to the encryption device and the hash of the commitment, wherein the hash of the identifier is generated using the identifier and a first hash function, and wherein the hash of the commitment is generated using the commitment and a second hash function; An additional request, including the random number, is transmitted to multiple additional cryptographic devices, each of which stores multiple additional secret shares generated from the secret value. Receive additional multiple part calculations from the additional multiple cryptographic devices, wherein the additional multiple part calculations are generated by the additional multiple cryptographic devices using the additional multiple secret shares and the random number; An additional message key is generated based on the additional multiple parts; as well as Use the additional message key to decrypt the ciphertext corresponding to the payload in the set of payloads.

28. A method for decryption, the method comprising being performed by a decryption device: Receive a payload, the payload including ciphertext corresponding to a message, a commitment, and an identifier corresponding to an encryption device; A request including one or more input values ​​is transmitted to multiple cryptographic devices, each of which stores multiple secret shares generated from secret values, wherein the one or more input values ​​include (1) a random number or (2) the promise and the identifier corresponding to the cryptographic device, wherein the random number includes the result of a bilinear pairing between a hash of the identifier corresponding to the cryptographic device and a hash of the promise; Receive multiple partial calculations from the plurality of cryptographic devices, wherein the multiple partial calculations are generated by the plurality of cryptographic devices (i) using the plurality of secret shares and the random number included in the one or more input values, or (ii) using the plurality of secret shares and a calculated random number, the calculated random number being calculated by each of the cryptographic devices based on a bilinear pairing between the hash value of the identifier corresponding to the cryptographic device and the hash value of the commitment included in the one or more input values; A message key is generated based on the aforementioned multiple components; as well as The ciphertext is decrypted using the message key to obtain the message.

29. The method of claim 28, wherein receiving the payload comprises: The request message is transmitted to the storage server, and the request message requests the payload. as well as Receive the payload from the storage server.

30. The method of claim 28, wherein the one or more input values ​​include the identifier corresponding to the cryptographic device and the commitment, and wherein the plurality of component calculations are generated by the plurality of cryptographic devices using the plurality of secret shares and the random number, the random number being calculated based on a bilinear pairing result between the hash of the identifier and the hash of the commitment, wherein the hash of the identifier is generated using the identifier corresponding to the cryptographic device and a first hash function, and wherein the hash of the commitment is generated using the commitment and a second hash function.

31. The method of claim 28, wherein the one or more input values ​​include the random number, and wherein the method further comprises: The random number is generated by calculating the result of the bilinear pairing between the hash of the identifier and the hash of the commitment, wherein the hash of the identifier is generated using the identifier corresponding to the encryption device and a first hash function, and wherein the hash of the commitment is generated using the commitment and a second hash function.

32. The method of claim 28, wherein decrypting the ciphertext further generates a random value, and wherein the method further comprises: A second commitment is generated using the message and the random value; as well as The message is verified to have been successfully decrypted by comparing the stated commitment with the second commitment.

33. A method for encryption, the method comprising being performed by a cryptographic device: Receive a request from an encryption device that includes an input value, wherein the input value includes an identifier corresponding to the encryption device or a hash corresponding to the identifier of the encryption device; Calculated based on the secret share generated from the secret value and the input value; as well as The partial computation is transmitted to the encryption device, thereby enabling the encryption device to: (1) generate a bulk key using the partial computation; (2) generate a message key for each message in a set of messages using the result of a bilinear pairing between the bulk key and a hash of a promise generated from the message and a random value; (3) generate ciphertext for each message in the set of messages by encrypting the message and the random value using the message key; and (4) generate a payload for each message in the set of messages, including the ciphertext, the identifier corresponding to the encryption device, and the promise generated from the message and the random value.

34. The method of claim 33, further comprising: Verify that the input value belongs to a predetermined multiplication cyclic group.

35. The method of claim 33, wherein the input value includes the hash of the identifier corresponding to the encryption device, and wherein the hash of the identifier corresponding to the encryption device is generated by the encryption device using a first hash function.

36. The method of claim 33, wherein the input value includes the identifier corresponding to the cryptographic device, and wherein the method further comprises: The hash of the identifier is generated using the identifier corresponding to the encryption device and the first hash function.

37. The method of claim 33, further comprising: Receive a random number from the decryption device, wherein the random number comprises the result of a bilinear pairing of the hash of the identifier and the hash of the commitment, the hash of the identifier being generated using the identifier and a first hash function corresponding to the encryption device, and the hash of the commitment being generated using the commitment and a second hash function; Calculated based on the secret share and the additional part generated by the random number; as well as The additional part is computed and transmitted to the decryption device, thereby enabling the decryption device to: (1) use the part to compute and generate an additional message key, and (2) use the additional message key to decrypt the additional ciphertext to generate the message.

38. The method of claim 33, further comprising, before receiving the request from the cryptographic device: receiving the secret share from a trusted external server, wherein the trusted external server also transmits one or more other secret shares to one or more other cryptographic devices.

39. The method of claim 33, further comprising: Receive a request to update the secret value from a trusted external server; The secret share is transmitted to the trusted external server, wherein the trusted external server receives one or more additional secret shares from one or more additional cryptographic devices, generates the secret value, generates an additional secret value, generates an update token based on the secret value and the additional secret value, generates a plurality of additional secret shares including the additional secret share based on the additional secret value, and transmits the update token to the storage server, wherein the storage server uses the update token to update one or more commitments corresponding to one or more payloads; as well as Receive the additional secret share from the trusted external server.

40. A computer system, the computer system comprising: processor; and A non-transient computer-readable medium coupled to the processor, the non-transient computer-readable medium comprising code executable by the processor to implement the method as described in any one of claims 1 to 39.

Images