Computer implemented system and method for sharing common secret

Abstract

To provide a method and a system for sharing a first common secret among a plurality of nodes for enabling secure communication for block chain transactions.SOLUTION: A method includes the steps of: determining a plurality of second common secrets each of which is common to a first node and a second node, is determined at the first node on the basis of a first private key of the first node and a first public key of the second node, and is determined at the second node on the basis of the first private key of the second node and the first public key of the first node; encrypting a share of a first common secret that has to be notified to the first node in the first node by determining a third common secret that is common in the second node and a third node in the second node, a third common secret common to the second node and a third node being determined for the second node; encrypting, at the first node, shares of the first common secret known to the first node, and transmitting the encrypted shares to the second nodes; receiving, from the second node, the encrypted shares of the first common secret to enable reaching a threshold number of shares of the first common secret to access the first common secret.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] The present disclosure relates generally to a method for sharing a common secret among multiple nodes, and in particular to a method for sharing a common secret among at least three nodes. The present disclosure may be particularly, but not exclusively, suitable for use in cryptography to enable secure communication between the nodes, and may be particularly, but not exclusively, suitable for use with digital wallets, blockchain (e.g., Bitcoin) technology, and personal device security. [Background technology]

[0002] In this specification, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. Although other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referred to herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" herein may refer to a human or processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system, and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are chained together to create a permanent, immutable record of all transactions written to the blockchain since origin. Transactions contain small programs, known as scripts, that embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a scripting language based on the stack.

[0004] In order for a transaction to be written to the blockchain, it must be validated. Network nodes (miners) perform the work to ensure that invalid transactions are rejected from the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, for a transaction to be written to the blockchain, it must be (i) validated by the first node that receives the transaction, and if the transaction is valid, the node relays the transaction to other nodes in the network, (ii) added to a new block constructed by miners, and (iii) mined, i.e., added to the public ledger of past transactions.

[0005] Although blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to exploit the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field.

[0006] Such solutions could leverage the benefits of blockchains (e.g., permanence, tamper-resistance of event records, decentralized processing, etc.) while making their uses more diverse.

[0007] International patent application WO2017 / 145016 discloses a method for sharing a common secret between two nodes to enable secure communication between the nodes.

[0008] However, it is desirable to provide a way to share a common secret between more than two nodes.

[0009] Such an improved solution is devised herein.

[0010] Thus, in accordance with the present disclosure, there is provided a method as defined in the accompanying claims. Summary of the Invention

[0011] According to the present disclosure, there is provided a method of sharing a first common secret among a plurality of nodes, each of the nodes being associated with a respective asymmetric cryptographic first key pair having a respective first private key and a respective first public key of a cryptosystem common to the plurality of nodes, the first common secret being based on the first private key of each of the nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and a respective second node, and which is determined at the first node based on the first private key of the first node and the first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not less than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, wherein a respective third common secret is common to the second node and a respective third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on the at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a second private key of a respective asymmetric cryptographic second key pair of a cryptosystem, the second key pair being based on the respective second common secret known to the first node; transmitting at least one of said encrypted shares from said first node to each said second node with which said second common secret on which said second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first secret, encrypted based on a second private key of a respective asymmetric cryptographic second key pair of the cryptosystem, known to the second node, the second key pair being based on the second common secret common to the first node and the second node, enabling each of the plurality of nodes to reach the threshold number of shares of the first common secret; A method is provided that includes:

[0012] This offers the advantage of providing an efficient way of sharing a common secret between multiple nodes, which can be used as the basis for secure communications between the nodes.

[0013] Each of the plurality of encrypted shares is based on a combination of a plurality of the common secrets known to a corresponding one of the nodes.

[0014] This offers the advantage of improving efficiency while allowing individual shared secrets to be obfuscated from third parties, thereby improving privacy, for example when shared secrets are included in the script of a blockchain transaction.

[0015] Each of the plurality of encrypted shares may be based on a respective XOR combination of at least one of a plurality of said common secrets known to a corresponding said node.

[0016] This provides the advantage of simplified processing, thereby simplifying the recovery of the first common secret by the receiving node.

[0017] A number of said encrypted shares may be based on a multiplicative combination of a number of said common secrets known to corresponding said nodes.

[0018] The multiplicative combination is (x1 ,x 2 ,x 3 ) mod n, where x 1 ,x 2 ,x 3 is a common secret known to the nodes, and n is the degree of the cryptosystem.

[0019] The plurality of shares may be shares of a first polynomial function, and the first secret may be determined by polynomial interpolation of at least a threshold number of the shares.

[0020] The method includes the steps of receiving at least a threshold number of shares of the first common secret, each of the shares corresponding to a respective value of the first polynomial function; determining the first polynomial function by determining coefficients of the first polynomial function from a plurality of known values ​​of the shares to determine the first common secret; It may further include.

[0021] Determining the first polynomial function may include performing an error correction algorithm.

[0022] Determining the first polynomial function may include performing a Berlekamp-Welch decoding algorithm.

[0023] The step of determining the first polynomial function comprises: defining an error locator polynomial function and a second polynomial function, the second polynomial function being a product of the first polynomial function and the error locator polynomial function; determining coefficients of the second polynomial function and the error locator polynomial function from a plurality of known values ​​of the partial signature; determining the first polynomial function from the second polynomial function and the error detection polynomial function to determine the first common secret.

[0024] At least one of said cryptosystems may have homomorphic properties.

[0025] This provides the advantage of allowing a more flexible and efficient operation of the method.

[0026] At least one of the digital signatures may be based on an elliptic curve cryptosystem.

[0027] This offers the advantage of high security for a given key size.

[0028] The method includes: 1C determining the first private key of at least one of the first nodes based on the first private key and a deterministic key (DK) common to the first and second nodes; The master public key (P 1S ) and an encryption of the deterministic key (DK) using the common cryptosystem, 2S ) It may further include.

[0029] A deterministic key (DK) may be based on a message (M).

[0030] The message (M) and the first node's first private key (V 2C ) generating a first signed message (SM1); a step of transmitting the first signed message (SM1) to the second node (S) via the communication network, the first signed message (SM1) including a first public key (P 2C ) and It may further include.

[0031] The method includes the steps of receiving a second signed message (SM2) from the second node (S) via the communications network; The first public key (P 2S ) verifying said second signed message (SM2); authenticating the second node (S) based on a result of verifying the second signed message (SM2); may further comprise The second signed message (SM2) is a message (M) or a second message (M2) and the first private key (V 2S ) and was generated based on

[0032] The method comprises the steps of generating a message (M); and transmitting the message (M) to the second node via a communications network.

[0033] The method may further comprise the step of receiving the message (M) from the second node (S) via the communication network.

[0034] The method may further comprise the step of receiving the message (M) from another node via the communication network.

[0035] The method may comprise the step of receiving the message (M) from a data store and / or an input interface associated with the first node (C).

[0036] The cryptosystem may be an Elliptic Curve Cryptography (ECC) system, and the first node's master public key (P 1C ) and the master public key of the second node (P 1S ) are the master private keys of the first node (V 1C ) and the master private key of the second node (V 1S ) and a generator (G).

[0037] The method further comprises: transmitting a master public key (P1S ), The data store associated with the first node (C) stores the master public key (P 1S ) storing the It may further include.

[0038] The method includes, at a first node (C), 1C ) and the master private key of the first node (P 1C ), The master public key (P 1C ) to the second node (S) and / or other nodes; A first data store associated with the first node (C) stores the master private key (V 1C ) storing the It may further include.

[0039] The method may further comprise the step of transmitting, via the communication network, to the second node a notification indicating use of a common cryptosystem for the method of determining at least one of the common secrets (CS); The master private key (V 1C ) and the master public key (P 1C ) is generated by: The master private key (V 1C ), The master private key (V 1C ) based on the encryption of the master public key (P 1C ) Includes.

[0040] The common cryptosystem is an Elliptic Curve Cryptography (ECC) system with a common generator (G), and the first node's master public key (P 1C ) is expressed by the following formula: P 1C =V 1C ×G According to the above, the master private key (V 1C ) and the elliptic curve dot product of the common generator (G).

[0041] The method may further comprise determining the deterministic key (DK) based on determining a hash of a message (M); The first private key (V 2C ) is determined by the following formula: V 2C =V 1C +DK The master private key (V 1C ) and the deterministic key (DK) based on scalar addition, The first public key (P 2S ) is determined by the following formula: P 2S =P 1S +DK×G The second node's master public key (P 1S ) elliptic curve point addition.

[0042] The deterministic key (DK) may be based on determining a hash of a previous deterministic key.

[0043] The present disclosure provides a method of secure communication between a plurality of nodes, the method comprising: determining a first common secret in accordance with the method described above; determining a symmetric key based on the first common secret; encrypting the first communication message with the symmetric key to form an encrypted first communication message; transmitting the encrypted first communication message from one of the plurality of nodes to another of the plurality of nodes over a communications network; A method including the steps of:

[0044] The method includes receiving, via a communications network, an encrypted second communication message from a node of the plurality of nodes; decrypting the encrypted second communication message with the symmetric key into a second communication message; It may further include.

[0045] The present disclosure provides a method for conducting an online transaction among a plurality of nodes, the method comprising: determining a first common secret in accordance with the method described above; determining a symmetric key based on the first common secret; encrypting the first transaction message with the symmetric key to form an encrypted first transaction message; transmitting the encrypted first transaction message from a first one of the plurality of nodes to another one of the plurality of nodes over a communications network; The method may further include:

[0046] The present disclosure also provides a system including a processor and a memory including executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented methods described herein.

[0047] The present disclosure also provides a non-transitory computer-readable storage medium having stored thereon executable instructions which, when executed by a processor of a computer system, cause the computer system to at least perform a computer-implemented method described herein.

[0048] These and other aspects of the present disclosure will be apparent from and taught with reference to the embodiments described herein. [Brief description of the drawings]

[0049] Embodiments of the present disclosure are now described, by way of example only, and with reference to the accompanying drawings. [Figure 1] FIG. 1 is a schematic diagram of an example system for determining a common secret for a first node and a second node. [Diagram 2] 1 is a flowchart of a computer-implemented method for determining a common secret. [Diagram 3] 1 is a flowchart of a computer-implemented method for registering first and second nodes. [Figure 4] 4 is another flow chart of a computer-implemented method for determining a common secret. [Diagram 5] 1 is a flowchart of a computer-implemented method of secure communication between a first and a second node. [Figure 6] 1 is a flowchart of a computer-implemented method for authenticating a first node and a second node. [Figure 7] FIG. 1 illustrates a method for implementing the present disclosure to share a common secret among three nodes. [Figure 8] 8 is a flow chart of the method of FIG. 7. [Figure 9] In a manner embodying the present disclosure, a Berlekamp-Welch decoder is shown for recovering the first common secret. [Figure 10] 1 is a flowchart of a method embodying the present disclosure for sharing a common secret among four nodes. [Figure 11] FIG. 1 illustrates a schematic diagram of a computing environment in which various embodiments can be implemented. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0050] <Summary> First, a method, apparatus and system are described for determining a common secret (CS) at a first node (C), which is the same common secret as at a second node (S). This is used to determine a second common secret between a pair of nodes, which is then used to share the first common secret between a plurality of nodes, including three or more nodes, as will be described in more detail below with reference to Figures 7 and 8. Figure 1 shows a system 1 including a first node 3 in communication with a second node 7 via a communication network 5. The first node 3 has an associated first processing device 23, and the second node 5 has an associated second processing device 27. The first and second nodes 3, 7 may include electronic devices such as computers, tablet computers, mobile communication devices, computer servers, etc. In one example, the first node 3 may be a client device and the second node 7 is a server.

[0051] The first node 3 receives the master private key (V 1C ) and the master public key of the first node (P 1C ) The second node (7) is associated with a first asymmetric cryptographic pair having the second node's master private key (V 1S ) and the master public key of the second node (P 1S ) The first and second asymmetric cryptographic pairs of each of the first and second nodes 3, 7 may be generated during registration. A method 100, 200 of registration performed by the first and second nodes 3, 7 is described in more detail below with reference to FIG. 3. The public key of each node may be publicly shared, for example via the communication network 5.

[0052] To determine a common secret (CS) at both the first node 3 and the second node 7 , the nodes 3 , 7 perform the steps of their respective methods 300 , 400 without communicating a private key over the communications network 5 .

[0053] The method 300 executed on the first node 3 includes obtaining at least the master private key (V 1C) and the deterministic key (DK), the first node’s second private key (V 2C The method 300 includes a step 320 of determining a deterministic key (P ) based on a message (M) shared between the first and second nodes. This may involve sharing the message over a communication network 5, as described in more detail below. The method 300 includes a step 320 of determining a master public key (P ) of at least the second node. 1S ) and the deterministic key (DK), the second node’s second public key (P 2S The method 300 also includes a step 370 of determining a second private key (V 2C ) and the second node's second public key (P 2S ) based on the common secret (CS).

[0054] Importantly, the same common secret (CS) can also be determined at the second node 7 by the method 400. The method 400 uses the master public key (P 1C ) and the deterministic key (DK), the first node’s second public key (P 2C The method 400 includes determining 430 a second private key (V 1S ) of the second node based on the master private key (V 1S ) and the deterministic key (DK) of the second node. 2S The method 400 also includes a step 470 of determining a second private key (V 2S ) and the second public key (P 2C ) based on the common secret (CS).

[0055] The communication network 5 may include a local area network, a wide area network, a cellular network, a wireless communication network, the Internet, and so on.

[0056] In these networks, data may be transmitted over communications media such as wires, optical fibers, or radio waves and may be subject to eavesdropping, such as by eavesdroppers.

[0057] The methods 300, 400 may enable both the first node 3 and the second node 7 to independently determine the common secret without transmitting the common secret over the communications network 5. Thus, one advantage is that the common secret (CS) may be securely determined by each node, without the need to transmit a private key over the potentially insecure communications network 5. Also, the common secret may be used as a secret key (or as the basis for a secret key) for encrypted communications between the first and second nodes 3, 7 over the communications network 5.

[0058] The method 300, 400 may include an additional step. The method 300 comprises: 2C The method 300 may further include a step of generating a signed message (SM1) based on a second public key (P 2C ), and step 460 of verifying the first signed message (SM1) and authenticating the first node 3 based on the result. Advantageously, this enables the second node 7 to authenticate that the purported first node (where the first signed message was generated) is the first node 3.

[0059] This means that only the first node 3 has the master private key of the first node (V 1C ), and therefore only the first node 3 has access to the second private key (V 2C ) can be determined. It should be appreciated that a second signed message (SM2) can be generated at the second node 7 and sent to the first node 3 so that the first node 3 can authenticate the second node 7, as in a peer-to-peer scenario.

[0060] Sharing the message (M) between the first and second nodes may be accomplished in various ways. In one example, the message may be generated at the first node 3 and then transmitted to the second node 7 over the communication network 5. Alternatively, the message may be generated at the second node 7 and then transmitted to the second node 7 over the communication network 5. In yet another example, the message may be generated at the third node 9 and the message transmitted to both the first and second nodes 3, 7. In yet another example, a user may input a message through a user interface to be received by the first and second nodes 3, 7. In yet another example, the message (M) may be retrieved from the data store 19 and transmitted to both the first and second nodes 3, 7. In some examples, the message (M) may be made public and therefore transmitted over an insecure network 5.

[0061] In a further example, one or more messages (M) may be stored in the data stores 13, 17, 19, and the messages may be associated with a session, transaction, etc. between the first node 3 and the second node 7. The messages (M) may then be read at the first node 3 and the second node 7, respectively, and used to recreate the common secret (CS) associated with the session or transaction. Advantageously, a record may be kept to enable the recreation of the common secret (CS), without the record itself having to be secretly stored or securely transmitted. This may be advantageous where a large number of transactions are carried out at the first node 3 and the second node 7, and it is not practical to store all the messages (M) at the nodes themselves.

[0062] <Registration methods 100, 200> Examples of registration methods 100, 200 are described with reference to figure 3, where method 100 is performed by a first node 3 and method 200h is performed by a second node 7. This comprises the step of establishing for each first node 3 and second node 7 first and second asymmetric cryptographic pairs.

[0063] An asymmetric cryptographic pair includes an associated private key and a public key, such as those used in public key cryptography, in this example, the asymmetric cryptographic pair is generated using the properties of Elliptic Curve Cryptography (ECC) and elliptic curve arithmetic.

[0064] Standards for ECC may include known standards such as those developed by the Standards for Efficient Cryptography Group (www.sceg.org).

[0065] Elliptic curve cryptography is also described in US 5,600,725, US 5,761,305, US 5889,865, US 5,896,455, US 5,933,504, US 6,122,736, US 6,141,420, US 6,618,483, US 6,704,870, US 6,785,813, US 6,078,667 and US 6,792,530.

[0066] In the method 100, 200, this involves steps 110, 210 where the first node and the second node decide to use a common ECC system and common generator (G). In one example, the common ECC system may be based on secp256K1, which is the ECC system used by Bitcoin. The common generator (G) may be selected, randomly generated, or assigned.

[0067] With reference to the first node 3, the method 100 includes determining 110 a common ECC system and a common origin (G). This may include receiving the common ECC system and the common origin from the second node 7 or the third node 9. Alternatively, a user interface 15 may be associated with the first node 3, whereby a user may selectively provide the common ECC system and / or the common origin (G). In yet another alternative, one or both of the ECC system and / or the common origin (G) may be randomly selected by the first node 3. The first node 3 may send a notification to the second node 7 via the communication network 5 indicating the use of the common ECC system with the common origin (G). The second node 7 may then determine 210 by sending a notification indicating an acknowledgment of the use of the common ECC system and the common origin (G).

[0068] The method 100 comprises: a first node 3 transmitting the first node's master private key (V 1C ) and the master public key of the first node (P 1C ), based at least in part on random integers within a range of allowed values ​​specified in the common ECC system, the first node's master private key (V 1C ) for the first node according to the following formula: 1C ) and the common generator (G), the master public key (P 1C )

[0069]

number

[0070] V 1C : The master private key of the first node, which is kept secret by the first node.

[0071] P 1C : The master public key of the first node, made publicly known.

[0072] The first node 3 receives the master private key (V 1C ) and the master public key of the first node (P 1C ) may be stored in a first data store 13 associated with the first node 3. For security purposes, the master private key (V 1C ) may be stored in a secure portion of the first data store 13 to ensure that the key remains private.

[0073] The method 100 includes transmitting a master public key (P 1C ) The second node 7 transmits the master public key (P 1C ) 220, the first node’s master public key (P 1C ) may be stored 230 in a second data store 17 associated with the second node 7.

[0074] Similar to the first node 3, the method 200 of the second node 7 involves obtaining the master private key (V 1S ) and the master public key of the second node (P 1S ) of the second node. 1S ) is also a random integer within the allowed range. The master public key of the second node (P 1S ) is determined by the following formula:

[0075]

number

[0076] V 1S : The master private key of the second node, which is kept secret by the second node.

[0077] P 1S : The second node’s master public key, made publicly known.

[0078] The second node 7 may store the second asymmetric cryptographic pair in the second data store 17. The method 200 may include transmitting to the first node 3 the master public key (P 1S ) to the first node 3. The first node 3 also transmits the master public key (P 1S ) may be received 140 and stored 150 .

[0079] It should be appreciated that in some alternatives, each public master key is received and stored in a third data store 19 associated with a third node 9 (such as a trusted third party). This may include a third party acting as a public directory, such as a certificate authority. Thus, in some examples, the first node's public master key (P) is only required when it is necessary to determine the shared secret (CS). 1C ) may be requested and received by the second node 7 (and vice versa).

[0080] The registration step only needs to occur once as an initial setup. Later, the master key can be reused for security purposes, especially to generate shared secrets that depend on the deterministic key (DK).

[0081] <Session start and determination of the shared secret by the first node 3> An example of determining the common secret (CS) is described below with reference to Figure 4. The common secret (CS) may be used between the first node 3 and the second node 7 for a particular session, time, transaction, or other purpose, and it may be undesirable or insecure to use the same common secret (CS). Thus, the common secret (CS) may be changed between different sessions, times, transactions, etc.

[0082] <Message (M) Creation 310> In this example, the method 300 performed by the first node 3 includes a step 310 of generating a message (M). The message (M) may be random, pseudorandom, or user defined. In one example, the message (M) is based on Unix time and a nonce (and an arbitrary value). For example, the message (M) may be provided as follows:

[0083]

number

[0084] The method 300 includes a step 315 of transmitting the message (M) over the communication network to the second node 7. Since the message (M) does not include information about the private key, the message (M) may be transmitted over an insecure network.

[0085] <Deterministic Key Determination 320> The method 300 further comprises determining 320 a deterministic key (DK) based on the message (M). In this example, this comprises determining a cryptographic hash of the message.

[0086] Examples of cryptographic hash algorithms include SHA-256 for generating a 256-bit deterministic key (DK), i.e.:

[0087]

number

[0088] <Determination of second secret key of first node 330> The method 300 then calculates the master private key (V 1C ) and the deterministic key (DK), the first node’s second private key (V 2C ) at step 330.

[0089] This is the master private key (V 1C ) and a deterministic key (DK).

[0090]

number

[0091]

number

[0092]

number

[0093] Keeping in mind that elliptic curve cryptography algebra is distributive, Equation 7 can be expressed as follows:

[0094]

number

[0095]

number

[0096] <Generation 350 of a first signed message (SM1) based on the message and the second private key of the first node> The method 300 includes receiving a message (M) and a determined second private key (V 2C ) to generate a first signed message (SM1). Generating a signed message includes applying a digital signature algorithm to digitally sign the message (M). In one example, this includes using a second private key (V 2C) to the message in an Elliptic Curve Digital Signature Algorithm (ECDSA).

[0097] Examples of ECDSA include those based on ECC systems having secp256k1, secp256r1, secp384r1, se3cp521r1.

[0098] The first signed message (SM1) is sent to the second node 7 using the second public key (P 2C ) This verification of the first signed message (SM1) may be used by the second node 7 to authenticate the first node 3. This is discussed in method 400 below.

[0099] <Determining the second public key of the second node 370'> The first node 3 then transmits the second public key (P 2S ) of the second node. As mentioned above, the second node may determine 370 a second public key (P 2S ) is the master public key (P 1S ) and a deterministic key (DK). In this example, the public key is determined by the elliptic curve dot product of the private key and the generator (G) 370′, so the second node’s second public key (P 2S ) can be expressed by the following equation, similar to equation 6:

[0100]

number

[0101] <Determination of the common secret 380 at the first node 3> The first node 3 determines the second private key (V 2C) and the second public key (P 2S ) based on which the common secret (CS) may be determined 380. The common secret (CS) may be determined by the first node 3 according to:

[0102]

number

[0103] The method 400 includes a step 410 of receiving a message (M) from the first node 3 via the communications network 5. This may include the message (M) sent by the first node 3 in step 315. The second node 7 then determines 420 a deterministic key (DK) based on the message (M). Step 420 of determining a deterministic key (DK) by the second node 7 is similar to step 320 performed by the first node, as described above. In this example, the second node 7 performs this determining step which is independent of the first node 3.

[0104] The next step is to generate the master public key (P 1C ) and the deterministic key (DK), the first node’s second public key (P 2C In this example, the public key is determined by the elliptic curve dot product of the private key and the generator (G) 430′, so the second public key (P 2C ) can be expressed by the following equation, similar to equation 9.

[0105]

number

[0106] <Second node 7 authenticates first node 3> The method 400 may include steps performed by the second node 7 to authenticate the purported first node 3 as the first node 3. As mentioned above, this includes a step 440 of receiving a first signed message (SM1) from the first node 3. The second node 7 receives the first signed message (SM2) from the first node 3 using the second public key (P 2C ) may verify 450 the signature on the first signed message (SM1).

[0107] Verification of the digital signature may be performed according to the Elliptic Curve Digital Signature Algorithm (ECDSA) as described above. 2C and P 2C form a cryptographic pair, the second private key of the first node (V 2C ) is signed by the second public key (P 2C ) should be read and correctly verified. These keys are generated by the master private key (V 1C ) and the master public key of the first node (P 1C ), verification of the first signed message (SM1) can be used as a basis for authenticating that the purported first node sending the first signed message (SM1) is the same first node 3 as being registered. Thus, the second node 7 may further perform a step (460) of authenticating the first node 3 based on the result of the step of verifying the first signed message (450).

[0108] The above authentication may be suitable for scenarios where one of the two nodes is a trusted node and only one of these nodes needs to be authenticated. For example, the first node 3 may be a client and the second node 7 may be a server trusted by the client. Thus, the server (the second node 7) may need to authenticate the credentials of the client (the first node 3) in order to allow the client to access the server system. The server may not need to have its credentials authenticated by the client. However, in some scenarios, it may be desirable for both nodes to be authenticated by each other, such as in a peer-to-peer scenario, as will be described later in another example.

[0109] <Second node 7 determines the shared secret> The method 400 includes a step of: 1S ) and the deterministic key (DK), the second node’s second private key (V 2S ) of the second node. Similarly to step 330 performed by the first node 3, 2S ) is the master private key (V 1S ) and a deterministic key (DK).

[0110]

number

[0111]

number

[0112] Given the common secret (CS) determined by the first node 3, Equation 10.1 can be substituted into Equation 11 as follows:

[0113]

number

[0114]

number

[0115]

number

[0116] The shared secret (CS) is the elliptic curve point (x S ,y S ), which may be converted to a standard key format using standard publicly known operations agreed upon by nodes 3 and 7. For example, x S The value may be a 256-bit integer that can be used as a key for AES256 encryption. It may be further converted to a 160-bit integer using RIPEMD160 for any application requiring a 160-bit long key.

[0117] The common secret (CS) may be determined as needed. Importantly, the first node 3 does not need to store the common secret (CS) since it can be re-determined based on the message (M). In some examples, the message (M) used may be stored in the data store 13, 17, 19 (or other data store) without having the same level of security as required for a master private key. In some examples, the message (M) may be publicly available.

[0118] However, depending on some applications, the shared secret (CS) may be the master private key (V 1C ), the common secret (CS) may be stored in a first data store (X) associated with the first node.

[0119] Furthermore, the disclosed system may enable the determination of multiple common secrets that may correspond to multiple secure secret keys based on a single master key cryptographic pair. The advantages of this may be illustrated by the following example.

[0120] In situations where multiple sessions exist, each associated with multiple respective common secrets (CS), it may be desirable to have records associated with these multiple sessions so that the respective common secrets (CS) can be redetermined in the future. In known systems, this requires storing multiple secret keys in a secure data store, which may be expensive or inconvenient to maintain.

[0121] In contrast, the system of the present invention keeps the master key secure at the first and second nodes while other deterministic keys or messages may be stored securely or insecurely. Instead of the deterministic key (DK) or message (M) being stored insecurely, multiple common secrets (CS) are kept secure because the master private key needed to determine the common secret remains secure.

[0122] The method may be used to generate a "session key" for a temporary communications link, for example to securely transmit a login password.

[0123] <Peer-to-Peer Authentication> In a peer-to-peer scenario, the first node 3 and the second node 7 may need to authenticate each other's authentication information. An example of this is described below with reference to Figure 6. In this example, the steps of the method 300, 400 for authenticating the first node 3 based on a verified first signed message (SM1) are similar to those described above.

[0124] However, the method 400 performed by the second node 7 does not require the message (M) and the private key of the second node (V 2S ) based on the second message (M2). In some alternatives, the second signed message (SM2) is generated 462 based on the second message (M2) and the second node's private key (V 2S ), and the second message (M2) is shared with the first node 3. The method 400 further comprises sending 464 the second signed message (SM2) to the first node 3 via the communication network 5.

[0125] At the first node 3, the method 300 includes receiving a second signed message (SM2) from the second node 7. The method includes receiving the second signed message (SM3) from the second node 7 using the second public key (P 2S ) to verify the signature on the second signed message (SM2). The method 300 may then include authenticating 376 the second node 7 based on verifying the second signed message (SM2). As a result, the first node 3 and the second node 7 authenticate each other.

[0126] <Deterministic key hierarchical structure> In one example, a series of successive deterministic keys may be determined, with each successive key being determined based on the preceding deterministic key.

[0127] For example, instead of repeating steps 310-370 and 410-470 to generate successive single-purpose keys, a previously used deterministic key (DK) can be repeatedly re-hashed by both parties to build a hierarchy of deterministic keys, by prior agreement between the nodes. In effect, a deterministic key based on a hash of a message (M) can be a next-generation message (M') for a next-generation deterministic key (DK'). Doing this allows successive generations of the shared secret to be computed without requiring further protocol-established transmissions, in particular the transmission of multiple messages for each generation of the shared secret. The next-generation shared secret (CS') can be computed as follows:

[0128] First, both the first node 3 and the second node 7 independently determine a next generation deterministic key (DK′), which is similar to steps 320 and 420, but adapted according to the following formula:

[0129]

number

[0130]

number

[0131]

number

[0132]

number

[0133]

number

[0134] This technique requires that both the first node 3 and the second node 7 keep track of the original message (M) or the originally calculated deterministic key (DK), and which node it is associated with. Since this is publicly known information, there are no security issues with keeping this information. Therefore, this information may be kept in a "hash table" (linking a hash value to a public key) and freely distributed across the network 5 (e.g. using Torrent). Furthermore, if none of the individual shared secrets (CS) in the hierarchy are compromised, this means that the private key V 1C , V 1S remains secure, it does not affect the security of any other shared secrets in the hierarchy.

[0135] <Key tree structure> As well as the chain (linear) hierarchical structures described above, hierarchical structures in the form of trees can be created.

[0136] According to the tree structure, various keys for different purposes such as authentication keys, encryption keys, signature keys, payment keys, etc. can be determined, whereby all these keys are linked to a single securely maintained master key.

[0137] <Description of the embodiment> FIG. 7 illustrates a method for implementing the present disclosure for sharing a first common secret among three nodes A, B, and C, and FIG. 8 illustrates a flow chart of the method. Each node A, B, and C is associated with its own private / public key pair (S, P), for example, node A's private key, public key pair is (S A ,P A ) Each private or public key may be derived from the node's respective master private or public key and a deterministic key in a manner similar to that described above with reference to Figs. 1-6. The private-public key pair is an elliptic curve cryptosystem key pair. For example, P A =S A ×G, where G is the elliptic curve generator point. Secure communications between each pair of nodes A and B, A and C, B and C are established in step 80 of Figure 8 by determining a second common secret between each pair of nodes using the methods described above with reference to Figures 1 to 6. In the configuration shown in Figure 7, the following relationships apply:

[0138]

number

[0139]

number

[0140]

number

[0141] In step 86 of Figure 8, each of nodes A, B, and C receives the encrypted shares from the other nodes and decrypts the encrypted shares. As a result, each of the nodes derives a first shared secret (x 1 )XOR(x 2 )XOR(x 3 ) can be obtained by using the threshold number of shares required to reconstruct

[0142] Node A receives a share (x 2 )XOR(x 3 ) from node C to (x 1 )XOR(x 3 ) Node A receives x 1 and x 2 Since node A knows x 1 and (x 2 )XOR(x 3 ) with or x 2 and (x 1 )XOR(x 3 ) to obtain the first shared secret (x 1 )XOR(x 2 )XOR(x 3 Similarly, node B receives a share (x 1 )XOR(x 2 ) from node C to (x 2 )XOR(x 3 ) Node B receives x 1 and x 3 Since we know each of x1 and (x 2 )XOR(x 3 ) with or x 3 and (x 1 )XOR(x 2 ) to obtain the first shared secret (x 1 )XOR(x 2 )XOR(x 3 ) can be easily calculated. Furthermore, node C receives a share (x 1 )XOR(x 3 ) from node A to (x 1 )XOR(x 2 ) Node C receives x 2 and x 3 Since we know each of x 2 and (x 1 )XOR(x 3 ) with or x 3 and (x 1 )XOR(x 2 ) to obtain the first shared secret (x 1 )XOR(x 2 )XOR(x 3 ) can be easily calculated.

[0143] Similar to the method described above for the second common secret, the first common secret (CS) is found by S ,y S ), which may be converted to a standard key format using standard publicly known operations agreed upon by nodes 3 and 7. For example, x S The value may be a 256-bit integer that can be used as a key for AES256 encryption. It may be further converted to a 160-bit integer using RIPEMD160 for any application requiring a 160-bit long key.

[0144] It is possible to distribute shares of the first shared secret by means other than XOR encryption. However, XOR encryption offers the advantage of obfuscating the second shared secret when it is broadcast in the script of a blockchain transaction. As a result, a third party cannot determine the second shared secret without knowing a threshold number of other second shared secrets. For example, if (x 1 x 2 x 3 ) mod n, where n is the order of the elliptic curve cryptosystem used.

[0145] Additionally, the shares of the first common secret may be distributed as shares of a polynomial function using Shamir's secret sharing scheme or dealerless secret sharing schemes familiar to those skilled in the art. When the shares of the first common secret are shares of a polynomial function, efficient recovery of the first common secret may be performed by a Berlekamp-Welch decoder as shown in Figure 9. Referring to Figure 9, the Berlekamp-Welch decoder 70 performs polynomial interpolation of the shares of the polynomial function to obtain the polynomial function.

[0146] In the traditional use of the Berlekamp-Welch algorithm to correct errors in transmitted data, the message m is split into k byte chunks in the encoder 72, and each byte c0, c1, ..., ck-1 is encoded as an integer modulo p. The message is then represented by a polynomial function.

[0147]

number

[0148] The data M received at the receiver 76 (i.e., the received message) is represented as pairs (a 1 ,b 1 ,...,a n ,b n ).

[0149]

number

[0150]

number

[0151]

number

[0152]

number

[0153]

number

[0154] It can thus be seen that the Berlekamp-Welch decoder 70 receives as input pairs representing points on a polynomial function and outputs the polynomial function. The decoder 70 can therefore be used in this disclosure as an alternative to Lagrange interpolation to determine the polynomial function from the shares of a threshold number represented by the polynomial function.

[0155] FIG. 10 illustrates a method for implementing the present disclosure, sharing a first common secret among four nodes A, B, C, and D. Each node A, B, C, and D is associated with its own private / public key pair (S, P), e.g., node A’s private key, public key pair is (S A ,P A ).

[0156] Each private or public key may be derived from the node's respective master private or public key and a deterministic key in a manner similar to that described above with reference to Figures 1-6. The private-public key pair is an elliptic curve cryptosystem key pair. For example, P A =S A ×G, where G is the elliptic curve generator point. Secure communication between each pair of nodes A and B, A and C, A and D, B and C, B and D, C and D is established by determining a second common secret between each pair of nodes using the methods described above with reference to Figures 1 to 6. In the configuration shown in Figure 10, the following relationships apply:

[0157]

number

[0158]

number

[0159]

number

[0160] In an embodiment of the present invention, a separate bond

[0161]

number

[0162] The encoded combination is then expressed as:

[0163]

number

[0164] In a similar manner, node B computes the following combinations:

[0165]

number

[0166]

number

[0167]

number

[0168]

number

[0169]

number

[0170]

number

[0171]

number

[0172] Node A receives a share from node B.

[0173]

number

[0174]

number

[0175] Node A receives a share from node C.

[0176]

number

[0177]

number

[0178] By performing a similar process, each of the other nodes B, C, D obtains the entire second common secret and can now determine the first common secret shared between all of the nodes.

[0179] Referring to FIG. 11, an illustrative simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 11, the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602) that may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0180] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0181] Bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of computing device 2600 to communicate with each other as intended.

[0182] Although the bus subsystem 2604 is shown diagrammatically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. The network interface subsystem 2616 may provide an interface to other computing devices and networks.

[0183] Network interface subsystem 2616, in some embodiments, may act as an interface to receive data from and transmit data to other systems on computing device 2600. For example, network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without being in a remote location, such as a data center.

[0184] User interface input devices 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touch screen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into computing device 2600.

[0185] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device, etc. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0186] The storage subsystem 2606 may provide a computer-readable storage medium that stores basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions) that, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, or DVD, or Blue-Ray) drives associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure, and data associated with the transactions and blocks described in this disclosure.

[0187] The computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that can be connected to the computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device that can be connected to the computing device 2600 may include multiple ports configured to receive optical fiber connectors. The device may thus be configured to convert optical signals into electrical signals that are transmitted to the computing device 2600 through the ports connecting the devices for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 shown in FIG. 11 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible having more or fewer components than the system shown in FIG. 11.

[0188] It should be noted that the above-described embodiments illustrate, rather than limit, the disclosure, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the disclosure, which is defined by the appended claims. In the claims, any reference signs in parentheses are not intended to limit the claims. The terms "comprising" and "comprises", etc., do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of" and "comprises" means "comprising or consisting of". A singular reference of an element does not exclude a plural reference of such an element. Vice versa. The disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage. [Explanation of symbols]

[0189] 9. Third Node 5. Network 3 First Node 7 Second Road 11. Wiretaper

Claims

1. 1. A method of sharing a first common secret among a plurality of nodes, each of the nodes being associated with a respective asymmetric cryptographic first key pair having a respective first private key and a respective first public key of a cryptosystem common to the plurality of nodes, the first common secret being based on the first private key of each of the nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and each second node, and which is determined at the first node based on the first private key of the first node and the first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not fewer than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, where each third common secret is common to the second node and each third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a respective encryption key common to the first node and each of the second nodes, the encryption key being based on a respective second common secret known to the first node and each of the second nodes; transmitting at least one of said encrypted shares from said first node to each of said second nodes to which said second common secret on which a second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first common secret encrypted based on a respective encryption key known to the second node and common to the first node and the second node, the encryption key being based on the second common secret common to the first node and the second node and enabling the first node to access the at least one share of the first common secret known to the second node; The method includes:

2. 2. The method of claim 1, wherein the step of encrypting comprises the step of encrypting a plurality of shares based on a combination of a plurality of the second or third common secrets known to corresponding nodes.

3. 3. The method of claim 2, wherein the step of encrypting comprises the step of encrypting a plurality of shares based on an XOR combination of at least one of each of a plurality of the second or third common secrets known to the corresponding node.

4. 3. The method of claim 2, wherein the step of encrypting comprises the step of encrypting a plurality of shares based on a multiplicative combination of a plurality of the second or third common secrets known to corresponding nodes.

5. The multiplicative combination is (x １ , x ２ , x ３ ) mod n, １ , x ２ , x ３ 5. The method of claim 4, wherein n is a second or third common secret known to the nodes, and n is the degree of the cryptosystem.

6. 2. The method of claim 1, wherein a plurality of said shares are shares of a first polynomial function, and said first common secret is determined by polynomial interpolation of at least a threshold number of said shares.

7. receiving at least a threshold number of shares of the first common secret, each of the shares corresponding to a respective value of the first polynomial function; determining the first polynomial function by determining coefficients of the first polynomial function from a plurality of known values ​​of the shares to determine the first common secret; The method of claim 6 further comprising:

8. The method of claim 7 , wherein determining the first polynomial function comprises executing an error correction algorithm.

9. 9. The method of claim 8, wherein determining the first polynomial function comprises performing a Berlekamp-Welch decoding algorithm.

10. The step of determining the first polynomial function comprises: defining an error locator polynomial function and a second polynomial function, the second polynomial function being a product of the first polynomial function and the error locator polynomial function; determining coefficients of the second polynomial function and the error locator polynomial function from a plurality of known values ​​of the first polynomial function; determining the first polynomial function from the second polynomial function and an error detection polynomial function to determine the first common secret; The method of claim 7, comprising:

11. The method of claim 1 , wherein at least one of the cryptosystems has homomorphic properties.

12. The method of claim 11 , wherein at least one of the cryptosystems is an elliptic curve cryptosystem.

13. 1. A method of secure communication between a plurality of nodes, the method comprising: Sharing a first common secret among a plurality of nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and each second node and which is determined at the first node based on a first private key of the first node and a first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not fewer than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, where each third common secret is common to the second node and each third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a respective encryption key common to the first node and each of the second nodes, the encryption key being based on a respective second common secret known to the first node and each of the second nodes; transmitting at least one of said encrypted shares from said first node to each of said second nodes to which said second common secret on which a second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first common secret encrypted based on a respective encryption key known to the second node and common to the first node and the second node, the encryption key being based on the second common secret common to the first node and the second node and enabling the first node to access the at least one share of the first common secret known to the second node; sharing a first common secret among a plurality of nodes according to determining a symmetric key based on the first common secret; encrypting the first communication message with the symmetric key into an encrypted first communication message; transmitting the encrypted first communication message from one of the plurality of nodes to another of the plurality of nodes over a communications network; The method includes:

14. receiving an encrypted second communication message from a node of the plurality of nodes over a communications network; decrypting the encrypted second communication message with the symmetric key into a second communication message; The method of claim 13 further comprising:

15. 1. A method for performing an online transaction among a plurality of nodes, the method comprising: Sharing a first common secret among a plurality of nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and each second node and which is determined at the first node based on a first private key of the first node and a first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not fewer than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, where each third common secret is common to the second node and each third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a respective encryption key common to the first node and each of the second nodes, the encryption key being based on a respective second common secret known to the first node and each of the second nodes; transmitting at least one of said encrypted shares from said first node to each of said second nodes to which said second common secret on which a second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first common secret encrypted based on a respective encryption key known to the second node and common to the first node and the second node, the encryption key being based on the second common secret common to the first node and the second node and enabling the first node to access the at least one share of the first common secret known to the second node; sharing a first common secret among a plurality of nodes by determining a symmetric key based on the first common secret; encrypting the first transaction message with the symmetric key into an encrypted first transaction message; transmitting the encrypted first transaction message from a first one of the plurality of nodes to another one of the plurality of nodes over a communications network; The method includes:

16. 1. A system comprising: A processor; a memory containing executable instructions; the executable instructions, upon execution by the processor, cause the system to perform a method of sharing a first common secret among a plurality of nodes, each of the nodes being associated with a respective asymmetric cryptographic first key pair having a respective first private key and a respective first public key of a cryptosystem common to the plurality of nodes, the first common secret being based on the first private key of each of the nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and each second node, and which is determined at the first node based on the first private key of the first node and the first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not fewer than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, where each third common secret is common to the second node and each third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a respective encryption key common to the first node and each of the second nodes, the encryption key being based on a respective second common secret known to the first node and each of the second nodes; transmitting at least one of said encrypted shares from said first node to each of said second nodes to which said second common secret on which a second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first common secret encrypted based on a respective encryption key known to the second node and common to the first node and the second node, the encryption key being based on the second common secret common to the first node and the second node and enabling the first node to access the at least one share of the first common secret known to the second node; Including, the system.

17. 1. A non-transitory computer readable storage medium having executable instructions stored thereon that, when executed by a processor of a computer system, result in the computer system comprising: a method of sharing a first common secret among a plurality of nodes, each of the nodes being associated with a respective asymmetric cryptographic first key pair having a respective first private key and a respective first public key of a cryptosystem common to the plurality of nodes, the first common secret being based on the first private key of each of the nodes, the method comprising: determining, for at least one first node, a plurality of second common secrets, each of which is common to the first node and each second node, and which is determined at the first node based on the first private key of the first node and the first public key of the second node, and which is determined at the second node based on the first private key of the second node and the first public key of the first node, a plurality of shares of the first common secret each based on at least one respective second common secret, such that the first common secret makes a threshold number of the shares accessible but not fewer than the threshold number of shares; determining, for at least one second node, at least one respective third common secret, where each third common secret is common to the second node and each third node, and is determined at the second node based on the first private key of the second node and the first public key of the third node, and is determined at the third node based on the first private key of the third node and the first public key of the second node, and at least one share of the first common secret is based on at least one respective third common secret; encrypting, in at least one of the first nodes, at least one share of the first common secret known to the first node based on a respective encryption key common to the first node and each of the second nodes, the encryption key being based on a respective second common secret known to the first node and each of the second nodes; transmitting at least one of said encrypted shares from said first node to each of said second nodes to which said second common secret on which a second key pair is based is common; receiving, in at least one of the first nodes, from at least one of the second nodes, at least one respective share of the first common secret encrypted based on a respective encryption key known to the second node and common to the first node and the second node, the encryption key being based on the second common secret common to the first node and the second node and enabling the first node to access the at least one share of the first common secret known to the second node; A non-transitory computer readable storage medium comprising:

Images