COMPUTER-IMPLEMENTED METHOD AND SYSTEM FOR ENCRYPTING DATA - Patent application

Abstract

A method for encrypting data is disclosed, the method comprising: A ) and the first public key (P A ), determining a common secret (S1) common to the first node and a second node, the first node being associated with a first public-private key pair of a cryptosystem having a second private key (V B ) and the second public key (P B a second public-private key pair of the cryptosystem having a first secret and a second public key. A common secret is determined based on the first private key and the second public key, and a property of the cryptosystem is that the common secret can be determined based on the second private key and the first public key. An encryption key based on the common secret is determined for encrypting data (M), and the data is encrypted based on the encryption key, and the step of encrypting the data includes an exclusive or XOR operation.

Description

[Technical field]

[0001] The present disclosure relates to computer-implemented methods and systems for encrypting data, particularly but not exclusively, for use in blockchain. The present disclosure also relates to a method for applying authentication data to a message. [Background technology]

[0002] In this specification, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. Although other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referred to herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" herein may refer to a human or processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system, and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are chained together to create a permanent, immutable record of all transactions written to the blockchain since origin. Transactions contain small programs, known as scripts, that embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a scripting language based on the stack.

[0004] In order for a transaction to be written to the blockchain, it must be "validated." Network nodes (miners) perform the work to ensure that invalid transactions are rejected from the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, for a transaction to be written to the blockchain, it must be (i) validated by the first node that receives the transaction, and if the transaction is valid, the node relays the transaction to other nodes in the network; (ii) added to a new block constructed by miners; and (iii) mined, i.e., added to the public ledger of past transactions.

[0005] Although blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to exploit the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field. Such solutions could make their uses more diverse while taking advantage of the benefits of blockchain (e.g. permanence, tamper resistance of the record of events, decentralized processing, etc.).

[0006] In systems where communication between parties occurs over an insecure network, an important concern is the probability of a shared secret key. To solve this problem, secure key distribution protocols have been developed, including the Diffie-Helman (DH) symmetric key exchange [Merkle, Ralph C. (April 1978), "Secure Communications Over Insecure Channels", Communications of the ACM. 21(4): 294-299;Diffie, Whitfield; Hellman, Martin E. (November 1976), "New Directions in Cryptography", IEEE Transactions on Information Theory. 22 (6): 644-654], and the three-pass protocol [Menezes, A.; van Oorschot, P.; Vanstone, S. (1996), "Handbook of Applied Cryptography", CRC Press. p.500]. While these methods achieve secure encryption, it is computationally expensive to generate and share large key sets, or to generate keys continuously.

[0007] International Patent Application Publication No. WO2017 / 145016 discloses a method for establishing a set of shared secret keys using only public keys, deterministic keys, and properties of elliptic curve algebra. Since the shared secret key does not need to be transmitted over a public network, it is not subject to man-in-the-middle attacks. From this shared secret key, it is straightforward to derive any number of additional shared secret keys through elliptic curve arithmetic or key generation extensions as proposed in this work. Of note, this protocol is key length independent, since keys can be concatenated or truncated to any desired length.

[0008] It is desirable to provide a more computationally efficient extension of the protocol disclosed in International Patent Application No. WO2017 / 145016 while maintaining the same level of security. Summary of the Invention

[0009] Thus, in accordance with the present disclosure, there is provided a method as defined in the accompanying claims.

[0010] 1. A method of encrypting data, comprising the steps of: determining, by a first participant, a cryptographic key for encrypting data based on a common secret common to the first participant and a second participant; encrypting the data based on the encryption key to provide encrypted data, the step of encrypting the data including at least one exclusive or XOR operation; incorporating the encrypted data into a blockchain transaction; A method may be provided that includes:

[0011] 1. A method of generating a cryptographic key for encrypting data, the method comprising: A method may be provided that includes a step of determining, by a first participant, a cryptographic key for encryption of data, the cryptographic key being based on at least one exclusive or XOR combination of first data, based on a common secret common to the first participant and a second participant having second data, and based on applying a one-way function to the data based on the common secret.

[0012] 1. A method of applying authentication data to a message, the method comprising: A method may be provided that includes determining message authentication data for a message to be communicated by a first participant to a second participant, the message authentication data being determined by applying a function known to the first and second participants to the message and to a common secret common to the first and second participants.

[0013] A system may be provided that includes a processor and a memory that includes executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented methods described herein.

[0014] A non-transitory computer-readable storage medium may be provided that stores executable instructions that, when executed by a processor of a computer system, cause the computer system to at least perform a computer-implemented method described herein. [Brief description of the drawings]

[0015] Various embodiments according to the present disclosure are described with reference to the drawings. [Figure 1] FIG. 2 is a schematic diagram of an encryption and decryption protocol. [Diagram 2] 1 illustrates processing of a blockchain script for redemption of a blockchain transaction. [Diagram 3]Shows the block data encryption and decryption method. [Figure 4] Shows a blockchain transaction incorporating message authentication data. [Diagram 5] Shows the message authentication code protocol. [Figure 6] It is a schematic diagram showing a computing environment in which various embodiments can be implemented.

Embodiments for Carrying Out the Invention

[0016] <Encryption Method Based on XOR> The following symbols:

Number

Table 1

[0017] When a message M and a secret key S are given, the derived ciphertext of the message is given by the following equation:

Number

Number

[0018] The decryption process uses the XOR operation and the associative property of the following equation to recover the original message:

Number

number

number

[0019] Provided that each secret key is used only once, assuming the secret key and message are unknown to any intercepting party, this provides a perfectly secure one-time-pad (OTP) method of communication. One risk of transmitting ciphertext over a public network is the malleability of the binary string in case of an intercepting party attack. However, this can be avoided by exploiting the immutability of the public blockchain, as shown below.

[0020] <Secure establishment of a shared secret key> As established in International Patent Application No. WO2017 / 145016, a shared secret key can be derived between two parties, say Alice (A) and Bob (B), using their public keys, a pre-agreed elliptic curve (e.g., scep256k1), and a generator point (G). Their respective private keys (V for Alice and Bob, respectively) are A and V B ), they each start by calculating their public keys using the following elliptic curve arithmetic:

number

[0021] They then exchange their public keys. Alice uses her private key (V A ) and Bob's public key (P B ) to obtain the shared secret key (S AB) to calculate:

number

[0022] Bob uses his private key (V B ) and Alice’s public key (P A ) to obtain the shared secret key (S AB ) to calculate:

number

[0023] Using the associative and commutative properties of elliptic curve point addition, we can see that the two computed values ​​are identical:

number

[0024] The result of the shared secret key calculation is a point (x AB ,y AB ), and they, for example, AB It may be agreed to incorporate the above scheme, which has the same hierarchical structure and the same set of operations as the arrangement described in International Patent Application No. WO2017 / 145016, but instead of using the generated secret as a symmetric key, it is used as a one-time pad (OTP), in the sense that it is based on XOR. As in International Patent Application No. WO2017 / 145016, the operations in this work can be extended to incorporate deterministic keys using a similar hierarchical key generation scheme.

[0025] FIG. 1 illustrates a key generation and XOR message encryption protocol utilizing the present disclosure for communication between two parties over a non-secure public network. A and P BFollowing the exchange of M, they each compute a shared secret key S1 using elliptic curve multiplication. Alice encrypts a message M using her secret key S1 and includes the resulting ciphertext M' in a transaction on blockchain 2. Bob reads the ciphertext M' and decrypts it using the shared secret key. The solid lined boxes in Figure 1 denote private parameters, while the dashed lined boxes denote publicly shared information.

[0026] <Non-Malleable XOR Cryptosystem Using Blockchain> The immutability of the public blockchain solves the malleability problem of transferring binary ciphertext over a non-secure network. The ciphertext can be included in a Bitcoin transaction that is sent to the network and universally recorded on the blockchain. If the ciphertext is included in the output of a transaction that is signed by the sender and verified by mining nodes, it will only be recorded on the blockchain if it has not been modified since it was signed. Similarly, anyone reading the ciphertext from the blockchain can verify the integrity of the transaction data by checking that the hash of the transaction is equal to the transaction ID. This ensures the end-to-end immutability of the ciphertext. Furthermore, since the signature is unique to the public key, the sender's identity can also be verified.

[0027] It should be noted that when data is included in the Input Script, this part of the transaction is not signed by the sender, so authenticity cannot be guaranteed.

[0028] There are two options for inserting the ciphertext into the transaction output: (1) Unspendable Output (OP_RETURN) If data is included in OP_RETURN, it cannot be used by future locking scripts, but serves as a store for the ciphertext. For example, if the address of the recipient Bob is included in the transaction, Bob's wallet can scan the blockchain for references to his address (e.g., using a smart wallet such as those used in tokenization protocols [William H, Brian P, Flannery P, Saul A, et al. Numerical recipes in C: The Art of Scientific Computing (1992) Cambridge]) and identify the ciphertext. Bob then calculates the shared secret key (S1) via the established protocol described above, and then retrieves the original message locally using the following formula:

number

[0029] This protocol is shown diagrammatically in Figure 1. Using this method, the transmission of data is resilient against man-in-the-middle attacks.

[0030] It should be noted that since this process only requires an XOR calculation, it can be easily implemented on low processing power devices.

[0031] As a use case, suppose a service provider, Alice (A), wants to send a one-time session key to a user, Bob (B). This session key can be included in a message addressed to Bob and used to initiate a communication channel, to verify login credentials, or in any other application requiring identity verification to replace traditional username and password based systems.

[0032] The process proceeds as follows in that it establishes a one-time session key K. Because the shared secret key can be reused, it must not be used directly to hide messages. By using a hash of the shared key (H(S1)) to encrypt the session key, the one-time disclosure of the session key does not reveal the secret key.

number

[0033] (2) Spendable Output A similar method to that described above can be used, using OP_DROP instead of OP_RETURN, to insert the ciphertext as a usable output. However, in Bitcoin scripts, the opcode OP_XOR can impose conditions on usage by decrypting the ciphertext, masking the data until after it has been used. For example, an XOR operation can be used to privately enter or exchange an OTP key that Alice and Bob can use to generate a more private and secure script. Without interacting with Bob, Alice can use this secret value (S1) to obscure payments to him, remaining unspent.

[0034] To do this, Alice uses a lock script of the following form:

number

[0035] This is solved by the following input:

number

[0036] The first line of the lock script is a hash puzzle that ensures the correct shared secret is used. The second line uses the secret to <h(P B )>. Then line 3 checks the signature, as in a standard transaction. The evaluation of the redemption process is shown in detail in Figure 2.

[0037] Note that when the above transaction is used, the shared secret is revealed. This can be avoided by replacing S1 by S'=h(S1) in the above script, which can be computed by both Bob and Alice.

[0038] As an example, Alice can generate a transaction that can be redeemed by Bob or a third party, Charlie. The terms of redemption for Charlie can be included in the lock script in the same way, using a shared key between Alice and Charlie. Using the properties of hash functions and XOR operations described above, the identities of Bob and Charlie can be completely hidden until the transaction is redeemed. Once redeemed, only the identity of the person redeeming the transaction is revealed.

[0039] This can be useful when two (or more) parties are anonymously racing to be the first to meet a condition, or when one party is waiting for a condition to redeem (this could include the outcome of a sporting or other event). If there are multiple parties, say Bob and Charlie, Alice can set up a transaction in the same script to be redeemable by either Bob or Charlie without the others knowing. That is, Alice configures a lock script with the condition OP_OR, redeemable by either Bob or Charlie. This is the scenario where Bob and Charlie can XOR their own public key hash values ​​for redemption, but others cannot.

[0040] <Multiparty communication> The versatility of the XOR scheme allows for easy expansion of the communication network to include many members, each with a means of secure communication between them. Using the key distribution protocol or master key derivation approach described above, a decentralized communication network establishes the XOR encryption and one-time pad directly. XOR-based encryption allows for secure and fast decryption even on devices with low processing power. In a centralized system, where a service provider verifies identity and grants access to selected parties, further concerns must be addressed.

[0041] Take for example a company or organization with an administrator, Alice (A). Alice may want to provide encrypted communication between employees while keeping a record of the communication. For example, Alice sends a message to Bob (B), who sends a message to Charlie (C) (A → B, B → C). Alice wants to keep a record of all transactions in order to have a complete record of events on their network. Alice and Bob share their shared key (S AB1 ) when Bob sends a message to Charlie, they communicate using their shared key (S BC1 ), but this message is encrypted using a derived private key (S AB2 ) to Alice.

number

[0042] This thus links Alice to all other parties in the network and ensures that she is always informed of actions on the network. This allows private communication between users who do not trust each other, while remaining completely hidden from the service provider.

[0043] <Key derivation method> Using the initial shared secret derived from the process described above, additional keys can be generated securely and efficiently without the need to establish a new set of secret keys. By exploiting the infeasibility of reversing a hash function, the one-time pad (OTP) limitation of XOR cryptography can be relaxed without sacrificing security. As will be described below, this can be extended to very large numbers of keys to securely encrypt large data structures such as multimedia files.

[0044] Using a single elliptic curve computation as described above, two parties derive a private key S1 = x AB A set of keys can be derived from this message to encode a predetermined number, say n, of messages. The key set can be derived using the following formula:

number

[0045] This yields the following:

number

[0046] This set of keys is generated using only the initial shared secret and only a single initial elliptic curve point calculation. These keys can then be used to encode n messages, S n Start from

number

[0047] The initial shared secret is never used alone to encrypt a message, and such a single compromised message does not destroy the security of all encrypted messages. Furthermore, the use of a hash function in the key calculation makes it impossible to reverse the calculation. Thus, by using the hash function in the key in reverse order, (S n+1 →S2), S n+1 The discovery of Sn Do not endanger S1 and S i Since it is not feasible to determine the message M (n-i+1) Even if a key is given, the key can still be safely reused.

[0048] <Large-scale data encryption using block ciphers> To efficiently encrypt large data sets, such as multimedia files, data is divided into fixed-length blocks and the same operation is performed on each block. As mentioned above, additional security can be applied to block ciphers by exploiting the properties of matrix multiplication [Sastry, VUK; Anup Kumar, K. (2012) “A Modified Feistel Cypher Involving XOR Operation and Modular Arithmetic Inverse of a Key Matrix”. International Journal of Advanced Computer Science and Applications (IJACSA). 3(7):35-39]. In the references, large strings are encoded by adding the ASCII values ​​of each character to a matrix and multiplying it with a randomly generated key matrix in a Feistel cipher (which typically uses repeated permutations and XOR operations to encode a single string). In this application, we show how a deterministic key can be derived to extend this process with XOR operations to encrypt large data sets securely and efficiently.

[0049] This paper outlines the process derived in [Sastry, VUK; Anup Kumar, K. (2012) “A Modified Feistel Cypher Involving XOR Operation and Modular Arithmetic Inverse of a Key Matrix”. International Journal of Advanced Computer Science and Applications (IJACSA). 3(7):35-39]. Large data sets are divided into 8-bit chunks known as words, and the data is split into exactly 2m 2 The words are then padded to ensure that they fit into a 2m by m matrix P. These words are then inserted as entries into a 2m by m matrix P. A prime modulus N is chosen to provide sufficient security for the desired application. A randomly generated key matrix K of size m by m is constructed to encrypt the data stored in P. Following this, the data matrix P is split into two m by m matrices P=(P0,Q0). The algorithm to encrypt and decrypt a data matrix is ​​given below. The encryption (and corresponding decryption) algorithm is repeated n times, providing additional security parameters. With each iteration the data is further scrambled, as each iteration permutes the data. This construction is used in the Data Encryption Standard or DES (n=16) and the Advanced Encryption Standard or AES (n=10-14).

[0050] Exploiting the nonlinearity of the encryption process ensures that the key cannot be determined using the Gaussian elimination algorithm, even if multiple ciphertext pairs are disclosed. Thus, a single key matrix K can be used to encrypt multiple data files. Furthermore, the similarity of the encryption and decryption processes reduces the amount of code, and therefore hardware, required for the computation.

[0051] <Encryption> [Number]

[0052] [Decryption] [Number]

[0053] [Feistel Cipher Key Matrix Construction] A modified Feistel cipher method is proposed here, using only the key S1 generated using the processes outlined above. Details are shown in Figure 3. The key matrix K is constructed by repeatedly taking the hash of the secret S1 and then performing a bitwise XOR operation with S1.

[0054] Using the key generation protocol described above, m(m + 1) unique keys are first derived from the aforementioned S1. [Number]

[0055] Using the elements, two matrices with linearly independent columns and rows (and thus invertible) are constructed. [Number]

[0056] K is then defined such that K = K1K2, where it is assumed that K is also invertible (necessary for the decryption process).

[0057] [Secure Multimedia Transfer] By a more efficient method of encrypting large datasets, over a public network, such as the Internet and mobile phone services BMultimedia files can be securely transmitted end-to-end through any data provider. Both matrix multiplication and Gauss-Jordan elimination matrix inversion are performed in O(m 2.376 ), which allows encryption and decryption in under a second, even on modern mobile devices. Pre-splitting the data into uniformly sized blocks makes it feasible to include huge files in the blockchain, either as a single stream or split across multiple transactions. Using the messaging protocol from the previous chapter, this can be easily integrated into peer-to-peer communication.

[0058] <Large-scale data encryption using streaming encryption> An alternative to block cipher protocols is streaming encryption, where keys are generated continuously and data is rapidly encoded one bit at a time. Using a securely generated secret key S1 and a derived key S2, a stream cipher seed can be generated using the following formula:

number

[0059] Using the seed as input to a standard PRNG (pseudo random number generator) and the XOR operation to encode the data, the stream cipher can be shared as a high-speed encryption and decryption system. Such a protocol is essential for secure streaming of media files or audio / video calls between two parties. The details of the protocol are detailed below with respect to the hash-based message authentication code (HMAC).

[0060] <Message Authentication Code (MAC)> Using the key distribution protocol, a Message Authentication Code (MAC) can be generated. The MAC allows the recipient of a message to verify the identity of the sender and ensures that the message has not been tampered with. The MAC is generated using a publicly known function of a shared secret key known jointly by Alice (A) and Bob (B) along with the message being sent.

[0061] <Blockchain-based message authentication code> Alice and Bob can establish a shared key (S1) using the protocol introduced above, i.e.:

number

[0062] Using a publicly known function f (e.g., one involving an XOR operation), the MAC is computed in terms of a shared key (S1 or any key derived from S1) and a message M. Alice computes a value y=f(M,S1) and sends the pair (M,y) to Bob. In the context of blockchain, this information can be embedded in the transaction from Alice to Bob in an OP_RETURN or as metadata in the transaction. Bob takes the information in the transaction from Alice and he can recompute y to check its validity. If the message did not originate from Alice or has been modified, the function f will produce a different value of y and can be ignored.

[0063] As an example, by defining the message M to be the entire transaction data before the OP_RETURN, this provides a way to verify offline that the transaction data has not been altered in transit, without the need for miner verification. This is shown diagrammatically in Figure 4. Figure 4 shows a message authentication code (MAC) using blockchain transaction data. By embedding the transaction data within the MAC, it can be used as a transaction verification scheme, providing additional security without the need to be connected to a network. This is important for very low capability mobile devices.

[0064] FIG. 5 illustrates a message authentication code (MAC) protocol utilizing the present disclosure for communication between two parties using a public blockchain. Following establishment of a shared secret key (as shown in FIG. 1), Alice uses the agreed-upon function f to compute a MAC(y) using a message M. Alice includes the message and MAC in a transaction to Bob. Bob computes the MAC himself using his secret key and compares it to the MAC he retrieved from the blockchain. If they are equal, Bob can verify the integrity of the message with the sender's identity.

[0065] This verification approach can be performed offline between two parties, where Bob can receive a value offline from Alice using information M and a shared secret S1 and later accept the value y as authentication. That is, after the key S1 is calculated, Alice sends a transaction tx with a message (M) included as metadata. Alice sends a message pair (y,M) offline to Bob to authenticate to the remote system, which recognizes the transaction on the blockchain.

[0066] The process is as follows.

number

[0067] A MAC can also be used as a Cyclic Redundancy Check (CRC) to detect random errors in encoding or transmission. By verifying that the same MAC can be regenerated following transmission, it is possible to ensure that the correct message is recovered. It can also be used as an offline method for authentication to a remote system.

[0068] <Reliability> The MAC can be encrypted to add authenticity to the transaction and authentication (e.g., to hide the values ​​y and M when sending to the server). A second generated key can be used to encrypt the MAC and provide additional privacy. This can be extended by incorporating a hash to generate a second MAC key, allowing both authentication and authenticity at the same time. In order to authenticate multiple times, a new key must be used each time Alice attempts to authenticate to the server.

[0069] Additional complexity can be added by using subkeys if necessary, for example if the TA is a time marker using the last valid block hash this can be incorporated to form a key hierarchy.

number

[0070] The key pair derived from S1(S2,S3) is then taken as the modulus and the function defined as follows:

number

[0071] f(M,K) can be made even stronger as y=(S2M+S3) mod N for some agreed-upon suitable integer N. If an attacker knows one (M,y) pair, this will hold when determining y' for the next message M'.

[0072] <Short MAC> A small amount of security may be sacrificed, but one still has a sufficiently secure MAC. In Bitcoin, the key length incorporates only a single coordinate (S1) and is 256 bits. On low-power devices, this can be reduced by using a lower order value for the modulus, making the operation possible in a reasonable time with moderate computational stress. If a small N is chosen, e.g. 64 bits:

number

[0073] Alternatively, M can be divided into blocks of length less than or equal to N:

number

number

number

[0074] Finally, it is possible to have a less secure but very simple means of transmitting only the lower order bits of:

number

[0075] <Streaming Hash-Based MAC (HMAC)> If an application requires additional security beyond that offered by standard MACs, a hash-based MAC (HMAC) can be used. Unlike MACs, HMACs can be easily scaled to large files (beyond the key size of a SHA-256 hash, as is a requirement of the arrangements disclosed in International Patent Application No. WO2017 / 145016) through the stream or block cipher schemes proposed in Section 3. This can be done by splitting the file into 256-bit parts.

number

[0076] <Protocol> Starting with a secret S1 derived using the method disclosed in International Patent Application No. WO2017 / 145016 and described above, subsequent keys can be securely derived using a variety of operations, including:

number

number

[0077] Here, the method for deriving the subsequent keys gives the value S i is B i , which acts as an OTP (One Time Pad) to secure the stream or channel. i ) can be calculated as follows:

number

[0078] All derived keys can be calculated using S0 and the initial block hash (initial 256 bits), ensuring data integrity.

[0079] <Usage example> <Secure peer-to-peer messaging service> Peer-to-peer communication with end-to-end encryption has been described in detail above, along with extensions to incorporate multimedia files and streaming data as verified above. The ability to freely integrate these protocols into blockchain systems provides further freedom for application developers to provide tamper-resistant security to their users. The incorporation of a Message Authentication Code (MAC) can provide users with additional assurance that the message originates from the claimed identity and that there has been no attempt to obfuscate or modify the message. For transmitting highly sensitive information, this is an important feature.

[0080] This disclosure provides an efficient and secure cryptosystem using XOR operations. The computational simplicity required allows for easy implementation using even the most basic languages ​​of blockchains such as Bitcoin (BSV). These schemes enable the proliferation of secure and diverse applications across many different systems and devices.

[0081] Referring to FIG. 6, an illustrative simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 6, the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602) that may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0082] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0083] Bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of computing device 2600 to communicate with each other as intended. Although bus subsystem 2604 is illustrated generally as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0084] The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616, in some embodiments, may act as an interface to receive data from and transmit data to other systems in the computing device 2600. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without being in a remote location, such as a data center.

[0085] User interface input devices 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touch screen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into computing device 2600.

[0086] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device, etc. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0087] The storage subsystem 2606 may provide a computer-readable storage medium that stores basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions) that, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, or DVD, or Blue-Ray) drives associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure, and data associated with the transactions and blocks described in this disclosure.

[0088] The computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that can be connected to the computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device that can be connected to the computing device 2600 may include multiple ports configured to receive optical fiber connectors. The device may thus be configured to convert optical signals into electrical signals that are transmitted to the computing device 2600 through the ports connecting the devices for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 shown in FIG. 6 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible having more or fewer components than the system shown in FIG. 6.

[0089] <Enumerated exemplary embodiments> Example embodiments of the present disclosure can be described in terms of the following paragraphs.

[0090] (Item 1) A method for encrypting data, comprising: determining, by a first participant, a cryptographic key for encrypting data based on a common secret common to the first participant and a second participant; encrypting the data based on the encryption key to provide encrypted data, the step of encrypting the data including at least one exclusive or XOR operation; incorporating the encrypted data into a blockchain transaction; The method includes:

[0091] By providing an encryption process that includes at least one exclusive or XOR operation, this provides the advantage that the XOR cipher can be derived and freely enjoyed on the public network by using a bitwise XOR encoding of the binary message string with a secret key of the same length. The ciphertext can then be decrypted using the same secret key and a bitwise XOR operation on the message. The simplicity of the protocol has the further advantage that it can be incorporated into any cryptographically based system. It is also provided that the computational efficiency of the invention allows the session key generation proposed in International Patent Application No. WO2017 / 145016 to be used on low-capability devices (mobile devices or smart cards) and can be included within the script in Bitcoin. It is also provided that the risk of modifying data or making the modification of data undetectable is minimized.

[0092] (Item 2) The method described in Item 1, wherein the encrypted data is included in the output of the blockchain transaction.

[0093] This provides the advantage that data in the output of a blockchain transaction has a verifiable digital signature, so that the identity of the sender of the data can be checked by the recipient and that the data has not been altered since it was signed.

[0094] (Item 3) The method of items 1 or 2, wherein the encrypted data is included in publicly accessible data within the transaction.

[0095] This offers the advantage that access to the data for decryption can be obtained without the need to redeem / spend a blockchain transaction.

[0096] (Item 4) The method according to any one of items 1 to 3, wherein the common secret can be used to derive a session key and / or a password from the encrypted data.

[0097] (Item 5) A method according to any one of items 1 to 4, wherein the blockchain transaction is redeemed using a script based on the shared secret.

[0098] (Item 6) The method of item 5, wherein the transaction is redeemed using a script including data based on applying a one-way function to the data based on the common secret.

[0099] This provides the advantage that the shared secret is not disclosed by redemption of a transaction and can therefore be reused.

[0100] (Item 7) The method according to item 6, wherein the one-way function is a hash function.

[0101] (Item 8) The method of any one of items 1 to 7, wherein redemption of the transaction causes the data to be made public.

[0102] (Item 9) The method according to any one of items 1 to 8, wherein redemption of the transaction identifies the participant redeeming the transaction.

[0103] This maintains privacy until the transaction is redeemed, but offers the advantage of making the consumer of the transaction identifiable in the case of more than one public key.

[0104] (Item 10) A method according to any one of items 1 to 9, further comprising, as a result of transmitting the encrypted data to the second participant, encrypting the data using an encryption key based on a second common secret common to the first participant and the third participant.

[0105] This provides the advantage of allowing multi-party encrypted communications with a record of the communications.

[0106] (Item 11) The method according to any one of items 1 to 10, further comprising a step of causing data to be transmitted to the first participant as a result of the data being transmitted from the second participant to the third participant.

[0107] (Item 12) The method according to any one of items 1 to 11, further comprising the step of determining a plurality of said encryption keys by repeatedly applying a one-way function to data based on said common secret.

[0108] This offers the advantage that a common secret needs to be established only once and then used as a seed for the generation of multiple keys, without the need for online data exchange.

[0109] (Item 13) The method according to item 12, wherein the one-way function is a hash function.

[0110] (Item 14) A method according to item 12 or 13, wherein a first encryption key used to encrypt first data is related to a second encryption key used to encrypt second data after encrypting the first data by applying the one-way function to the data based on the first encryption key.

[0111] This provides the advantage of maintaining the confidentiality of the shared secret.

[0112] (Item 15) A method according to any one of items 1 to 14, wherein the encryption is performed by applying at least one encryption key to portions of the data.

[0113] This offers the advantage of increased efficiency for large data sets.

[0114] (Item 16) The method according to any one of items 1 to 15, wherein at least one of the encryption keys is a matrix.

[0115] This provides the advantage of allowing for more secure encryption due to the non-linear properties of matrix multiplication.

[0116] (Item 17) The method of item 16, wherein the elements of the matrix are generated by repeatedly applying a one-way function to data based on the common secret.

[0117] (Item 18) The method of items 16 or 17, wherein at least one of the matrices is derived from the product of two matrices having linearly independent columns and rows.

[0118] This offers the advantage of providing an invertible matrix, thereby enabling the calculation of the decryption key.

[0119] (Item 19) A method according to any one of items 1 to 18, wherein the encryption is performed by repeatedly applying at least one encryption key to at least one portion of the data.

[0120] This offers the advantage of providing additional security due to the non-linear properties of the iterative encryption.

[0121] (Item 20) A method according to any one of items 1 to 19, further comprising a step of determining the common secret at the first participant, wherein the first participant is associated with a first public-private key pair of the cryptosystem having a first private key and a first public key, and the second participant is associated with a second public-private key pair of the cryptosystem having a second private key and a second public key, the common secret being determined at the first participant based on the first private key and the second public key, and a property of the cryptosystem being that the common secret can be determined at the second participant based on the second private key and the first public key.

[0122] (Item 21) The method described in Item 21, wherein the cryptosystem is an elliptic curve cryptosystem.

[0123] (Item 22) A method according to any one of items 1 to 21, wherein the first participant has a share of the shared secret, the shared secret being accessible with a threshold number of the shares and inaccessible with shares less than the threshold number.

[0124] (Item 23) A method for generating a cryptographic key for encrypting data, the method comprising: determining, by a first participant, a cryptographic key for encryption of data, the cryptographic key being based on at least one exclusive or XOR combination of first data, based on a common secret common to the first participant and a second participant having second data, and based on applying a one-way function to the data based on the common secret.

[0125] This offers the advantage of computational efficiency, making the method usable by devices with lower processing power.

[0126] (Item 24) The method of item 23, further comprising the step of determining a plurality of said cryptographic keys by repeatedly applying said one-way function to data based on said common secret.

[0127] (Item 25) The method according to item 23 or 24, wherein the one-way function is a hash function.

[0128] (Item 26) A method according to any one of items 23 to 25, wherein a first encryption key used to encrypt third data is related to a second encryption key used to encrypt fourth data after encrypting the third data by applying the one-way function to the data based on the first encryption key.

[0129] (Item 27) A method according to any one of items 23 to 26, wherein the encryption is performed by applying at least one encryption key to portions of the data.

[0130] (Item 28) The method according to any one of items 23 to 27, wherein at least one of the encryption keys is a matrix.

[0131] (Item 29) The method of item 28, wherein the elements of the matrix are generated by repeatedly applying the one-way function to data based on the common secret.

[0132] (Item 30) The method of item 28 or 29, wherein at least one of the matrices is derived from the product of two matrices having linearly independent columns and rows.

[0133] (Item 31) A method according to any one of items 23 to 30, wherein the encryption is performed by repeatedly applying at least one encryption key to at least one portion of the data.

[0134] (Item 32) A method according to any one of items 23 to 31, further comprising a step of determining the common secret at the first participant, wherein the first participant is associated with a first public-private key pair of the cryptosystem having a first private key and a first public key, and the second participant is associated with a second public-private key pair of the cryptosystem having a second private key and a second public key, the common secret being determined at the first participant based on the first private key and the second public key, and a property of the cryptosystem being that the common secret can be determined at the second participant based on the second private key and the first public key.

[0135] (Item 33) The method described in Item 32, wherein the cryptosystem is an elliptic curve cryptosystem.

[0136] (Item 34) A method according to any one of items 23 to 33, wherein the first participant has a share of the shared secret, the shared secret being accessible with a threshold number of the shares and inaccessible with shares less than the threshold number.

[0137] (Item 35) A method for encrypting data, the method comprising: A step of generating an encryption key by the method according to any one of items 23 to 34; encrypting data based on the encryption key to provide encrypted data, the step of encrypting the data including at least one exclusive or XOR operation; The method includes:

[0138] (Item 36) The method described in Item 35, further comprising a step of incorporating the encrypted data into a blockchain transaction.

[0139] (Item 37) The method described in Item 36, wherein the encrypted data is included in the output of the blockchain transaction.

[0140] (Item 38) The method described in items 36 or 37, wherein the encrypted data is included in publicly accessible data in the transaction.

[0141] (Item 39) The method according to any one of items 36 to 38, wherein the common secret can be used to derive a session key and / or a password from the encrypted data.

[0142] (Item 40) A method according to any one of items 36 to 39, wherein the blockchain transaction is redeemed using a script based on the shared secret.

[0143] (Item 41) The method of item 40, wherein the transaction is redeemed using a script including data based on applying a one-way function to the data based on the common secret.

[0144] (Item 42) The method described in Item 41, wherein the one-way function is a hash function.

[0145] (Item 43) The method according to any one of items 36 to 42, wherein redemption of the transaction causes the data to be made public.

[0146] (Item 44) The method according to any one of items 36 to 43, wherein redemption of the transaction identifies the participant redeeming the transaction.

[0147] (Item 45) A method of applying authentication data to a message, the method comprising the steps of: determining message authentication data for a message to be communicated by a first participant to a second participant, the message authentication data being determined by applying a function known to the first and second participants to the message and to a common secret common to the first and second participants.

[0148] This provides the advantage that the message authentication data can be recomputed at the second node to check that the data has not been corrupted since it was originally determined.

[0149] (Item 46) The method described in Item 45, wherein the message is included in a blockchain transaction.

[0150] (Item 47) The method described in Item 46, wherein the message includes data regarding a previous blockchain transaction.

[0151] This provides the advantage of allowing checking that transaction data has not been altered in transit to be done offline, which is particularly useful for low-capability devices.

[0152] (Item 48) The method described in Items 46 or 47, wherein the message authentication data is included in the blockchain transaction.

[0153] (Item 49) A method according to any one of items 46 to 48, further comprising a step of communicating the message authentication data to at least the second participant separately from the blockchain transaction.

[0154] (Item 50) A method according to any one of items 45 to 49, wherein the message authentication data includes a plurality of data items based on the common secret.

[0155] (Item 51) The method described in Item 50, wherein a plurality of the data items are applied to respective parts of the message.

[0156] This provides the advantage of making the processing of message data more efficient for large data items.

[0157] (Item 52) The method according to any one of items 45 to 51, wherein the function includes at least one exclusive OR operation.

[0158] (Item 53) A method according to any one of items 45 to 52, wherein the message authentication data comprises a plurality of data items determined by repeatedly applying a one-way function to the data based on the common secret.

[0159] (Item 54) The method described in Item 53, wherein the one-way function is a hash function.

[0160] (Item 55) A method as described in Item 53 or 54, wherein a first data item applied to a first message relates to second data which is applied to a second message after applying the first data item to the first message by applying the one-way function to the data based on the common secret.

[0161] (Item 56) A method according to any one of items 45 to 55, further comprising a step of determining the common secret at the first participant, wherein the first participant is associated with a first public-private key pair of the cryptosystem having a first private key and a first public key, and the second participant is associated with a second public-private key pair of the cryptosystem having a second private key and a second public key, the common secret being determined at the first participant based on the first private key and the second public key, and a property of the cryptosystem being that the common secret can be determined at the second participant based on the second private key and the first public key.

[0162] (Item 57) The method described in Item 56, wherein the cryptosystem is an elliptic curve cryptosystem.

[0163] (Item 58) A method according to any one of items 45 to 57, wherein the first participant has a share of the shared secret, the shared secret being accessible with a threshold number of the shares and inaccessible with shares less than the threshold number.

[0164] (Item 59) A computer-implemented system comprising: A processor; A memory containing executable instructions that, when executed by the processor, cause the system to perform any embodiment of the computer-implemented method of any of claims 1 to 58; A system including:

[0165] (Item 60) A non-transitory computer-readable storage medium storing executable instructions, the executable instructions, when executed by a processor of a computer system, causing the computer system to perform at least an embodiment of the method described in any one of items 1 to 58.

[0166] It should be noted that the above-described embodiments illustrate, rather than limit, the disclosure, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the disclosure, which is defined by the appended claims. In the claims, any reference signs in parentheses shall not be construed as limiting the claims. The terms "comprising" and "including" and the like do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of" and "comprising" means "comprising or consisting of". A singular reference of an element does not exclude a plural reference of such an element. Vice versa. The disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0167] References [1] Merkle, Ralph C. (April 1978). "Secure Communications Over Insecure Channels". Communications of the ACM. 21 (4): 294-299. [2] Diffie, Whitfield; Hellman, Martin E. (November 1976). "New Directions in Cryptography" IEEE Transactions on Information Theory. 22 (6): 644-654. [3] Menezes, A.; van Oorschot, P.; Vanstone, S. (1996). “Handbook of Applied Cryptography”. CRC Press. p.500. [4] International patent application WO2017 / 145016 [5] Belding, J.; Georges, S.; Barr, S.; Uddeen, F.; Lee, B. (2018) “Tokenized: A token Protocol for the Bitcoin (BSV) Network. [6] Sastry, V.U. K.; Anup Kumar, K. (2012) “A Modified Feistel Cypher Involving XOR Operation and Modular Arithmetic Inverse of a Key Matrix”. International Journal of Advanced Computer Science and Applications (IJACSA). 3(7):35-39. [7] William H, Brian P, Flannery P, Saul A, et al. Numerical recipes in C: The Art of Scientific Computing (1992) Cambridge.

Claims

1. 16. A method of encrypting data, the method being performed by a computing device associated with a first participant, the method comprising: determining an encryption key for encrypting data based on a common secret common to the first and second participants; encrypting the data based on the encryption key to provide encrypted data, the step of encrypting the data comprising at least one XOR operation; incorporating the encrypted data into a blockchain transaction, wherein a session key and / or a password can be derived from the encrypted data using the common secret; Including, The method, wherein the blockchain transaction is redeemed using a script including data based on applying a one-way function to the data based on the common secret.

2. Features: (i) the encrypted data is included in the output of the blockchain transaction; (ii) the encrypted data is included in publicly accessible data in the blockchain transaction; The method of claim 1 , comprising one or more of:

3. The method of claim 1 , wherein the one-way function is a hash function.

4. Features: (i) redemption of the blockchain transaction makes the data public; (ii) redeeming the blockchain transaction identifies the participant redeeming the blockchain transaction; (iii) as a result of transmitting the encrypted data to the second participant, causing the data to be encrypted using an encryption key based on a second common secret common to the first participant and the third participant; (iv) causing transmission of the data to the first participant as a result of the data being transmitted from the second participant to a third participant; or (v) determining a plurality of said cryptographic keys by repeatedly applying a one-way function to data based on said common secret. The method according to any one of claims 1 to 3, comprising one or more of the following:

5. When the method includes the step of determining a plurality of said cryptographic keys by repeatedly applying a one-way function to data based on the common secret, the one-way function is a hash function; and / or 5. The method of claim 4, wherein a first encryption key used to encrypt first data is related to a second encryption key used to encrypt second data after encrypting the first data by applying the one-way function to the data based on the first encryption key.

6. said encryption being performed by applying at least one encryption key to said portion of data; and / or The method according to any one of claims 1 to 5, wherein at least one said cryptographic key is a matrix.

7. When at least one of the cryptographic keys is a matrix, the elements of the matrix are generated by repeatedly applying a one-way function to data based on the common secret; and / or The method of claim 6 , wherein at least one of the matrices is derived from a product of two matrices having linearly independent columns and rows.

8. the encryption is performed by repeatedly applying at least one encryption key to at least one portion of the data; and / or 8. The method of claim 1, further comprising the step of determining the common secret at the first participant, the first participant being associated with a first public-private key pair of a cryptosystem having a first private key and a first public key, and the second participant being associated with a second public-private key pair of the cryptosystem having a second private key and a second public key, the common secret being determined at the first participant based on the first private key and the second public key, and a property of the cryptosystem being that the common secret is determinable at the second participant based on the second private key and the first public key.

9. The method of claim 8 , wherein the cryptosystem is an elliptic curve cryptosystem.

10. A method according to any preceding claim, wherein the first participant has a share of the common secret, the common secret being accessible with a threshold number of the shares and inaccessible with shares below the threshold number.

11. 1. A computer-implemented system comprising: A processor; a memory containing executable instructions which, upon execution by said processor, cause said system to perform a method according to any one of claims 1 to 10; A system including:

12. A non-transitory computer readable storage medium having stored thereon executable instructions which, when executed by a processor of a computer system, cause the computer system to perform a method according to any one of claims 1 to 10.

Images