Method and System for Communicating Secrets

Abstract

To provide a method of communicating a secret (k0, k1) on the Bitcoin blockchain.SOLUTION: The method comprises the steps of sending information identifying secrets selectable by the recipient and receiving a first public key (Ui) of an elliptic curve cryptography system, corresponding to a first secret (Si) selected for access by the recipient, and a first private key (m) is accessible to the recipient. A second public key (U1-i) is received, corresponding to a second secret not selected for access by the recipient, wherein a corresponding second private key is not available to the recipient. First and second secrets encrypted by means of the respective first and second public keys (X0, X1) are sent to the recipient, wherein the first secret is accessible to the recipient by means of the first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first and second secrets.SELECTED DRAWING: Figure 5

Description

Technical Field

[0001] The present disclosure relates to computer-implemented systems and methods, and more particularly, to computer-implemented systems and methods for transferring digital assets. The present disclosure is particularly suitable for, but not limited to, blockchain-based data transfer systems.

Background Art

[0002] In this document, the term "blockchain" is used to include all forms of electronic computer-based distributed ledgers. These include consensus-based blockchain and transaction chain technologies, private (permissioned) and public (un-permissioned) ledgers, shared ledgers, and variations thereof. The most widely known application of blockchain technology is the Bitcoin ledger, although other blockchain implementations have also been proposed and developed. Here, Bitcoin may be referred to for convenience and illustrative purposes, but it should be noted that the present disclosure is not limited to use in the Bitcoin blockchain, and alternative blockchain implementations and protocols are also within the scope of the present disclosure. The term "user" may here refer to a human or a processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger, which is implemented as a decentralized distributed system based on computers composed of blocks, which are in turn composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and includes at least one input and at least one output. Each block contains the hash of the previous block, whereby the blocks are linked together to create a permanent and immutable record of all transactions written to the blockchain since the start of the blockchain. Transactions include a small program known as a script embedded in the inputs and outputs of the transaction, which specifies how and by whom the outputs of the transaction can be accessed. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] For a transaction to be written to the blockchain, it must be "validated". Network nodes (miners) perform work to ensure that each transaction is valid, and invalid transactions are rejected from the network. The software client installed on the node performs this validation work on unspent transaction outputs (UTXOs) by executing lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Therefore, for a transaction to be written to the blockchain, it must i) be approved by the first node that receives the transaction, and if the transaction is approved, the node relays it to other nodes within the network, ii) be added to a new block constructed by the miner, and iii) be mined, i.e., added to the public ledger of past transactions.

[0005] Blockchain technology is most widely known for its use in cryptocurrency implementations, but digital entrepreneurs are beginning to investigate the use of both the Bitcoin-based cryptographic security system and the data that can be stored on the blockchain to implement new systems. The blockchain can be very advantageous if it can be used for automated tasks and processes that are not limited to the cryptocurrency realm. Such solutions can take advantage of the benefits of the blockchain (e.g., permanent tamper-proof recording of events, distributed processing, etc.) while being more versatile in these applications.

[0006] In the case of data exchange among related parties, it is often desirable that the recipient of the data file can access only one or a limited number of files from a selection, while the sender of the data is unable to recognize which file has been accessed. This configuration is known as Oblivious Transfer and will be described below with reference to FIGS. 1 to 3.

[0007] Referring to FIG. 1, oblivious transfer is a method of controlling access to a resource (file, database record, or any other digital asset) and transferring that resource with enhanced privacy. The basic problem of oblivious transfer is to define a mechanism by which the sender should not learn which of the many files sent to the recipient the recipient will open. Alice is the sender, Bob is the recipient, m is the message, and b is the index of the message. Alice sends a number of messages, and Bob selects whether to receive and decrypt any one of the messages. Alice does not know which one Bob selects.

[0008] The basic mechanism can be defined by considering the Diffie-Hellman (DH) key exchange

[10] with reference to FIG. 2. As shown in FIG. 2, in the Core Diffie Hellman (CDH) key exchange, it can be seen that which key is being exchanged and thus which message is being decrypted as a result of the Diffie-Hellman protocol is clear. C is the encrypted message, E is the encryption function that takes an argument of the secret key K, and D is the decryption function that takes an argument of the encrypted message C and the secret key K. Recognition by a third party of which message is being decrypted results in reduced data security in certain situations, which may lead to unauthorized access to the data.

[0009] Next, referring to FIG. 3, a modification of the DH mechanism for adapting to lost communication will be described. The receiver returns multiple keys to the sender, but it can be seen that only one of the keys is genuine and the others are "dummy" or redundant. The main difference between the configuration shown in FIG. 3 and the standard core Diffie Hellman (CDH) protocol shown in FIG. 2 is that the key returned from Bob to Alice depends on the value of bit 'b'. This calculation is performed by Bob. Next, Alice constructs two keys based on the key received from Bob. Alice returns these two keys to Bob. Bob can decrypt the message received from Alice using the key received from Alice and the key calculated by Bob from the previous value passed by Alice to Bob. Similar to the case of the configuration in FIG. 2, E is an encryption algorithm and D is a decryption algorithm. Bob can decrypt only one of the message pairs, and the other combination is "dummy" and does not work.

[0010] Using a modification of the Diffie-Hellman mechanism, it can be seen that the message that Bob decrypts remains "oblivious" to Alice. In this example, only one of the two possible messages that Bob can decrypt exists.

[0011] Therefore, it is desirable to improve data security by providing a lost communication mechanism applicable to blockchain.

[0012] Currently, such improved solutions have been devised. SUMMARY OF THE INVENTION

[0013] Accordingly, according to the present disclosure, a method and system defined in the appended claims are provided.

[0014] A method of communicating at least one secret from a sender to a receiver may be provided, the method comprising transmitting from a sender to a recipient information for identifying a plurality of secrets selectable by the recipient; receiving at the sender, from the recipient, at least one first public key corresponding to each of the first secrets selected for access by the recipient, wherein the first public key or each of the first public keys is part of a public key / secret key pair of an elliptic curve cryptosystem, and a first secret key corresponding to the first public key is accessible to the recipient; receiving at the sender, from the recipient, at least one second public key corresponding to each of the second secrets not selected for access by the recipient, wherein the second public key or each of the second public keys is a public key of the elliptic curve cryptosystem, and each second secret key corresponding to the second public key is not available to the recipient; transmitting from the sender to the recipient at least one of the first secrets encrypted by the corresponding first public key; transmitting from the sender to the recipient at least one of the second secrets encrypted by the corresponding second public key; comprising; the first secret or each of the first secrets is accessible to the recipient by the corresponding first secret key, the second secret or each of the second secrets is inaccessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0015] A method of receiving at least one secret transmitted from a sender to a recipient may be provided, the method comprising: receiving at the recipient information for identifying a plurality of secrets selectable by the recipient; Transmitting from the recipient to the sender at least one first public key corresponding to each of the first secrets selected for access by the recipient, wherein the first public key or each of the first public keys is part of a public key / secret key pair of an elliptic curve cryptosystem, and the first secret key corresponding to the first public key is accessible to the recipient, the step; Transmitting from the recipient to the sender at least one second public key corresponding to each of the second secrets not selected for access by the recipient, wherein the second public key or each of the second public keys is a public key of the elliptic curve cryptosystem, and each of the second secret keys corresponding to the second public key is not available to the recipient, the step; Receiving at the recipient at least one of the first secrets encrypted by the corresponding first public key from the sender; Receiving at the recipient at least one of the second secrets encrypted by the corresponding second public key from the sender Including; The first secret or each of the first secrets is accessible to the recipient by the corresponding first secret key, the second secret or each of the second secrets is not accessible to the recipient, and the sender cannot distinguish between the first secret and the second secret.

[0016] A system may be provided, the system comprising: A processor; As a result of execution by the processor, a memory including executable instructions for causing the system to execute any of the embodiments of the computer-implemented method described herein Including.

[0017] A non-transitory computer-readable storage medium storing executable instructions for causing a computer system to execute at least an embodiment of the computer-implemented method described herein as a result of execution by a processor of the computer system may be provided.

Brief Description of the Drawings

[0018] Various embodiments according to the present disclosure will be described with reference to the drawings.

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Modes for Carrying Out the Invention

[0019] Referring to FIG. 4, a method for executing a lost communication process from sender Bob to receiver Alice on the Bitcoin blockchain is shown. Bob begins by creating n keys {k1, k2,..., k n}. These are deterministically created as subkeys of the elliptic curve digital signature algorithm (ECDSA) master key k0 by the method disclosed in international patent application WO2017 / 145016. These n keys are used when encrypting n different values. Alice requests access to only one of these values without informing Bob which one was selected. Bob requests to ensure that Alice can access only a single value and one key in each exchange.

[0020] The process starts when Alice and Bob set the curve parameters for an elliptic curve cryptography (ECC) / elliptic curve digital signature algorithm (ECDSA) system (using, e.g., Bitcoin).

[0021] From the ECDSA mechanism, d A Q B = d A d B G = d B d A G = d B Q A is obtained.

[0022] Here, Alice calculates the point (x K , y k ) = d A Q B Bob calculates the point (x K , y K ) = d B Q A x K is the shared secret. d[[ID=4�]] A and d B are the private keys of Alice and Bob, respectively. Q A and Q B are the public keys, respectively.

[0023] From this basic algorithm, a method for exchanging pairs of numbers can be created. This logic can be repeated log2(n) times to select one of n values. This is done by ensuring that only the exchanged pair of keys is valid.

[0024] This first step enables Alice to select only one value from two possible choices, k0 and k1.

[0025] 1. Alice and Bob begin by agreeing on a value C. Alice and Bob use an ECDSA exchange to select the current block height and the hash of a secret generated by their master keys. Such an exchange is described in detail by international patent application WO2017 / 145016, where C = h(BH|S) or C = h(BH|S|Blockhash).

[0026] Here, h() is a hash function and | is a concatenation operator.

[0027] BH is the block height.

[0028] S is a shared secret generated, for example, by the method disclosed in international patent application WO2017 / 145016.

[0029] Blockhash = the block hash.

[0030] Any random value can be used, but it should be noted that the block height is a suitable source of externally agreed randomness.

[0031] 2. Alice selects a value. Alice keeps this for herself. This value (i) represents the key created by Bob at k i .

[0032] 3. Next, Alice creates a sub - key from her master key pair d A / Q A using the method of international patent application WO2017 / 145016, where Q A0 has. Here, Q A is the master key of Q A0 .

[0033] Alice first uses the ECDSA exchange to inform Bob of Q A0 . Bob encrypts. Bob encrypts Alice's option k i .

[0034] To ensure that Bob does not know whether Alice has selected \(i = 0\) or \(1\), Alice creates a decoy public key \(Q\). A1 as well.

[0035] 4. Bob does not know which is the true value.

[0036] If Alice wishes to use the private key \(d\) to decrypt the value selected by Alice, A0 Alice creates the sub - key \(d\) corresponding to \(Q=(x,y)\). A0 =(x A0 ,y A0 ) A0 as well.

[0037] Alice knows \(d\), and thus knows \(Q\). A0 A0

[0038] Alice also knows that \(dQ = d dG=d dG = Qd\). A0 Q A1 =d A0 d A1 G=d A1 d A0 G=Q A0 d A1

[0039] Alice knows \(d\), but cannot calculate \(d\). A0 d A1

[0040] Next, Bob requests \(C\equiv x = dQ=dQ\). A0 =d A0 Q A1 =d A1 Q A0

[0041] Alice knows \(d\) and can calculate \(Q\). \(Q\) is the product of \(d\) and is known to Alice. A0 d A1 Q A0 is the product of \(d\) A0 and is known to Alice.

[0042] ​​​​​5. Even if Alice can only decrypt the information encrypted with respect to Q A0 Alice gives both keys Q A0 and Q A1 to Bob. That is, Alice has the private key d A0 for Q A0 but does not have the private key d A1 for Q A1 .

[0043] 6. Bob encrypts k i for Alice. In this example, k0 is something that Alice can decrypt. That is, Bob encrypts k0 with respect to Q A0 and encrypts k1 with respect to Q A1 . So, Bob does not recognize whether Alice wants k0 or k1, but Bob recognizes that Alice has only one of the keys d A0 or d A1 necessary for Alice to decrypt the packet.

[0044] 7. Bob selects two random values r0 and r1. Bob calculates two keys Q r0 = r0G, Q r1 = r1G and sends these to Alice.

[0045] 8. Bob calculates h(Q A0 ) and h(Q A1 ).

[0046] 9. Bob creates the public keys Q AB0 = (h(Q A0 ) + r0)G, Q AB1 = (h(Q A1 ) + r1)G.

[0047] Bob encrypts k0 and k1 with Q AB0 and Q AB1 respectively. Bob sends Q r0 = r0G and Q r1 = r1G to Alice.

[0048] 10. Alice cannot oppose to obtain r0 or r1.

[0049] 11. Alice needs to determine one value, but can only decrypt (receive) one value (the blank key is not used). Both Alice and Bob are restricted as follows. Alice can choose to decrypt (receive) k0 or k1, not both, Bob does not recognize either, and Bob can send both to Alice.

[0050] In one of the two systems, Alice has two secrets, but is required to disclose one of them. At the same time, Bob does not want Alice to know which of the two secrets he wants. Bob is only interested in one of Alice's secrets, but does not want Alice to know which one. Bob receives only one answer while Alice does not recognize what Bob wants to answer.

[0051] Figure 5 shows the operation of a non-interactive lossy communication protocol, where Alice begins by sending two values k0 and k1 to Bob. These are sent as functions of Bob's public and private keys, such that Bob can extract only one of the two keys.

[0052] Finite field Z with prime number (p) p The elliptic curve above is used. All values are between 0 and (p - 1), and all calculations are done modulo p.

[0053] The general form of the elliptic curve equation is y 2 mod p = (x 3 + ax + b) mod p.

[0054] The set of points (x, y) that satisfy the elliptic curve equation is given by E p (a, b). The order r of a point T = (x1, y1) on the elliptic curve is defined as the smallest positive integer r such that rT = 0, where 0 is the point at infinity.

[0055] Point G is E p (a, b)'s reference point. This value is selected such that the degree r becomes very large. The security of the system is based on the elliptic curve discrete logarithm problem (ECDLP) and is so difficult that it cannot be solved. Solving the ECDLP of point Q is equivalent to solving an integer k such that Q = kP (or Q = kG). Here, Q and P are known.

[0056] Both Alice and Bob use the same elliptic curve and reference point G. Alice selects two values k0 and k1 and generates two points P0 = k0G and P1 = k1G.

[0057] The values k0 and k1 should not be recognized by Bob and function as secret keys held by Alice.

[0058] These values can be determined using the exchange process described in international patent application WO2017 / 145016.

[0059] If Alice has the master key of k sa , the values k0 and k1 can be linked to k sa + v0 = k0, k sa + v1 = k1 in the form of k sa .

[0060] Here, v0 and v1 are values recognized by Alice. This process can be completed before the lost communication message exchange.

[0061] The protocol is defined as follows.

[0062] Referring to Figure 5, it starts with the reference point G and points P0 and P1.

[0063] Let P = P0 + P1 and i ∈ {0, 1}.

[0064] 1. Bob creates the public key (U0, U1) by selecting a random integer m and setting U i = mG. Here, U i indicates whether U0 or U1 corresponds to k0 or k1 selected by Bob. Bob sends the public keys U0 and U1 to Alice.

[0065] Next, set U b = mG - P i and U 1-i = P 1-i - U b in this way.

[0066] Bob's private key is m. m can be derived using the process described in international patent application WO2017 / 145016.

[0067] 2. Alice selects two random integers a0 and a1, and calculates V0 = a0G and V1 = a1G.

[0068] Next, Alice calculates W0 = a0U0 and W1 = a1U1.

[0069] Alice sends V0 and V1 to Bob.

[0070] Next, Alice

[0071]

Number

[0072]

Number

[0073] Here,

[0074]

Number

[0075] Alice also sends X0 and X1 to Bob.

[0076] 3. Bob calculates the value mV i = ma i G = W i to calculate.

[0077] This enables Bob to

[0078]

Number

[0079] S i is the i-th secret.

[0080] Since Bob cannot calculate n, it should be noted that S 1-i cannot be extracted, where U 1-i = nG. Alice does not know which of U0 or U1 is equal to mG so that Bob can determine the value of m. Therefore, Alice does not know which of the two secrets Bob received.

[0081] Alice can verify that Bob's public key is correctly formed in the following manner.

[0082] 1. Check that U i + U 1-i = P.

[0083] 2. Calculate U b = U i - P i to calculate.

[0084] This is U 1-i - P 1-iIt is used to verify whether it is negative or not.

[0085] The security aspects of the protocol are as follows.

[0086] 1. Alice cannot estimate which of the two secrets Bob received.

[0087] 2. The security of the protocol holds when the discrete logarithm problem (DLP) holds for the elliptic curve.

[0088] 3. If Alice follows the protocol, Bob can find only one of Alice's secrets.

[0089] This system enables fair management of exchanges. Bob and Alice can exchange information without knowing what was exchanged. This can be used to control all viewing of data or information, access to databases, and other records (e.g., medical files), and this information can be published bit by bit along with a record of who viewed which information. This can eliminate the need for a trusted server or third party.

[0090] Next, referring to FIG. 6, a simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided as an example. In various embodiments, the computing device 2600 may be used to implement any of the implementation systems shown and described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 6, the computing device 2600 may include one or more processors having one or more levels of cache memory, and a memory controller (collectively labeled 2602) configured to communicate with a storage subsystem 2606 that includes main memory 2608 and persistent storage 2610. Main memory 2608 may include, as illustrated, dynamic random access memory (DRAM) 2618 and read-only memory (ROM) 2620. The storage subsystem 2606 and the cache memory 2602 may be used for storing information such as details related to the transactions and blocks described in the present disclosure. The processor 2602 may be utilized to provide the steps or functions of any of the embodiments described in the present disclosure.

[0091] The processor 2602 may also communicate with one or more user interface input devices 2612, one or more user interface output devices 2614, and a network interface subsystem 2616.

[0092] The bus subsystem 2604 may provide a mechanism that enables the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is schematically shown as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0093] The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616 may function as an interface for receiving data from other systems and transmitting data from the computing device 2600 to other systems. For example, the network interface subsystem 2616 may enable a device to be connected to a network so that a data technician can send data to and receive data from the device while being at a remote location such as a data center.

[0094] The user interface input device 2612 may include one or more user input devices such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touch screen incorporated into a display, an audio input device such as a voice recognition system, microphone, and other types of input devices. Generally, the use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into the computing device 2600.

[0095] One or more user interface output devices 2614 may include a non-visual display such as a display subsystem, printer, or audio output device. The display subsystem may be a cathode ray tube (CRT), a flat panel device such as a liquid crystal display (LCD), a light emitting diode (LED) display, or a projection or other display device. Generally, the use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. One or more user interface output devices 2614 may be used, for example, to present a user interface so as to realize user interaction with an application that executes the processes and variations described herein when user interaction may be appropriate.

[0096] The memory subsystem 2606 may provide a computer-readable storage medium for storing the basic programming and data configurations that can provide the functionality of at least one embodiment of the present disclosure. Applications (programs, code modules, instructions) may provide the functionality of one or more embodiments of the present disclosure when executed by one or more processors and may be stored in the memory subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The memory subsystem 2606 may further provide a repository for storing data used in accordance with the present disclosure. For example, main memory 2608 and cache memory 2602 can provide volatile storage for programs and data. Persistent storage 2610 can provide persistent (non-volatile) storage for programs and data and may include flash memory, one or more solid state drives, one or more magnetic hard disk drives, one or more floppy disk drives with associated removable media, one or more optical drives (e.g., CD-ROM or DVD or Blu-ray) drives with associated removable media, and other similar storage media. Such programs and data can include a program for executing the steps of one or more embodiments described in the present disclosure and data related to the transactions and blocks described in the present disclosure.

[0097] The computing device 2600 may be of various types, including a portable computer device, a tablet computer, a workstation, or any other device described below. Further, the computing device 2600 may include other devices that can be connected to the computing device 2600 through one or more ports (e.g., USB, headphone jack, Lightning connector, etc.). The devices that can be connected to the computing device 2600 may include a plurality of ports configured to receive optical fiber connectors. Thus, this device may be configured to convert optical signals into electrical signals, and the electrical signals may be transmitted through the port that connects the device to the computing device 2600 for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 shown in FIG. 6 is intended only as a specific example for the purpose of illustrating a preferred embodiment of the device. Many other configurations are possible with more or fewer components than the system shown in FIG. 6.

[0098] [Enumeration of Exemplary Embodiments] Examples of embodiments of the present disclosure can be described in view of the following items.

[0099] 1. A method for communicating at least one secret from a sender to a receiver, transmitting from the sender to the receiver information identifying a plurality of secrets selectable by the receiver; at the sender, receiving from the receiver at least one first public key corresponding to each of the first secrets selected by the receiver for access by the receiver, wherein the first public key or each of the first public keys is part of a public key / secret key pair of an elliptic curve cryptosystem, and the first secret key corresponding to the first public key is accessible to the receiver; In the sender, receiving from the receiver at least one second public key corresponding to each of the second secrets not selected by the receiver for access by the receiver, wherein the second public key or each of the second public keys is a public key of the elliptic curve cryptosystem, and each second secret key corresponding to the second public key is not available to the receiver; transmitting from the sender to the receiver at least one of the first secrets encrypted by the corresponding first public key; transmitting from the sender to the receiver at least one of the second secrets encrypted by the corresponding second public key; comprising; wherein the first secret or each of the first secrets is accessible to the receiver by the corresponding first secret key, the second secret or each of the second secrets is inaccessible to the receiver, and the sender cannot distinguish between the first secret and the second secret.

[0100] This provides the advantage of improving the security of the data of the method by allowing the receiver to access only a limited number of messages while preventing the sender from recognizing which messages the receiver has accessed.

[0101] 2. The method according to item 1, further comprising encrypting at least one of the first secrets by the corresponding first public key and encrypting at least one of the second secrets by the corresponding second public key.

[0102] 3. The method according to item 2, wherein at least one of the first secrets and at least one of the second secrets are encrypted by respective exclusive-or ciphers.

[0103] This provides the advantage of enabling fast and efficient encryption and decryption.

[0104] 4. The method according to item 3, wherein at least one of said exclusive OR ciphers has respective encryption keys based on the corresponding first or second public key.

[0105] 5. The method according to item 4, wherein at least one of said encryption keys includes the corresponding first or second public key multiplied by the respective first or second cryptographic integer known to the sender by multiplication of scalar elliptic curve points.

[0106] 6. The method according to item 5, further comprising the step of transmitting from the sender to the receiver at least one of said first and / or second cryptographic integers encrypted by the corresponding first or second public key.

[0107] 7. The method according to any one of items 1 to 6, wherein at least one of said first secrets is encrypted by a respective third public key including respective masking terms each including the result of scalar multiplication of the elliptic curve generation point of the elliptic curve cryptosystem by the respective first masking integer known to the sender, added to the respective first cryptographic terms by addition of elliptic curve points.

[0108] 8. The method according to item 7, wherein at least one of said first cryptographic terms includes the result of scalar multiplication of the elliptic curve generation point by the respective third cryptographic integer depending on the corresponding first public key.

[0109] 9. The method according to item 8, wherein at least one of said third cryptographic integers is the hash value of the corresponding first public key.

[0110] 10. The method according to any one of items 7 to 9, wherein at least one of said second secrets is encrypted by a respective fourth public key including respective masking terms each including the result of scalar multiplication of the elliptic curve generation point of the elliptic curve cryptosystem by the respective second masking integer known to the sender, added to the respective second cryptographic terms by addition of elliptic curve points.

[0111] 11. The method according to item 10, wherein at least one of the second cryptographic terms includes a result of scalar multiplication of the elliptic curve generation points by respective fourth cryptographic integers that depend on the corresponding second public keys.

[0112] 12. The method according to item 11, wherein at least one of the fourth cryptographic integers is a hash value of the corresponding second public key.

[0113] 13. The method according to any one of items 1 to 12, wherein at least one of the first and / or second public keys can be determined from the corresponding second and / or first public keys.

[0114] 14. The method according to any one of items 1 to 13, further comprising the step of generating at least one third secret to be shared between the sender and the receiver.

[0115] 15. The method according to items 13 and 14, wherein at least one of the first and / or second public keys is based on the corresponding second and first public keys and at least one of the third secrets.

[0116] 16. The method according to any one of items 1 to 15, further comprising, at the sender, the step of checking the integrity of at least one of the first and / or second public keys received from the receiver using the corresponding second and / or first public keys received from the receiver.

[0117] 17. The method according to any one of items 1 to 16, wherein the result of scalar multiplication of at least one of the first public keys by the second secret key is equal to the result of scalar multiplication of each of the second public keys by the respective first secret keys.

[0118] 18. The method according to any one of items 1 to 17, wherein at least one of the first secret key and at least one of the second secret keys are deterministically derived from the secret key of the elliptic curve cryptosystem known to the sender.

[0119] 19. A method for receiving at least one secret transmitted from a sender to a receiver, comprising: receiving, at the receiver, information for identifying a plurality of secrets selectable by the receiver; transmitting, from the receiver to the sender, at least one first public key corresponding to each of the first secrets selected for access by the receiver, wherein the first public key or each of the first public keys is part of a public key / secret key pair of an elliptic curve cryptosystem, and the first secret key corresponding to the first public key is accessible to the receiver; transmitting, from the receiver to the sender, at least one second public key corresponding to each of the second secrets not selected for access by the receiver, wherein the second public key or each of the second public keys is a public key of the elliptic curve cryptosystem, and each second secret key corresponding to the second public key is not available to the receiver; receiving, at the receiver, at least one of the first secrets encrypted by the corresponding first public key from the sender; receiving, at the receiver, at least one of the second secrets encrypted by the corresponding second public key from the sender, wherein the first secret or each of the first secrets is accessible to the receiver by the corresponding first secret key, the second secret or each of the second secrets is inaccessible to the receiver, and the sender cannot distinguish between the first secret and the second secret.

[0120] 20. The method according to item 19, wherein at least one of the first secrets and at least one of the second secrets are encrypted by respective exclusive-or ciphers.

[0121] 21. The method according to item 20, wherein at least one of said exclusive OR ciphers has respective encryption keys based on the corresponding first or second public key.

[0122] 22. The method according to item 21, wherein at least one of said encryption keys includes the corresponding first or second public key multiplied by the respective first or second encryption integer known to the sender by multiplication of scalar elliptic curve points.

[0123] 23. The method according to item 22, further including, at the receiver, receiving from the sender at least one of said first and / or second encryption integers encrypted by the corresponding first or second public key.

[0124] 24. The method according to any one of items 19 to 23, wherein at least one of said first secrets is encrypted by a respective third public key including respective masking terms including the result of scalar multiplication of the elliptic curve generation point of said elliptic curve cryptosystem by the respective first masking integer known to the sender, added to the respective first cipher terms by addition of elliptic curve points.

[0125] 25. The method according to item 24, wherein at least one of said first cipher terms includes the result of scalar multiplication of the elliptic curve generation point by the respective third encryption integer depending on the corresponding first public key.

[0126] 26. The method according to item 25, wherein at least one of said third encryption integers is the hash value of the corresponding first public key.

[0127] 27. The method according to any one of items 24 to 26, wherein at least one of said second secrets is encrypted by a respective fourth public key including respective masking terms including the result of scalar multiplication of the elliptic curve generation point of said elliptic curve cryptosystem by the respective second integer known to the sender, added to the respective second cipher terms by addition of elliptic curve points.

[0128] 28. The method according to item 27, wherein at least one of the second cryptographic terms includes a result of scalar multiplication of the elliptic curve generation point by respective fourth cryptographic integers that depend on the corresponding second public key.

[0129] 29. The method according to item 28, wherein at least one of the fourth cryptographic integers is a hash value of the corresponding second public key.

[0130] 30. The method according to any one of items 19 to 29, wherein at least one of the first and / or second public keys can be determined from the corresponding second and / or first public keys.

[0131] 31. The method according to any one of items 19 to 30, further comprising the step of generating at least one third secret to be shared between the sender and the receiver.

[0132] 32. The method according to items 30 and 31, wherein at least one of the first and / or second public keys is based on the corresponding second and first public keys and at least one of the third secrets.

[0133] 33. The method according to any one of items 19 to 32, wherein the result of scalar multiplication of at least one of the first public keys by the second secret key is equal to the result of scalar multiplication of each of the second public keys by the respective first secret keys.

[0134] A computer-implemented system configured to execute the method according to any one of items 1 to 33.

[0135] The above embodiments are illustrative rather than limiting of the present invention, and it should be noted that those skilled in the art can design many alternative embodiments without departing from the scope of the present disclosure defined by the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Terms such as "comprising" and "comprises" do not exclude the presence of elements or steps other than those listed in any claim or specification as a whole. In this specification, "comprises" means "includes or consists of", and "comprising" means "comprising or consisting of". A reference to the singular form of an element does not exclude a reference to the plural form of such element, and vice versa. The present invention may be implemented by hardware including several distinct elements and also by a suitably programmed computer. In a claim of a device listing several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be advantageously utilized.

[0136] [References] [1] “Generalised Oblivious Transfer Protocol”, Partha Sarathi Roy, Department of Pure mathematics, University Cacutta India [2] “Generalised oblivious transfer by secret sharing” Tamir Tassa [3] “Computationally secure oblivious transfer” Moni Naor, Benny Pinkas [4] "The simplest protocol for oblivious transfer" Tung Chou and Claudio Orlandi [5] "Smooth projective hashing and two message oblivious transfer" Yuri Tauman KAlai MIT [6] "Oblivious Transfer with Access Control" Jan Camenisch, Maria Dubovitskaya, Gregory Neven [7] "Practical Fully Simulatable Oblivious Transfer with Sub-linear communication" BingSheng Zhang, Helger Lipmaa, Cong Wang, Kuri Ren [8] Rabin (1981) for papers on oblivious transfer [9] Bellare M.; Micalli, S.

[1989] "Non-Interactive Oblivious Transfer and Applications" : Proc. On Adv in Cryptography CRYPTO 89. PP 547-557.

[10] Diffie, W.; Hellman, M. (1976). "New directions in cryptography" (PDF). IEEE Transactions on Information Theory. 22 (6): 644-654. doi:10.1109 / TIT.1976.1055638.

[11] Prof Bill Buchanan, www.asecuritysite.com

[12] Boneh, Franklin, “Identity-Based Encryption from the Weil Pairing”. Appears in SIAM J. of Computing, Vol. 32, No. 3, pp. 586-615, 2003. An extended abstract of this paper appears in the Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer Science, pages 213-229, Springer-Verlag, 2001. “Bilinear paring”

Claims

1. A computer-implemented method for communicating secrets from a first computing device to a second computing device, each of the first computing device and the second computing device having a respective public key / secret key pair, the method comprising: at the first computing device: generating a secret value in cooperation with the second computing device based on the respective public keys of the first and second computing devices; transmitting information identifying a plurality of secrets to the second computing device; receiving from the second computing device a first public key corresponding to a first secret of the plurality of secrets, the first public key being part of a public key / secret key pair of an elliptic curve cryptosystem, the first secret key corresponding to the first public key being accessible to the second computing device, and the first public key being generated by the second computing device from its public key / secret key pair; receiving from the second computing device a second public key corresponding to a second secret of the plurality of secrets, the second public key being a public key of the elliptic curve cryptosystem, the second secret key corresponding to the second public key not being available to the second computing device, and the second public key being generated by the second computing device from the first public key and the secret value; transmitting the first secret encrypted by the first public key to the second computing device; transmitting the second secret encrypted by the second public key to the second computing device wherein: the first secret is accessible to the second computing device by the corresponding first secret key, the second secret is not accessible to the second computing device, and the first computing device cannot identify which secret is accessible to the second computing device.

2. The method according to claim 1, further comprising encrypting the first secret with the first public key and encrypting the second secret with the second public key.

3. The method according to claim 1 or 2, wherein the first secret is encrypted by a third public key derived from the first public key including a first masking term including a result of scalar multiplication by a first masking integer known to the first computing device of the elliptic curve generation point of the elliptic curve cryptosystem, which is added to the first cryptographic term by addition of elliptic curve points.

4. The method according to claim 3, wherein the first cryptographic term includes a result of scalar multiplication of the elliptic curve generation point by a third cryptographic integer that depends on the first public key.

5. The method according to claim 4, wherein the third cryptographic integer is a hash value of the first public key.

6. The method according to any one of claims 3 to 5, wherein the second secret is encrypted by a fourth public key including a second masking term including a result of scalar multiplication by a second masking integer known to the first computing device of the elliptic curve generation point of the elliptic curve cryptosystem, which is added to the second cryptographic term by addition of elliptic curve points.

7. The method according to claim 6, wherein the second cryptographic term includes a result of scalar multiplication of the elliptic curve generation point by a fourth cryptographic integer that depends on the second public key.

8. The method according to claim 7, wherein the fourth cryptographic integer is a hash value of the second public key.

9. The method according to any one of claims 1 to 8, wherein the result of scalar multiplication of the first public key by the second secret key is equal to the result of scalar multiplication of the second public key by the first secret key.

10. A system including a processor configured to execute the method according to any one of claims 1 to 9.

11. A computer-implemented method for a second computing device to receive a secret from a first computing device, wherein each of the first computing device and the second computing device has its own public key / secret key pair, the method comprising: In the second computing device, generating a secret value in cooperation with the first computing device based on the respective public keys of the first and second computing devices; receiving information for identifying a plurality of secrets from the first computing device and selecting a first secret from the plurality of secrets; generating a first public key and a corresponding first secret key from the public key / secret key pair of the second computing device; Generating the second public key from the first public key and the secret value such that a second secret key corresponding to the second public key is not available to the second computing device; Sending, to the first computing device, the first public key corresponding to the first secret and the second public key corresponding to a second secret among the plurality of secrets; Receiving, from the first computing device, the first secret encrypted by the first public key and the second secret encrypted by the second public key; comprising; wherein the first secret is accessible to the second computing device by the first secret key, the second secret is not accessible to the second computing device, and the first computing device cannot identify which secret is accessible to the second computing device. **Claim 12** The method according to claim 11, wherein the first secret is encrypted by a third public key including a first masking term including a result of scalar multiplication by a first masking integer known to the first computing device of an elliptic curve generation point of the elliptic curve encryption system, which is added to a first encryption term by addition of elliptic curve points. **Claim 13** The method according to claim 3, wherein the first encryption term includes a result of scalar multiplication of the elliptic curve generation point by a third encryption integer dependent on the first public key. **Claim 14** The method according to claim 13, wherein the third encryption integer is a hash value of the first public key. **Claim 15** The method according to any one of claims 12 to 14, wherein the second secret is encrypted by a fourth public key including a second masking term including a result of scalar multiplication by a second integer known to the first computing device of the elliptic curve generation point of the elliptic curve encryption system, which is added to a second encryption term by addition of elliptic curve points. **Claim 16** The method according to claim 15, wherein the second encryption term includes a result of scalar multiplication of the elliptic curve generation point by a fourth encryption integer dependent on the second public key. **Claim 17** The method according to claim 16, wherein the fourth encryption integer is a hash value of the second public key. **Claim 18** The method according to any one of claims 11 to 17, wherein a result of scalar multiplication of the first public key by the second secret key is equal to a result of scalar multiplication of the second public key by the first secret key.

19. A system including a processor configured to execute the method according to any one of claims 11 to 18.

Images