Computer-implemented system and method for distributing shares of digitally signed data

Abstract

To provide a method and system for distributing shares of digitally signed data especially suitable for use in distributing arbitrary shares of signed blockchain transaction.SOLUTION: A method includes: mapping a digitally signed message to an elliptic curve point of an elliptic curve of an elliptic curve cryptography system common to participants; generating a digital signature obtained by encrypting the mapped elliptic curve point by a first encryption step in a knapsack algorithm form; generating a doubly encrypted digital signature obtained by encrypting the encrypted digital signature by a second encryption step in an elliptic curve cryptography method (ECC) form; and dividing the doubly encrypted digital signature into a plurality of shares and distributing them to the plurality of participants by a secret sharing step such as Shamir's secret sharing.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates generally to secret sharing, and in particular to distributing shares of digitally signed data. The present disclosure is particularly suited for use in distributing any shares of signed blockchain transactions, without limitation. [Background technology]

[0002] Herein, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. While other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referenced herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" here may refer to a human or a processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based, decentralized, distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are strung together to create a permanent, immutable record of all transactions written to the blockchain since its origin. Transactions contain small programs known as scripts. Scripts embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0004] For a transaction to be written to the blockchain, it must be validated. Network nodes (miners) perform the work to ensure that invalid transactions are rejected by the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Therefore, for a transaction to be written to the blockchain, it must (i) be validated by the first node that receives it, and if the transaction is valid, the node relays the transaction to other nodes in the network; (ii) be added to a new block constructed by miners; or (iii) be mined, i.e., added to the public ledger of past transactions.

[0005] While blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to explore the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field. Such solutions could take advantage of the benefits of blockchains (e.g., permanence, tamper-resistance of event records, decentralized processing, etc.) while further diversifying their uses.

[0006] Blockchain technology utilizes secret sharing techniques in its implementation, for example distributing shares of a password or digital signature to allow a threshold number of signatures on a transaction.

[0007] Existing secret sharing techniques, such as threshold signature processes, do not scale well because the private keys that are generated are packed into data structures that have little or no sorting or organization.

[0008] It would therefore be desirable to provide an improved secret sharing method that can be more efficiently scaled.

[0009] Such an improved solution is devised here.

[0010] Thus, in accordance with the present disclosure, there is provided a method as defined in the accompanying claims. Summary of the Invention

[0011] According to the present disclosure, there is provided a computer-implemented method for distributing a shared secret among multiple participants, the method comprising: a first mapping step, wherein a plurality of inputs to said first mapping step are mapped to respective elliptic curve points of an elliptic curve of an elliptic curve cryptosystem common to said participants; a first encryption step in which a plurality of the elliptic curve points are encrypted with a public key of a public-private key pair of the elliptic curve cryptosystem to provide an output adapted to be decrypted using a corresponding private key of the public-private key pair; a second encryption step, wherein portions of at least one input to said second encryption step are multiplied by respective terms of a sequence known to said participants; a secret sharing step, wherein shares of an input to the secret sharing step are distributed among a plurality of the participants such that the input has access to a threshold number of the shares and no input has access to fewer than the threshold number of the shares; A method may be provided that includes:

[0012] This offers the advantage of increased security, as the shared secret is disguised as an elliptic curve point and is therefore more difficult for unauthorized parties to detect.

[0013] At least one input of the secret sharing step may be based on the output of the first encryption step or the second encryption step.

[0014] At least one input to the first encryption step may be based on a shared secret, at least one input to the second encryption step may be based on the output of the first encryption step, and at least one input to the secret sharing step may be based on the output of the second encryption step.

[0015] At least one input to the second encryption step may be based on a shared secret, at least one input to the first encryption step may be based on the output of the second encryption step, and at least one input to the secret sharing step may be based on the output of the first encryption step.

[0016] At least one input of the first encryption step may be based on the output of the secret sharing step or the second encryption step.

[0017] By performing the secret sharing step before at least one of the other steps, this provides the advantage of improving the computational efficiency of the process.

[0018] At least one input to the secret sharing step may be based on a shared secret, at least one input to the second encryption step may be based on the output of the secret sharing step, and at least one input to the first encryption step may be based on the output of the second encryption step.

[0019] At least one input to the second encryption step may be based on a shared secret, at least one input to the secret sharing step may be based on the output of the second encryption step, and at least one input to the first encryption step may be based on the output of the secret sharing step.

[0020] At least one input of the second encryption step may be based on the output of the secret sharing step or the first encryption step.

[0021] At least one input to the secret sharing step may be based on a shared secret, at least one input to the first encryption step may be based on the output of the secret sharing step, and at least one input to the second encryption step may be based on the output of the first encryption step.

[0022] At least one input to the first encryption step may be based on a shared secret, at least one input to the secret sharing step may be based on the output of the first encryption step, and at least one input to the second encryption step may be based on the output of the secret sharing step.

[0023] The second encryption step may include performing a Knapsack algorithm.

[0024] This offers the advantage of improving the efficiency of the method.

[0025] The second encryption step may include the sequence being based on a Stern sequence.

[0026] This provides the advantage of greater efficiency by reducing the amount of time to execute the algorithm.

[0027] The second encryption step may include the sequence containing powers of terms known to the participants.

[0028] The terms may be based on messages shared between the participants.

[0029] The second encryption step may include a super-increasing number sequence.

[0030] This provides the advantage of allowing for more efficient decryption of the shared secret.

[0031] The first mapping step may include determining an elliptic curve point having coordinates based on the input.

[0032] The coordinates may be based on the input multiplied by an amount known to the participant.

[0033] This offers the advantage of increased security.

[0034] The first encryption step may include determining a term comprising an elliptic curve point multiplied by an integer representing an input to the first encryption step.

[0035] The first encryption step may include determining a term based on the short-term key and the participant's public key.

[0036] The method may further include transmitting to at least one participant an elliptic curve point based on an origin of the elliptic curve cryptosystem multiplied by a short-term key and an elliptic curve point based on the participant's public key multiplied by the short-term key.

[0037] The shared secret may be a digitally signed message.

[0038] The digitally signed message may be a blockchain transaction.

[0039] The present disclosure also provides a system including a processor and a memory including executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented method described herein.

[0040] The present disclosure also provides a non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least one of the computer-implemented methods described herein.

[0041] The present disclosure ensures authenticity, authentication, non-repudiation, and adds message recovery and transformation in digital signatures. The present disclosure allows for secure transmission of data (such as logs in scripts of secrets or keys). The present disclosure also protects against attacks such as key-only attacks and message attacks in banking systems. Overall, embodiments of the present disclosure relate to a process that allows for the incorporation of external information related to Bitcoin transactions and messages for other uses.

[0042] The mechanism for key distribution and efficient distribution of key shares in embodiments of the present disclosure introduces nonlinearity into the process of storing key data. This enhances the degree of security in cryptographic protocols by adding steps for diffusion and confusion. The efficient packing of key shares also allows the solution to scale efficiently. The distributed nature of key shares enables an operational model involving the ESCROW service, where ESCROW agents can act as forwarding agents without knowing any cryptographic secrets, while still being able to monitor, verify, send, and receive messages.

[0043] These and other aspects of the present disclosure will be apparent from and will be taught with reference to the embodiments described herein, which are described below, by way of example only, and with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0044] [Figure 1] FIG. 1 is a schematic diagram of a process for distributing shares of a digitally signed message embodying the present disclosure. [Figure 2] 2 is a detailed representation of part of the process of FIG. 1. [Figure 3] 2 shows the signature generation step of the process of FIG. 1. [Figure 4] 1 shows the encryption step of the process of FIG. [Figure 5]The message recovery process for obtaining the digital signature encrypted by the process of FIG. 1 is shown below. [Figure 6] A decoding process for use in the process of FIG. 5 is shown. [Figure 7] FIG. 1 is a schematic diagram illustrating a computing environment in which various embodiments may be implemented. DETAILED DESCRIPTION OF THE INVENTION

[0045] Referring to Figure 1, a process for distributing shares of a digitally signed message among multiple participants is described. First, in step 10, a digital message m (where m is the hash value of a message M, such as a Bitcoin transaction) is input into an elliptic curve digital signature algorithm. As will be understood by those skilled in the art, ECDSA generates a public and private key pair and an ephemeral key, which is a random integer, to provide a digital signature (r, s) in a manner described in further detail below. In a mapping step 20, the digital signature (r, s) is then mapped to an elliptic curve point of the elliptic curve cryptosystem common to the participants. A first encryption step 30 in the form of a knapsack algorithm is then applied to the elliptic curve point generated in step 20 to generate an encrypted version (R, S) of the digital signature (r, s). A second encryption step 40 in the form of elliptic curve cryptography (ECC) is then applied to the encrypted version (R,S) of the digital signature (r,s) to produce a doubly encrypted version (P R ,P S Alternatively, the first encryption step 20 can be elliptic curve cryptography (ECC) and the second encryption step 40 can be a knapsack algorithm. Finally, a secret sharing step 50, such as Shamir's secret sharing, provides a doubly encrypted version (P R ,P S) ECC encryption can use the Koblitz algorithm, which is described in more detail below.

[0046] The techniques of the disclosed embodiments allow for the distribution of key shares among participants in a shared fashion. This, in turn, allows for a distributed mechanism for message decryption and message recovery. The same mechanism can be used to encrypt messages, as described in more detail below. The techniques optimize the data packing problem to allow key shares to be packed and distributed as efficiently as possible, using a knapsack algorithm, such as that disclosed in "Different Approaches to Solve the 0 / 1 Knapsack Problem," Maya Hristakeva, Computer Science Department, Simpson College, Indianola, IA 50125, hristake@simpson.edu.

[0047] All variations of the standard solution, such as the knapsack algorithm and those defined in "Different Approaches to Solve the 0 / 1 Knapsack Problem," Maya Hristakeva, Computer Science Department, Simpson College, Indianola, IA 50125, hristake@simpson.edu, perform some variation of a search through the configuration space. The search through the configuration space can be made systematic and exhaustive by using a Stern series to seed the ratios with which the knapsack algorithm is initialized. This impacts the algorithm's operational efficiency, since the Stern series can be used to generate all possible rational fractions exactly once. When the fractions are constrained to be values ​​less than 1, they can be used as packing ratios by the knapsack algorithm. This contributes to an exhaustive search through all possible ratios of key shares. Signature generation is performed from an arbitrary data message.

[0048] Advantages of the Preferred Embodiments Bitcoin allows for digital signing of messages in its current format. The introduction of the proposed Knapsack ECC method of this disclosure extends this to allow for signature lookup and decryption, as detailed further below. Thus, the same mechanism can be used for message lookup.

[0049] In the disclosed scheme, the ciphertext of the signature can be sent to a group of verifiers. The verifiers can then decrypt the ciphertext according to a (t,n) threshold scheme, where any t of the n verifiers in the group can decrypt and recover the message. This is described, for example, in Hsu C. L and Wu TC (1998), "Authenticated Encryption Scheme with (t,n) Shared Verification," IEEE Proceedings - Computers and Digital Techniques, Vol. 145, no. 2, pp. 117-120. This improves the confidentiality of data transmissions and allows for the integration of encrypted sessions directly related to Bitcoin exchanges.

[0050] Elliptic curve cryptography (ECC), described for example in Koblitz N. (1987), 'Elliptic Curve Cryptosystems', Mathematics of Computation, pp. 203-209, provides a secure method for exchanging encrypted information. ECC does not require domain parameters to remain secret (unlike other known cryptographic methods such as RSA). Some applications of this procedure include public key designation with simultaneous verification in self-certified public key cryptosystems. By introducing the knapsack algorithm, the disclosed scheme introduces nonlinearity into the encryption process. The nonlinearity is generated not by the order in which the information is used, but because the key information that constitutes the encryption process is packed in a space-efficient manner. This provides a higher level of security for encrypted messages that are fed into the knapsack algorithm before being sent to the receiver. The receiver can then use the reverse knapsack process to subsequently decrypt and recover the message.

[0051] The initial domain parameters are set within the Bitcoin protocol. The message exchanges used within this scheme, together with the user's Bitcoin key-based identity, can be used as a secure authentication mechanism. This allows for a challenge-response mechanism between the user and the server, as described for example in Nyberg K. And Rueppel RA (1993), 'A New Signature Scheme Based on DSA giving message Recovery', ACM Computer and Communications Security, Vol.1, pp.58-61.

[0052] The base public key held by the client can be extended using the multi-signature method described below.

[0053] In this method, for example, as described in Huang, et al., “An FPGA Implementation of Elliptic Curve Cryptography for Future Secure Web Transaction”, Conference Paper, January 2007, the client's public key can be recalculated as needed and for each authenticated session. The generation of digital signatures in Bitcoin transactions follows the standard ECDSA (r, s) signature process.

[0054] <Encryption method> Referring to Figure 2, an information flow for the processing of encrypting a general message is shown. It can be seen that there is an optional branch 70 through the information flow. The optional branch 70 enables further improvement in the security of the encryption method by fragmenting the (R, S) pair before performing the knapsack encryption. This is detailed below.

[0055] <ECDSA signature> Referring to Figure 3, the digital signature step 10 of Figures 1 and 2 is shown in detail. Similar to the standard process in Bitcoin, the message (M), which is the key exchange part of the transaction, is signed by the sender of the message, and the recipient's address is incorporated unless a specific form of the public signature that any miner can claim for the transaction is generated. The calculation of the r value in the ECDSA signature is detailed below. If the value r is equal to 0, another random number k is selected in the calculation of the value s as described later.

Number

[0056] Bitcoin uses the SHA256 algorithm and signs the hash of the message. Therefore, m = Hash256(M) The signature generation process is shown in Figure 3. In step 30 (Figures 1 and 2), the digital signature (r, s) from the Bitcoin transaction is then used as input to the Knapsack algorithm. The defined Knapsack sequence is described in detail in Rajaram Ramasamy R, Prabakar MA, Devi MI, and Suguna M (2009), 'Knapsack Based ECC Encryption and Decryption', International Journal of Network Security, Vol. 9, no. 3, pp. 218-226. This results in the generation of an encoded value (R, S), which is then encrypted using ECC in step 40. This results in the generation of an encryption point (P R ,P S )

[0057] The process of transforming (r, s) using the knapsack algorithm is detailed in Method 1 below. The sequence used in the knapsack algorithm should be a super increasing sequence, which makes the problem easier to solve. A super increasing sequence is defined as a sequence in which the next term in the sequence is greater than the sum of all preceding terms. To solve a super increasing knapsack sequence, the total weight of the knapsack is compared to the maximum weight and the sequence. If the total weight is less than the maximum weight, it is not in the knapsack. If the total weight is greater than the maximum weight, it is in the knapsack. The algorithm subtracts the maximum weight from the total weight and compares it to the next maximum number. This process is repeated until the sum reaches a value of zero. If the sum does not reach zero, there is no solution. This is a property of a super increasing sequence.

[0058] <Knapsack algorithm using Stern sequence> The general knapsack problem and algorithmic solutions are described, for example, in "Different Approaches to Solve the 0 / 1 Knapsack Problem", Maya Hristakeva, Computer Science Department, Simpson College, Indianola, IA 50125, hristake@simpson.edu. It turns out that all standard solutions to the knapsack problem involve searching through the configuration space. A variant of the knapsack algorithm is defined below. The "knapsack sequence" in this algorithm is computed by multiplying values ​​by an integer K (see definition of K below), where "p" is a prime number (the order of the elliptic curve) also used in modular arithmetic, and "k" is a function of m L The value "v" is unique for each authenticated client, and the new short-term key k is kept secret.

[0059] A modified Stern series is used to reduce the time quantum. Stern series are described in detail in Reznick (2008), 'Regularity Properties of the Stern Enumeration of the Rationals', Journal of Integer Sequence.

[0060] The value K = Hash(k) is used in the reverse knapsack algorithm. It is computationally infeasible to determine k from the hash value K.

[0061] <Knapsack Algorithm> We now describe in detail the Knapsack algorithm shown in step 30 of FIGS.

[0062] First, the sequence is defined as follows:

number

[0063] The value v is unique for each key, and is therefore an address, and is updated with each new deterministic exchange.

[0064] The value of K = Hash(k) should be sent along with the signature (r, s) for use in the Reverse Knapsack algorithm. This should be sent between the parties using standard multi-signature methods (described below). A series of random values ​​can be generated using this method and multi-signature methods (described below), as well as short-term k values ​​used as random integers.

[0065] The modified Stern sequence is used in the Knapsack algorithm because it orders the rational numbers between 0 and 1, making it easier to search for rational numbers and thereby reducing the amount of time.

[0066] The Stern sequence (described in more detail in Stern, MA "Über eine zahlentheoretische Funktion." J. Reine angew. Math. 55, 193-220, 1858) is:

number

[0067] Consider a binary tree generated by iteration, starting from root 1 1, a, b → a, a + b, a + b, b (1). The numbers a, a + b and a + b, b are called the left and right children of a and b, respectively, and a and b are also called the mothers of the children. Note that for generation by induction, root 1 1 forms the first generation, and generation (n+1) is the set of all children of the elements of the nth generation. The binary tree obtained from this iteration is called a Calkin-Wilf tree.

[0068] The Stern-Brocot tree procedure is detailed below.

[0069] According to the knapsack algorithm, R is calculated using equation (3). The knapsack sequence is a i and the binary value of r is x i It is expressed using

[0070] The S value of the system is given using equation (4).

number

[0071] Other values ​​can be exchanged for K. These do not need to be related to the original random value k used in the signature. However, the integral K = Hash(k) allows additional script forms to be generated later within Bitcoin. The use of (R,S) creates a form of double encryption, which provides both authentication and authenticity for subsequent message exchanges. The input is fragmented into blocks of approximately 160 bits in a similar fashion to the Menezes-Vanstone elliptic curve algorithm described in Nyberg K. and Rueppel RA (1993), 'A New Signature Scheme Based on DSA giving message Recovery', ACM Computer and Communications Security, Vol. 1, pp. 58-61. Partial blocks are modified or fragmented using the recipient's public key along with the ECC algorithm input. An escrow agent or cloud-based server is used for the exchange. Each fragment is also encrypted using the system's public key.

[0072] The signature is sent to a server or other cloud node. This system can also be an escrow agent or other third party. This third party or cloud server cannot decrypt the signature because decryption of the signature requires the private key of the ultimate receiving party. The ECC encryption algorithm is shown below.

[0073] In the version of the ECC cryptographic algorithm of the present disclosure, first, the input is converted into a point on an elliptic curve using the Koblitz method. The Koblitz method is described in Koblitz N. (1987), ‘Elliptic Curve Cryptosystems’, Mathematics of Computation, pp203-209, and Padma Bh et. al. / (IJCSE) International Journal on Computer Science and Engineering Vol.02, No.05, 2010, 1904-1907 Encoding And Decoding of a Message in the Implementation of Elliptic Curve Cryptography using Koblitz’s Method.

[0074] <Definition of Stern-Brocot tree> This chapter describes how rational numbers can be generated using the Stern-Brocot tree.

Number

[0075] Considering this value as a vector and multiplying it by the left matrix L or the right matrix R, consecutive leaves on the tree can be generated. The matrices L and R are defined as follows.

Number

Number

[0076] <Multi-signature method> In this chapter, we explain the multi-signature mechanism using ECSDA as the underlying technology.

[0077] For clarity, the following description uses an example in which the two parties involved in secret sharing are some kind of Internet-based service provider (hereafter Server) and the Server's client (hereafter Client). The described method can be generalized for any two parties (see, e.g., Variant V2).

[0078] Each party is assumed to have the ability to perform ECC operations. Indeed, a "naive" client may be using software provided by the server or by a third party for cryptographic services (e.g., a Bitcoin electronic wallet).

[0079] <Phase I: Registration> (1) Each party agrees on a standard ECC system, such as secp256k1 (used by the Bitcoin system), that uses a common generator G.

[0080] (2) The server generates a public / private key pair using secp256k1 and publishes their public key (e.g., by making it visible on their official website):

number

number

[0081] a. The client generates a public / private key pair using secp256k1:

number

[0082] The registration phase occurs only once as an initial setup, after which the master key is reused in a secure manner to generate single-use symmetric encryption keys.

[0083] <Phase II: Session Begins> (3) The client generates a "message" to send to the server and uses a standard algorithm to generate a hash of the message, which results in a 256-bit integer.

number

[0084] (4) The client calculates the secondary secret key as follows:

number

number

[0085] Therefore, the client's secondary secret key (V 2C ) remains secret, but the secondary public keys can be easily derived knowing the master key and the message M.

[0086] (5) The client sends message M to V 2C and sends it to the server.

number

[0087] This step represents the only transmission required to both establish the shared secret and to initiate the secure communication session between the client and server. The server will use the received message M to generate their own secondary public / private key pair. This allows the client to immediately calculate the server's secondary public key.

[0088] (6) The client computes the server's secondary public key (P2S) using the same technique as in step (4).

number

[0089] (8) The server obtains the client's secondary public key (P 2C ) is calculated.

[0090] (9) The server calculates P 2C The client's signature (Sig-V 2C ) to verify.

[0091] This is described in more detail below.

[0092] https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorithm; http: / / cs.ucsb.edu / ~koc / ccs130h / notes / ecdsa-cert.pdf At this point, the server may perform further checks based on the content of the message M and according to any agreed conditions (eg, as in embodiment 1).

[0093] (10) The server calculates the secondary private key as follows:

number

[0094] (11) The client and server now have each other's secondary public key and can each independently calculate the shared secret S using their own secondary private key:

number

number

number

[0095] The shared secret S is the elliptic curve point (x S ,y S ), which can be converted to a standard key format using a standard publicly known operation agreed upon by both parties. For example, x S The value is AES 256 It is a 256-bit integer that can be used as a key for encryption. It can also be further converted to a 160-bit integer using RIPEMD160 for any application that requires a key of 160 bits length. Once the shared secret S is calculated, the secondary secret key (V 2C and V 2S Note that the shared secret ) does not need to be kept or stored (however, depending on the particular application, they may be stored if they are kept securely as master private keys). Furthermore, the shared secret itself only needs to exist for the duration of the communication session and can be discarded immediately after the session without storing it (although it can be recomputed at any time).

[0096] Phase II in this protocol can be repeated multiple times to generate successive shared secrets for single-purpose usage. Alternatively, the same shared secret can be reused. In the latter case, for security reasons, the actual secret is not stored, since it can be recomputed from publicly known information and an existing, secretly held private key (e.g., embodiment 2).

[0097] <Method 1 - Knapsack Algorithm> This section explains how the knapsack algorithm in Figures 1, 2, and 34, step 30, can be used to optimally pack ECDSA signatures as detailed below in the section entitled "Further Extensions to the Knapsack Procedure." As discussed above, the nonlinear packing procedure of the knapsack algorithm adds security to the key shares.

number

[0098] <Signature Extension> The method can be extended beyond the signature process used in Bitcoin through whole-message signing, where a message to be shared and encrypted between parties is digitally signed using the process deployed in Bitcoin without a message hash, i.e., the whole message is signed to generate a larger version of the (r,s) signature pair.

[0099] The knapsack algorithm is again used to encode the (R,S) value. While the use of a message hash is preferred in most instances, there are use cases where the entire message may be signed.

[0100] The (R,S) value should be fragmented into blocks before undergoing a double encryption process using the sender's private key and the server's or escrow agent's public key.

[0101] When the server receives the signature, it decrypts it using a private key it maintains. The server then encrypts it using the public key of the end recipient. The signature is then transmitted from the server or agent to the recipient according to this process.

[0102] Implementation details of the ECC algorithm for a single character A method of encrypting a single character by the ECC encryption step 40 of FIGS. 1, 2, and 4 is described. This can be generalized to a stream of characters.

[0103] From the elliptic curve, a base point G is selected.

[0104] G has [x, y] coordinates that satisfy the following equation.

Number

[0105] In the ECC method, a random integer k (k < p) that needs to be kept secret is selected.

[0106] Next, kG is evaluated by a series of additions and multiplications as is standard in elliptic curve algebra.

[0107] The source is specified as host A and the destination is specified as host B.

[0108] The private key of host B is n B and is called. k and n B can be generated by a random number generator, providing credibility.

[0109] The public key of B is evaluated by the following equation.

Number

[0110] For example, if A wants to send the character 'S', the ASCII value of the character 'S' is used to change an arbitrary point P m as follows.

Number

[0111] This conversion is done for two purposes: first, it converts single-valued ASCII into x,y coordinates in EC, and second, it is completely camouflaged to would-be hackers.

[0112] The next step after ECC is kP B where P B is the public key of user B. To converge the result quickly, the optimal number of doublings and additions in the sequence should be planned depending on the value of k. The encrypted message is then m ' and kP B That is,

number

number

[0113] <Further extension of the knapsack procedure> The Knapsack procedure introduces a defense against brute force attacks through diffusion and impersonation.

[0114] The knapsack procedure is a i We use a sequence of vectors called

[0115] There are several ways to generate these vectors. For example, you can get a sequence of powers of n like this:

number

[0116] The message is encrypted according to the knapsack process as follows:

[0117]

number

number

[0118] Similarly, other coordinates such as y1, x2, y2 are transformed by the knapsack algorithm, resulting in the encrypted message being expressed as follows:

number

[0119] Receiver B has all the relevant information to reverse the knapsack procedure and recover the bit pattern of the coordinates. i sequence, his own secret key nB B knows the values ​​of a, b, and p, and the base point of the elliptic curve G. B receives the encrypted message:

number

number

number

number

number

[0120] n m-1 is now subtracted from the current value of S[x1]. Depending on whether the value is positive or negative, a value of 1 or 0 is assigned to the associated bit position. This subtraction process is i This continues until the sequence is exhausted, which recovers the binary bit pattern of x1.

[0121] These steps are then repeated for y1, x2, and y2. kG is represented by x1, y1, and P m '+kP B Recall that P is expressed in terms of x2 and y2. m '+kP B From P m To extract ', B uses his secret key n B Apply and multiply by kG. [Number] Let this be P m ’ + kP B Subtract this from, and obtain P m ’ as follows. [Number] Subtraction includes ECC doubling and addition. Here, the only difference is that the negative term has its own y - coordinate with a minus sign in front. The formulas for determining the new values of the gradient, x R , y R are the same. When y is a number, it is always replaced by -y.

[0122] This generates P m ’. The ASCII value of “S” can then be retrieved from, for example, a lookup table of elliptic - curve cryptography of ASCII values from P m ’ = S·P m .

[0123] ECC Encryption Algorithm In this chapter, a method of combining the ECC encryption algorithm, the Koblitz algorithm, and the knapsack algorithm is described. [Number] (1) The Koblitz method is used in the mapping step 20 of FIG. 1 to identify the unique elliptic - curve point corresponding to R. This is achieved by identifying the points on the elliptic curve by the x - coordinate x ∈ Z p . Thus, for a specific constant λ agreed upon between the sender and the receiver, λR < x ≤ λR + 1. If no such point exists, try λR < x ≤ λR + 2, and so on.

[0124] (2) The sender generates a random number K. This may be selected such that K = Hash(k).

[0125] (3) The sender sends the following encrypted ciphertext to the receiver:

number

number

number

[0126] <Decryption> The information flow in the decoding procedure of step 80 of Figures 5 and 6 is as follows.

[0127] The procedure for each of the steps is explained in the remainder of the Decoding section.

[0128] <Message recovery> Once received by the server, the message signature can be decrypted using the server's private key. Once decrypted, the message is encrypted using a secret key shared between the cloud server and the ultimate recipient. This allows the server or agent to act as an escrow or transfer agent without gaining knowledge of the encrypted secret, while still being able to monitor and verify the sending and receiving parties. The value exchange is done using the secret sharing method described below in the Secret Value Sharing section.

[0129] The cloud server can also act as a certificate authority in the encryption scheme based on the generation of IDs. The ECC decryption algorithm is shown below. The receiving party can recover (R,S) using their private key input into the ECC decryption algorithm. This allows the receiver to decrypt the elliptic curve point back into the message.

[0130] <ECC decoding algorithm> The operation of the ECC decoding algorithm in step 80 of FIGS. 5 and 6 is shown.

Number

Number

Number

Number

[0131] The message can then be restored using Equation 5. The message can be in ASCII format or any other encoding including non-text input.

Number

[0132] <Secret value sharing> A fundamental problem in encryption systems is the establishment of a shared secret between parties across an insecure network. For example, in symmetric key cryptography, as described in detail at https: / / en.wikipedia.org / wiki / Symmetric-key_algorithm, a single secret key is shared between two parties, as used by AES, described in detail at https: / / aesencryption.net / . This has the disadvantage that the secret key must first be securely transmitted somehow between the two parties. Because key transmission is usually done electronically over a communications system like the Internet, the sharing step is potentially a catastrophic vulnerability. Because symmetric key protocols are simple and widely used, the ability to securely share secret keys over insecure networks is necessary.

[0133] Existing protocols such as Diffie-Hellman key exchange (described in detail at https: / / en.wikipedia.org / wiki / Diffie%E2%80%93Hellman_key_exchange) and the Three Pass protocol (described in detail at https: / / en.wikipedia.org / wiki / Three-pass_protocol) enable the secure sharing of secrets over insecure networks. However, these methods are computationally expensive when new secrets are constantly generated and stored. Embodiments of the present invention provide an efficient and inexpensive method for secure secret sharing. Furthermore, the described techniques enable the generation and convenient management of multiple secure secret keys based on a single master key.

[0134] The main elements of the processing of this embodiment are as follows.

[0135] 1. The method takes advantage of the properties of Elliptic Curve Cryptography (ECC) (described in detail at https: / / en.wikipedia.org / wiki / Elliptic-curve_cryptography) and elliptic curve arithmetic. Several standards exist for cryptography using elliptic curves, and are developed by an independent group known as the Standards for Efficient Cryptography Group (SECG) (http: / / www.secg.org / ).

[0136] 2. ECC is used to generate pairs of asymmetric cryptography keys, where one key is made publicly available and the other is kept secret (described in detail at https: / / searchsecurity.techtarget.com / definition / asymmetric-cryptography). This embodiment allows each party to independently calculate the same secret key based on their own asymmetric key pair generated by an agreed-upon ECC standard such as secp256k1. Security comes from the fact that the shared secret is calculated by each party but is never transmitted.

[0137] 3. Efficiency comes from combining several steps into a single step and from using fewer computationally expensive calculations to derive new keys. After an initialization phase in which a master key is established, each subsequent generation of a new secret key is efficient and repeatable.

[0138] <Technical specifications> For clarity, the following description uses an example in which the two parties involved in secret sharing are some kind of Internet-based service provider (hereafter Server) and the Server's client (hereafter Client). The described method can be generalized for any two parties (see, e.g., Variant V2 below).

[0139] Each party is assumed to have the ability to perform ECC operations. Indeed, a "naive" client may be using software provided by the server or by a third party for cryptographic services (e.g., a Bitcoin electronic wallet).

[0140] Phase I: Enrollment (12) Each party agrees on a standard ECC system such as secp256k1 (used by the Bitcoin system) that uses a common generator G.

[0141]

number

number

[0142]

number

[0143] The registration phase occurs only once as an initial setup, after which the master key is reused in a secure manner to generate single-use symmetric encryption keys.

[0144] Phase II: Session Begins (16) The client generates a "message" to send to the server and uses a standard algorithm to generate a hash of the message, which results in a 256-bit integer.

number

number

[0145] (17) The client calculates the secondary secret key as follows:

number

number

[0146] (18) The client sends message M to V 2C and sends it to the server.

number

[0147] (19) The client obtains the server's secondary public key (P 2S ) is calculated.

number

[0148] (21) The server obtains the client's secondary public key (P 2C ) is calculated.

[0149] (22) The server calculates P 2C The client's signature (Sig-V 2C At this point, the server may perform further checks based on the content of the message M and according to any agreed conditions (see, for example, embodiment 1).

[0150] (23) The server calculates the secondary private key as follows:

number

[0151] (24) The client and server now have each other's secondary public key and can each independently calculate the shared secret S using their own secondary private key:

number

number

number

[0152] The shared secret S is the elliptic curve point (x S ,y S ), which can be converted to a standard key format using a standard publicly known operation agreed upon by both parties. For example, x S The value is AES 256 It is a 256-bit integer that can be used as a key for encryption. It can be further converted to a 160-bit integer using RIPEMD160 (http: / / homes.esat.kuleuven.be / ~bosselae / ripemd160.html) for any application that requires a key of 160 bits length. Note that once the shared secret S is calculated, a secondary private key (V 2C and V 2S ) do not need to be kept or stored (however, depending on the particular application, they may be stored if they are kept securely as master private keys). Furthermore, the shared secret itself need only exist for the duration of the communication session and can be discarded immediately after the session without storing it (although it can be recomputed at any time).

[0153] Phase II in this protocol can be repeated multiple times to generate successive shared secrets for single - purpose usage. Alternatively, the same shared secret can be reused. In the latter case, for security reasons, the actual secret is not stored since it can be recomputed from publicly known information and a secret key held by an existing secret (e.g., as described in Embodiment 2).

[0154] <Variant> In this chapter, methods for hash variants are described.

[0155] <V1: Hierarchical Structure of Hash> Instead of repeating Phase II to generate successive single - purpose keys, by prior agreement between the parties, the previously used Message Hash (SHA - 256(M)) can be repeatedly re - hashed by both parties to construct a hierarchical structure of hashes. In fact, the hash of the message can be the next generation of the message (M'). Doing this enables the continuous generation of the common secret to be computed without the need for transmissions established by further protocols. The second - generation common secret (S') can be computed as follows.

Equation

[0156] As well as the chain (linear) hierarchies described above, hierarchies in the form of trees can be created. Branching of the tree can be achieved in several ways, three of which are described here. (i) Master Key Generation First, note that in the chain hierarchy, each new "link" (public / private key pair) is generated by adding multiple rehashed messages to the original master key, i.e. (only the private key is shown for clarity): (ii)

number

number

[0157] (iv) Message diversity: A new secret / public key pair can be generated by introducing a new message M at any point in the chain or tree. The message itself can be arbitrary, or convey some meaning or function (e.g., it may be associated with a "real" bank account number, etc.). Of course, any new message must be kept secure.

[0158] According to the tree structure, a host of keys for different purposes can be provided, such as authentication keys, encryption keys, signature keys, payment keys, etc., all linked to a single master key that is securely maintained. Each of these can be used to generate a shared secret with another party.

[0159] <V2: Peer-to-Peer Secret Sharing> Embodiments of the present invention can be used between two peers rather than between a server and a client. In the examples described in the above technical description, the server acts as a trusted party by the client. The server must authenticate the client's credit in order to allow the client to access their system. The server does this by verifying the client's signed message. In a peer-to-peer scenario, each peer must establish trust with each other. That is, the "client" must also authenticate the "server's" credit. This can be done by a two-way process where both parties perform message signing and verification steps (steps (0)-(9) of the technical description).

[0160] In a peer-to-peer scenario, after the client sends a signed message M to the server, the server signs the same message using their calculated secondary secret key V2S and sends it back to the client.

Number

[0161] Referring to FIG. 7 , an illustrative simplified block diagram of a computing device 2600 is provided that may be used to implement at least one embodiment of the present disclosure. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 7 , the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602), which may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read-only memory (ROM) 2620, as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0162] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0163] The bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of the computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0164] The network interface subsystem 2616 may provide an interface to other computing devices and networks. In some embodiments, the network interface subsystem 2616 may act as an interface to receive data from and send data to other systems on the computing device 2600. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without having to be in a remote location, such as a data center.

[0165] User interface input device(s) 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touchscreen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to encompass all possible types of devices and mechanisms for inputting information into computing device 2600.

[0166] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection, or other display device. In general, use of the term "output device" is intended to encompass all possible types of devices and mechanisms for outputting information from computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0167] The storage subsystem 2606 may provide a computer-readable storage medium that stores the basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions), which, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure, may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, DVD, or Blue-Ray) associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure and data associated with the transactions and blocks described in this disclosure.

[0168] Computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, computing device 2600 may include another device connectable to computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device connectable to computing device 2600 may include multiple ports configured to receive fiber optic connectors. The device may thus be configured to convert optical signals into electrical signals that are transmitted to computing device 2600 through the ports connecting the devices for processing. Due to the ever-changing nature of computers and networks, the description of computing device 2600 shown in FIG. 7 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible, having more or fewer components than the system shown in FIG. 7.

[0169] It should be noted that the above-described embodiments illustrate, rather than limit, the present disclosure, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the present disclosure, which is defined by the appended claims. In the claims, any reference signs between parentheses are not intended to limit the claim. The words "comprising" and "comprises", and the like, do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of," and "comprises" means "including or consisting of." A singular reference of an element does not exclude a plural reference of such element, and vice versa. The present disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0170] <References> 1. Chen T.S., Huang G.S., Liu T.P., and Chung Y.F (2002), ‘Digital Signature Scheme Resulted from Identification Protocol for Elliptic Curve Cryptosystem’, Proceedings of IEEE TENCON’02. pp. 192 - 195 2. Hsu C.L and Wu T. C. (1998), Authenticated Encryption Scheme with (t, n) Shared Verification’, IEEE Proceedings - Computers and Digital Techniques, Vol. 145, no. 2, pp. 117 - 120. 3. Graham, R. L.; Knuth, D. E.; and Patashnik, O. Concrete Mathematics: A Foundation for Computer Science, 2nd ed. Reading, MA: Addison - Wesley, pp. 116 - 117, 1994. 4. Koblitz N. (1987), ‘Elliptic Curve Cryptosystems’, Mathematics of Computation, pp 203 - 209. 5. Nyberg K. and Rueppel R.A. (1993), ‘A New Signature Scheme Based on DSA giving message Recovery’, ACM Computer and Communications Security, Vol.1,pp.58 - 61. 6. Rajaram Ramasamy R, Prabakar M.A, Devi M.I, and Suguna M(2009), ‘Knapsack Based ECC Encryption and Decryption’, International Journal of Network Security, Vol.9, no.3, pp. 218-226. 7. Rajaram Ramasamy R. and Amutha Prabakar M. (2011), ‘Digital Signature Scheme with message Recovery Using Knapsack -based ECC’, International Journal of Network Security, Vol.12, no.1,pp.15,20. 8. Reznick (2008), ‘Regularity Properties of the Stern Enumeration of the Rationals’, Journal of Integer Sequence. 9. Stern, M. A. "Uber eine zahlentheoretische Funktion." J. reine angew. Math. 55, 193-220, 1858. 10. Different Approaches to Solve the 0 / 1 Knapsack Problem Maya Hristakeva Computer Science Department Simpson College Indianola, IA 50125 hristake@simpson.edu 11. Huang, et al., “An FPGA Implementation of Elliptic Curve Cryptography for Future Secure Web Transaction”, Conference Paper, January 2007. 1a. Symmetric key cryptography: https: / / en.wikipedia.org / wiki / Symmetric-key_algorithm 2a. AES encryption: http: / / aesencryption.net / 3a. Diffie-Hellman Key exchange: https: / / en.wikipedia.org / wiki / Diffie%E2%80%93Hellman_key_exchange 4a. Three Pass Protocol: https: / / en.wikipedia.org / wiki / Three-pass_protocol 5a. Elliptic Curve Cryptography: https: / / en.wikipedia.org / wiki / Elliptic_curve_cryptography 6a. Standards for Efficient Cryptography Group (SECG): http: / / www.secg.org / 7a. Asymmetric cryptography: http: / / searchsecurity.techtarget.com / definition / asymmetric-cryptography 8a. SHA-256 algorithm: http: / / hash.online-convert.com / sha256-generator 9a. Elliptic Curve Digital Signature Algorithm(ECDSA): https: / / en.wikipedia.org / wiki / Elliptic_Curve_Digital_Signature_Algorithm; http: / / cs.ucsb.edu / ~koc / ccs130h / notes / ecdsa-cert.pdf 10a. RIPEMD160 algorithm: http: / / homes.esat.kuleuven.be / ~bosselae / ripemd160.html 4aa. Padma Bh et. al. / (IJCSE) International Journal on Computer Science and Engineering Vol. 02, No. 05, 2010, 1904-1907 Encoding And Decoding of a Message in the Implementation of Elliptic Curve Cryptography using Koblitz’s Method

Claims

1. 1. A computer-implemented method for distributing a shared secret among multiple participants, comprising: a first mapping step, wherein a plurality of inputs to said first mapping step are mapped to respective elliptic curve points of an elliptic curve of an elliptic curve cryptosystem common to said participants; a first encryption step in which a plurality of the elliptic curve points are encrypted with a public key of a public-private key pair of the elliptic curve cryptosystem to provide an output adapted to be decrypted using a corresponding private key of the public-private key pair; a second encryption step, wherein portions of at least one input to the second encryption step are multiplied by respective terms of a sequence of numbers known to the participants, the sequence of numbers including powers of terms known to the participants based on a message shared among the participants; a secret sharing step, wherein shares of an input to the secret sharing step are distributed among a plurality of the participants such that the input has access to a threshold number of the shares and no input has access to fewer than the threshold number of the shares; A method comprising:

2. 2. The method of claim 1, wherein at least one input of the first encryption step is based on a shared secret, at least one input of the second encryption step is based on an output of the first encryption step, and at least one input of the secret sharing step is based on an output of the second encryption step.

3. 2. The method of claim 1, wherein at least one input of the second encryption step is based on a shared secret, at least one input of the first encryption step is based on an output of the second encryption step, and at least one input of the secret sharing step is based on an output of the first encryption step.

4. The method of claim 1 , wherein at least one input of the first encryption step is based on an output of the secret sharing step or the second encryption step.

5. 5. The method of claim 4, wherein at least one input of the secret sharing step is based on a shared secret, at least one input of the second encryption step is based on an output of the secret sharing step, and at least one input of the first encryption step is based on an output of the second encryption step.

6. 5. The method of claim 4, wherein at least one input of the second encryption step is based on a shared secret, at least one input of the secret sharing step is based on an output of the second encryption step, and at least one input of the first encryption step is based on an output of the secret sharing step.

7. 2. The method of claim 1, wherein at least one input of the second encryption step is based on the output of the secret sharing step or the first encryption step.

8. 8. The method of claim 7, wherein at least one input of the secret sharing step is based on a shared secret, at least one input of the first encryption step is based on an output of the secret sharing step, and at least one input of the second encryption step is based on an output of the first encryption step.

9. 8. The method of claim 7, wherein at least one input of the first encryption step is based on a shared secret, at least one input of the secret sharing step is based on an output of the first encryption step, and at least one input of the second encryption step is based on an output of the secret sharing step.

10. The method according to any one of claims 1 to 9, wherein the second encryption step comprises performing a Knapsack algorithm.

11. The method according to any one of claims 1 to 10, wherein the second encryption step comprises the sequence being based on a Stern sequence.

12. The method according to any one of claims 1 to 11, wherein the second encryption step comprises a super-increasing sequence.

13. A method according to any preceding claim, wherein the first mapping step comprises determining an elliptic curve point having coordinates based on the input.

14. The method of claim 13 , wherein the coordinates are based on the input multiplied by an amount known to the participant.

15. 15. A method according to any preceding claim, wherein the first encryption step comprises determining a term comprising an elliptic curve point multiplied by an integer representing an input to the first encryption step.

16. The method of any one of claims 1 to 15, wherein the first encryption step comprises determining a term based on a short-term key and a participant's public key.

17. 17. The method of claim 16, further comprising transmitting to at least one participant an elliptic curve point based on a generator of the elliptic curve cryptosystem multiplied by a short-term key and an elliptic curve point based on the public key of the participant multiplied by the short-term key.

18. The method of any one of claims 1 to 17, wherein the shared secret is a digitally signed message.

19. 20. The method of claim 18, wherein the digitally signed message is a blockchain transaction.

20. 1. A computer-implemented system comprising: a processor; a memory containing executable instructions that, upon execution by the processor, cause the system to perform the computer-implemented method of any one of claims 1 to 19; and A system including:

21. 20. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least the method of any one of claims 1 to 19.

Images