Hierarchical Deterministic Keys for Secure Common-Secret Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic methods face challenges in securely establishing a common secret key between nodes over unsecure networks, particularly with symmetric-key algorithms, and existing asymmetric-key methods are computationally expensive or have poor key management.
Innovation Solution
A method using deterministic hierarchical shared secrets based on elliptic curve cryptography, where nodes independently derive a common secret key through a deterministic key derived from a shared message, allowing secure communication without transmitting private keys over unsecure networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetric-key algorithms are used for secure communication, then communication security is improved, but the secure transmission of symmetric-key becomes a vulnerability
Solution Approach 1:
The patent extracts the symmetric-key from the communication process by using asymmetric-key cryptography to establish a common secret key independently at each node. The symmetric-key is never transmitted over the network but is instead derived locally from the common secret key, eliminating the key transmission vulnerability while maintaining communication security.
Solution Approach 2:
The patent introduces a common secret key as an intermediary that enables both nodes to independently derive the same symmetric-key without direct transmission. This intermediary value (common secret key) acts as a mediator that allows secure symmetric-key establishment over unsecure networks by being derived from asymmetric-key operations.
2Reliability
If asymmetric-key methods like Diffie-Hellman Key Exchange are used, then secure key sharing across unsecure networks is achieved, but computational cost increases
Solution Approach 1:
The patent performs preliminary action by pre-generating asymmetric-key pairs at each node before the key exchange process. The nodes store their private keys and public keys in advance, allowing the actual key exchange to use simpler, more efficient operations rather than performing complex modular exponentiation during the exchange itself.
Solution Approach 2:
The patent changes the parameters of the key exchange by using a deterministic key derivation function that takes the common secret key and node-specific identifiers as inputs to generate the final symmetric-key. This parameter-based approach is computationally more efficient than traditional Diffie-Hellman while maintaining the security properties of asymmetric-key cryptography.
3Ease of manufacture
If random seeds and index structures are used for key hierarchies, then key generation is simplified, but key management quality deteriorates
Solution Approach 1:
The patent implements self-service by enabling each node to independently derive its own symmetric-key and verify the common secret key using its own private key and the counterparty's public key. This self-verification mechanism eliminates the need for centralized key management while maintaining high key management quality through cryptographic proof of correctness.
Solution Approach 2:
The patent creates a universal key management system where the same asymmetric-key pair and common secret key can be used for multiple purposes including establishing symmetric-keys for encryption, generating digital signatures for authentication, and deriving multiple session keys. This multi-functional approach simplifies key generation while maintaining security through a single, well-managed key hierarchy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method (300) and system (1) of determining a common secret for two nodes (3, 7). Each node (3, 7) has a respective asymmetric cryptography pair, each pair including a master private key and a master public key. Respective second private and public keys may be determined based on the master private key, master public key and a deterministic key. A common secret may be determined at each of the nodes based on the second private and public keys. In one example, a node (3, 7) may determine the common secret based on (i) a second private key based on the node's own master private key and the deterministic key; and (ii) a second public key based on the other node's master public key and the deterministic key. The invention may be suited for use with, but not limited to, digital wallets, blockchain (e.g. Bitcoin) technologies and personal device security.