Decentralized Public Key Verification for Communication Addresses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public key encryption schemes relying on Certificate Authorities (CAs) or key servers face challenges in verifying the accuracy of associations between stored public keys and identities, and identity-based encryption requires trusted third parties for private key generation.
Innovation Solution
A decentralized database system that associates public keys with communications addresses without relying on trusted third parties, allowing users to generate their own key pairs and register them through a verification process using signed secret messages, stored as a blockchain across multiple computing devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Certificate Authorities (CAs) or key servers are used for key management, then public key storage is enabled, but the accuracy of associations between stored public keys and identities cannot be reliably verified
Solution Approach 1:
The system segments the verification process into multiple independent validation steps: (1) receiving a request containing public key and identity information, (2) retrieving corresponding cryptographic material from storage, (3) generating a challenge message, (4) verifying the signed response, and (5) confirming the association. This segmentation allows each step to be independently verified, improving overall reliability without requiring a complex centralized authority.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where a third party (the verification system) mediates between the public key holder and the identity claimant. The system uses cryptographic challenges and signed responses as an intermediary proof mechanism, avoiding the need for direct trust in centralized CAs while maintaining verification accuracy.
2Ease of operation
If identity-based encryption is used with email addresses as public keys, then simplified key management is achieved, but a trusted third party is required to operate the private key generator
Solution Approach 1:
The system enables self-service key management where users generate their own key pairs using standard cryptographic libraries. Users independently manage their private keys and can prove ownership through digital signatures without requiring a trusted third party to generate or manage keys on their behalf. The verification system only needs to verify cryptographic proofs, not manage key generation.
Solution Approach 2:
Instead of having a trusted third party generate keys for users (the traditional identity-based approach), the system inverts the model: users generate their own keys, and the third party only performs verification of cryptographic proofs. This inversion eliminates the need for the third party to have key generation capabilities while maintaining simplified key management.
3Productivity
If CAs or key servers store public keys, then key distribution is enabled, but inventorying all stored public keys becomes difficult
Solution Approach 1:
The system implements feedback mechanisms where the verification process provides information about stored public keys. When a verification request is made, the system retrieves and validates the associated public key, creating a feedback loop that maintains an implicit inventory. The verification logs and challenge-response records serve as feedback that tracks which public keys are stored and associated with which identities, making inventory management possible without centralized tracking.
4Reliability
If trusted third parties are used for key management, then security is simplified, but decentralization and user autonomy are reduced
Solution Approach 1:
The system performs preliminary cryptographic setup where users pre-generate their key pairs and store their public keys in the verification system before any transactions occur. This preliminary action enables users to maintain full control of their private keys and cryptographic identities from the outset, eliminating the need for ongoing trusted third party involvement while maintaining security.
Data Source
AI summary
Systems and techniques are provided for a decentralized database associating public keys and communications addresses. A signed secret message may be sent by a validator computing device of a peer-to-peer network for a decentralized database to a communications address from a request for verification entry in a verification queue of the decentralized database. A second request for verification including the communications address and a user-signed secret message may be received. The user-signed secret message may be verified using a public key from the request for verification entry in the verification queue. The communications address and public key may be written to a verified database of the decentralized database when verifying the user-signed secret message causes a number of user-signed secret messages received in requests for verification with the communications address and successfully verified to meet a threshold number.