Cryptographic methods and systems for managing digital certificates with linkage values

A method for managing digital certificates by entities operable to perform computing on digital values and to communicate with each other, the entities comprising at least a first entity and a second entity, each digital certificate comprising a corresponding linkage value linkable to linkage values of one or more other digital certificates to define one or more groups of digital certificates, the method comprising performing the following operations to generate the digital certificates:

• sending by the second entity, to the first entity, encrypted second pre-linkage values which are not decryptable by the first entity;
• for each digital certificate:
• receiving, by the second entity from the first entity, a certificate generation request comprising an encrypted combined value obtained by the first entity combining a selected first pre-linkage value with a selected second pre-linkage value, wherein the second pre-linkage value has a similar format as the first pre-linkage value, the first and second pre-linkage values being selected by the first entity, the second entity not knowing which of the first and second pre-linkage values were selected for the encrypted combined value, the encrypted combined value not being decryptable by the first entity;
• in response to the certificate generation request:
• decrypting, by the second entity, the corresponding encrypted combined value;
• and
• creating, by the second entity, the corresponding digital certificate with a linkage value obtained from the corresponding combined value.

A tangible non-transitory machine readable storage medium comprising instructions executable by a first entity to perform a method for managing digital certificates by entities operable to perform computing on digital values and to communicate with each other, each digital certificate comprising a corresponding linkage value linkable to linkage values of one or more other digital certificates to define one or more groups of digital certificates, the method comprising performing the following operations to generate the digital certificates:

• generating, by the first entity, first pre-linkage values;
• receiving, by the first entity, encrypted second pre-linkage values from a second entity, wherein the second pre-linkage values have a similar format as the first pre-linkage values, wherein each encrypted second pre-linkage value is not decryptable by the first entity;
• for each digital certificate:
• selecting, by the first entity, a first pre-linkage value and an encrypted second pre-linkage value;
• combining, by the first entity, the selected first pre-linkage value with the selected encrypted second pre-linkage value without decrypting the second pre-linkage value, to obtain an encrypted combined value, the encrypted combined value being decryptable by the second entity but not the first entity;
• and
• sending, by the first entity to the second entity, a certificate generation request comprising the encrypted combined value.