# US 11,451,382 B2 · Method and system for communicating a secret > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,382 B2 - Document ID: US11451382B2 - Status: Granted - Kind: B2 - Application number: 17/055,095 - Filed: 2019-05-13 - Published: 2021-07-08 - Granted: 2022-09-20 - Earliest claimed: 2018-05-14 - Assignees: nChain Holdings Limited - Applicants: nChain Holdings Limited - Inventors: Craig Steven Wright - Web page: https://patentgrep.com/patent/US11451382B2 ## CPC - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3013: {involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/50: Oblivious transfer - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of communicating a secret (k0, k1) on the Bitcoin blockchain is disclosed. The method comprises sending information identifying secrets selectable by the recipient and receiving a first public key (Ui) of an elliptic curve cryptography system, corresponding to a first secret (Si) selected for access by the recipient and for which a first private key (m) is accessible to the recipient. A second public key (U1-i) is received, corresponding to a second secret not selected for access by the recipient, wherein a corresponding second private key is not available to the recipient. First and second secrets encrypted by means of the respective first and second public keys (X0, X1) are sent to the recipient, wherein the first secret is accessible to the recipient by means of the first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first and second secrets. ## Claims ### Claim 1 A method of communicating a secret from a sender to a recipient, the method comprising: sending, from the sender to the recipient, information identifying a plurality of secrets selectable by the recipient; receiving, at the sender, from the recipient, a first public key, corresponding to a first secret of the plurality of secrets selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to said first public key is accessible to the recipient; receiving, at the sender, from the recipient, a second public key, corresponding to a second secret not selected for access by the recipient, wherein the second public key is a public key of said elliptic curve cryptography system and a second private key, corresponding to said second public key, is not available to the recipient; encrypting the first secret by means of the first public key and a third public key containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a first encryption integer, the first encryption integer being a hash value of the first public key; sending, from the sender to the recipient, the encrypted first secret; encrypting the second secret; and sending, from the sender to the recipient, the encrypted second secret, wherein the first secret is accessible to said recipient by means of the corresponding first private key, the second secret is inaccessible to said recipient, and said sender is unable to distinguish between the first secret and the second secret. ### Claim 2 (depends on 1) A method according to claim 1, wherein the first secret is encrypted by means of the first public key and the second secret is encrypted by means of the second public key. ### Claim 3 (depends on 1) A method according to claim 1, wherein the first secret and the second secret are encrypted by means of a respective exclusive OR cipher. ### Claim 4 (depends on 3) A method according to claim 3, wherein the exclusive OR cipher has a respective encryption key based on the corresponding first or second public key. ### Claim 5 (depends on 4) A method according to claim 4, wherein the respective encryption key comprises the corresponding first or second public key, multiplied by a respective first or second encryption integer, known to the sender, by means of scalar elliptic curve point multiplication. ### Claim 6 (depends on 5) A method according to claim 5, further comprising sending, from said sender to said recipient, the first or second encryption integer, encrypted by means of the first or second public key. ### Claim 7 (depends on 1) A method according to claim 1, wherein the second secret is encrypted by means of a fourth public key containing a second masking term comprising a result of scalar multiplication, by a second masking integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a second encryption term by means of elliptic curve point addition. ### Claim 8 (depends on 7) A method according to claim 7, wherein the second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a second encryption integer dependent on the second public key. ### Claim 9 (depends on 8) A method according to claim 8, wherein the second encryption integer is a hash value of the second public key. ### Claim 10 (depends on 1) A method according to claim 1, wherein the first public key can be determined from the second public key or the second public key can be determined from the first public key. ### Claim 11 (depends on 10) A method according to claim 10, wherein the first public key is based on the second public key and the third secret or the second public key is based on the first public key and the third secret. ### Claim 12 (depends on 1) A method according to claim 1, further comprising generating a third secret, to be shared between the sender and the recipient. ### Claim 13 (depends on 1) A method according to claim 1, further comprising checking, at said sender, consistency of the first public key received from the recipient with the second public key received from the recipient or consistency of the second public key received from the recipient with the first public key received from the recipient. ### Claim 14 (depends on 1) A method according to claim 1, wherein a result of scalar multiplication of the first public key by the second private key is equal to a result of scalar multiplication of a the second public key by the first private key. ### Claim 15 (depends on 1) A method according to claim 1, wherein the first private key and the second private key are derived deterministically from a private key of said elliptic curve cryptography system known to the sender. ### Claim 16 A method of receiving a secret sent from a sender to a recipient, the method comprising: receiving, at the recipient, information identifying a plurality of secrets selectable by the recipient; sending, to the sender, from the recipient, a first public key, corresponding to a first secret of the plurality of secrets selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to the first public key is accessible to the recipient; sending, to the sender, from the recipient, a second public key, corresponding to a second secret of the plurality of secrets not selected for access by the recipient, wherein the second public key is a public key of said elliptic curve cryptography system and a second private key, corresponding to the second public key, is not available to the recipient; encrypting the first secret by means of the first public key and a third public key containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a first encryption integer, the first encryption integer being a hash value of the first public key; receiving, at the recipient from the sender, the encrypted first secret; encrypting the second secret by means of the second public key; and receiving, at the recipient from the sender, the encrypted second secret, wherein the first secret is accessible to said recipient by means of the first private key, the second secret is inaccessible to said recipient, and said sender is unable to distinguish between the first secret and the second secret. ### Claim 17 (depends on 16) A method according to claim 16, wherein the first secret and the second secret are encrypted by means of a respective exclusive OR cipher. ### Claim 18 (depends on 17) A method according to claim 17, wherein the exclusive OR cipher has a respective encryption key based on the respective first or second public key. ### Claim 19 (depends on 18) A method according to claim 18, wherein the respective encryption key comprises the first or second public key, multiplied by a respective first or second encryption integer, known to the sender, by means of scalar elliptic curve point multiplication. ### Claim 20 (depends on 19) A method according to claim 19, further comprising receiving, at said recipient from said sender, the first or second encryption integer, encrypted by means of the respective first or second public key. ### Claim 21 (depends on 16) A method according to claim 16, wherein the second secret is encrypted by means of a fourth public key containing a second masking term comprising a result of scalar multiplication, by a respective second integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a second encryption term by means of elliptic curve point addition. ### Claim 22 (depends on 21) A method according to claim 21, wherein the second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a second encryption integer dependent on the second public key. ### Claim 23 (depends on 22) A method according to claim 22, wherein the second encryption integer is a hash value of the second public key. ### Claim 24 (depends on 16) A method according to claim 16, wherein the first-public key can be determined from the second public key or the second public key can be determined from the first public key. ### Claim 25 (depends on 24) A method according to claim 24, wherein the first public key is based on the second public key and the third secret or the second public key is based on the first public key and the third secret. ### Claim 26 (depends on 16) A method according to claim 16, further comprising generating a third secret, to be shared between the sender and the recipient. ### Claim 27 (depends on 16) A method according to claim 16, wherein a result of scalar multiplication of the first public key by the second private key is equal to a result of scalar multiplication of the second public key by the first private key. ### Claim 28 A computer implemented system, comprising a processor and a memory coupled to the processor, the memory storing thereon computer executable instructions that, when executed, cause the system to: send, from the sender to the recipient, information identifying a plurality of secrets selectable by the recipient; receive, at the sender, from the recipient, a first public key, corresponding to a first secret of the plurality of secrets selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to said first public key is accessible to the recipient; receive, at the sender, from the recipient, a second public key, corresponding to a second secret not selected for access by the recipient, wherein the second public key is a public key of said elliptic curve cryptography system and a second private key, corresponding to said second public key, is not available to the recipient; encrypt the first secret by means of the first public key and a third public key containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a first encryption integer, the first encryption integer being a hash value of the first public key; send, from the sender to the recipient, the encrypted first secret; encrypt the second secret; and send, from the sender to the recipient, the encrypted second secret, wherein the first secret is accessible to said recipient by means of the corresponding first private key, the second secret is inaccessible to said recipient, and said sender is unable to distinguish between the first secret and the second secret. ### Claim 29 A computer implemented system, comprising a processor and a memory coupled to the processor, the memory storing thereon computer executable instructions that, when executed, cause the system to: receive, at the recipient, information identifying a plurality of secrets selectable by the recipient; send, to the sender, from the recipient, a first public key, corresponding to a first secret of the plurality of secrets selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to the first public key is accessible to the recipient; send, to the sender, from the recipient, a second public key, corresponding to a second secret of the plurality of secrets not selected for access by the recipient, wherein the second public key is a public key of said elliptic curve cryptography system and a second private key, corresponding to the second public key, is not available to the recipient; encrypt the first secret by means of the first public key and a third public key containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a first encryption integer, the first encryption integer being a hash value of the first public key; receive, at the recipient from the sender, the encrypted first secret; encrypt the second secret by means of the second public key; and receive, at the recipient from the sender, the encrypted second secret, wherein the first secret is accessible to said recipient by means of the first private key, the second secret is inaccessible to said recipient, and said sender is unable to distinguish between the first secret and the second secret. ### Claim 30 (depends on 16) A method according to claim 16, wherein the first private key and the second private key are derived deterministically from a private key of said elliptic curve cryptography system known to the sender.