# US 12,003,636 B2 · Device and method for certifying reliability of public key, and program therefor > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,636 B2 - Document ID: US12003636B2 - Status: Granted - Kind: B2 - Application number: 17/054,673 - Filed: 2019-05-10 - Published: 2021-11-25 - Granted: 2024-06-04 - Earliest claimed: 2018-05-11 - Assignees: Bitflyer Blockchain, Inc. - Applicants: bitFlyer Blockchain, Inc. - Inventors: Takafumi Komiyama - Web page: https://patentgrep.com/patent/US12003636B2 ## CPC - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3247: {involving digital signatures} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Proving reliability of a second public key of a second key pair generated in association with a first key pair. A generator 210 calculates and stores x·H(n) which is proof data and ax·H(n), when the second public key ax·g1 which is of the second key pair is generated (S301). The generator 210 provides the calculated proof data to a receiving apparatus 220 (S302) which has received the proof data, transmits a proof request to the proving apparatus 230 for requesting a proof that the second public key ax·g1 is generated by an owner of the first public key a·g1 (S303). In response to the proof request, the proving apparatus 230 verifies the proof data by calculating a verification formula for the proof data (S304). The proving apparatus 230 transmits the verification result as a response to the proof request from the receiving apparatus 220 (S305). ## Claims ### Claim 1 A method for proving a reliability of a second public key which is part of a second key pair generated in association with a first key pair comprising a first secret key and a first public key, wherein the first secret key is a, a generator of a cyclic group G1 is g1, the first public key is a·g1, the second secret key is ax where x is an integer, the second public key is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, comprising steps of: a first computer receiving a proof request for a proof of a reliability of the second public key ax·g1, from a second computer which can communicate with the first computer via a computer network, the first computer calculating a verification formula expressed in equation (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H(n1, n2, . . . nN) in response to the proof request, and the first computer transmitting a result of the verification as a response to the proof request, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1. ### Claim 2 (depends on 1) The method according to claim 1, wherein N is greater than or equal to 2 and n2 is data representing an attribute given to the second key pair. ### Claim 3 (depends on 1) The method according to claim 1, wherein the proof request includes the second public key ax·g1. ### Claim 4 (depends on 1) The method according to claim 1, wherein the proof request includes the proof data. ### Claim 5 A program for causing a first computer to perform a method for proving a reliability of a second public key which is part of a second key pair generated in association with a first key pair comprising a first secret key and a first public key, wherein the first secret key is a, a generator of a cyclic group G1 is g1, the first public key is a·g1, the second secret key is ax where x is an integer, the second public key is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, the method comprising steps of: receiving a proof request for a proof of a reliability of the second public key ax·g1 from a second computer which can communicate with the first computer via a computer network, calculating a verification formula expressed in equation (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H (n1, n2, . . . nN) in response to the proof request, and transmitting a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1. ### Claim 6 A first computer for proving a reliability of a second public key which is part of a second key pair generated in association with a first key pair comprising a first secret key and a first public key, wherein the first secret key is a, a generator of a cyclic group G1 is g1, the first public key is a·g1, the second secret key is ax where x is an integer, the second public key is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, configured to: receive a proof request for a proof of a reliability of the second public key ax·g1 from a second computer which can communicate with the first computer via a computer network, calculate a verification formula expressed in equation (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H (n1, n2, . . . nN) in response to the proof request, and send a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1. ### Claim 7 A method for proving a reliability of a second identifier generated in association with a first identifier, wherein a first constant is a, a generator of a cyclic group G1 is g1, a first identifier is a·g1, a second constant is ax where x is an integer, a second identifier is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, comprising steps of: a first computer receiving a proof request for a proof of a reliability of the second identifier ax·g1 from a second computer which can communicate with the first computer via a computer network, the first computer calculating a verification formula expressed in formula (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H(n1, n2, . . . nN) in response to said proof request, and the first computer transmitting a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1. ### Claim 8 A first computer comprising a non-transitory computer readable medium and a processor for proving a reliability of a second identifier generated in association with a first identifier, wherein a first constant is a, a generator of a cyclic group G1 is g1, a first identifier is a·g1, a second constant is ax where x is an integer, a second identifier is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, the first computer configured to: receive a proof request for a proof of a reliability of the second identifier ax·g1 from a second computer which can communicate with the first computer via a computer network, calculate a verification formula expressed in formula (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H(n1, n2, . . . nN) in response to said proof request, and transmit a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1. ### Claim 9 A program, stored in a non-transitory computer readable medium of a first computer comprising the medium and a processor, including instructions that, when executed, causes the first computer to perform a method for proving a reliability of a second identifier generated in association with a first identifier, wherein a first constant is a, a generator of a cyclic group G1 is g1, a first identifier is a·g1, a second constant is ax where x is an integer, a second identifier is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, the method comprising steps of: receiving a proof request for a proof of a reliability of the second identifier ax·gi from a second computer which can communicate with the first computer via a computer network, calculating a verification formula expressed in formula (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H(n1, n2, . . . nN) in response to said proof request, and transmitting a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which ni is ax·g1. ### Claim 10 A non-transitory computer readable medium storing a program including instructions that, when executed, causes a first computer comprising the medium and a processor to perform a method for proving a reliability of a second identifier generated in association with a first identifier, wherein a first constant is a, a generator of a cyclic group G1 is g1, a first identifier is a·g1, a second constant is ax where x is an integer, a second identifier is ax·g1, and H(n1, n2, . . . nN) (N is an integer greater than or equal to 1) is a hash function, the method comprising steps of: receiving a proof request for a proof of a reliability of the second identifier ax·g1 from a second computer which can communicate with the first computer via a computer network, calculating a verification formula expressed in formula (1) e(ax·g1,H)=e(a·g1,x·H)=e(g1,ax·H) (1) to verify proof data including x·H(n1, n2, . . . nN) and ax·H(n1, n2, . . . nN) in response to said proof request, and transmitting a result of the verification as a response to the proof request to the second computer, wherein G2 is a cyclic group with g2 as a generator, GT is a cyclic group with gT as a generator, and a bilinear map e can be defined from G1×G2 to GT, and wherein a hash function H(n1, n2, . . . nN) can be defined as a map from an arbitrary combination of first to Nth data to the cyclic group G2 in which n1 is ax·g1.