# US 12,010,221 B2 · Method and system for communicating a secret > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,221 B2 - Document ID: US12010221B2 - Status: Granted - Kind: B2 - Application number: 17/947,151 - Filed: 2022-09-18 - Published: 2023-06-08 - Granted: 2024-06-11 - Earliest claimed: 2018-05-14 - Assignees: nChain Licensing AG - Applicants: nChain Holdings Limited - Inventors: Craig Steven Wright - Web page: https://patentgrep.com/patent/US12010221B2 ## CPC - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3013: {involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3218: {using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/50: Oblivious transfer - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of communicating a secret (k0, k1) on the Bitcoin blockchain is disclosed. The method comprises sending information identifying secrets selectable by the recipient and receiving a first public key (Ui) of an elliptic curve cryptography system, corresponding to a first secret (Si) selected for access by the recipient and for which a first private key (m) is accessible to the recipient. A second public key (U1-i) is received, corresponding to a second secret not selected for access by the recipient, wherein a corresponding second private key is not available to the recipient. First and second secrets encrypted by means of the respective first and second public keys (X0, X1) are sent to the recipient, wherein the first secret is accessible to the recipient by means of the first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first and second secrets. ## Claims ### Claim 1 A method of communicating a secret from a sender to a recipient, each having a respective public key/private key pair, the method comprising: sending, from the sender to the recipient, information identifying a plurality of secrets selectable by the recipient; generating a third secret, to be shared between the sender and the recipient, from the respective public key/private key pairs held by the sender and recipient; receiving, at the sender, from the recipient, a first public key, corresponding to a first secret, of the plurality of secrets, selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to the first public key is accessible to the recipient, and wherein the first public key has been generated by the recipient from its respective public key/private key pair; receiving, at the sender, from the recipient, a second public key, corresponding to a second secret, of the plurality of secrets, not selected for access by the recipient, wherein the second public key is a public key of the elliptic curve cryptography system and a second private key, corresponding to the second public key, is not available to the recipient, wherein the second public key is based on the public key/private key pair and the third secret; encrypting the first secret by means of the corresponding first public key and sending it from the sender to the recipient; and encrypting the second secret by means of the corresponding second public key and sending it from the sender to the recipient; wherein the first secret is accessible to the recipient by means of the corresponding first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first secret and the second secret. ### Claim 2 (depends on 1) The method according to claim 1, wherein the first secret is encrypted using a third public key derived from said first public key, containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition. ### Claim 3 (depends on 2) The method according to claim 2, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a third encryption integer dependent on the first public key. ### Claim 4 (depends on 3) The method according to claim 3, wherein the third encryption integer is a hash value of the first public key. ### Claim 5 (depends on 2) The method according to claim 2, wherein the second secret is encrypted using a fourth public key derived from said second public key, containing a second masking term comprising a result of scalar multiplication, by a second masking integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a second encryption term by means of elliptic curve point addition. ### Claim 6 (depends on 5) The method according to claim 5, wherein the second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a fourth encryption integer dependent on the second public key. ### Claim 7 (depends on 6) The method according to claim 6, wherein the fourth encryption integer is a hash value of the second public key. ### Claim 8 (depends on 1) The method according to claim 1, wherein a result of scalar multiplication of the first public key by the second private key is equal to a result of scalar multiplication of the second public key by the first private key. ### Claim 9 A method of receiving a secret sent from a sender to a recipient, each having a respective public key/private key pair, the method comprising: receiving, at the recipient, information identifying a plurality of secrets selectable by the recipient; generating a third secret, to be shared between the sender and the recipient, from the respective public key/private key pairs held by the sender and recipient; generating, at the recipient, a first public key, a first private key corresponding to the first public key, and a second public key, all being of an elliptic curve cryptography system, wherein the first public key is generated from the recipient's respective public key/private key pair, the first private key is based on the first public key, the second public key is based on the first public key/first private key pair and the third secret, and a second private key corresponding to the second public key is not known to the recipient sending, to the sender, from the recipient, the first public key, corresponding to a first secret, of the plurality of secrets, selected for access by the recipient; sending, to the sender, from the recipient, the second public key, corresponding to a second secret, of the plurality of secrets, not selected for access by the recipient; receiving, at the recipient from the sender, a first secret encrypted by means of the corresponding first public key; and receiving, at the recipient from the sender, a second secret encrypted by means of the corresponding second public key, wherein the first secret is accessible to the recipient by means of the corresponding first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first secret and the second secret. ### Claim 10 (depends on 9) The method according to claim 9, wherein the first secret is encrypted using a third public key derived from the first public key, containing a first masking term comprising a result of scalar multiplication, by a first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a first encryption term by means of elliptic curve point addition. ### Claim 11 (depends on 10) The method according to claim 10, wherein the first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a third encryption integer dependent on the first public key. ### Claim 12 (depends on 11) The method according to claim 11, wherein the third encryption integer is a hash value of the first public key. ### Claim 13 (depends on 10) The method according to claim 10, wherein the second secret is encrypted using a respective fourth public key derived from said second public key, containing a second masking term comprising a result of scalar multiplication, by a second integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a second encryption term by means of elliptic curve point addition. ### Claim 14 (depends on 13) The method according to claim 13, wherein the second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a fourth encryption integer dependent on the second public key. ### Claim 15 (depends on 14) The method according to claim 14, wherein the fourth encryption integer is a hash value of the second public key. ### Claim 16 (depends on 9) The method according to claim 9, wherein a result of scalar multiplication of the first public key by the second private key is equal to a result of scalar multiplication of the second public key by the first private key. ### Claim 17 A computer-implemented comprising: a processor; and non-transitory computer-readable memory with instructions that, if executed by the processor, cause the system to: receive, at a recipient having a respective public key/private key pair, information identifying a plurality of secrets selectable by the recipient; generate a third secret, to be shared between a sender having a respective public key/private key pair, and the recipient, from the respective public key/private key pairs held by the sender and recipient; generate, at the recipient, a first public key, a first private key corresponding to the first public key, and a second public key, all being of an elliptic curve cryptography system, wherein the first public key is generated from the recipient's respective public key/private key pair, the first private key is based on the first public key, the second public key is based on the first public key/first private key pair and the third secret, and a second private key corresponding to the second public key is not known to the recipient send, to the sender, from the recipient, the first public key, corresponding to a first secret, of the plurality of secrets, selected for access by the recipient; send, to the sender, from the recipient, the second public key, corresponding to a second secret, of the plurality of secrets, not selected for access by the recipient; receive, at the recipient from the sender, a first secret encrypted by means of the corresponding first public key; and receive, at the recipient from the sender, a second secret encrypted by means of the corresponding second public key, wherein the first secret is accessible to the recipient by means of the corresponding first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first secret and the second secret.