# US 12,192,318 B2 · Quantum-safe cryptographic method and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,318 B2 - Document ID: US12192318B2 - Status: Granted - Kind: B2 - Application number: 17/964,709 - Filed: 2022-10-12 - Published: 2023-02-16 - Granted: 2025-01-07 - Earliest claimed: 2021-03-10 - Assignees: Quantropi Inc. - Applicants: Quantropi Inc. - Inventors: Randy Kuang; Maria Perepechaenko - Web page: https://patentgrep.com/patent/US12192318B2 ## CPC - H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/0662: {with particular pseudorandom sequence generator} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/3093: {involving Lattices or polynomial equations, e.g. NTRU scheme} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cryptographic method and system. A plurality of ciphers is identified in a message received by a recipient, such message encrypting a digital asset. A private key associated with the recipient is obtained. The private key corresponds to a public key associated with the recipient. The method includes solving for x in the equation: [(f0(R0−1N′0 mod S)+P′+fλ(Rn−1N′n mod S))/(h0(R0−1N′0 mod S)+Q′+hλ(Rn−1N′n mod S))]*h(x)−f(x)=0 mod p, where (i) P′, Q′, N′0, and N′n correspond to the ciphers in the received message; (ii) R0, Rn and S are data elements of the private key; (iii) f(·) is a polynomial function defined by coefficients f0, f1, . . . fλ that are also data elements of the private key; and (iv) h(·) is a polynomial function defined by coefficients h0, h1, . . . hλ that are also data elements of the private key. The value of x is assigned to the digital asset, which is then stored in non-transitory memory or packaged in a message sent over the data network. ## Claims ### Claim 1 A method of operating a first computing apparatus of a recipient for cryptographic communication with a second computing apparatus, the method comprising: receiving a message from the second computing apparatus; identifying a plurality of ciphers in the received message; retrieving from a memory of the first computing apparatus a private cryptographic key associated with the recipient, the private cryptographic key corresponding to a public cryptographic key associated with the recipient, the private cryptographic key comprising a plurality of private cryptographic key data elements; solving for x in an equation: [(f0(R0−1N′0 mod S)+P′+fλ(Rn−1N′n mod S))/(h0(R0−1N′0 mod S)+Q′+hλ(Rn−1N′n mod S))]*h(x)−f(x)=0 mod p, where: p is a predetermined integer stored in the memory of the first computing apparatus; P′, Q′, N′0, and N′n correspond to the ciphers in the received message; R0, Rn and S are included in the private cryptographic key data elements; f(·) is a first polynomial function defined by a set of coefficients f0, f1, . . . fλ included in the private cryptographic key data elements, with λ being a predetermined integer; and h(·) is a second polynomial function defined by a set of coefficients h0, h1, . . . hλ included in the private cryptographic key data elements; assigning the value of x to a digital asset; and storing the digital asset in non-transitory memory or packaging the digital asset in a message sent over a data network. ### Claim 2 (depends on 1) The method defined in claim 1, further comprising receiving the private cryptographic key from a key generation server over an out-of-bank link. ### Claim 3 (depends on 1) The method defined in claim 1, further comprising receiving the private cryptographic key from a key generation server not over the data network. ### Claim 4 (depends on 1) The method defined in claim 1, further comprising generating the public cryptographic key and the private cryptographic key. ### Claim 5 (depends on 4) The method defined in claim 4, further comprising withholding the private cryptographic key from a sender of the message. ### Claim 6 (depends on 4) The method defined in claim 4, further comprising sending the public cryptographic key to a sender of the message over the data network. ### Claim 7 (depends on 1) The method defined in claim 1, wherein λ is selected to be no greater than 3. ### Claim 8 (depends on 1) The method defined in claim 1, wherein when solving for x yields a plurality of candidate solutions, the method further comprises selecting one of the candidate solutions as the digital asset. ### Claim 9 (depends on 8) The method defined in claim 8, wherein selecting one of the candidate solutions as the digital asset comprises: comparing a portion of each of the candidate solutions against a predetermined flag or code and selecting as the digital asset the candidate solution for which the compared portion matches the predetermined flag or code; or performing a checksum on each candidate solution and comparing the checksum to a received checksum associated with each candidate solution and selecting as the digital asset the candidate solution for which the checksums are matching. ### Claim 10 (depends on 1) The method defined in claim 1, wherein the public cryptographic key is formed from: a. a first set of public key coefficients, being the coefficients of a first product polynomial in x obtained as the product of (i) a base polynomial in x of order n and m noise variables and (ii) a first entanglement polynomial f(x), minus the coefficient of x0 and the coefficient of xn+λ, with m and n being predetermined integers stored in the memory of the first computing apparatus; b. a second set of public key coefficients, being the coefficients of a second product polynomial in x obtained as the product of (i) said base polynomial in x of order n and said m noise variables and (ii) a second entanglement polynomial h(x), minus the coefficient of x0 and the coefficient of xn+λ; c. a third set of public key coefficients, being the coefficients of a first linear combination of the noise variables, each multiplied by R0 and then mod S; and d. a fourth set of public key coefficients, being the coefficients of a second linear combination of the noise variables, each multiplied by Rn and then mod S. ### Claim 11 (depends on 10) The method defined in claim 10, wherein successful decryption of the digital asset occurs if the public cryptographic key was used by a sender to encrypt the digital asset by: a. computing the cipher P′ as the result of using the first set of public key coefficients as the coefficients of a first polynomial of the digital asset; b. computing the cipher Q′ as the result of using the second set of public key coefficients as the coefficients of a second polynomial of the digital asset; c. computing the cipher N′0 as the result of using the third set of public key coefficients as the coefficients of the terms of a linear combination of the noise variables with values selected by the sender; and d. computing the cipher N′n as the result of using the fourth set of public key coefficients as the coefficients of the terms of a linear combination of said noise variables multiplied by the digital asset to the power n+λ. ### Claim 12 (depends on 10) The method defined in claim 10, wherein p is selected to be at least as great as 26, wherein n is selected to be at least as great as 3, or wherein m is selected to be at least as great as 2. ### Claim 13 (depends on 10) The method defined in claim 10, wherein p is selected to be at least as great as 26, wherein n is selected to be equal to 1, and wherein m is selected to be equal to 1. ### Claim 14 (depends on 1) The method defined in claim 1, wherein p is represented by X bits and is selected to be the largest prime number less than 2X. ### Claim 15 A non-transitory computer-readable storage medium comprising computer-readable instructions which, when executed by a processing entity of a first computing apparatus, cause the first computing apparatus to carry out operations for cryptographic communication with a second computing apparatus, the operations including: receiving a message from the second computing apparatus; identifying a plurality of ciphers in the received message; retrieving from a memory of the first computing apparatus a private cryptographic key associated with a recipient, the private cryptographic key corresponding to a public cryptographic key associated with the recipient, the private cryptographic key comprising a plurality of private cryptographic key data elements; solving for x in an equation: [(f0(R0−1N′0 mod S)+P′+fλ(Rn−1N′n mod S))/(h0(R0−1N′0 mod S)+Q′+hλ(Rn−1N′n mod S))]*h(x)−f(x)=0 mod p, where: p is a predetermined integer stored in the memory of the first computing apparatus; P′, Q′, N′0, and N′n correspond to the ciphers in the received message; R0, Rn, Sp and Sq are included in the private cryptographic key data elements; f(·) is a first polynomial function defined by a set of coefficients f0, f1, . . . fλ included in the private cryptographic key data elements; and h(·) is a second polynomial function defined by a set of coefficients h0, h1, . . . hλ included in the private cryptographic key data elements; assigning the value of x to a digital asset; and storing the digital asset in non-transitory memory or packaging the digital asset in a message sent over a data network. ### Claim 16 A method of operating a first computing apparatus of a recipient server for cryptographic communication with a second computing apparatus, the method comprising: receiving a message from the second computing apparatus; identifying a plurality of ciphers in the received message; retrieving from a memory of the first computing apparatus a private cryptographic key associated with the recipient, the private cryptographic key corresponding to a public cryptographic key associated with the recipient, the private cryptographic key comprising a plurality of private cryptographic key data elements; solving for x in an equation: [(Rp−1P′ mod Sp)/(Rq−1Q′ mod Sq)]*h(x)−f(x)=0 mod p, where: p is a predetermined integer stored in the memory of the first computing apparatus; P′ and Q′ correspond to the ciphers in the received message; Rp, Rq, Sp and Sq are included in the private cryptographic key data elements; f(·) is a first polynomial function defined by a set of coefficients f0, f1, . . . fλ included in the private cryptographic key data elements; and h(·) is a second polynomial function defined by a set of coefficients h0, h1, . . . hλ included in the private cryptographic key data elements; assigning the value of x to a digital asset; and storing the digital asset in non-transitory memory or packaging the digital asset in a message sent over a data network. ### Claim 17 (depends on 16) The method defined in claim 16, further comprising receiving the private cryptographic key from a key generation server over an out-of-bank link. ### Claim 18 (depends on 16) The method defined in claim 16, further comprising receiving the private cryptographic key from a key generation server not over the data network. ### Claim 19 (depends on 16) The method defined in claim 16, further comprising generating the public cryptographic key and the private cryptographic key. ### Claim 20 (depends on 19) The method defined in claim 19, further comprising withholding the private cryptographic key from a sender of the message. ### Claim 21 (depends on 19) The method defined in claim 19, further comprising sending the public cryptographic key to a sender of the message over the data network. ### Claim 22 (depends on 16) The method defined in claim 16, wherein λ is selected to be no greater than 3. ### Claim 23 (depends on 16) The method defined in claim 16, wherein when solving for x yields a plurality of candidate solutions, the method further comprises selecting one of the candidate solutions as the digital asset. ### Claim 24 (depends on 16) The method defined in claim 16, wherein Sp and Sq are selected to be identical. ### Claim 25 (depends on 16) The method defined in claim 16, wherein the public cryptographic key is formed from: a. a first set of public key coefficients, being the coefficients of a first product polynomial in x obtained as the product of (i) a base polynomial in x of order n and m noise variables and (ii) a first entanglement polynomial f(x), minus the resulting coefficient of x0 and the resulting coefficient of xn+λ, each remaining coefficient multiplied by Rp and then mod Sp, with m and n being predetermined integers stored in the memory of the first computing apparatus; and b. a second set of public key coefficients, being the coefficients of a second product polynomial in x obtained as the product of (i) said base polynomial in x of order n and said m noise variables and (ii) a second entanglement polynomial h(x), minus the resulting coefficient of x0 and the resulting coefficient of xn+λ, each remaining coefficient multiplied by Rq and then mod Sq. ### Claim 26 (depends on 25) The method defined in claim 25, wherein successful decryption of the digital asset occurs if the public cryptographic key was used by a sender to encrypt the digital asset by: a. computing the cipher P′ as the result of using the first set of public key coefficients as the coefficients of a first polynomial of the digital asset; and b. computing the cipher Q′ as the result of using the second set of public key coefficients as the coefficients of a second polynomial of the digital asset. ### Claim 27 (depends on 25) The method defined in claim 25, wherein p is selected to be at least as great as 232, wherein n is selected to be at least as great as 1, and wherein and m is selected to be at least as great as 1. ### Claim 28 (depends on 25) The method defined in claim 25, wherein p is selected to be at least as great as 232, wherein n is selected to be at least as great as 1, and wherein and m is selected to be at least as great as 2. ### Claim 29 A non-transitory computer-readable storage medium comprising computer-readable instructions which, when executed by a processing entity of a first computing apparatus, cause the computing apparatus to carry out operations for cryptographic communication with a second computing apparatus, the operations including: receiving a message from the second computing apparatus; identifying a plurality of ciphers in the received message; retrieving from a memory of the first computing apparatus a private cryptographic key associated with a recipient, the private cryptographic key corresponding to a public cryptographic key associated with the recipient, the private cryptographic key comprising a plurality of private cryptographic key data elements; solving for x in an equation: [(Rp−1P′ mod Sp)/(Rq−1Q′ mod Sq)]*h(x)−f(x)=0 mod p, where: p is a predetermined integer stored in the memory of the first computing apparatus; P′ and Q′ correspond to the ciphers in the received message; Rp, Rq, Sp and Sq are included in the private cryptographic key data elements; f(·) is a first polynomial function defined by a set of coefficients f0, f1, . . . fλ included in the private cryptographic key data elements; and h(·) is a second polynomial function defined by a set of coefficients h0, h1, . . . hλ included in the private cryptographic key data elements; assigning the value of x to a digital asset; and storing the digital asset in non-transitory memory or packaging the digital asset in a message sent over a data network. ### Claim 30 A method of operating an encryption server of a first computing apparatus to encrypt a digital asset for transmission to a second computing apparatus over a data network, the method comprising: identifying a public key associated with a recipient, the public key comprising a first, a second, a third and a fourth set of public key coefficients, the public key being part of a public-private key pair associated with the recipient; selecting m noise variables, wherein m is an integer greater than or equal to 1; creating a plurality of ciphers based on the public key, the digital asset and the noise variables, wherein a ciphertext comprises: a first cipher computed as the result of using the first set of public key coefficients as the coefficients of a first polynomial of the digital asset; a second cipher computed as the result of using the second set of public key coefficients as the coefficients of a second polynomial of the digital asset; a third cipher computed as the result of using the third set of public key coefficients as the coefficients of terms of a linear combination of the noise variables; and a fourth cipher computed as the result of using the fourth set of public key coefficients as the coefficients of the terms of a linear combination of the noise variables multiplied by the digital asset to the power n+λ, where n and λ are integers at least as great as one; and sending a message comprising the plurality of ciphers over the data network towards the recipient server in possession of the private key.