# US 12,603,788 B2 · Managing hygiene of key pairs between certificate authorities using FHE

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,788 B2
- Document ID: US12603788B2
- Status: Granted
- Kind: B2
- Application number: 18/343,091
- Filed: 2023-06-28
- Published: 2025-01-02
- Granted: 2026-04-14
- Earliest claimed: 2023-06-28
- Assignees: DigiCert, Inc.
- Applicants: DigiCert, Inc.
- Inventors: Avesta Hojjati
- Web page: https://patentgrep.com/patent/US12603788B2

## CPC

- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 9/008: {involving homomorphic encryption}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/3247: {involving digital signatures}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of issuing a digital certificate includes receiving a certificate signing request (CSR) from an entity; determining a public key of the entity from the CSR; applying encryption to the public key; checking whether a result of the encryption is in a database to determine whether the public key has been previously used; and responsive to the public key not having been previously used, issuing a certificate to the entity based on the public key and the CSR. The method can further include, responsive to the public key having been previously used, alerting the entity to resubmit the CSR with a public key that has not been previously used or inquiring from the entity whether to proceed to issuing the certificate despite previous use. The encryption can be fully homomorphic encryption (FHE).

## Claims

### Claim 1

A method of issuing a digital certificate comprising steps of:
receiving a certificate signing request (CSR) from an entity at a certificate authority (CA);
determining a public key of the entity from the CSR;
applying fully homomorphic encryption (FHE) specifically to the public key to generate an encrypted query that preserves anonymity of the public key;
querying a Certificate Transparency (CT) log in a database updated by a plurality of different certificate authorities using the encrypted query to determine whether the public key has been previously used by any of the different certificate authorities;
responsive to the public key not having been previously used, issuing a certificate to the entity based on the public key and the CSR; and
responsive to the public key having been previously used, alerting the entity to resubmit the CSR with a public key that has not been previously used.

### Claim 2 (depends on 1)

The method of claim 1, wherein the steps further include:
responsive to the public key having been previously used, inquiring from the entity whether to proceed to issuing the certificate despite previous use.

### Claim 3 (depends on 1)

The method of claim 1, wherein the steps further include:
responsive to the public key not having been previously used, entering a hash of the encryption in the database to denote previous use of the public key based on the issued certificate.

### Claim 4 (depends on 1)

The method of claim 1, wherein the steps further include:
determining the CSR is for a public hierarchy; and
responsive to the public hierarchy, checking whether the public key is in the database to determine whether the public key has been previously used.

### Claim 5 (depends on 1)

The method of claim 1, wherein the steps further include:
determining the CSR is for a private hierarchy; and
responsive to the private hierarchy, performing the querying to determine whether the public key has been previously used.

### Claim 6 (depends on 1)

The method of claim 1, wherein the CT log includes entries for both full public keys and encrypted public keys for anonymization purposes.

### Claim 7 (depends on 1)

The method of claim 1, wherein the CT log includes entries for only encrypted public keys for anonymization purposes.

### Claim 8

A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
receiving a certificate signing request (CSR) from an entity at a certificate authority (CA);
determining a public key of the entity from the CSR;
applying fully homomorphic encryption (FHE) specifically to the public key to generate an encrypted query that preserves anonymity of the public key;
querying a Certificate Transparency (CT) log in a database updated by a plurality of different certificate authorities using the encrypted query to determine whether the public key has been previously used by any of the different certificate authorities;
responsive to the public key not having been previously used, issuing a certificate to the entity based on the public key and the CSR; and
responsive to the public key having been previously used, alerting the entity to resubmit the CSR with a public key that has not been previously used.

### Claim 9 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the steps further include:
responsive to the public key having been previously used, inquiring from the entity whether to proceed to issuing the certificate despite previous use.

### Claim 10 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the steps further include:
responsive to the public key not having been previously used, entering a hash of the encryption in the database to denote previous use of the public key based on the issued certificate.

### Claim 11 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the steps further include:
determining the CSR is for a public hierarchy; and
responsive to the public hierarchy, checking whether the public key is in the database to determine whether the public key has been previously used.

### Claim 12 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the steps further include:
determining the CSR is for a private hierarchy; and
responsive to the private hierarchy, performing the querying to determine whether the public key has been previously used.

### Claim 13 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the CT log includes entries for both full public keys and encrypted public keys for anonymization purposes.

### Claim 14 (depends on 8)

The non-transitory computer-readable medium of claim 8, wherein the CT log includes entries for only encrypted public keys for anonymization purposes.