Sharing cryptographic material

A system comprising:

• a server comprising at least one processor and at least one memory, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to carry out operations comprising:
• receiving, from a first communications device:
• a token;
• authentication data for authenticating the token;
• and
• a ciphertext comprising respective portions for transmitting to each of a plurality of second communications devices;
• and
• transmitting, to each of the plurality of second communications devices, data comprising:
• the token;
• the authentication data;
• and
• the respective portion of the ciphertext depending on the respective encapsulation key for that second communications device.

A first communications device comprising one or more processors, the first communications device arranged to:

• receive a respective encapsulation key associated with each of a plurality of second communications devices;
• generate a first public-private keypair comprising an ephemeral first decapsulation key and an associated ephemeral first encapsulation key;
• process the respective encapsulation keys associated with the plurality of second communications devices using an encapsulation function to generate a first symmetric cryptographic key, a first token, and a first ciphertext, wherein:
• the first token is a cryptographic commitment of the first symmetric cryptographic key;
• and
• the first ciphertext is a multi-recipient encapsulation of the first symmetric cryptographic key under the encapsulation keys of the plurality of second communications devices;
• sign first data derived from the token and the first encapsulation key to generate a first digital signature;
• upload the first token, the first digital signature, the first encapsulation key, and the first ciphertext to a server;
• download, from the server, second data associated with one of the plurality of second communications devices, the second data comprising:
• a second token;
• a second digital signature;
• an ephemeral second encapsulation key;
• and
• a portion of a second ciphertext, wherein said second ciphertext is a multi-recipient encapsulation of the second symmetric cryptographic key under a plurality of encapsulation keys including the first encapsulation key;
• and
• process the first decapsulation key and the portion of the second ciphertext, using a decapsulation function associated with the encapsulation function, to generate a candidate copy of a second symmetric cryptographic key stored by said one of the plurality of second communications devices;
• and
• authenticate the second token and the second encapsulation key by verifying the second digital signature using a public verification key associated with the second signature key and data derived from the second token and the second encapsulation key, whereby to determine that the candidate copy of the second symmetric cryptographic key corresponds to the second symmetric cryptographic key stored by said one of the plurality of second communications devices.