Publicly verifiable encryption

Patent metadata

Field	Value
Publication number	US-12574258-B2
Application number	US-202318372051-A
Country	US
Kind code	B2
Filing date	Sep 22, 2023
Priority date	Sep 22, 2023
Publication date	Mar 10, 2026
Grant date	Mar 10, 2026

Abstract

Methods, systems, and devices for data management are described. A server may receive a plurality of parts of a secret from a computing device, where the plurality of parts may be individually encrypted and individually associated with respective public parts. The server may transmit a random challenge to the computing device. The computing device may transmit, to the server, a subset of parts in a decrypted state. The server may determine, using the subset of decrypted parts and a corresponding subset of respective public parts, that the subset of decrypted parts corresponds to a polynomial function with a degree corresponding to a quantity of parts in the subset of decrypted parts. The server may verify that the individually encrypted plurality of parts corresponds to a secret based on determining that the subset of decrypted parts corresponds to the polynomial function.

First claim

What is claimed is:

1 . A method for key management, comprising:
receiving from a computing device, a plurality of parts of a secret, wherein the plurality of parts are individually encrypted and individually associated with respective public parts; transmitting, to the computing device, a random challenge; receiving, from the computing device, after transmitting the random challenge, a subset of parts of the plurality of parts, wherein the subset of parts are in a decrypted state; determining, using the subset of parts in the decrypted state and a corresponding subset of the respective public parts, that the subset of parts corresponds to a polynomial function with a degree corresponding to a quantity of parts in the subset of parts; and verifying, based at least in part on determining that the subset corresponds to the polynomial function, that the individually encrypted plurality of parts corresponds to the secret without revealing the secret.

2 . The method of claim 1 , wherein the quantity is a threshold quantity of parts usable to determine that the subset of parts corresponds to the polynomial function without revealing the secret.

3 . The method of claim 1 , wherein:
an evaluation of the polynomial function determined using the subset of parts and at least one additional part in the decrypted state results in the secret, and the evaluation of the polynomial function corresponding to the secret is unobtainable using only the subset of parts in the decrypted state.

4 . The method of claim 1 , wherein the quantity is based at least in part on a total quantity of parts in the individually encrypted plurality of parts.

5 . The method of claim 1 , wherein receiving the plurality of parts comprises:
receiving, from a client application on the computing device, a request to back up the secret that is usable by the client application on the computing device; and receiving, from the client application after receiving the request to back up the secret, the individually encrypted plurality of parts, wherein the verifying is performed based at least in part on receiving the request to back up the secret.

6 . The method of claim 5 , wherein the client application is an application that supports access to a custodial token platform and the verifying is performed on one or more servers supporting the custodial token platform.

7 . The method of claim 1 , wherein the random challenge includes a selection of the subset of the parts in an encrypted state.

8 . An apparatus for key management, comprising:
one or more memories storing processor-executable code; and one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
receive from a computing device, a plurality of parts of a secret, wherein the plurality of parts are individually encrypted and individually associated with respective public parts;
transmit, to the computing device, a random challenge;
receive, from the computing device, after transmitting the random challenge, a subset of parts of the plurality of parts, wherein the subset of parts are in a decrypted state;
determine, using the subset of parts in the decrypted state and a corresponding subset of the respective public parts, that the subset of parts corresponds to a polynomial function with a degree corresponding to a quantity of parts in the subset of parts; and
verifying, based at least in part on determining that the subset corresponds to the polynomial function, that the individually encrypted plurality of parts corresponds to the secret without revealing the secret.

9 . The apparatus of claim 8 , wherein the quantity is a threshold quantity of parts usable to determine that the subset of parts corresponds to the polynomial function without revealing the secret.

10 . The apparatus of claim 8 , wherein:
an evaluation of the polynomial function determined using the subset of parts and at least one additional part in the decrypted state results in the secret, and the evaluation of the polynomial function corresponding to the secret is unobtainable using only the subset of parts in the decrypted state.

11 . The apparatus of claim 8 , wherein the quantity is based at least in part on a total quantity of parts in the individually encrypted plurality of parts.

12 . The apparatus of claim 8 , wherein, to receive the plurality of parts, the one or more processors are individually or collectively operable to execute the code to cause the apparatus to:
receive, from a client application on the computing device, a request to back up the secret that is usable by the client application on the computing device; and receive, from the client application after receiving the request to back up the secret, the individually encrypted plurality of parts, wherein the verifying is performed based at least in part on receiving the request to back up the secret.

13 . The apparatus of claim 12 , wherein the client application is an application that supports access to a custodial token platform and the verifying is performed on one or more servers supporting the custodial token platform.

14 . The apparatus of claim 8 , wherein the random challenge includes a selection of the subset of the parts in an encrypted state.

15 . A non-transitory computer-readable medium storing code for key management, the code comprising instructions executable by one or more processors to:
receive from a computing device, a plurality of parts of a secret, wherein the plurality of parts are individually encrypted and individually associated with respective public parts; transmit, to the computing device, a random challenge; receive, from the computing device, after transmitting the random challenge, a subset of parts of the plurality of parts, wherein the subset of parts are in a decrypted state; determine, using the subset of parts in the decrypted state and a corresponding subset of the respective public parts, that the subset of parts corresponds to a polynomial function with a degree corresponding to a quantity of parts in the subset of parts; and verifying, based at least in part on determining that the subset corresponds to the polynomial function, that the individually encrypted plurality of parts corresponds to the secret without revealing the secret.

16 . The non-transitory computer-readable medium of claim 15 , wherein the quantity is a threshold quantity of parts usable to determine that the subset of parts corresponds to the polynomial function without revealing the secret.

17 . The non-transitory computer-readable medium of claim 15 , wherein:
an evaluation of the polynomial function determined using the subset of parts and at least one additional part in the decrypted state results in the secret, and the evaluation of the polynomial function corresponding to the secret is unobtainable using only the subset of parts in the decrypted state.

18 . The non-transitory computer-readable medium of claim 15 , wherein the quantity is based at least in part on a total quantity of parts in the individually encrypted plurality of parts.

19 . The non-transitory computer-readable medium of claim 15 , wherein the instructions to receive the plurality of parts are executable by the one or more processors to:
receive, from a client application on the computing device, a request to back up the secret that is usable by the client application on the computing device; and receive, from the client application after receivin

Assignees

• Coinbase Inc

Inventors

• Chen Yi-Hsiu
• Ranellucci Samuel
• Haitner Iftach
• Afshar Arash

Classifications

• H04L9/0819

  Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062) · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title