Methods and devices for automated digital certificate verification
A public key may be recorded on the blockchain by a certificate authority in such a manner that any third party may quickly and easily verify that the public key is certified by the certificate authority and that the certification has not been revoked. The certificate authority may be able to revoke the certification nearly instantaneously, and/or may be able to simultaneously certify a new key for the same entity while revoking the old key. The verification may be incorporated into a new transaction so that there is no gap between reliance on the certificate and the verification of its validity. In some cases, each transaction in which the certificate is used may also serve as linked certificate transaction that renews the certificate to enable a subsequent use.
1. A computer-implemented method of validating a certificate associated with a first node, the method comprising:
receiving a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
obtaining a copy of a certification transaction and determining that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key, wherein obtaining includes identifying a last transaction in a series of linked transactions based on the last transaction containing the certification transaction output, and tracing through the series of linked transactions to identify the certification transaction; and
propagating the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set.
2. The method of claim 1 , wherein the transaction template includes an input from a first public key associated with the first node, and wherein the certificate includes the first public key.
3. The method of claim 2 , wherein propagating includes adding, to the transaction template prior to propagation, an output to a second public key associated with a second node.
4. The method of claim 1 , wherein the transaction template includes an output to a first public key associated with the first node, and wherein the certificate includes the first public key.
5. The method of claim 4 , wherein propagating includes adding, to the transaction template prior to propagation, an input from a second public key associated with a second node.
6. The method of claim 1 , wherein the certification transaction output includes a pay-to-public-key output in the certification transaction.
7. The method of claim 6 , wherein the certification transaction output is one of a plurality of pay-to-public-key outputs in the certification transaction, and wherein each of the pay-to-public-key outputs in the certification transaction involves a different respective public key.
8. The method of claim 1 , wherein obtaining further includes verifying that the certification transaction output is a multi-signature output for which a permitted signatory includes the certification authority key.
9. The method of claim 1 , wherein the unspent transaction output set includes all transaction outputs not yet utilized as an input to a further transaction, and wherein the unspent transaction output set is maintained by the blockchain network.
10. The method of claim 1 , wherein the certification transaction output is in a transaction having a transaction identifier, and wherein the first input in the transaction template references the transaction identifier and wherein the certification transaction key is a private key associated with the transaction identifier and an index.
11. The method of claim 1 , wherein obtaining includes transmitting a request for the certification transaction to a node in the blockchain network and receiving a response containing the certification transaction.
12. The method of claim 1 , wherein obtaining includes receiving, from the first node, the copy of the certification transaction and a Merkle path associated with the certification transaction, and wherein the method further includes verifying that the certification transaction existing in a blockchain based on the copy of the certification transaction, the Merkle path, and a set of block headers for the blockchain.
13. A computing device to validate a certificate associated with a first node, the computing device including:
one or more processors;
memory;
computer-executable instructions stored in the memory that, when executed by the one or more processors, cause the one or more processors to:
receive a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
obtain a copy of a certification transaction and determine that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key; and
propagate the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set,
and wherein the instructions, when executed, are to cause the one or more processors to identify a last transaction in a series of linked transactions based on the last transaction containing the certification transaction output, and to trace through the series of linked transactions to obtain the certification transaction.
14. The computing device of claim 13 , wherein the transaction template includes an input from a first public key associated with the first node, and wherein the certificate includes the first public key, and wherein the instructions, when executed, are to cause the one or more processors to add, to the transaction template prior to propagation, an output to a second public key associated with a second node.
15. The computing device of claim 13 , wherein the transaction template includes an output to a first public key associated with the first node, and wherein the certificate includes the first public key, and wherein the instructions, when executed, are to cause the one or more processors to add, to the transaction template prior to propagation, an input from a second public key associated with a second node.
16. The computing device of claim 13 , wherein the certification transaction output includes a pay-to-public-key output in the certification transaction, and wherein the certification transaction output is one of a plurality of pay-to-public-key outputs in the certification transaction, and wherein each of the pay-to-public-key outputs in the certification transaction involves a different respective public key.
17. The computing device of claim 13 , wherein the certification transaction output is in a transaction having a transaction identifier, and wherein the first input in the transaction template references the transaction identifier and wherein the certification transaction key is a private key associated with the transaction identifier and an index.
18. A non-transitory computer-readable medium storing processor-executable instructions for validating a certificate associated with a first node, the processor-executable instructions including instructions that, when executed by one or more processors, cause the one or more processors to:
receive a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
obtain a copy of a certification transaction and determine that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key; and
propagate the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set,
and wherein the instructions, when executed, are to cause the one or more processors to identify a last transaction in a series of linked transactions based on the last transaction containing the certification transaction output, and to trace through the series of linked transactions to obtain the certification transaction.
19. A computer-implemented method of validating a certificate associated with a first node, the method comprising:
receiving a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
receiving, from the first node, a copy of a certification transaction and a Merkle path associated with the certification transaction, and determining that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key;
verifying that the certification transaction exists in a blockchain based on the copy of the certification transaction, the Merkle path, and a set of block headers for the blockchain; and
propagating the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set.
20. The method of claim 19 , wherein the transaction template includes an input from a first public key associated with the first node, and wherein the certificate includes the first public key.
21. The method of claim 20 , wherein propagating includes adding, to the transaction template prior to propagation, an output to a second public key associated with a second node.
22. The method of claim 19 , wherein the transaction template includes an output to a first public key associated with the first node, and wherein the certificate includes the first public key.
23. The method of claim 22 , wherein propagating includes adding, to the transaction template prior to propagation, an input from a second public key associated with a second node.
24. The method of claim 19 , wherein obtaining includes identifying a last transaction in a series of linked transactions based on the last transaction containing the certification transaction output, and tracing through the series of linked transactions to identify the certification transaction.
25. The method of claim 24 , obtaining further includes verifying that the certification transaction output is a multi-signature output for which a permitted signatory includes the certification authority key.
26. A computing device to validate a certificate associated with a first node, the computing device including:
one or more processors;
memory;
computer-executable instructions stored in the memory that, when executed by the one or more processors, cause the one or more processors to:
receive a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
obtain a copy of a certification transaction and determine that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key;
receive, from the first node, a Merkle path associated with the certification transaction;
verify that the certification transaction exists in a blockchain based on the copy of the certification transaction, the Merkle path, and a set of block headers for the blockchain; and
propagate the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set.
27. The computing device of claim 26 , wherein the transaction template includes an input from a first public key associated with the first node, and wherein the certificate includes the first public key.
28. The computing device of claim 27 , wherein the instructions, when executed, are to cause the one or more processors to propagate by adding, to the transaction template prior to propagation, an output to a second public key associated with a second node.
29. The computing device of claim 26 , wherein the transaction template includes an output to a first public key associated with the first node, and wherein the certificate includes the first public key.
30. The computing device of claim 29 , wherein the instructions, when executed, are to cause the one or more processors to propagate by adding, to the transaction template prior to propagation, an input from a second public key associated with a second node.
31. The computing device of claim 26 , wherein the instructions, when executed, are to cause the one or more processors to obtain the certification transaction by identifying a last transaction in a series of linked transactions based on the last transaction containing the certification transaction output, and tracing through the series of linked transactions to identify the certification transaction.
32. The computing device of claim 31 , wherein the instructions, when executed, are to further cause the one or more processors to verify that the certification transaction output is a multi-signature output for which a permitted signatory includes the certification authority key.
33. A non-transitory computer-readable medium storing processor-executable instructions for validating a certificate associated with a first node, the processor-executable instructions including instructions that, when executed by one or more processors, cause the one or more processors to:
receive a transaction template from the first node, the transaction template containing a first input that references a certification transaction output and is signed by a certification transaction key;
obtain a copy of a certification transaction and determine that the certification transaction includes the certificate associated with the first node and that the certification transaction is signed by a certification authority key;
receive, from the first node, a Merkle path associated with the certification transaction;
verify that the certification transaction exists in a blockchain based on the copy of the certification transaction, the Merkle path, and a set of block headers for the blockchain; and
propagate the transaction template on a blockchain network, wherein the transaction template propagated includes a second input transferring resources to an output address,
and whereby the transaction template is to be validated by nodes on the blockchain network if the certification transaction output is contained within an unspent transaction output set.