Doubly-encrypted secret parts allowing for assembly of a secret using a subset of the doubly- encrypted secret parts
A system includes at least one processor and at least one memory communicatively coupled to the at least one processor. The at least one processor is configured to receive a plurality of doubly-encrypted secret parts that were encrypted using at least a public key belonging to a public/private keypair. The at least one processor is also configured to decrypt each of the plurality of doubly-encrypted secret parts into a corresponding singly-encrypted secret part using a private key belonging to the public/private keypair. The at least one processor is also configured to decrypt each corresponding singly-encrypted secret part into a corresponding secret part. A secret is reconstructed from a quantity of corresponding secret parts that is a subset of a total number of secret parts. The public key, the private key, or both are rotated by creating a new version of the public key, the private key, or both.
1. A system comprising:
at least one processor; and
at least one memory communicatively coupled to the at least one processor;
wherein the at least one processor is configured to:
receive a plurality of doubly-encrypted secret parts that were encrypted using at least a public key belonging to a public/private keypair;
decrypt each of the plurality of doubly-encrypted secret parts into a corresponding singly-encrypted secret part using a private key belonging to the public/private keypair;
decrypt each corresponding singly-encrypted secret part into a corresponding secret part;
wherein a secret is reconstructed from a quantity of corresponding secret parts that is a subset of a total number of secret parts previously created from the secret; and
rotate at least one of the public key and the private key by:
replacing the public key with a new public key;
replacing the private key with a new private key; or
replacing the public key with the new public key and the private key with the new private key.
2. The system of claim 1 , wherein each doubly-encrypted secret part was encrypted into the corresponding singly-encrypted secret part using at least one corresponding symmetric key.
3. The system of claim 2 , wherein at least one first corresponding symmetric key for a first secret part is identical to at least one second corresponding symmetric key for a second secret part.
4. The system of claim 2 , wherein at least one first corresponding symmetric key for a first secret part is distinct from at least one second corresponding symmetric key for a second secret part.
5. The system of claim 1 , wherein the plurality of doubly-encrypted secret parts were encrypted using two stages, comprising:
a first stage during which each corresponding secret part was encrypted into the corresponding singly-encrypted secret part using a symmetric key or a second public key belonging to a second public/private keypair; and
a second stage during which each corresponding singly-encrypted secret part was encrypted into a respective doubly-encrypted secret part of the plurality of doubly-encrypted secret parts using the public key belonging to the public/private keypair.
6. The system of claim 1 , wherein the at least one processor is further configured to perform at least one of the following actions using the secret:
encrypting first data;
decrypting second data;
generating a transaction address; or
signing a transaction.
7. The system of claim 1 , wherein the at least one processor is configured to decrypt each corresponding singly-encrypted secret part by exclusive ORing (XORing) each corresponding singly-encrypted secret part with at least one corresponding symmetric key to produce the corresponding secret part.
8. The system of claim 1 , wherein the plurality of doubly-encrypted secret parts are received from a plurality of part holders.
9. The system of claim 1 , wherein, for each of the plurality of doubly-encrypted secret parts, the at least one processor is further configured to verify a respective signature associated with each of the plurality of doubly-encrypted secret parts.
10. The system of claim 1 , wherein the at least one processor is further configured to verify that a respective timestamp associated with each of the plurality of doubly-encrypted secret parts is not older than a predetermined time threshold.
11. A method for reconstructing an asset encryption key, comprising:
by at least one computing device:
receiving a plurality of doubly-encrypted secret parts that were encrypted using at least a public key belonging to a public/private keypair;
decrypting each of the plurality of doubly-encrypted secret parts into a corresponding singly-encrypted secret part using a private key belonging to the public/private keypair;
decrypting each corresponding singly-encrypted secret part into a corresponding secret part;
wherein a secret is reconstructed from a quantity of corresponding secret parts that is a subset of a total number of secret parts previously created from the secret; and
rotating at least one of the public key and the private key by:
replacing the public key with a new public key;
replacing the private key with a new private key; or
replacing the public key with the new public key and the private key with the new private key.
12. The method of claim 11 , wherein each doubly-encrypted secret part was encrypted into the corresponding singly-encrypted secret part using at least one corresponding symmetric key.
13. The method of claim 12 , wherein at least one first corresponding symmetric key for a first secret part is identical to at least one second corresponding symmetric key for a second secret part.
14. The method of claim 12 , wherein at least one first corresponding symmetric key for a first secret part is distinct from at least one second corresponding symmetric key for a second secret part.
15. The method of claim 11 , wherein the plurality of doubly-encrypted secret parts were encrypted using two stages, comprising:
a first stage during which each corresponding secret part was encrypted into the corresponding singly-encrypted secret part using a symmetric key or a second public key belonging to a second public/private keypair; and
a second stage during which each corresponding singly-encrypted secret part was encrypted into a respective doubly-encrypted secret part of the plurality of doubly-encrypted secret parts using the public key belonging to the public/private keypair.
16. The method of claim 11 , further comprising performing at least one of the following actions using the secret:
encrypting first data;
decrypting second data;
generating a transaction address; or
signing a transaction.
17. The method of claim 11 , further comprising decrypting each corresponding singly-encrypted secret part by exclusive ORing (XORing) each corresponding singly-encrypted secret part with at least one corresponding symmetric key to produce the corresponding secret part.
18. The method of claim 11 , wherein the plurality of doubly-encrypted secret parts are received from a plurality of part holders.
19. The method of claim 11 , further comprising verifying a respective signature associated with each of the plurality of doubly-encrypted secret parts.
20. The method of claim 11 , further comprising verifying that a respective timestamp associated with each of the plurality of doubly-encrypted secret parts is not older than a predetermined time threshold.