Method and apparatus for using secret keys to make data permanently unreadable

1. A method for managing secret keys for messages, comprising:

receiving a desired expiration time T and a nonce N at a server that manages keys, wherein T (and possibly N) is received from an encrypter of a message M, wherein if N is not received from the encrypter, N is chosen by the server;

ensuring that a secret S T associated with the expiration time T is stored on the server so that S T can be looked up using an identifier ID S ;

calculating a hash H=h(N,S T ), thereby generating a key H for encrypting and decrypting message M;

sending H and ID S from the server to the encrypter, thereby allowing the encrypter to encrypt M with H to form {M}H, and to communicate ({M}H,N,ID S ) to a message reader;

deleting H and N at the server before expiration time T and after sending H and ID S to the encrypter;

subsequently receiving N and ID S at the server from the message reader;

using ID S to lookup S T ;

recalculating H=h(N,S T ); and

sending H to the message reader, thereby enabling the message reader to decrypt {M}H to obtain M;

wherein by using the secret S T associated with the expiration time T and the nonce N, the server is able to reconstruct the secret key H for the message M.

2. The method of claim 1 , wherein ensuring that the secret S T is stored on the server involves:

determining if the secret S T is already stored on the server for the expiration time T; and

if not, generating secret S T for the expiration time T, and storing S T on the server.

3. The method of claim 1 , wherein when the expiration time T is reached, the method further comprises forgetting the secret S T at the server.

4. The method of claim 1 , wherein if N is not received from the encrypter, but is instead generated by the server, sending H from the server to the encrypter additionally involves sending N from the server to the encrypter.

5. The method of claim 1 , wherein the secret S T for expiration time T, is computed by applying a hash function h to a secret S T-1 for a preceding expiration time T−1, so that S T =h(S T-1 );

whereby space can be saved by storing only the secret S T , and by repeatedly applying the hash function h to S T , to compute secrets for subsequent expiration times.

6. The method of claim 1 , wherein the server stores a different secret for each combination of expiration time and security property, whereby the server can store multiple secrets with different security properties for each expiration time.

7. The method of claim 1 , wherein the nonce N is a per-message nonce which is generated specifically for the message M.

8. The method of claim 1 , wherein storing S T involves generating and storing S T on a tamper-resistant smart card, which receives ID S and N, calculates H, and does not reveal S T .

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for managing secret keys for messages, wherein the computer-readable storage medium does not contain transitory signals, the method comprising:

receiving a desired expiration time T and a nonce N at a server that manages keys, wherein T (and possibly N is received from an encrypter of a message M, wherein if N is not received from the encrypter, N is chosen by the server;

ensuring that a secret S T associated with the expiration time T is stored on the server so that S T can be looked up using an identifier ID s ;

calculating a hash H=h(N, S T ), thereby generating a key H for encrypting and decrypting message M;

sending H and ID s from the server to the encrypter, thereby allowing the encrypter to encrypt M with H to form (M)H, and to communicate ((M)H,N, ID s );

to a message reader; deleting H and N at the server before expiration time T and after sending H and IDs to the encrypter; subsequently receiving N and ID S at the server from the message reader; using ID S to lookup S T ;

recalculating H=h(N, S T ); and sending H to the message reader, thereby enabling the message reader to decrypt (M)H to obtain M;

wherein by using the secret S T associated with the expiration time T and the nonce N, the server is able to reconstruct the secret key H for the message M.

10. The computer-readable storage medium of claim 9 , wherein ensuring that the secret S T is stored on the server involves:

determining if the secret S T is already stored on the server for the expiration time T; and

if not, generating secret S T for the expiration time T, and storing S T on the server.

11. The computer-readable storage medium of claim 9 , wherein when the expiration time T is reached, the method further comprises forgetting the secret S T at the server.

12. The computer-readable storage medium of claim 9 , wherein if N is not received from the encrypter, but is instead generated by the server, sending H from the server to the encrypter additionally involves sending N from the server to the encrypter.

13. The computer-readable storage medium of claim 9 , wherein the secret S T for expiration time T, is computed by applying a hash function h to a secret S T-1 for a preceding expiration time T−1, so that S T =h(S T-1 );

whereby space can be saved by storing only the secret S T , and by repeatedly applying the hash function h to S T , to compute secrets for subsequent expiration times.

14. The computer-readable storage medium of claim 9 , wherein the server stores a different secret for each combination of expiration time and security property, whereby the server can store multiple secrets with different security properties for each expiration time.

15. The computer-readable storage medium of claim 9 , wherein the nonce N is a per-message nonce which is generated specifically for the message M.

16. The computer-readable storage medium of claim 9 , wherein storing S T involves generating and storing S T on a tamper-resistant smart card, which receives ID S and N, calculates H, and does not reveal S T .

17. An apparatus that managing secret keys for messages, comprising:

a receiving mechanism configured to receive a desired expiration time T and a nonce N at a server that manages keys, wherein T (and possibly N) is received from an encrypter of a message M, wherein if N is not received from the encrypter, N is chosen by the server;

a key storage mechanism configured to ensure that a secret S T associated with the expiration time T is stored on the server so that S T can be looked up using an identifier ID S ;

a calculation mechanism configured to calculate a hash H=h(N,S T ), thereby generating a key H for encrypting and decrypting message M;

a sending mechanism configured to send H and ID S from the server to the encrypter, thereby allowing the encrypter to encrypt M with H to form {M}H, and to communicate ({M}H, N, ID S ) to a message reader;

a deleting mechanism configured to delete H and Nat the server before expiration time T and after sending H and ID S to the encrypter;

wherein the receiving mechanism is additionally configured to subsequently receive N and ID S at the server from the message reader;

a lookup mechanism configured to use ID S to lookup S T ;

wherein the calculation mechanism is additionally configured to recalculate H=h(N,S T ); and

wherein the sending mechanism is additionally configured to send H to the message reader, thereby enabling the message reader to decrypt {M}H to obtain M;

wherein by using the secret S T associated with the expiration time T and the nonce N, the server is able to reconstruct the secret key H for the message M.

18. The apparatus of claim 17 , wherein the key storage mechanism is configured to:

determine if the secret S T is already stored on the server for the expiration time T; and

if not, to generate secret S T for the expiration time T, and to store S T on the server.

19. The apparatus of claim 17 , wherein when the expiration time T is reached, the key storage mechanism is configured to forget the secret S T at the server.

20. The apparatus of claim 17 , wherein if N is not received from the encrypter, but is instead generated by the server, while sending H from the server to the encrypter, the sending mechanism is additionally configured to send N from the server to the encrypter.

21. The apparatus of claim 17 , further comprising a key generation mechanism that is configured to compute the secret S T for expiration time T by applying a hash function h to a secret S T-1 for a preceding expiration time T−1, so that S T =h(S T-1 );

whereby space can be saved by storing only the secret S T , and by repeatedly by applying the hash function h to S T , to compute secrets for subsequent expiration times.

22. The apparatus of claim 17 , wherein the server stores a different secret for each combination of expiration time and security property, whereby the server can store multiple secrets with different security properties for each expiration time.

23. The apparatus of claim 17 , wherein the nonce N is a per-message nonce which is generated specifically for the message M.

24. The apparatus of claim 17 , wherein storing S T involves generating and storing S T on a tamper-resistant smart card, which receives ID S and N, calculates H, and does not reveal S T .