Providing smart contracts including secrets encrypted with oracle-provided encryption keys

1. A computing system, comprising a contract creator comprising a first computing device comprising a first memory and a first processor device coupled to the first memory, the contract creator to:

generate a symmetric cryptographic key K;

encrypt sensitive data for a smart contract into ciphertext using the symmetric cryptographic key K;

encrypt the symmetric cryptographic key K into a wrapper using a public cryptographic key e of a contract executor, the public cryptographic key e corresponding to a private cryptographic key E of the contract executor;

generate an envelope using a public cryptographic key o of a contract oracle, the public cryptographic key o corresponding to a private cryptographic key O of the contract oracle, and the envelope comprising the wrapper encrypted using the public cryptographic key o and a policy that comprises one or more conditions precedent and is digitally authenticated; and

deploy the smart contract comprising the envelope and the ciphertext to the contract executor.

2. The computing system of claim 1 , wherein the contract creator is further to, prior to encrypting the sensitive data for the smart contract and encrypting the symmetric cryptographic key K:

receive, from the contract executor, the public cryptographic key e; and

receive, from the contract oracle, the public cryptographic key o.

3. The computing system of claim 1 , wherein the contract creator is further to, prior to deploying the smart contract, encrypt the envelope using the public cryptographic key e.

4. The computing system of claim 1 , wherein the contract creator is to deploy the smart contract comprising the envelope and the ciphertext to the contract executor via a secure transport protocol.

5. The computing system of claim 1 , wherein the contract executor comprises a node of a plurality of nodes of a distributed ledger network.

6. The computing system of claim 1 , further comprising:

the contract executor, comprising a second computing device comprising a second memory and a second processor device coupled to the second memory, and communicatively coupled to the contract creator; and

the contract oracle, comprising a third computing device comprising a third memory and a third processor device coupled to the third memory, and communicatively coupled to the contract creator and the contract executor;

the contract executor to:

determine whether the one or more conditions precedent of the policy have been satisfied; and

responsive to determining that the one or more conditions precedent of the policy have been satisfied, transmit the envelope to the contract oracle;

the contract oracle to:

determine whether the one or more conditions precedent of the policy have been satisfied;

decrypt the wrapper of the envelope using the private cryptographic key O; and

responsive to determining that the one or more conditions precedent of the policy have been satisfied, transmit the wrapper to the contract executor; and

the contract executor further to:

decrypt the symmetric cryptographic key K of the wrapper using the private cryptographic key E;

decrypt the sensitive data of the ciphertext of the smart contract using the symmetric cryptographic key K; and

execute the smart contract using the sensitive data.

7. The computing system of claim 6 , wherein the contract oracle is to decrypt the wrapper of the envelope prior to determining whether the one or more conditions precedent of the policy have been satisfied.

8. A method comprising:

generating, by a contract creator comprising a first computing device, a symmetric cryptographic key K;

encrypting, by the contract creator, sensitive data for a smart contract into ciphertext using the symmetric cryptographic key K;

encrypting, by the contract creator, the symmetric cryptographic key K into a wrapper using a public cryptographic key e of a contract executor comprising a second computing device, the public cryptographic key e corresponding to a private cryptographic key E of the contract executor;

generating, by the contract creator, an envelope using a public cryptographic key o of a contract oracle comprising a third computing device, the public cryptographic key o corresponding to a private cryptographic key O of the contract oracle, and the envelope comprising the wrapper encrypted using the public cryptographic key o and a policy that comprises one or more conditions precedent and is digitally authenticated; and

deploying, by the contract creator, the smart contract comprising the envelope and the ciphertext to the contract executor.

9. The method of claim 8 , further comprising:

receiving, by the contract creator, the public cryptographic key e prior to encrypting the sensitive data for the smart contract and encrypting the symmetric cryptographic key K; and

receiving, by the contract creator, the public cryptographic key o prior to encrypting the sensitive data for the smart contract and encrypting the symmetric cryptographic key K.

10. The method of claim 8 , further comprising encrypting, by the contract creator, the envelope using the public cryptographic key e prior to deploying the smart contract.

11. The method of claim 8 , wherein deploying the smart contract comprising the envelope and the ciphertext to the contract executor comprises deploying the smart contract via a secure transport protocol.

12. The method of claim 8 , further comprising:

determining, by the contract executor, whether the one or more conditions precedent of the policy have been satisfied;

responsive to determining that the one or more conditions precedent of the policy have been satisfied, transmitting, by the contract executor, the envelope to the contract oracle;

determining, by the contract oracle, whether the one or more conditions precedent of the policy have been satisfied;

decrypting, by the contract oracle, the wrapper of the envelope using the private cryptographic key O;

responsive to determining that the one or more conditions precedent of the policy have been satisfied, transmitting, by the contract oracle, the wrapper to the contract executor;

decrypting, by the contract executor, the symmetric cryptographic key K of the wrapper using the private cryptographic key E;

decrypting, by the contract executor, the sensitive data of the ciphertext of the smart contract using the symmetric cryptographic key K; and

executing, by the contract executor, the smart contract using the sensitive data.

13. The method of claim 12 , wherein decrypting the wrapper of the envelope comprises decrypting the wrapper of the envelope prior to determining whether the one or more conditions precedent of the policy have been satisfied.

14. A non-transitory computer-readable medium having stored thereon computer-executable instructions that, when executed, cause one or more processor devices to:

generate a symmetric cryptographic key K;

encrypt sensitive data for a smart contract into ciphertext using the symmetric cryptographic key K;

encrypt the symmetric cryptographic key K into a wrapper using a public cryptographic key e of a contract executor, the public cryptographic key e corresponding to a private cryptographic key E of the contract executor;

generate an envelope using a public cryptographic key o of a contract oracle, the public cryptographic key o corresponding to a private cryptographic key O of the contract oracle, and the envelope comprising the wrapper encrypted using the public cryptographic key o and a policy that comprises one or more conditions precedent and is digitally authenticated; and

deploy the smart contract comprising the envelope and the ciphertext to the contract executor.

15. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions further cause the one or more processor devices to, prior to encrypting the sensitive data for the smart contract and encrypting the symmetric cryptographic key K:

receive, from the contract executor, the public cryptographic key e; and

receive, from the contract oracle, the public cryptographic key o.

16. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions further cause the one or more processor devices to, prior to deploying the smart contract, encrypt the envelope using the public cryptographic key e.

17. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions cause the one or more processor devices to deploy the smart contract comprising the envelope and the ciphertext to the contract executor via a secure transport protocol.

18. The non-transitory computer-readable medium of claim 14 , wherein the contract executor comprises a node of a plurality of nodes of a distributed ledger network.

19. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions cause the one or more processor devices to:

determine, by the contract executor, whether the one or more conditions precedent of the policy have been satisfied;

responsive to determining that the one or more conditions precedent of the policy have been satisfied, transmit, by the contract executor, the envelope to the contract oracle;

determine, by the contract oracle, whether the one or more conditions precedent of the policy have been satisfied;

decrypt, by the contract oracle, the wrapper of the envelope using the private cryptographic key O;

responsive, by the contract oracle, to determining that the one or more conditions precedent of the policy have been satisfied, transmit the wrapper to the contract executor; and

decrypt, by the contract executor, the symmetric cryptographic key K of the wrapper using the private cryptographic key E;

decrypt, by the contract executor, the sensitive data of the ciphertext of the smart contract using the symmetric cryptographic key K; and

execute, by the contract executor, the smart contract using the sensitive data.

20. The non-transitory computer-readable medium of claim 19 , wherein the computer-executable instructions cause the one or more processor devices to decrypt, by the contract oracle, the wrapper of the envelope prior to determining whether the one or more conditions precedent of the policy have been satisfied.