DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . In communications filed on 03/30/2026. Claim24 is amended. Claims 9-11, 17, and 22-23 are cancelled. Claims 1-8, 12-16, 18-21, and 24-25 are pending in this examination.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. This examination is in response to US Patent Application No. 18/838,089.
Response to Arguments
Applicant’s cancelling claim 22, and amendment to claim 24 obviates previously raised claims 22, and 24 , 35 U.S.C .112(b), and 112(a) rejections.
Applicant's arguments filed 03/30/2026 have been fully considered but they are not persuasive:
Applicant submits on page 8 of remarks filed on 03/30/2026 regarding claim 1 that it appears that Wright does not disclose the claimed "puzzle transaction" as specifically described in this application. In the Office Action, the Examiner has cited the Abstract of Wright against this feature. However, while the Abstract discloses a puzzle, it does not disclose specifically a puzzle blockchain transaction.
Examiner respectfully disagrees with applicant argument for claim 1 filed on 03/30/2026 on page 8 of remarks. Examiner maintain the rejection
Wright discloses: [Abstract, Embodiments of the present disclosure provides protocols, methods and systems which provides advantages such as the resistance of centralisation of mining on a blockchain network, preferably a Proof-of-Work blockchain. A method in accordance with an embodiment may comprise generating a plurality of non-parallelisable challenges (or “puzzles”) and allocating one of said plurality of challenges to each miner on the network. The miner uses an inherently sequential (non-parallelisable) algorithm to find a solution to his allocated challenge. The challenges are generated by a committee of nodes, and a new set of challenges is generated for each block], and [0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network…], and [0006] In order to build new blocks, the miners compete by performing resource-intensive work with the aim of being the first to find a solution (proof of work, also known as a “PoW” or “nonce”) to a computation (puzzle). The difficulty of the puzzle can be adjusted over time to influence the rate at which new blocks are added to the blockchain. In Bitcoin, miners use the SHA256 hashing algorithm to find a PoW which, when hashed, produces a hash value that is lower than or equal to the current difficulty level set by the network protocol], and [0047] once the solution is found the trap door can be published or jointly computed enabling fast verification the solution using that trap door. Herein, a trap-door mining function known as a time-lock puzzle is used to construct a consensus algorithm for non-parallelisable mining on a blockchain network], and [0185] This technique has the following features [0186] Puzzles are time-locked using two values: t and t.sub.i. t acts as a standard difficulty parameter and is a uniform minimum number of squarings for the puzzle whereas t.sub.i is analogous to a nonce. This means that a miner will not be able to tell how many additional squarings are required without doing the computations [0187] Puzzle solution (analogous to the nonce in Bitcoin) can only be found using sequential computation. [0188] The puzzle solution (nonce) is public key dependent. This means that a new public key has to be generated for each entity that iterates nonce values].
Applicant submits on pages 9-11 of remarks filed on 03/30/2026 regarding claim 1 that Wright does not appear to disclose:
"A computer implemented method for generating a puzzle blockchain transaction"
ii) "the first locking script corresponding to a first unspent transaction output and
comprising a hash value derived from a target solution of a time-lock puzzle, and a set of puzzle parameters of the time-lock puzzle".
iii) "the locking script is configured to: when executed with a first unlocking script of a solution blockchain transaction, verify a candidate solution, computed using the set of puzzle parameters, provided in the first unlocking script of the solution blockchain transaction based on the hash value".
iv) "making the puzzle blockchain transaction available to one or more nodes of a blockchain network".
Examiner respectfully disagrees with applicant argument for claim 1 filed on 03/30/2026 on pages 9-11 of remarks. Examiner maintain the rejection.
Wright discloses: A computer implemented method for generating a puzzle blockchain transaction[Abstract, Embodiments of the present disclosure provides protocols, methods and systems which provides advantages such as the resistance of centralisation of mining on a blockchain network, preferably a Proof-of-Work blockchain. A method in accordance with an embodiment may comprise generating a plurality of non-parallelisable challenges (or “puzzles”) and allocating one of said plurality of challenges to each miner on the network. The miner uses an inherently sequential (non-parallelisable) algorithm to find a solution to his allocated challenge. The challenges are generated by a committee of nodes, and a new set of challenges is generated for each block], and [0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network…], and [0006] In order to build new blocks, the miners compete by performing resource-intensive work with the aim of being the first to find a solution (proof of work, also known as a “PoW” or “nonce”) to a computation (puzzle). The difficulty of the puzzle can be adjusted over time to influence the rate at which new blocks are added to the blockchain. In Bitcoin, miners use the SHA256 hashing algorithm to find a PoW which, when hashed, produces a hash value that is lower than or equal to the current difficulty level set by the network protocol], and [0047] once the solution is found the trap door can be published or jointly computed enabling fast verification the solution using that trap door. Herein, a trap-door mining function known as a time-lock puzzle is used to construct a consensus algorithm for non-parallelisable mining on a blockchain network], and [0185] This technique has the following features [0186] Puzzles are time-locked using two values: t and t.sub.i. t acts as a standard difficulty parameter and is a uniform minimum number of squarings for the puzzle whereas t.sub.i is analogous to a nonce. This means that a miner will not be able to tell how many additional squarings are required without doing the computations [0187] Puzzle solution (analogous to the nonce in Bitcoin) can only be found using sequential computation. [0188] The puzzle solution (nonce) is public key dependent. This means that a new public key has to be generated for each entity that iterates nonce values].
Wright discloses "the first locking script corresponding to a first unspent transaction output and comprising a hash value derived from a target solution of a time-lock puzzle, and a set of puzzle parameters of the time-lock puzzle"[0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction by checking that it conforms to the blockchain's protocol rules and also by executing the locking and corresponding unlocking scripts. If execution of the locking and unlocking scripts evaluates to TRUE, the transaction is valid. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the mining node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions]; and [0154] The scheme presented has the following key features [0155] Puzzles are time-locked using two values: t and t.sub.i. t is the minimum number of squarings for the puzzle and acts as a network-wide difficulty parameter. t.sub.i is a pseudo randomly generated value, unique to each miner and each new block. Furthermore t.sub.i cannot be immediately deduced, instead requiring some initial computations in order to be worked out. [0156] Puzzle solution can only be solved using sequential computation [0157] Hash function digest acts as a random number generator so that the puzzle is unique to each miner].
Wright discloses the locking script is configured to: when executed with a first unlocking script of a solution blockchain transaction, verify a candidate solution, computed using the set of puzzle parameters, provided in the first unlocking script of the solution blockchain transaction based on the hash value"[0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction by checking that it conforms to the blockchain's protocol rules and also by executing the locking and corresponding unlocking scripts. If execution of the locking and unlocking scripts evaluates to TRUE, the transaction is valid. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the mining node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions], and 0006] In order to build new blocks, the miners compete by performing resource-intensive work with the aim of being the first to find a solution (proof of work, also known as a “PoW” or “nonce”) to a computation (puzzle). The difficulty of the puzzle can be adjusted over time to influence the rate at which new blocks are added to the blockchain. In Bitcoin, miners use the SHA256 hashing algorithm to find a PoW which, when hashed, produces a hash value that is lower than or equal to the current difficulty level set by the network protocol.], and [0157].
Wright discloses making the puzzle blockchain transaction available to one or more nodes of a blockchain network".[ 0006] In order to build new blocks, the miners compete by performing resource-intensive work with the aim of being the first to find a solution (proof of work, also known as a “PoW” or “nonce”) to a computation (puzzle). The difficulty of the puzzle can be adjusted over time to influence the rate at which new blocks are added to the blockchain. In Bitcoin, miners use the SHA256 hashing algorithm to find a PoW which, when hashed, produces a hash value that is lower than or equal to the current difficulty level set by the network protocol.[0007] If a miner is the first to find the PoW to the current puzzle, that miner generates a new block which is then broadcast to the other miners on the network. The new block must contain the verifiable PoW if the other miners are to accept it as valid. Thus, mining provides a consensus mechanism which ensures that nodes on the network are synchronised and in agreement as to the legitimate and current state of the blockchain. It also protects against certain types of potential network attack, providing security for the network.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-8, 12-16, 18-21, and 24-25 are rejected under 35 U.S.C. 102(a) (1) as being anticipated by WRIGHT (WO2020/229925), examiner maps the limitations in the claims with (US2022/0224534) which corresponds to (WO2020/229925).
Regarding claim 1, Wright discloses a computer-implemented method for generating a puzzle blockchain transaction, the method comprising [Abstract, Embodiments of the present disclosure provides protocols, methods and systems which provides advantages such as the resistance of centralisation of mining on a blockchain network, preferably a Proof-of-Work blockchain. A method in accordance with an embodiment may comprise generating a plurality of non-parallelisable challenges (or “puzzles”) and allocating one of said plurality of challenges to each miner on the network. The miner uses an inherently sequential (non-parallelisable) algorithm to find a solution to his allocated challenge. The challenges are generated by a committee of nodes, and a new set of challenges is generated for each block], and [0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network…]; and
providing a first locking script of the puzzle blockchain transaction, the first locking script corresponding to a first unspent transaction output and [0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction by checking that it conforms to the blockchain's protocol rules and also by executing the locking and corresponding unlocking scripts. If execution of the locking and unlocking scripts evaluates to TRUE, the transaction is valid. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the mining node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions]; and
comprising a hash value derived from a target solution of a time-lock puzzle, and a set of puzzle parameters of the time-lock puzzle [0154] The scheme presented has the following key features [0155] Puzzles are time-locked using two values: t and t.sub.i. t is the minimum number of squarings for the puzzle and acts as a network-wide difficulty parameter. t.sub.i is a pseudo randomly generated value, unique to each miner and each new block. Furthermore t.sub.i cannot be immediately deduced, instead requiring some initial computations in order to be worked out. [0156] Puzzle solution can only be solved using sequential computation [0157] Hash function digest acts as a random number generator so that the puzzle is unique to each miner]; and
wherein the target solution is computed using a set of secret puzzle parameters and wherein the time-lock puzzle is solvable using the set of puzzle parameter in a time equal to or greater than a minimum solving time, wherein the set of puzzle parameters does not comprise the secret puzzle parameters [0048] Time Lock Puzzles
[0049] Time-lock puzzles are problems that take a predetermined time to complete. We call an algorithm Fh a time-lock puzzle if for some given input parameters a, t such that
Fh(a, t) =L,
[0050] there exists another algorithm Fe with O(FJ«O (Fh) such that
F,(a, t, s) = L
[0051] if and only if s is known. Moreover, the ability to accurately control the time taken for a computer to complete the algorithm though the input parameters require Fh be a function that is inherently sequential so that the task cannot be shared between machines.
[0052] Repeated Squaring as an Inherently Sequential Algorithm
[0053] The core problem is to compute a2' mod n for
specified values of a, t and n. In this paper we consider the problem when n is the product of two large primes, and t is chosen to set the desired level of difficulty of the puzzle. a is chosen to be a random and can be player specific. The most efficient way of solving the puzzle is by performing t successive squarings modulo n, beginning with the value a. That is, perform the following algorithm:
Algorithm 1
For i from O to t - 1 compute W(O) = a
W(i + 1) = W(i)2 mod n
[0054] to yield W(t). There is no known way to perform this computation in a more efficient way without knowing the factorization of n.
wherein the locking script is configured to: when executed with a first unlocking script of a solution blockchain transaction, verify a candidate solution, computed using the set of puzzle parameters, provided in the first unlocking script of the solution blockchain transaction based on the hash value; and making the puzzle blockchain transaction available to one or more nodes of a blockchain network [0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction by checking that it conforms to the blockchain's protocol rules and also by executing the locking and corresponding unlocking scripts. If execution of the locking and unlocking scripts evaluates to TRUE, the transaction is valid. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the mining node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions], and [0006] In order to build new blocks, the miners compete by performing resource-intensive work with the aim of being the first to find a solution (proof of work, also known as a “PoW” or “nonce”) to a computation (puzzle). The difficulty of the puzzle can be adjusted over time to influence the rate at which new blocks are added to the blockchain. In Bitcoin, miners use the SHA256 hashing algorithm to find a PoW which, when hashed, produces a hash value that is lower than or equal to the current difficulty level set by the network protocol., and [0007] If a miner is the first to find the PoW to the current puzzle, that miner generates a new block which is then broadcast to the other miners on the network. The new block must contain the verifiable PoW if the other miners are to accept it as valid. Thus, mining provides a consensus mechanism which ensures that nodes on the network are synchronised and in agreement as to the legitimate and current state of the blockchain. It also protects against certain types of potential network attack, providing security for the network.], and [0157].
Regarding claim 2, Wright discloses wherein the hash value is a hash of a public key derived using the target solution to the time-lock puzzle.
[0139] Step 1: A group of network miners M1, ... , Mn
(n>3) start the cycle by selecting a subcommittee of 3 (connected) miners (M1, M2 and M3 without loss of gener ality) using a verifiable random function.
[0140] Step 2a: Miners M1, M2 and M3 do a multiparty computation to compute
n =pq
without any individual miner able to calculate (p, q).
[0141] Step 2b: Miners M1, M2 and M3 propagate time lock puzzle (t, n) along with a proof that they were chosen at random
[0142] Step 3a: Miner M; with public key PK; receives (t, n) and computes
L;= 2H(XIIPK;)[OAJ modn
[0143] where X is the previous block header hash.
[0144] Step 3b: Miner M; receives (t, n) and computes
a= L,mod32 b=L,+4mod32
t, = H(XIIPK,)[a:b]
Regarding claim 3, Wright discloses, wherein the public key is derived from a private key, wherein the private key is derived from a private key of a predefined recipient and the target solution [0044] Trap-Door Mining Function
[0045] In general, a good one-way trap-door function will be difficult to compute but will be easy to verify when presented with some additional information and can there fore be mapped to a mining process that has both properties one and two.
[0046] For example, in the Rabin Cryptosystem a public key n=p·q is generated from a private key (p, q) where p, q are both primes. Calculating a signature (S, U) on a message m is a one-way function whose solution is a value S which satisfies the equation
H(mllU) = S2 modn.
[0047] The algorithm for finding a valid Sis a trap-door algorithm or function because it is difficult to find S given (n, m, U), but is easy if the factorisation of n is known. The important point here is that, before knowledge of the trap door, mining should be hard and thus take a period of time sufficiently larger than network messaging latency. How ever, once the solution is found the trap door can be published or jointly computed enabling fast verification the solution using that trap door. Herein, a trap-door mining function known as a time-lock puzzle is used to construct a consensus algorithm for non-parallelisable mining on a blockchain network.
Regarding claim 4, Wright discloses wherein the private key is the sum of the private key of the predefined recipient and the target solution
[0044] Trap-Door Mining Function
[0045] In general, a good one-way trap-door function will be difficult to compute but will be easy to verify when presented with some additional information and can there fore be mapped to a mining process that has both properties one and two.
[0046] For example, in the Rabin Cryptosystem a public key n=p·q is generated from a private key (p, q) where p, q are both primes. Calculating a signature (S, U) on a message m is a one-way function whose solution is a value S which satisfies the equation
H(mllU) = S2 modn.
[0047] The algorithm for finding a valid Sis a trap-door algorithm or function because it is difficult to find S given (n, m, U), but is easy if the factorisation of n is known. The important point here is that, before knowledge of the trap door, mining should be hard and thus take a period of time sufficiently larger than network messaging latency. How ever, once the solution is found the trap door can be published or jointly computed enabling fast verification the solution using that trap door. Herein, a trap-door mining function known as a time-lock puzzle is used to construct a consensus algorithm for non-parallelisable mining on a blockchain network
Regarding claim 5, Wright discloses, wherein the public key is derived from a private key, wherein the private key is a randomly generated private key, wherein the method further comprises randomly generating the private key [0046] For example, in the Rabin Cryptosystem a public key n=p.Math.q is generated from a private key (p, q) where p, q are both primes.
Regarding claim 6, Wright discloses, wherein the method further comprises encrypting the private key based on the target solution [0116] Miners M.sub.1, M.sub.2, M.sub.3 are selected using the Unique and Secure Subcommittee Selection. Miners must establish a direct connection with one-another and all messages between them are encrypted using AES symmetric encryption. The AES key is established using elliptic curve Diffie Hellmann key exchange.
Regarding claim 7, Wright discloses, wherein the first locking script further comprises the encrypted private key for rendering available when the puzzle blockchain transaction is committed to the blockchain [0116] Miners M.sub.1, M.sub.2, M.sub.3 are selected using the Unique and Secure Subcommittee Selection. Miners must establish a direct connection with one-another and all messages between them are encrypted using AES symmetric encryption. The AES key is established using elliptic curve Diffie Hellmann key exchange.
Regarding claim 8, Wright discloses wherein the first locking script further comprises a second hash value, wherein the second hash value is derived from a second target solution to a second time-lock puzzle and a set of second puzzle parameters of the second time-lock puzzle and corresponds to a second unspent transaction output, wherein the second unspent transaction output corresponds to a second locking script comprising the second hash value[0005] In order for a transaction to be written to the blockchain, it must be “validated”. Nodes on the network (“miners”) ensure that each transaction is valid, with invalid transactions being rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction by checking that it conforms to the blockchain's protocol rules and also by executing the locking and corresponding unlocking scripts. If execution of the locking and unlocking scripts evaluates to TRUE, the transaction is valid. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the mining node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions.
Regarding claim 12, the claim is interpreted and rejected for the same rational set forth in claim 1.
Regarding claim 13, the claim is interpreted and rejected for the same rational set forth in claim 2.
Regarding claim 14, the claim is interpreted and rejected for the same rational set forth in combination of claims 3-5.
Regarding claim 15, the claim is interpreted and rejected for the same rational set forth in combination of claims 3-7.
Regarding claim 16, the claim is interpreted and rejected for the same rational set forth in claim 8.
Regarding claim 18, Wright discloses wherein the time-lock puzzle is a modular squaring puzzle. [0048] Time Lock Puzzles
[0049] Time-lock puzzles are problems that take a predetermined time to complete. We call an algorithm Fh a time-lock puzzle if for some given input parameters a, t such that
Fh(a, t) =L,
[0050] there exists another algorithm Fe with O(FJ«O (Fh) such that
F,(a, t, s) = L
[0051] if and only if s is known. Moreover, the ability to accurately control the time taken for a computer to complete the algorithm though the input parameters require Fh be a function that is inherently sequential so that the task cannot be shared between machines.
[0052] Repeated Squaring as an Inherently Sequential Algorithm
[0053] The core problem is to compute a2' mod n for
specified values of a, t and n. In this paper we consider the problem when n is the product of two large primes, and t is chosen to set the desired level of difficulty of the puzzle. a is chosen to be a random and can be player specific. The most efficient way of solving the puzzle is by performing t successive squarings modulo n, beginning with the value a. That is, perform the following algorithm:
Algorithm 1
For i from O to t - 1 compute W(O) = a
W(i + 1) = W(i)2 mod n
[0054] to yield W(t). There is no known way to perform this computation in a more efficient way without knowing the factorization of n.
Regarding claim 19, Wright discloses wherein the candidate solution is computed using:
sol =a2tmod n wherein a, t, and n are puzzle parameters, wherein 1 < a < n and t > 0.
[0061] 3. Alice selects puzzle computational time, T, and computes
t= TS
[0062] where S is the squaring rate (measure of computational speed) for Bob.
[0063] 4. Alice picks random base, a, and computes L: =F,(a, t, <p(n)) efficiently by using the following algorithm
e = 2' modq,(n) a.
l=aemodn b.
[0064] where <p(n) is the trap-door function.
[0065] 5. Alice sends the time-lock puzzle (a, t, n) to Bob and asks him to find L=Fh(a, t), where
L = a2t modn
Regarding claim 20, Wright discloses, wherein the puzzle parameter n is defined by: modulus n =pq wherein p and q are large prime numbers.
[0057] 1. Alice generates a composite modulus
n =pq
[0058] Where p, q are prime. She keeps ret.
Regarding claim 21. Wright discloses, wherein the target solution is computed using sol =a2tmodQ(n) mod n wherein cQ(n) = (p - 1) (q - 1), wherein the set of secret puzzle parameters comprises p and q.
[0057] 1. Alice generates a composite modulus
n =pq
[0058] Where p, q are prime. She keeps ret.
[0059] 2. Alice computes a second modulus
Q(n) = (p - l) (q - 1)
[0060] which is kept secret.
[0061] 3. Alice selects puzzle computational time, T, and computes
t= TS
[0062] where S is the squaring rate (measure of computational speed) for Bob.
[0063] 4. Alice picks random base, a, and computes L:=Fe(a, t, <Q(n)) efficiently by using the following algorithm
e = 2' mod Q(n) a.
L=ae mod n b.
[0064] where <p(n) is the trap-door function.
[0065] 5. Alice sends the time-lock puzzle (a, t, n) to Bob and asks him to find L=Fh(a, t), where
L = a2t mod n
[0066] It can be shown by using Fermat's test that L=L. The fastest known way of computing L without knowing (p, q) and <Q(n) is to use Algorithm 1. Step 4a, however, significantly increases efficiency of computing the puzzle
solution. The time-complexity of Fe (a, t, <Q(n)) is Q (log (t)) whilst F(a. t) has complexity Q(t).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
See submitted 892 for more relevant references.
WRIGHT (US2020/0279256) 0028] In another additional or alternative wording, the invention may comprise: arranging a locking script in a blockchain transaction such that it takes an input (i.e. value) and uses that input in a calculation. The calculation may perform a mathematical operation on the input. The calculation may produce a time-related result which may then be used as the input for a time lock mechanism (e.g. comprising CLTV, CSV and/or nLockTime). This may ensure that the output is only spendable at a given time in accordance with at least one condition that has been written into the locking/redeem script.
[0088] In our example scenario, we assume that: [0089] There are a group of n participants in a m-of-n Dealerless Distribution scheme. Dealerless distribution schemes are known in the art. [0090] A UTXO is created paying to the group's public key and a transaction ‘puzzle’ (note that the puzzle is designed to be variable) [0091] Threshold (m members) subgroups collaborate to transfer control of the UTXO by off-block mechanisms. This is achieved by enabling different subgroups to have exclusive solutions to the puzzle under different conditions e.g. at different time periods or block numbers. Therefore, the goal is to allow different parties to be able to spend the UTXO and unlock its funds when respective criteria are met.
[0092] Suppose that a dealerless scheme has been used to establish an unknown private key and an associated known public key. A Bitcoin transaction TX.sub.0 is created which includes an output (UTXO). The portion of cryptocurrency associated with this UTXO is locked with a locking script as follows], and [¶¶ 4, 24],
[0095] In the redeem script, T.sub.supplied represents a specific time or period, or a specific block number or range of block numbers. It is the time at which the user (spender of the UTXO) wishes to unlock and spend the output (UTXO). T can be locked within the script by a combination of the time lock mechanisms CLTV and CSV—i.e. it is the parameter value passed into the CLTV/CSV locking technique that is described in more detail below in the section entitled “Step 2: Using T.sub.supplied In A Time Lock Mechanism”.
[0096] A is a secret number. Subgroup-A are the only set of participants who can derive A (collaboratively) and therefore can spend the UTXO (if they can provide the other unknowns).
[0101] The secret value A and the target value T are known by the subgroup creating the transaction (i.e. subgroup-A). Therefore, subgroup-A can calculate the required value for X from:
X=700000+H(A)
[0102] Thus, the values for A and X are now both available to an authorised spender (subgroup-A) of the UTXO and can be passed into the redeem script via the unlocking script of a further transaction TX.sub.1 along with the relevant signature, as explained above.
[0103] The purpose of the redeem script and its supplied inputs is that only those who know the secret value of A (i.e. subgroup-A) can unlock the transaction and only at the block number 700,000. For this to work, part of the locking script will need to validate the value of A by comparing its hash with a stored hash value that is written into the locking script.
Examiner Note: the hash function is the set of puzzle parameters.
NPL: Time-Lock puzzles and timed-release crypto (filed in IDS)
2.1 Creating a time-lock puzzle
We now show a method for creating time-lock puzzles based on repeated squaring.
Here is our approach. Suppose Alice has a message M that she wants to encrypt with a time-lock puzzle for a period of T' seconds.
e She generates a composite modulus
n= pq (1) as the product of two large randomly chosen secret primes p and q. She also computes o(n) = (p—1)(q—1). (2)
She computes t=TS, (3) where S is the number of squarings modulo n per second that can be performed by the solver.
e She generates a random key K for a conventional cryptosystem, such as RC5. This key is long enough (say 160 bits or more) that searching for it is infeasible, even with the advances in computing power expected during the lifetime of the puzzle.
e She encrypts M with key A and encryption algorithm RC5, to obtain the ciphertext
Cu = RC5(K,M) . (4)
e She picks a random a modulo n (with 1 < a Ce =K+a™ (mod n) . (5) To do this efficiently, she first computes e=2 (mod 6(n)) (6) and then computes b=a° (mod n). (7)
e She produces as output the time-lock puzzle (n,a,t,Ck,Cm), and erases any other variables (such as p, q) created during this computation.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHAHRIAR ZARRINEH whose telephone number is (571)272-1207. The examiner can normally be reached Monday-Friday, 8:30am-5:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge Ortiz-Criado can be reached at 571-272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHAHRIAR ZARRINEH/Primary Examiner, Art Unit 2496
Prosecution Insights