Sequential public key generation with secret private keys?

So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties?

Is there a way to construct a public / private key system in such a way that I can somehow compute some "seed" like 0x22EDEF67FFEED that can be used to derive an infinite number of public keys, while NOT being able to generate the corresponding private key?

To be able to generate the private keys you need to know a secret that was computed together with the above "seed".

Example usage:

• Alice publish a public key seed with the above rules with the value 0x22EED...
• Alice then makes the promise that she will make the private key for the Nth derived public key public every Nth day.
• Bob can now encrypt some secret with the 100th derived public key and publish it, knowing that the data will be publicly available in exactly 100 days.
• After 100 days Alice publishes the 100th private key and Bob's secret can be decrypted by anyone.

I have no idea if this would be useful in the real world, but it peaked my interest anyway.

• Sounds like IBE (Identity-Based Encryption); that's not typically how IBE is used, but it'd do what you're asking for... – poncho May 17 '17 at 21:19

Yes, this is indeed possible.

A scheme with such properties is e. g. used in Bitcoin's HD (hierarchical deterministic) wallets. The scheme was introduced in BIP32 (Bitcoin Improvement Protocol) and is explained in detail here: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki

Regarding your example scenario: That is also possible with the system Bitcoin uses. However the key derivation path and the order in which the private keys are released is important in order to not leak future private keys in advance.