CN109547212B

CN109547212B - Threshold signature method based on SM2 signature algorithm

Info

Publication number: CN109547212B
Application number: CN201811473852.7A
Authority: CN
Inventors: 范佳; 白健; 安红章; 王震
Original assignee: CETC 30 Research Institute
Current assignee: CETC 30 Research Institute
Priority date: 2018-12-04
Filing date: 2018-12-04
Publication date: 2021-06-18
Anticipated expiration: 2038-12-04
Also published as: CN109547212A

Abstract

The invention discloses a threshold signature method based on SM2 signature algorithm, which comprises a system establishing stage, a signature stage and a signature verification stage, wherein: in the system establishment phase, a plurality of participating users jointly generate a DSA key pair (x, y ═ g)^x) Where y is a public value and x is shared among users; in the stage of generating the signature, a signature algorithm of DSA is adopted, a random number k in the DSA signature is jointly generated by n users, then an encrypted value of the DSA signature is jointly calculated through the property of homomorphic encryption, and finally the value is decrypted to generate the signature of the message digest. The invention provides a novel threshold signature method based on sm2 algorithm, wherein the total membership n in the method only needs to be more than or equal to t +1, and the intermediate result of each step output by a user can be verified. Therefore, the threshold signature method provided by the invention is more flexible and wider in application range.

Description

Threshold signature method based on SM2 signature algorithm

Technical Field

The invention relates to a threshold signature method based on an SM2 signature algorithm.

Background

The national crypto-authority issued SM2 elliptic curve public key cryptography on 12 months and 17 days 2010. The SM2 algorithm aims to guarantee the safety of various information systems and has great significance for the construction of commercial cipher products and information safety systems in China. The SM2 elliptic curve public key cryptographic algorithm comprises a digital signature algorithm, a key exchange protocol and a public key encryption algorithm.

In a common signature algorithm, the private key is held by only 1 user. If the user private key is stolen by an attacker, the attacker can forge the signature. To avoid this risk, desmdt et al propose the idea of a threshold signature. In threshold signatures, where the private key is shared by a community of n users, any t or more members collaborate to generate a valid signature on behalf of the community, and less than t members collaborate to generate a valid signature on behalf of the community.

In 2014, Shang Ming et al proposed a threshold signature algorithm based on sm2 algorithm. However, this algorithm has the following limitations: (1) the total number of group members n must be at least 2t +1 or more. Therefore, the method is not suitable for block chain signature scenes such as (2, 3), (2, 2) and the like. (2) The validity of the signature given by each user in the group cannot be verified, and only the final result can be authenticated. If the signature result is incorrect, a non-honest user cannot be determined.

Disclosure of Invention

In order to overcome the above disadvantages of the prior art, the present invention provides a threshold signature method based on SM2 signature algorithm.

The technical scheme adopted by the invention for solving the technical problems is as follows: a threshold signature method based on SM2 signature algorithm comprises a system establishing stage, a signature stage and a signature verification stage, wherein: in the system establishment phase, a plurality of participating users jointly generate a DSA key pair (x, y ═ g)^x) Where y is a public value and x is shared among users; in the stage of generating the signature, a signature algorithm of DSA is adopted, a random number k in the DSA signature is jointly generated by n users, then an encrypted value of the DSA signature is jointly calculated through the property of homomorphic encryption, and finally the value is decrypted to generate the signature of the message digest.

Compared with the prior art, the invention has the following positive effects:

the invention provides a novel threshold signature method based on sm2 algorithm, wherein the total membership n in the method only needs to be more than or equal to t +1, and the intermediate result of each step output by a user can be verified.

Therefore, the threshold signature method provided by the invention is more flexible and wider in application range.

The method of the invention can be applied in a block chain system to support various applications, such as:

(1) the user stores the digital assets in the synthetic address, and both parties respectively master a private key and cannot independently control the assets. Both parties need to sign for a transaction when trading assets.

(2) For example, in a transaction, three parties are respectively from a buyer, a seller and an arbitrator, and each transaction requires a signature of the buyer, the seller and the arbitrator to complete the transaction.

Detailed Description

The threshold signature based on the SM2 signature algorithm proposed by the method comprises three stages: a system setup phase, a signature phase, and a verification signature phase.

In this method, the following three documents are cited as techniques for constructing our scheme.

A key generation method of a threshold homomorphic encryption scheme in cited documents of 'C.Hazay, G.L.Mikkelsen, T.Rabin, T.Toft.and A.A.Nicolosi: Efficient RSA key generation and threshold Pattern in the two-party setting' generates a user private key and a scheme public key of the threshold homomorphic encryption scheme, and the threshold encryption and decryption algorithms in the cited documents are cited as encryption algorithms E and D in the scheme; the notation in the cited literature in the method is prepared_ERepresenting homomorphic multiplication.

The commitment algorithm and commitment verification algorithm described in the documents "r.gennaro.multi-trailer Commitments and heat Applications to pro of sof Knowledge current Man-in-the-Middle attacks.proc.ofcrypto' 04, Springer LNCS 3152, pp.220-236" are cited as the Com algorithm and Ver algorithm in the present solution.

Zero knowledge evidence was generated and validated by the method in the literature "R.Gennaro, S.Goldfeder, Narayanan A.Threshold-Optimal DSA/ECDSA Signatures and an Application to Bitcion Wallet Security [ J ]. 2016".

The method comprises the following specific construction processes:

first, system establishment

In the present process, the main purpose is that multiple participating users jointly generate a DSA key pair (x, y ═ g)^x) Where y is a public value and x is shared among users. A public key N for an additive homomorphic encryption scheme E is first generated, along with a secret key d in shared form between users. Secondly, each user selects a respective private key x_iGenerating a public key y_iAnd calculating a signature public key y; then for x_iEncrypted with E, the value α ═ E (x) can be obtained according to the nature of the additive homomorphism. Note that α is an implicit (t, n) secret sharing of x, since the decryption key d for E is shared among users, only ≧ t users can recover key d.

Firstly, each user generates a user private key and a scheme public key of a threshold homomorphic encryption scheme by adopting a key generation method of the threshold homomorphic encryption scheme.

And (3) generating a scheme public key:

n users jointly generate a public key N of RSA; the composition form is

Each user generates a pair of Paillier keys N independently_i＝p_i.q_iThen, p can be obtained by applying the property of Paillier homomorphic encryption between every two users through common calculation_iq_jThe value of (c).

1) The users each generate an RSA combination pair:

generating an ElGamal public key by the n users; in the group with original g and Q, each party P_iSelecting a random number x'_i∈Z_QBroadcasting, broadcasting

Then the public key of ElGamal

Each user P_iGenerating a Paillier key N_i＝p_i.q_iAnd broadcast. p is a radical of_iAnd q is_iIs a private key.

2) Computing a scheme public key N:

the main idea is to do for any two users P_iAnd P_jParticipating in protocol acquisition

It can be directly calculated when i ═ j. Thereby obtaining

The method comprises the following specific steps:

for 1. ltoreq. i, j. ltoreq. n, P_jBroadcast uniform random values

ElGamal encrypted value of (1).

For 1. ltoreq. i, j. ltoreq. n, P_iSending p_iOf Paillier's encryption value

To P_j

For 1. ltoreq. i, j. ltoreq. n, P_jWhen the secret key is N_iThe Paillier encryption is calculated as follows:

wherein r is_ijIs a random number. Will be provided with

Is sent to P_i。

For 1. ltoreq. i, j. ltoreq. n, P_iDecryption

The plaintext modulo Q is denoted as

For 1. ltoreq. i, j. ltoreq. n, each user confirms that everyone is actually dedicated to producing p_i·q_jThe fraction of (c).

Based on q_jEncryption of, user P_iCompute and broadcast p_i·q_jThe new encryption of (2); all parties then calculate the ElGamal encryption using homomorphism

The plaintext obtained after decryption by all users is 0.

For 1. ltoreq. i, j. ltoreq. n, all users use homomorphism calculation

Encryption of (2). And P is_iBroadcasting s_i。

For 1. ltoreq. i, j. ltoreq. n, the final user calculation

And (3) generating a user private key:

when the private key of the user is generated, the addition sharing d of d is firstly calculated_iCalculated by user together

And

in this process d is obtained_i. Then, the values of d are calculated together, and a Shamir share of (t, n) is generated for d and is given to the related n users.

The second step is that:

1) each user randomly selects x_iCalculating y_i＝x_i*G,α_i＝E(x_i) Calculate [ C ]_i,D_i]＝Com(y_i)；

2) Per user broadcast C_i。

The third step:

1) calculating zero knowledge evidence pi for each user_(0,i)

Certifying that

So that eta G ═ y_i，D(α_i)＝η；

2) Broadcast per user D_i，α_i，Π_(0,i)。

The fourth step:

1) each user verifying other user commitments y_i＝Ver(C_i,D_i)

2) Each user verifying zero knowledge proof of other users

3) E (α) is calculated per user, where

4) The algorithm public key is y

Second, generate signature

The main approach is to apply the signature algorithm of DSA. The random number k in the DSA signature is jointly generated by n users; namely, each participating user selects a random number and then calculates to obtain k, and the encrypted value of the DSA signature is obtained through the common calculation of the property of homomorphic encryption. Decrypting the value generates a signature of the message digest.

The first step is as follows:

each user P_i

1) Selecting rho_i∈_RZ_q

2) Calculating u_i＝E(ρ_i)，v_i＝ρ_i×_Eα＝E(ρ_ix)

3) Calculating [ C ]_1,i,D_1,i]＝Com([u_i,v_i])

4) Calculating zero knowledge evidence Π_(1,i)，

Certifying that

So that D (u)_i)＝η，D(v_i)＝ηD(E(x))

5) Broadcast C_1,i

Second step, each user P_iBroadcast D_1,iZero knowledge evidence pi (1, i)

The third step:

each user P_i

1) Open other user commitments by calculating [ u_j,v_j]＝Ver(C_1,j,D_1,j)

2) Verifying zero knowledge evidence II of other users_(1,j)

3) If the verification is passed, u-E (rho) and v-E (rho x) are calculated, wherein

The fourth step:

each user P_i

1) Selection of k_i∈_R Z_qandc_i∈_R[-q⁶,q⁶]

2) Calculating r_i＝k_i*G，

3) Calculating w_i＝(k_i×_E u)+_EE(c_iq)＝E(k_iρ+c_iq)

4) Calculating [ C ]_2,i,D_2,i]＝Com(r_i,w_i)

5) Calculating zero knowledge evidence Π (2, i), (ensure u_iAnd v_iIs correctly set up)

Certifying that

So that eta G r_i，D(w_i)＝ηD(u)mod q

6) Broadcast C_2,i(ensure each k_iIndependence of (2)

Fifth step, each user P_iBroadcast D_2,iZero knowledge evidence pi (2, i)

And a sixth step:

each user P_i

1) Open other user commitments by calculating [ r_j,w_j]＝Ver(C_2,j,D_2,j)

2) Verifying zero knowledge evidence II of other users_(2,j)

3) If the verification is passed, w ═ E (k ρ + cq) is calculated, where

4) Computing

r＝[R]_x+e mod n,

The seventh step:

each user P_i

1) The threshold decryption v yields d (v) · η ∈ [ -q7, q7]And η mod q and ψ η^-1mod q

2) Calculating sigma psi × E [ w + E (r × E u)]＝ψ×E[E(kρ+cq)+_E E(rρ)]

＝(ρ^-1x^-1)×_EE(kρ+cq+rρ)＝E(x^-1(k+r))

3) Threshold decryption σ, calculating s ═ D (v) -r modq

And eighthly, obtaining a signature (r, s).

Third, verify the signature

The verify signature step is consistent with the verify SM2 signature step.

Claims

1. A threshold signature method based on SM2 signature algorithm is characterized in that: the method comprises a system establishing stage, a signature stage and a signature verification stage, wherein: in the system establishment phase, the participating n users jointly generate a DSA key pair (x, y ═ g)^x) Where y is a public value and x is shared among users; in the stage of generating the signature, a signature algorithm of DSA is adopted, a random number k in the DSA signature is jointly generated by n users, then an encrypted value of the DSA signature is jointly calculated through the property of homomorphic encryption, and finally the value is decrypted to generate the signature of the message digest.

2. The threshold signature method based on the SM2 signature algorithm of claim 1, wherein: the method for generating the DSA key pair comprises the following steps: firstly, generating a public key N for an additive homomorphic encryption scheme E and a secret key d existing in a shared form among users; secondly, each user selects a respective private key x_iGenerating a public key y_iAnd calculating a signature public key y; then for x_iE is used for encryption, and a value alpha (E) (x) is obtained through calculation according to the property of addition homomorphism, wherein alpha is implicit (t, n) secret sharing of x, a decryption key d of E is shared among users, and the key d can be recovered only by more than or equal to t users.

3. The threshold signature method based on the SM2 signature algorithm of claim 2, wherein: the specific process of establishing the system comprises the following steps:

firstly, each user generates a user private key and a scheme public key of a threshold homomorphic encryption scheme by adopting a key generation method of the threshold homomorphic encryption scheme;

second, each user randomly selects x_iCalculating y_i＝x_i*G，α_i＝E(x_i) Calculate [ C ]_i,D_i]＝Com(y_i) (ii) a Per user broadcast C_i；

Thirdly, calculating zero knowledge evidence pi for each user_(0,i)Prove that

So that eta G ═ y_i，D(α_i) η; broadcast per user D_i，α_i，Π_(0,i)；

Fourth, each user verifies other user commitments y_i＝Ver(C_i,D_i) And zero knowledge evidence of other users, calculating E (alpha), wherein

The algorithm public key is y.

4. The threshold signature method based on the SM2 signature algorithm of claim 3, wherein: the method for generating the scheme public key comprises the following steps:

1) the users each generate an RSA combination pair:

generating an ElGamal public key by the n users; in generating the group of original g and order Q, each party P_iSelecting a random number x'_i∈Z_QBroadcasting, broadcasting

Then the public key of ElGamal

Each user P_iGenerating a Paillier key N_i＝p_i.q_iAnd broadcast, p_iAnd q is_iIs a private key;

2) computing a scheme public key N:

for 1. ltoreq. i, j. ltoreq. n, P_jBroadcast uniform random values

The ElGamal encrypted value of (1);

for 1. ltoreq. i, j. ltoreq. n, P_iSending p_iOf Paillier's encryption value

To P_j；

wherein r is_ijIs a random number, will

Is sent to P_i；

For 1. ltoreq. i, j. ltoreq. n, P_iDecryption

The plaintext modulo Q is denoted as

For 1. ltoreq. i, j. ltoreq. n, each user confirms that everyone is actually dedicated to producing p_i·q_jBased on the share of q_jEncryption of, user P_iCompute and broadcast p_i·q_jThe new encryption of (2); all parties then calculate the ElGamal encryption using homomorphism

The plaintext obtained after all users decrypt is 0;

for 1. ltoreq. i, j. ltoreq. n, all users use homomorphism calculation

Is encrypted, and P_iBroadcasting s_i；

For 1. ltoreq. i, j. ltoreq. n, the final user calculation

5. The threshold signature method based on the SM2 signature algorithm of claim 3, wherein: the method for generating the user private key comprises the following steps: compute d first for the additive share d_iObtained by common calculation of users

And

and in the process d is obtained_i(ii) a Then, the values of d are calculated together, and a Shamir share of (t, n) is generated for d and is given to the related n users.

6. The threshold signature method based on the SM2 signature algorithm of claim 1, wherein: the specific process of generating the signature includes:

first step, per user P_iSelecting rho_i∈_RZ_qCalculating u_i＝E(ρ_i)，v_i＝ρ_i×_Eα＝E(ρ_ix); calculating [ C ]_1,i,D_1,i]＝Com([u_i,v_i]) (ii) a Calculating zero knowledge evidence Π_(1,i)Prove that

So that D (u)_i)＝η，D(v_i) Eta D (e (x)), and then broadcast C_1,i；

Second step, each user P_iBroadcast D_1,iZero knowledge evidence Π (1, i);

third step, each user P_iOpen other user commitments by calculating [ u_j,v_j]＝Ver(C_1,j,D_1,j) Verifying zero-knowledge evidence II of other users_(1,j)And calculating u ═ E (ρ) and v ═ E (ρ x) after the verification is passed, wherein

Fourth step, each user P_iSelection of k_i∈_R Z_qandc_i∈_R[-q⁶,q⁶]Calculating r_i＝k_iG; calculating w_i＝(k_i×_Eu)+_EE(c_iq)＝E(k_iρ+c_iq); calculating [ C ]_2,i,D_2,i]＝Com(r_i,w_i) (ii) a Calculating zero knowledge evidence II (2, i) to prove

So that eta G r_i，D(w_i) η d (u) mod q, then broadcast C_2,i；

Fifth step, each user P_iBroadcast D_2,iZero knowledge evidence Π (2, i);

sixth step, each user P_iOpen other user commitments by calculating [ r_j,w_j]＝Ver(C_2,j,D_2,j) Verifying zero-knowledge evidence II of other users_(2,j)And calculating w ═ E (k ρ + cq) after the verification passes, wherein

Computing

Seventh step, each user P_iThe threshold decryption v yields d (v) · η ∈ [ -q7, q7]And η mod q and ψ η^-1mod q; calculating sigma ═ psi × E [ w + E (r × Eu)]＝ψ×E[E(kρ+cq)+_EE(rρ)]＝(ρ^-1x^-1)×_EE(kρ+cq+rρ)＝E(x^-1(k + r)); threshold decryption σ, calculating s ═ d (v) -r modq;

and eighthly, obtaining a signature (r, s).