CN116915414A

CN116915414A - Method for realizing threshold signature, computer equipment and storage medium

Info

Publication number: CN116915414A
Application number: CN202311120249.1A
Authority: CN
Inventors: 唐国锋; 林立; 王尧; 闫莺
Original assignee: Ant Blockchain Technology Shanghai Co Ltd
Current assignee: Ant Blockchain Technology Shanghai Co Ltd
Priority date: 2023-08-31
Filing date: 2023-08-31
Publication date: 2023-10-20

Abstract

A method of implementing a distributed threshold signature, comprising: a distributed key generation stage: each of the n participants generates a respective private key share through a distributed key generation protocol, generates a homomorphic encryption public-private key pair respectively, and sends the homomorphic encryption public key to other participants; offline stage: at least t+1 participators generate respective first random value and second random value, each participator also adopts homomorphic encryption algorithm of the homomorphic encryption public-private key pair, obtains coordinate components through offline stage protocol and second random value, and obtains private key share component masking value based on respective private key shares; on-line stage: the at least t+1 participants sign the same message by adopting the first random value, the private key share component masking value and the coordinate component of the at least t+1 participants in the online stage to obtain at least t+1 signature shares.

Description

Method for realizing threshold signature, computer equipment and storage medium

Technical Field

The embodiment of the specification belongs to the technical field of cryptography, and particularly relates to a method for realizing threshold signature, computer equipment and a storage medium.

Background

In cryptography, public key cryptography, known as public key cryptography for short, is cryptography using a pair of public and private keys (public-private keys are denoted pk-sk, where pk represents public key, sk represents secret key), corresponding to cryptography using only one private key. Public key cryptography includes encryption algorithms and digital signature algorithms. Public-private key cryptography pairs are the basis for modern cryptographic security, and many applications are based on pk-sk, such as https (Hypertext Transfer Protocol Secure, secure hypertext transfer protocol) based application layer encrypted transport protocols, blockchain, etc.

The private key generally represents the identity of the party that owns the private key, which can only be held by the owner of the private key and cannot be disclosed, while the corresponding public key can be disclosed. Signing with the private key may represent approval by the private key owner of certain information of the digital world, and the signed information may also represent certain behavior of the private key owner in the message of the agreement. In general, an owner has a private key alone, and then the owner can sign a certain information by using its private key and send the signed information to other parties. After receiving this signature, the receiver can verify the signature using the corresponding public key. The recipient can confirm that the owner signed the information and that the signed information has not been tampered with.

Sometimes an account requires a flexible access control policy, especially where one account is commonly controlled by multiple parties on a blockchain. Under some requirements, one account needs to be commonly controlled by n participants. Thus, controlling the account, such as a transfer, requires approval by all n parties to control the account's transfer. In other demands, the account may be controlled without all agreement by n participants, but with t+1 of them (t < n, t is also referred to as threshold), which may be achieved by a threshold signature. In the threshold cryptography, private key information is shared to a plurality of independent participants, and each private key calculation requires agreement of the plurality of participants, so that the algorithm security is improved; and when a small number of participants fail and are not available, the usability of the private key is not affected. A secure (t, n) threshold cryptographic algorithm should be satisfied that (1) any more than t participants can calculate the final signature, exchanged keys or plaintext, while t or less than t participants cannot get any information about the above result; (2) No information about the private key and the private key shares of the participants is revealed during the execution of the algorithm.

Disclosure of Invention

The invention aims to provide a method, computer equipment and storage medium for realizing threshold signature, which comprises the following steps:

a distributed threshold signature method, comprising:

a distributed key generation stage: each of the n participants generates a respective private key share through a distributed key generation protocol, generates a homomorphic encryption public-private key pair respectively, and sends the homomorphic encryption public key to other participants;

offline stage: at least t+1 participators generate respective first random value and second random value, each participator also adopts homomorphic encryption algorithm of the homomorphic encryption public-private key pair, obtains coordinate components through offline stage protocol and second random value, and obtains private key share component covering value based on respective private key shares;

on-line stage: the at least t+1 participators sign the same message by adopting the first random value, the private key share component masking value and the coordinate component of the participators in the online stage to obtain at least t+1 signature shares.

A computer device, comprising:

a processor;

and a memory in which a program is stored, wherein when the processor executes the program, the following operations are performed:

Generating a private key share through a distributed key generation protocol, generating a homomorphic encryption public-private key pair, and transmitting the homomorphic encryption public key;

generating respective first random values and second random values, further adopting a homomorphic encryption algorithm of the homomorphic encryption public-private key pair, obtaining coordinate components through an offline stage protocol and the second random values, and obtaining private key share component masking values based on respective private key shares;

and signing the same message by adopting the first random value, the private key share component masking value and the coordinate component of the first message to obtain at least t+1 signature shares.

A storage medium storing a program, wherein the program when executed performs the operations of:

The scheme provided by the application can support any threshold value.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present disclosure, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of distributed threshold key generation in one embodiment;

figure 2 is a schematic diagram of a distributed threshold signature in one embodiment.

Detailed Description

In order to make the technical solutions in the present specification better understood by those skilled in the art, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only some embodiments of the present specification, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are intended to be within the scope of the present disclosure.

DKG (Distributed Key Generation) protocol, a distributed key generation protocol, refers to a distributed protocol that cooperatively generates a set of keys among a plurality of parties participating in the protocol. The VSS (Verifiable Secret Sharing) protocol, namely the verifiable secret sharing protocol, is an important theoretical basis of the DKG protocol.

VSS refers to the fact that, when sharing one piece of secret data among a plurality of parties, the secret data can be split into a plurality of pieces without revealing the secret data itself, and the pieces can be stored in the plurality of parties. Then, when the secret data needs to be restored, all the fragments need to be collected to successfully restore the complete secret data.

The VSS protocol was first proposed by Shamir in 1979 to be a polynomial-based secret sharing protocol. The VSS protocol was developed by Shamir's Secret Sharing (SSS), and Shamir Secret Sharing was first introduced.

Shamir secret sharing, which includes two phases of secret sharing (or secret distribution) and secret reconstruction, first requires the construction of a polynomial by a Dealer:

f(x)＝a ₀ +a ₁ x+a ₂ x ² +…+a _n x ⁿ polynomial (, x)

Wherein a is ₀ Is secret data to be shared.

The n-degree polynomial is composed of a set of coefficients (a ₀ ，a ₁ ，a ₂ ，…，a _n ) The unique determination, the set of coefficients includes n+1 values. Thus, if the curve corresponding to the n th order polynomial is known to pass through a planeN+1 different points on the coordinate (x) ₁ ,y ₁ ),(x ₂ ,y ₂ ),…,(x _n ,y _n ),(x _n+1 ,y _n+1 ) Then a system of (n+1) th-order equations of n+1 equations can be obtained, from which the n+1 coefficients a can be determined ₀ ，a ₁ ，a ₂ ，…，a _n Further determining the polynomial (x), finally obtaining the secret data a ₀ Is a value of (2). Coordinates (x) ₁ ,y ₁ ),(x ₂ ,y ₂ ),…,(x _n ,y _n ),(x _n+1 ,y _n+1 ) I.e. n +1 secret slices.

With respect to solving for curves passing through points from existing points, this solving process is called polynomial interpolation. There are various ways to implement polynomial interpolation, and a common lagrangian (Lagrange) interpolation method is described below. Given an n-degree polynomial, the polynomial is known to correspond to a curve passing through n+1 points (x ₁ ,y ₁ ),(x ₂ ,y ₂ ),…,(x _n ,y _n ),(x _n+1 ,y _n+1 ) The polynomial of the nth order curve can be obtained by lagrangian interpolation as follows:

the polynomial (x) is in fact equivalent to the polynomial (x). Let x=0 in polynomial (x), then f (0) =a ₀ I.e. the secret data a can be obtained ₀ Is a value of (2). Therefore, the secret data a can also be obtained by setting x=0 in the polynomial (x:) ₀ The value of (i.e. f (0) =a) ₀ 。

For n+1 points (x ₁ ,y ₁ ),…,(x _n ,y _n ),(x _n+1 ,y _n+1 ) The above polynomial (x) can also be expressed as:

wherein, the liquid crystal display device comprises a liquid crystal display device,likewise, there is +.>

In summary, n+1 points on the polynomial may be taken and shared among n+1 participants, e.g., each participant obtains coordinates of one point. Collecting coordinates of any less than n+1 points does not infer the original secret data a ₀ The secret data a can be restored by reconstructing the polynomial coefficients only after all n+1 points have been obtained ₀ Is a value of (2). In addition, even if the coordinates of any less than n+1 points, for example, the coordinates of n points are collected, since there are innumerable n-th-order curves passing through the n points, the secret data a cannot be leaked from the probability ₀ Is a value of (2). The degree of the polynomial is also referred to herein as the degree of the degree n.

Based on the method, threshold Shamir secret sharing can be achieved. For example, t-of-n secret sharing is to share secrets among n participants and specifies that the minimum secret shards required for recovery have a threshold value greater than t, i.e., greater than or equal to t+1. For example, in a transaction in which 4 parties participate, the agreed threshold is 3, i.e., n=4, t=2, and if t+1=3 parties are greater than or equal to t+1=3 parties provide own secret fragments, the secret can be restored, otherwise, the secret cannot be restored. Specifically, a polynomial of t=2 degrees may be constructed:

f(x)＝a ₀ +a ₁ x+a ₂ x ² Polynomial (/ x)

Can obtain 4 different points on the curve passing plane corresponding to the 2-degree polynomial, namely obtain coordinates (x) ₁ ,y ₁ ),(x ₂ ,y ₂ ),(x ₃ ,y ₃ ),(x ₄ ,y ₄ ) And in secret divisionThe sharing phase distributes the coordinates of the 4 points to one participant, respectively. The 4 participants were set to Party ₁ ,Party ₂ ,Party ₃ ,Party ₄ Thus, assume Party ₁ Having slices (x) ₁ ,y ₁ )，Party ₂ Having slices (x) ₂ ,y ₂ )，Party ₃ Having slices (x) ₃ ,y ₃ )，Party ₄ Having slices (x) ₄ ,y ₄ ). Since the polynomial (x) can be determined from any 3 points on the corresponding curve, party is therefore _i When any three parties provide own secret shards in (i epsilon {1,2,3,4 }), a polynomial (x) can be restored in the secret reconstruction stage, so that a secret value a can be obtained ₀ . When any less than three parties provide own secret shards, the polynomial (x) cannot be restored, and the secret value a cannot be obtained ₀ . The above t is also referred to as a threshold.

The above Shamir secret sharing and threshold Shamir secret sharing require a role of generating polynomials and distributing secret patches, which may be referred to as Dealer. This Dealer is an entity that knows the secret and needs to be a trusted third party for each party. There is also a need for an entity, e.g. a Dealer or a party, but also other entities, for aggregating at least t+1 fragments and deriving secrets.

In engineering practice, polynomials are often defined in a finite or prime number domain, rather than a real or natural number domain.

In the classical Shamir secret sharing scheme, the participants are assumed to be honest. In practice there may be dishonest behaviour, or so-called devil behaviour, e.g. deception of a certain party or parties, distribution of erroneous secret fragments to the party or parties, etc.

In secret sharing, verifiable secret sharing (Verifiable Secret Sharing, VSS) is proposed in order to verify a disfigurement, such as a party verifying that a Dealer spoofs itself (verifying whether the Dealer sent a wrong secret piece as described above). Feldman VSS is a practical VSS solution based on the Shamir secret sharing architecture, comprising:

the Dealer has a secret and distributes n fragments of the secret to n participants, where t participants can reconstruct the secret, and a t degree polynomial can be constructed using a threshold Shamir secret sharing scheme similar to that described above:

f(x)＝a ₀ +a ₁ x+a ₂ x ² +…+a _t x ^t polynomial (/ x)

Dealer is Party for each participant _i Optionally selecting a non-0 x _i Calculate s _i ＝f(x _i ) And secret the child s _i Encryption of Party sent to participant _i . Meanwhile, dealer calculationWhere j=0, 1,2,.. t, and disclose A _j I.e. publication { A ₀ ,A ₁ ,A ₂ ,…,A _t }。A _j Also referred to as public verification parameters. Here A _j The method of generating (a) is the same as the method of generating the public key based on the private key on the elliptic curve, and thus, a _j May also be referred to as public key sharding (or public key sharing, public key share).

For the case where the selected polynomial is a corresponding elliptic curve, disclosure A _j Is safe because according to the nature of elliptic curve, it cannot be according to A _j Back-pushing to obtain a _j 。

Public authentication parameter { A ₀ ,A ₁ ,A ₂ ,…,A _t Also known as commitment. The commitment can be used to verify whether a value of the polynomial is correct, since the coefficients of the polynomial are bound. In a discrete logarithm based implementation, g is the generator of the cyclic group over the finite field, g may be the generator of the cyclic group over the Dealer and Party _i Pre-configured. The above-mentioned sub-secrets may also be referred to as secret shares.

The party receives the sub-secret s _i Thereafter, the common verification parameters may be employed to verify s _i Is effective in the following. S can be verified by verifying whether the following equation holds true _i Whether or not to be effective:

polynomial (.) x) of the following formula the right side can be derived as follows:

the right side of the polynomial (x) can also be written as:

it can be seen that for Party _i The Dealer selects a non-0 x for it _i ，x _i For example i, then Party _i I and a common authentication parameter { A }, may be employed ₀ ,A ₁ ,A ₂ ,…,A _t To the right of the polynomial (x) is computed and the generator g and the subsecret s are used _i To calculate the left side of the polynomial (x) and to determine whether the left and right sides of the polynomial (x) are equalWhether or not it is { A ₀ ,A ₁ ,A ₂ ,…,A _t Corresponds to a point on the curve. This verification belongs to the verification of the secret distribution phase. For simplicity, x can be taken generally _i ＝i。

In engineering, the method is generally realized based on discrete logarithm, and modulo operation, such as mod p, where p is a large prime number, and p is also Dealer and Party _i Pre-configured. mod p is also omitted in the following analogy.

In the secret reconstruction phase, for example, at least t+1 participants respectively send their secret fragments to the Dealer, the Dealer can verify each secret fragment using the common verification parameters corresponding to the polynomial. Verification is not passed, and the party sending the secret shard can be proved to be wrongly; the secret shards that pass verification can be used as the basis for reconstructing the secret.

And in the secret reconstruction stage, after collecting secret fragments of at least t+1 participants, reconstructing a polynomial f (x) through a Lagrange interpolation method, thereby obtaining a value of f (0), and obtaining the secret value.

Furthermore, by the common authentication parameter { A } ₀ ,A ₁ ,A ₂ ,…,A _t May also be applied to secret a ₀ Is verified, i.e. can verify (0, a) ₀ ) Whether it is a point on the curve, because the following relationship exists:

that is, for the secret a ₀ Is verified by the validity of the (A) and can be simplified to pass through the public verification parameter A ₀ Realizing the method.

In the above derivation, 0 is defined ⁰ =1, and 0 ^k ＝0，k≠0。

In the above scenario, a Dealer is required, which is centralized, is a secret-aware entity, and as previously described, needs to be a trusted third party, or requires that the participants all trust the Dealer. In a distributed scenario, both distributed secret distribution and distributed secret reconstruction are required, which requires the removal of a centralized Dealer, thus implementing the de-trust. To address this problem, an improved protocol called join-Feldman was proposed by Rabin et al in 1999. The basic idea of this protocol is to execute the Feldman VSS protocol in parallel, where each participant generates a random polynomial locally and then shares the randomly selected secret value among all participants. Since it is a promise of the secret that is shared and not the secret itself, the secret cannot be recovered as long as multi-person collusion cheating exceeding the threshold t does not occur. Such Distributed VSS protocol with trusted third parties removed is also known as DVSS protocol (Distributed VSS).

Specifically, taking 4 participants as an example, assuming that the threshold t=2, the degree of the polynomial is also t=2, and the decentralizing threshold secret sharing, that is, the Joint-Feldman implementation scheme, includes the following steps:

each P _i (Party _i Abbreviated as P _i I e {1,2,3,4 }) sets the secret s to be shared _i0 And randomly select other parameters to generate a t-1 degree polynomial:

participant P ₁ Generating a 2 degree polynomial:

f ₁ (z)＝a ₁₀ +a ₁₁ z+a ₁₂ z ² wherein a is ₁₀ Is P ₁ Set secret s ₁ ；

Participant P ₂ Generating a 2 degree polynomial:

f ₂ (z)＝a ₂₀ +a ₂₁ z+a ₂₂ z ² wherein a is ₂₀ Is P ₂ Set secret s ₂ ；

Participant P ₃ Generating a 2 degree polynomial:

f ₃ (z)＝a ₃₀ +a ₃₁ z+a ₃₂ z ² wherein a is ₃₀ Is P ₃ Set secret s ₃ ；

Participant P ₄ Generating a 2 degree polynomial:

f ₄ (z)＝a ₄₀ +a ₄₁ z+a ₄₂ z ² wherein a is ₄₀ Is P ₄ Set secret s ₄ 。

Next, each party P _i Generating n values on the curve corresponding to the t degree polynomial of the self and distributing, wherein n=4, t=2, n=1, 2,3,4 are still set, and then:

participant P ₁ Generating s ₁₁ ＝f ₁ (1)、s ₁₂ ＝f ₁ (2)、s ₁₃ ＝f ₁ (3)、s ₁₄ ＝f ₁ (4) Self-reserve s ₁₁ And respectively encrypt and send s ₁₂ To P ₂ Encrypted transmission s ₁₃ To P ₃ Encrypted transmission s ₁₄ To P ₄ ；

Participant P ₂ Generating s ₂₁ ＝f ₂ (1)、s ₂₂ ＝f ₂ (2)、s ₂₃ ＝f ₂ (3)、s ₂₄ ＝f ₂ (4) Self-reserve s ₂₂ And respectively encrypt and send s ₂₁ To P ₁ Encrypted transmission s ₂₃ To P ₃ Encrypted transmission s ₂₄ To P ₄ ；

Participant P ₃ Generating s ₃₁ ＝f ₃ (1)、s ₃₂ ＝f ₃ (2)、s ₃₃ ＝f ₃ (3)、s ₃₄ ＝f ₃ (4) Self-reserve s ₃₃ And respectively encrypt and send s ₃₁ To P ₁ Encrypted transmission s ₃₂ To P ₂ Encrypted transmission s ₃₄ To P ₄ ；

Participant P ₄ Generating s ₄₁ ＝f ₄ (1)、s ₄₂ ＝f ₄ (2)、s ₄₃ ＝f ₄ (3)、s ₄₄ ＝f ₄ (4) Self-reserve s ₄₄ And respectively encrypt and send s ₄₁ To P ₁ Encrypted transmission s ₄₂ To P ₂ Encrypted transmission s ₄₃ To P ₃ 。

Also, each participant P _i Generating public verification parameters corresponding to the self t-1 degree polynomialWhere k=0, 1, …, t, and published to each party, specifically:

participant P ₁ Generatingk=0, 1, …, t, including +.>Broadcast { A ₁₀ ,A ₁₁ ,A ₁₂ Go to P ₂ 、P ₃ And P ₄ ；

Participant P ₂ Generatingk=0, 1, …, t, including +.>Broadcast { A ₂₀ ,A ₂₁ ,A ₂₂ Go to P ₁ 、P ₃ And P ₄ ；

Participant P ₃ Generatingk=0, 1, …, t, including +.>Broadcast { A ₃₀ ,A ₃₁ ,A ₃₂ Go to P ₁ 、P ₂ And P ₄ ；

Participant P ₄ Generatingk=0, 1, …, t, including +.>Broadcast { A ₄₀ ,A ₄₁ ,A ₄₂ Go to P ₁ 、P ₂ And P ₃ 。

Thus P ₁ Receiving s ₂₁ After that, { A } ₂₀ ,A ₂₁ ,A ₂₂ Verifying; p (P) ₁ Receiving s ₃₁ After that, { A } ₃₀ ,A ₃₁ ,A ₃₂ Verifying; p (P) ₁ Receiving s ₄₁ After that, { A } ₄₀ ,A ₄₁ ,A ₄₂ Verifying; the verification method is similar to the above, and will not be repeated.

Similarly, P ₂ Receiving s ₁₂ After that, { A } ₁₀ ,A ₁₁ ,A ₁₂ Verifying; p (P) ₂ Receiving s ₃₂ After that, { A } ₃₀ ,A ₃₁ ,A ₃₂ Verifying; p (P) ₂ Receiving s ₄₂ After that, { A } ₄₀ ,A ₄₁ ,A ₄₂ Go intoPerforming row verification;

similarly, P ₃ Receiving s ₁₃ After that, { A } ₁₀ ,A ₁₁ ,A ₁₂ Verifying; p (P) ₃ Receiving s ₂₃ After that, { A } ₂₀ ,A ₂₁ ,A ₂₂ Verifying; p (P) ₃ Receiving s ₄₃ After that, { A } ₄₀ ,A ₄₁ ,A ₄₂ Verifying;

Similarly, P ₄ Receiving s ₁₄ After that, { A } ₁₀ ,A ₁₁ ,A ₁₂ Verifying; p (P) ₄ Receiving s ₂₄ After that, { A } ₂₀ ,A ₂₁ ,A ₂₂ Verifying; p (P) ₄ Receiving s ₃₄ After that, { A } ₃₀ ,A ₃₁ ,A ₃₂ Verifying.

Assuming that the set of authenticated participants obtained after each participant is authenticated is set as Qual, and qual= { P is set ₁ ,P ₂ ,P ₃ ,P ₄ -such that:

P ₁ locally generated secret shares s with different parties ₁₁ 、s ₂₁ 、s ₃₁ 、s ₄₁ And a common authentication parameter { A } ₁₀ ,A ₁₁ ,A ₁₂ }，{A ₂₀ ,A ₂₁ ,A ₂₂ }，{A ₃₀ ,A ₃₁ ,A ₃₂ }，{A ₄₀ ,A ₄₁ ,A ₄₂ }；

P ₂ Locally generated secret shares s with different parties ₁₂ 、s ₂₂ 、s ₃₂ 、s ₄₂ And a common authentication parameter { A } ₁₀ ,A ₁₁ ,A ₁₂ }，{A ₂₀ ,A ₂₁ ,A ₂₂ }，{A ₃₀ ,A ₃₁ ,A ₃₂ }，{A ₄₀ ,A ₄₁ ,A ₄₂ }；

P ₃ Locally generated secret shares s with different parties ₁₃ 、s ₂₃ 、s ₃₃ 、s ₄₃ And a common authentication parameter { A } ₁₀ ,A ₁₁ ,A ₁₂ }，{A ₂₀ ,A ₂₁ ,A ₂₂ }，{A ₃₀ ,A ₃₁ ,A ₃₂ }，{A ₄₀ ,A ₄₁ ,A ₄₂ }；

P ₄ Locally generated secret shares s with different parties ₁₄ 、s ₂₄ 、s ₃₄ 、s ₄₄ And a common authentication parameter { A } ₁₀ ,A ₁₁ ,A ₁₂ }，{A ₂₀ ,A ₂₁ ,A ₂₂ }，{A ₃₀ ,A ₃₁ ,A ₃₂ }，{A ₄₀ ,A ₄₁ ,A ₄₂ }。

Then:

participant P ₁ Can calculate the secret share s ₁ The method comprises the following steps: s is(s) ₁ ＝s ₁₁ +s ₂₁ +s ₃₁ +s ₄₁ ；

Participant P ₂ Can calculate the secret share s ₂ The method comprises the following steps: s is(s) ₂ ＝s ₁₂ +s ₂₂ +s ₃₂ +s ₄₂ ；

Participant P ₃ Can calculate the secret share s ₃ The method comprises the following steps: s is(s) ₃ ＝s ₁₃ +s ₂₃ +s ₃₃ +s ₄₃ ；

Participant P ₄ Can calculate the secret share s ₄ The method comprises the following steps: s is(s) ₄ ＝s ₁₄ +s ₂₄ +s ₃₄ +s ₄₄ ；

Each participant P _i Can calculate the secret share s by itself _i Broadcast to other participants. Each party P _i Collect the alignment { s ] ₁ ,s ₂ ,s ₃ ,s ₄ After at least t+1 secret shares, the secret s can be reconstructed ₀ . Here, for t=2, each party P _i After collecting at least t+1=2+1=3 secret shares, the secret s can also be reconstructed ₀ 。

This is because the sum of the curves of the participants can be summed to give a total curve:

f(z)＝f ₁ (z)+f ₂ (z)+f ₃ (z)+f ₄ (z)

f(z)＝(a ₁₀ +a ₁₁ z+a ₁₂ z ² )+(a ₂₀ +a ₂₁ z+a ₂₂ z ² )+(a ₃₀ +a ₃₁ z+a ₃₂ z ² )

+(a ₄₀ +a ₄₁ z+a ₄₂ z ² )

f(z)＝(a ₁₀ +a ₂₀ +a ₃₀ +a ₄₀ )+(a ₁₁ +a ₂₁ +a ₃₁ +a ₄₁ )z+(a ₁₂ +a ₂₂ +a ₃₂ +a ₄₂ )z ²

polynomial (I)

This is the case:

s ₁ ＝s ₁₁ +s ₂₁ +s ₃₁ +s ₄₁ ＝f ₁ (1)+f ₂ (1)+f ₃ (1)+f ₄ (1)；

s ₂ ＝s ₁₂ +s ₂₂ +s ₃₂ +s ₄₂ ＝f ₁ (2)+f ₂ (2)+f ₃ (2)+f ₄ (2)；

s ₃ ＝s ₁₃ +s ₂₃ +s ₃₃ +s ₄₃ ＝f ₁ (3)+f ₂ (3)+f ₃ (3)+f ₄ (3)；

s ₄ ＝s ₁₄ +s ₂₄ +s ₃₄ +s ₄₄ ＝f ₁ (4)+f ₂ (4)+f ₃ (4)+f ₄ (4)；

for the total curve f (z), there is a relationship:

s ₁ ＝f ₁ (1)+f ₂ (1)+f ₃ (1)+f ₄ (1)＝f(1)；

s ₂ ＝f ₁ (2)+f ₂ (2)+f ₃ (2)+f ₄ (2)＝f(2)；

s ₃ ＝f ₁ (3)+f ₂ (3)+f ₃ (3)+f ₄ (3)＝f(3)；

s ₄ ＝f ₁ (4)+f ₂ (4)+f ₃ (4)+f ₄ (4)＝f(4)；

secret s ₀ ＝a ₁₀ +a ₂₀ +a ₃₀ +a ₄₀ 。

Thus, either oneParticipant P _i Collecting secret shares s ₁ 、s ₂ 、s ₃ 、s ₄ After at least 3 points on the corresponding curve of the polynomial (I) are obtained, namely (x) ₁ ＝1,y ₁ ＝s ₁ ),(x ₂ ＝2,y ₂ ＝s ₂ ),(x ₃ ＝3,y ₃ ＝s ₃ ),(x ₄ ＝4,y ₄ ＝s ₄ ) At least 3 of these 4 coordinates, so that the total curve f (z) can be restored. Further, f (0) =a can be calculated ₁₀ +a ₂₀ +a ₃₀ +a ₄₀ ＝s ₀ Thus, the secret s can be obtained ₀ 。

Also, by verifying the parameter { A } ₁₀ ,A ₁₁ ,A ₁₂ }，{A ₂₀ ,A ₂₁ ,A ₂₂ }，{A ₃₀ ,A ₃₁ ,A ₃₂ }，{A ₄₀ ,A ₄₁ ,A ₄₂ May also be applied to secret s _i Can be verified by verifying the validity of (0, s) _i ) Whether it is a point on the total curve. Specifically, the validity is judged by verifying whether the following equation is established:

this is because the following relationship exists:

the right side of the polynomial (II) equal sign is also commonly referred to as public key share and is denoted as pub _i I=1, 2, …, n for verifying the corresponding private key share.

As previously mentioned, x can be taken generally _i I for eachi=1, 2, …, n. Thus, i can be the number of each participant.

For secret s ₀ Verification of (x), i.e. x _i =0, the above formula can be further deduced as follows:

definition 0 ⁰ =1, and 0 ^k =0, k+.0, so the above equation can be further derived:

It can be seen that based on the polynomial (III), s can be verified ₀ Is the legitimacy of (2).

Moreover, based on the derivation in the above polynomial (III), for verification s ₀ Can be further simplified into:

the right side of the polynomial (IV) is also generally designated as the total public key and is denoted as pub.

The join-Feldman protocol can realize distributed secret sharing, namely, the main content of DKG is completed. The above-described secret sharing implementation is a series of secret sharing implementations starting from Shamir to threshold Shamir, feldman VSS protocol, and then to join-Feldman DVSS protocol. In fact, besides the series of schemes taking Shamir secret sharing as a starting point, there are schemes based on additive secret sharing (Additive Secret Share), SPDZ (an important protocol in multiparty security computation, which was first proposed in 2012), or chinese remainder theorem, etc., and finally DKG may also be implemented, which is omitted here and not repeated.

By implementing the DKG protocol, the generation of keys by a single entity can be overcomeBut with a single point of failure resulting in a problem of overall unavailability and a problem of a single point of trust in the generated key. However, due to the individual parties P _i Broadcast-generated secret shares s _ij I, j e (1, 2, …, n), n being the number of participants, and each participant P _i Can calculate the secret share s by itself _i Broadcast to other participants so that each participant P _i Collect the alignment { s ] ₁ ,s ₂ ,s ₃ ,s ₄ After at least t+1 secret shares, the secret s can be reconstructed ₀ In this way, at least t+1 participants will be led to obtain the final reconstructed secret s ₀ I.e. the secret s will be exposed ₀ The total curve will also become unusable. If a new secret s is to be generated again next time ₀ The process of executing the DKG protocol needs to be repeated.

The DKG protocol can be used for constructing a distributed threshold signature protocol by combining the properties of threshold and secret promise and the like and a threshold signature algorithm matched with the DKG protocol. Blockchains are largely used as distributed systems with signature algorithms. In this way, nodes in the blockchain generate secret shares in a distributed manner through DKG, at least t+1 blockchain nodes adopt the secret shares as private key shares to sign information to be signed and broadcast, any blockchain node which collects at least t+1 signature shares can recover the total signature and recover the total public key in the mode, and the recovered total signature can be verified by the total public key, so that threshold signature is realized. Moreover, this has the advantage that the secret shares held by each block link point need not be broadcasted to other nodes, so that the secret shares of each block link point are not exposed, i.e. the private key is not exposed, and therefore the secret shares generated by one DKG can be reused many times without performing one DKG protocol for each threshold signature.

The underlying ECDSA signature algorithm includes:

the signing party Alice selects an elliptic curve E _q (a, b) and a base point G, and share this information to a verifier Bob, where q is a modulus.

Alice is in finite fieldSelecting a private key X, and generating a public key x=x·g according to the private key;

alice is in finite fieldA random number k is selected and r=k is calculated ^-1 G, calculating r=f (R), and r+.0; wherein f (R) may be the abscissa of R.

Alice calculates the message m to be signed by hash to obtain a digest value h, i.e. h=hash (m), and calculates:

sigma=k (h+x.r) mod q formula (a)

Alice generates a signature sig= (r, σ) and sends a message m, signature sig, public key X to signature verifier Bob.

Bob verifies the following equation with public key X for the received message m and signature sig:

r＝f(σ ^-1 ·h·G+σ ^-1 r.X) formula (b)

If equation b holds, then the signature is indicated as valid, otherwise the signature is invalid. This is because, as can be obtained by the formula (a): k (k) ^-1 ＝σ ^-1 (h+x·r) mod q, and r=k can be further calculated ^-1 G and k ^-1 Substitution r=f (R) can be obtained:

r＝f(R)＝f(k ^-1 ·G)＝f(σ ^-1 (h+x·r)·G)＝f(σ ^-1 ·h·G+σ ^-1 ·x·r·G)＝f(σ ^-1 ·h·G+σ ^-1 ·r·X)

i.e. according to the right side of equation (b), bob can use σ, r in the received signature and the message m and public key X to calculate, verify if the calculation is equal to r in the signature.

The basic ECDSA signature algorithm described above can be extended to a threshold signature algorithm. For example, through the DKG procedure described above, n signers P ₁ ,P ₂ ,…,P _n Each having its own secret share and having a total public key, wherein the threshold value is t, and t<n. At least t+1 signers in the n participators respectively adopt own secret shares as secret shares respectivelyAfter signing and broadcasting the same information to be signed, any verifier collecting at least t+1 signature shares can recover the total signature and verify the total signature by adopting the total public key, thereby realizing the threshold signature. One specific implementation is the publication UC Non-Interactive, proactive, threshold ECDSA with Identifiable Aborts by Fireblock corporation in CCS 20. The article builds a distributed ECDSA signature scheme under a malicious model. The disadvantage of this approach is that a large amount of zero knowledge proof is required to combat malicious adversaries, thus requiring large communication and computation costs. Meanwhile, the threshold value of the scheme is fixed to be t=n-1, and no scheme with any threshold value is given.

The embodiment of the application provides a distributed threshold signature method based on ECDSA. In this embodiment, each signer may generate a threshold private key by means of a threshold Shamir, feldman or a Dealer or non-Dealer protocol such as the join-Feldman protocol, or by other DKG schemes. As a result of implementation of such DKG scheme, party P _i (i e n) has a private key share ω _i Any at least t+1 shares of private key corresponds to a total private key ω. The result of the DKG may also generate a total public key X. This total public key X has a relationship with the total private key ω: ω·g=x.

In addition, after n participants obtain respective private key shares based on the DKG, the same message may be signed with its own private key share to generate a signature share. Any at least t+1 signature shares may be aggregated into a total signature, and the total signature may be verified by a total public key.

The above relationship may be represented by the distributed threshold key generation of fig. 1 and the distributed threshold signature of fig. 2.

The embodiment of the application can comprise two parts, namely a distributed threshold key generation part and a distributed threshold signature part, wherein the two parts are processes of how to mutually transmit data and how to process the data through a protocol form between the parties, so that the specific purpose is realized by cooperation. Wherein the distributed threshold signature comprises an offline stage and an online stage.

The following are the followingFirst, a procedure of the distributed threshold key generation protocol will be described. In this process, it is assumed that there are n participants, P ₁ ，P ₂ ，…，P _n . Each party P via a distributed threshold key generation protocol _i (i= {1,2, …, n }) may generate respective private key shares.

Specifically, each party P _i A t degree polynomial f may be generated _i (z)＝a _i0 +a _i1 z+a _i2 z ² +…+a _it z ^t Wherein a is _i0 Is P _i Set secret s _i0 . Here the threshold is t) so that the degree of the polynomial is also t.

Let the threshold be 2 and let the total number of participants be 5, i.e. t=2, n=5, there are a total of 5 participants P ₁ ，P ₂ ，P ₃ ，P ₄ ，P ₅ Wherein:

P ₁ generating a 2 degree (t=2) polynomial: f (f) ₁ (z)＝a ₁₀ +a ₁₁ z+a ₁₂ z ² Wherein a is ₁₀ Is P ₁ Set secret s ₁₀ ；

P ₂ Generating a 2 degree (t=2) polynomial: f (f) ₂ (z)＝a ₂₀ +a ₂₁ z+a ₂₂ z ² Wherein a is ₂₀ Is P ₂ Set secret s ₂₀ ；

P ₃ Generating a 2 degree (t=2) polynomial: f (f) ₃ (z)＝a ₃₀ +a ₃₁ z+a ₃₂ z ² Wherein a is ₃₀ Is P ₃ Set secret s ₃₀ ；

P ₄ Generating a 2 degree (t=2) polynomial: f (f) ₄ (z)＝a ₄₀ +a ₄₁ z+a ₄₂ z ² Wherein a is ₄₀ Is P ₄ Set secret s ₄₀ ；

P ₅ Generating a 2 degree (t=2) polynomial: f (f) ₅ (z)＝a ₅₀ +a ₅₁ z+a ₅₂ z ² Wherein a is ₅₀ Is P ₅ Set secret s ₅₀ ；

Further, each of the ginsengParty P _i N secret shares may be generated, one of which is reserved by itself, and the remaining secret shares sent to the other participants are encrypted. For example, party P _i Generating coordinates of n points on a polynomial corresponding curve of the self as n secret shares, reserving the coordinates of one point of the self, and encrypting and transmitting the coordinates of the other points to other participants.

Specifically, for example:

P ₁ generating s ₁₁ ＝f ₁ (1)、s ₁₂ ＝f ₁ (2)、s ₁₃ ＝f ₁ (3)、s ₁₄ ＝f ₁ (4)、s ₁₅ ＝f ₁ (5) Self-reserve s ₁₁ And respectively encrypt and send s ₁₂ To P ₂ Encrypted transmission s ₁₃ To P ₃ Encrypted transmission s ₁₄ To P ₄ Encrypted transmission s ₁₅ To P ₅ ；

P ₂ Generating s ₂₁ ＝f ₂ (1)、s ₂₂ ＝f ₂ (2)、s ₂₃ ＝f ₂ (3)、s ₂₄ ＝f ₂ (4)、s ₂₅ ＝f ₂ (5) Self-reserve s ₂₂ And respectively encrypt and send s ₂₁ To P ₁ Encrypted transmission s ₂₃ To P ₃ Encrypted transmission s ₂₄ To P ₄ Encrypted transmission s ₂₅ To P ₅ ；

P ₃ Generating s ₃₁ ＝f ₃ (1)、s ₃₂ ＝f ₃ (2)、s ₃₃ ＝f ₃ (3)、s ₃₄ ＝f ₃ (4)、s ₃₅ ＝f ₃ (5) Self-reserve s ₃₃ And respectively encrypt and send s ₃₁ To P ₁ Encrypted transmission s ₃₂ To P ₂ Encrypted transmission s ₃₄ To P ₄ Encrypted transmission s ₃₅ To P ₅ ；

P ₄ Generating s ₄₁ ＝f ₄ (1)、s ₄₂ ＝f ₄ (2)、s ₄₃ ＝f ₄ (3)、s ₄₄ ＝f ₄ (4)、s ₄₅ ＝f ₄ (5) Self-reserve s ₄₄ And respectively encrypt and sends ₄₁ To P ₁ Encrypted transmission s ₄₂ To P ₂ Encrypted transmission s ₄₃ To P ₃ Encrypted transmission s ₄₅ To P ₅ ；

P ₅ Generating s ₅₁ ＝f ₅ (1)、s ₅₂ ＝f ₅ (2)、s ₅₃ ＝f ₅ (3)、s ₅₄ ＝f ₅ (4)、s ₅₅ ＝f ₅ (5) Self-reserve s ₅₅ And respectively encrypt and send s ₅₁ To P ₁ Encrypted transmission s ₅₂ To P ₂ Encrypted transmission s ₅₃ To P ₃ Encrypted transmission s ₅₄ To P ₄ ；

This is the case:

P ₁ locally generated secret shares s with different parties ₁₁ 、s ₂₁ 、s ₃₁ 、s ₄₁ 、s ₅₁ ；

P ₂ Locally generated secret shares s with different parties ₁₂ 、s ₂₂ 、s ₃₂ 、s ₄₂ 、s ₅₂ ；

P ₃ Locally generated secret shares s with different parties ₁₃ 、s ₂₃ 、s ₃₃ 、s ₄₃ 、s ₅₃ ；

P ₄ Locally generated secret shares s with different parties ₁₄ 、s ₂₄ 、s ₃₄ 、s ₄₄ 、s ₅₄ ；

P ₅ Locally generated secret shares s with different parties ₁₅ 、s ₂₅ 、s ₃₅ 、s ₄₅ 、s ₅₅ 。

Then, each party P _i One secret share s that can be reserved by itself _ii And from other participants P _j The resulting secret share s _ji The private key shares are obtained after a summation, e.g. by summing, e.g. by party P _i Private key share of (2)Specific examples are: />

Participant P ₁ The private key share s can be calculated ₁ The method comprises the following steps: s is(s) ₁ ＝s ₁₁ +s ₂₁ +s ₃₁ +s ₄₁ +s ₅₁ ；

Participant P ₂ The private key share s can be calculated ₂ The method comprises the following steps: s is(s) ₂ ＝s ₁₂ +s ₂₂ +s ₃₂ +s ₄₂ +s ₅₂ ；

Participant P ₃ The private key share s can be calculated ₃ The method comprises the following steps: s is(s) ₃ ＝s ₁₃ +s ₂₃ +s ₃₃ +s ₄₃ +s ₅₃ ；

Participant P ₄ The private key share s can be calculated ₄ The method comprises the following steps: s is(s) ₄ ＝s ₁₄ +s ₂₄ +s ₃₄ +s ₄₄ +s ₅₄ ；

Participant P ₅ The private key share s can be calculated ₅ The method comprises the following steps: s is(s) ₅ ＝s ₁₅ +s ₂₅ +s ₃₅ +s ₄₅ +s ₅₅ 。

Also, each participant P _i Can also generate a public verification parameter A corresponding to the self t degree polynomial _ik ＝a _ik G, where k=0, 1, …, t, and published to each party, specifically:

participant P ₁ Generation A _1k ＝a _1k G, k=0, 1, …, t=2, including a ₁₀ ＝a ₁₀ G＝s ₁₀ G，A ₁₁ ＝a ₁₁ G，

A ₁₂ ＝a ₁₂ G, broadcast { A ₁₀ ,A ₁₁ ,A ₁₂ Go to P ₂ 、P ₃ 、P ₄ And P ₅ ；

Participant P ₂ Generation A _2k ＝a _2k G, k=0, 1, …, t=2, including a ₂₀ ＝a ₂₀ G＝s ₂₀ G，A ₂₁ ＝a ₂₁ G，

A ₂₂ ＝a ₂₂ G, broadcast { A ₂₀ ,A ₂₁ ,A ₂₂ Go to P ₁ 、P ₃ 、P ₄ And P ₅ ；

Participant P ₃ Generation A _3k ＝a _3k G, k=0, 1, …, t=2, including a ₃₀ ＝a ₃₀ G＝s ₃₀ G，A ₃₁ ＝a ₃₁ G，

A ₃₂ ＝a ₃₂ G, broadcast { A ₃₀ ,A ₃₁ ,A ₃₂ Go to P ₁ 、P ₂ 、P ₄ And P ₅ ；

Participant P ₄ Generation A _4k ＝a _4k G, k=0, 1, …, t=2, including a ₄₀ ＝a ₄₀ G＝s ₄₀ G，A ₄₁ ＝a ₄₁ G，

A ₄₂ ＝a ₄₂ G, broadcast { A ₄₀ ,A ₄₁ ,A ₄₂ Go to P ₁ 、P ₂ 、P ₃ And P ₅ ；

Participant P ₅ Generation A _5k ＝a _5k G, k=0, 1, …, t=2, including a ₅₀ ＝a ₅₀ G＝s ₅₀ G，A ₅₁ ＝a ₅₁ G，

A ₅₂ ＝a ₅₂ G, broadcast { A ₅₀ ,A ₅₁ ,A ₅₂ Go to P ₁ 、P ₂ 、P ₃ And P ₄ 。

Each participant P _i Can also be according to P _j Public authentication parameter { A } _j0 ,A _j1 ,…，A _jt Verification P _j The transmitted secret share s _ji For example, by the following formula:

s _ji G＝A _j0 +iA _j1 +…+i ^t A _jt

specific:

participant P ₁ Through s ₂₁ G＝A ₂₀ +A ₂₁ +A ₂₂ Verification s ₂₁ Through s ₃₁ G＝A ₃₀ +A ₃₁ +A ₃₂ Verification s ₃₁ Through s ₄₁ G＝A ₄₀ +A ₂₁ +A ₄₂ Verification s ₄₁ Through s ₅₁ G＝A ₅₀ +A ₅₁ +A ₅₂ Verification s ₅₁ ；

Participant P ₂ Through s ₁₂ G＝A ₁₀ +2A ₁₁ +2 ² A ₁₂ Verification s ₁₂ Through s ₃₂ G＝A ₃₀ +2A ₃₁ +2 ² A ₃₂ Verification s ₃₂ Through s ₄₂ G＝A ₄₀ +2A ₂₁ +2 ² A ₄₂ Verification s ₄₂ Through s ₅₂ G＝A ₅₀ +2A ₅₁ +2 ² A ₅₂ Verification s ₅₂ ；

Participant P ₃ Through s ₁₃ G＝A ₁₀ +3A ₁₁ +3 ² A ₁₂ Verification s ₁₃ Through s ₂₃ G＝A ₃₀ +3A ₃₁ +3 ² A ₃₂ Verification s ₂₃ Through s ₄₃ G＝A ₄₀ +3A ₂₁ +3 ² A ₄₂ Verification s ₄₃ Through s ₅₃ G＝A ₅₀ +3A ₅₁ +3 ² A ₅₂ Verification s ₅₃ ；

Participant P ₄ Through s ₁₄ G＝A ₁₀ +4A ₁₁ +4 ² A ₁₂ Verification s ₁₄ Through s ₂₄ G＝A ₂₀ +4A ₂₁ +4 ² A ₂₂ Verification s ₂₄ Through s ₃₄ G＝A ₄₀ +4A ₂₁ +4 ² A ₄₂ Verification s ₄₂ Through s ₅₄ G＝A ₅₀ +4A ₅₁ +4 ² A ₅₂ Verification s ₅₂ ；

Participant P ₅ Through s ₁₅ G＝A ₁₀ +5A ₁₁ +5 ² A ₁₂ Verification s ₁₅ Through s ₂₅ G＝A ₂₀ +5A ₂₁ +5 ² A ₂₂ Verification s ₂₅ Through s ₃₅ G＝A ₃₀ +5A ₃₁ +5 ² A ₃₂ Verification s ₃₅ Through s ₄₅ G＝A ₄₀ +5A ₄₁ +5 ² A ₄₂ Verification s ₄₅ ；

Either party may terminate the protocol if the authentication is not passed.

On the other hand, each party P _i The total public key X may be calculated in a similar manner as described above, for example by the following formula:

as previously described, this total public key may be used to verify the total signature after subsequent aggregation.

In addition, to combat attacks by malicious adversaries, each party P further _i A hash value of the private corresponding public key itself may be generated and broadcast so that the receiver can verify each party P by the hash value _i The sent secret corresponds to the correctness of the public key. For example:

P ₁ calculation ofH ₁ () A is a hash algorithm ₁₀ ＝a ₁₀ G is a secret s ₁₀ The corresponding public key (obtained by an operation on an elliptic curve, here in the form of a product); p (P) ₁ Can broadcast +.>To other participants, any receiver receives +. >After that, the +.>Verification A ₁₀ The correctness of the code (C) can resist the attack of malicious enemies;

P ₂ calculation ofH ₁ () A is a hash algorithm ₂₀ ＝a ₂₀ G is a secret s ₂₀ The corresponding public key (obtained by an operation on an elliptic curve, here in the form of a product); p (P) ₂ Can broadcast +.>To other participants, any receiver receives +.>After that, the +.>Verification A ₂₀ The correctness of the code (C) can resist the attack of malicious enemies;

P ₃ calculation ofH ₁ () A is a hash algorithm ₃₀ ＝a ₃₀ G is a secret s ₃₀ The corresponding public key (obtained by an operation on an elliptic curve, here in the form of a product); p (P) ₃ Can broadcast +.>To other participants, any receiver receives +.>After that, the +.>Verification A ₃₀ The correctness of the code (C) can resist the attack of malicious enemies;

P ₄ calculation ofH ₁ () A is a hash algorithm ₄₀ ＝a ₄₀ G is a secret s ₄₀ The corresponding public key (obtained by an operation on an elliptic curve, here in the form of a product); p (P) ₄ Can broadcast +.>To other participants, any receiver receives +.>After that, the +.>Verification A ₄₀ The correctness of the code (C) can resist the attack of malicious enemies;

P ₅ calculation ofH ₁ () A is a hash algorithm ₅₀ ＝a ₅₀ G is a secret s ₅₀ The corresponding public key (obtained by an operation on an elliptic curve, here in the form of a product); p (P) ₅ Can broadcast +.>To other participants, any receiver receives +. >After that, the +.>Verification A ₅₀ The correctness of the code (C) can resist the attack of malicious enemies;

in addition, each party P _i An own public-private key pair for homomorphic encryption, such as the Paillier public-private key pair (E _i ,e _i ) Wherein e is _i Is a private key, E _i Is the corresponding public key. Homomorphic encryption techniques can "homomorphic" the plaintext data, i.e., map the plaintext data to a new, secure state, such that only recipients with a secret key can obtain the plaintext data. Paillier homomorphic addition is a public key encryption system widely used in cryptography, proposed by Pascal Paillier (1999). Its main feature is that it has additive homomorphic property, which means that given two ciphertexts, the ciphertexts of their corresponding plain text sum can be calculated without decryption. Specifically, assume that there are two plain texts m1 and m2, pa of whichThe illier encrypted ciphertext is c1 and c2, respectively. The additive homomorphism of Paillier can be implemented as a new ciphertext c, which is exactly the ciphertext of the sum of m1 and m2, obtained by computing the product of c1 and c2. This homomorphism property allows some form of computation of the encrypted data to be accomplished without revealing the original data.

Each participant P _i After the generated homomorphic encryption public and private key pair, the public key can be sent to other participants.

For example, party P ₁ Generating a Paillier encrypted public-private key (E ₁ ,e ₁ ) Then, homomorphic encryption public key E ₁ Broadcasting to other participants; participant P ₂ Generating a Paillier encrypted public-private key (E ₂ ,e ₂ ) Then, homomorphic encryption public key E ₂ Broadcasting to other participants; participant P ₃ Generating a Paillier encrypted public-private key (E ₃ ,e ₃ ) Then, homomorphic encryption public key E ₃ Broadcasting to other participants; participant P ₄ Generating a Paillier encrypted public-private key (E ₄ ,e ₄ ) Then, homomorphic encryption public key E ₄ Broadcasting to other participants; participant P ₅ Generating a Paillier encrypted public-private key (E ₅ ,e ₅ ) Then, homomorphic encryption public key E ₅ Broadcast to other participants.

Thus, each party P _i The local may store the own secret, own private key shares, own homomorphic encryption private keys, the total public key, and homomorphic encryption public keys for each party.

In one embodiment, to combat attacks by malicious adversaries, a first zero knowledge proof may be employed to provide proof of homomorphic encryption public keys. For example, each party P _i A first zero knowledge proof ψ may be generated _i The psi is _i Can be used for proving public key E _i Is a legal Paillier public key. Correspondingly, the receiver receiving the homomorphic encryption public key and the corresponding first zero knowledge proof can verify the corresponding homomorphic encryption public key through the first zero knowledge proof. For example, any of the receivers P _j Receiving party P _i The transmitted psi _i And E is _i Thereafter, it may be described as E _j Sum phi _j Verification of ψ for input (proof algorithm input to zero knowledge proof) _j Whether or not it is E _j Is an acceptable proof of legal Paillier public key. If the verification is passed, the flow of the embodiment can continue the subsequent process, otherwise, the description is illegal, and the flow can be terminated.

Through the distributed threshold key generation process, there is a total polynomial:

f(z)＝f ₁ (z)+f ₂ (z)+f ₃ (z)+f ₄ (z)+f ₅ (z)

＝a ₁₀ +a ₁₁ z+a ₁₂ z ² +a ₂₀ +a ₂₁ z+a ₂₂ z ² +a ₃₀ +a ₃₁ z+a ₃₂ z ² +a ₄₀ +a ₄₁ z

+a ₄₂ z ² +a ₅₀ +a ₅₁ z+a ₅₂ z ²

＝(a ₁₀ +a ₂₀ +a ₃₀ +a ₄₀ +a ₅₀ )+(a ₁₁ +a ₂₁ +a ₃₁ +a ₄₁ +a ₅₁ )z

+(a ₁₂ +a ₂₂ +a ₃₂ +a ₄₂ +a ₅₂ )z ²

as previously mentioned, the polynomial corresponds to a total curve and there is the following relationship:

s ₁ ＝f ₁ (1)+f ₂ (1)+f ₃ (1)+f ₄ (1)+f ₅ (1)＝f(1)；

s ₂ ＝f ₁ (2)+f ₂ (2)+f ₃ (2)+f ₄ (2)+f ₅ (2)＝f(2)；

s ₃ ＝f ₁ (3)+f ₂ (3)+f ₃ (3)+f ₄ (3)+f ₅ (3)＝f(3)；

s ₄ ＝f ₁ (4)+f ₂ (4)+f ₃ (4)+f ₄ (4)+f ₅ (4)＝f(4)；

s ₅ ＝f ₁ (5)+f ₂ (5)+f ₃ (5)+f ₄ (5)+f ₅ (5)＝f(5)；

in the aforementioned DKG scheme, each party P _i Can calculate the secret share s by itself _i Broadcast to other participants. Each party P _i Collect the alignment { s ] ₁ ,s ₂ ,s ₃ ,s ₄ ,s ₅ After at least t+1 secret shares, the secret s can be reconstructed ₀ . For example for a threshold of 2, each party P _i After collecting at least 3 secret shares, the secret s can also be reconstructed ₀ 。

In the present embodiment, however, the purpose is to achieve a distributed threshold signature, so that the secret share s is not to be used _i Sent to other parties, but rather as a private key share. In this way, at least t+1 secret shares are not obtained by any party or other parties, and then the total secret is recovered, namely the total private key is not obtained, so that the private key shares obtained by a plurality of parties through one-time distributed threshold key generation protocol are ensured, and the distributed threshold signature can be repeatedly carried out in the follow-up process.

The distributed threshold signature process in this embodiment is described below and may include both an offline phase and an online phase. The distributed key generation process described above requires n participants to participate in the protocol process together. The distributed threshold signature process described below requires only at least t+1 participants to participate in the protocol process together. Here again, the threshold t=2 is taken as an example.

Offline stage: at least t+1 participants generate respective first random values k _i And a second random value gamma _i Each participant also adopts homomorphic encryption algorithm and obtains a coordinate component r and a private key share component masking value χ of each participant through offline phase protocol _i . Specifically, the method comprises the following steps:

t+1 participants, each participant P _i Calculation of Lagrange coefficientsAnd calculates a private key share component x _i ＝λ _i s _i . Here, for example, i is 1, 2, 3, then:

Participant P ₁ Calculation of Lagrange coefficientsAnd calculates a private key share component x ₁ ＝λ ₁ s ₁ ；/>

Participant P ₂ Calculation of Lagrange coefficientsAnd calculates a private key share component x ₂ ＝λ ₂ s ₂ ；

Participant P ₃ Calculation of Lagrange coefficientsAnd calculates a private key share component x ₃ ＝λ ₃ s ₃ 。

S11：

Each of the at least t+1 parties generates a first random value and a second random value, and a corresponding first random value homomorphic ciphertext and a second random value public key hash. In particular, for example, party P _i ,i∈[1,t+1]Generating a first random value k _i And a second random value gamma _i And k is _i ,On the basis of this, party P _i The first random value homomorphic ciphertext, e.g. Paillier ciphertext K, may be calculated _i ＝E _i (k _i ) And computing a second random value public key hash, such as g _i ＝H ₁ (γ _i G)，H ₁ () Is a hash algorithm, similar to that described above. t+1 is 3, the participation party is P ₁ 、P ₂ 、P ₃ When (1):

P ₁ generating a first random value k ₁ And a second random value gamma ₁ And calculates the Paillier ciphertext K of the first random value ₁ ＝E ₁ (k ₁ ) And calculating a second random value public key hash g ₁ ＝H ₁ (γ ₁ G)；

P ₂ Generating a firstRandom value k ₂ And a second random value gamma ₂ And calculates the Paillier ciphertext K of the first random value ₂ ＝E ₂ (k ₂ ) And calculating a second random value public key hash g ₂ ＝H ₁ (γ ₂ G)；

P ₃ Generating a first random value k ₃ And a second random value gamma ₃ And calculates the Paillier ciphertext K of the first random value ₃ ＝E ₃ (k ₃ ) And calculating a second random value public key hash g ₃ ＝H ₁ (γ ₃ G)；

Further, each of at least t+1 participants, P _i The generated first random value homomorphic ciphertext may be sent to other parties, such as:

P ₁ broadcast K ₁ To P ₂ And P ₃ ；

P ₂ Broadcast K ₂ To P ₁ And P ₂ ；

P ₃ Broadcast K ₃ To P ₁ And P ₂ ；

S12：

Participant P receiving broadcast _i For P _j K sent out _j Selecting two mask numbers beta _i,j , Here, the value range of the finite field subscript is represented as the 5 th power of q, which is a proven value range with cryptographic security. Mask number beta _i,j ,/>Can be generally +.>Larger values are selected within the range. Further, P _i Intermediate ciphertext D may be calculated by homomorphic algorithm _i,j And->And send to P _j ：

The above two formulas are as follows,Respectively representing homomorphic multiplication and homomorphic addition operations.

Specific:

P ₁ receiving P ₂ Broadcast K ₂ ＝E ₂ (k ₂ ) Then, two mask numbers beta are selected _1,2 ,And then P ₁ Intermediate ciphertext D may be calculated by homomorphic algorithm _1,2 And->And send to P ₂ Wherein:

/>

thus P ₂ Receipt D _1,2 ＝E ₂ (α _1,2 ) Andalthough P ₂ With a corresponding Paillier private key e ₂ ，k ₂ Also P ₂ Generated but due to P therein ₁ Selected mask number beta _1,2 ,/>Masking effect of P ₂ Cannot estimate P ₁ Private key share x of (2) ₁ Random value gamma ₁ Thereby completing the information transfer on the basis. Similar to the above, the description is omitted.

P ₁ Receiving P ₃ Broadcast K ₃ ＝E ₃ (k ₃ ) After that, the intermediate ciphertext D can be calculated by homomorphic algorithm _1,3 Andand send to P ₃ Wherein:

similarly, P ₂ Receiving P ₁ Broadcast K ₁ ＝E ₁ (k ₁ ) After that, the intermediate ciphertext D can be calculated by homomorphic algorithm _2,1 Andand send to P ₁ Wherein:

P ₂ receiving P ₃ Broadcast K ₃ ＝E ₃ (k ₃ ) After that, the intermediate ciphertext D can be calculated by homomorphic algorithm _2,3 Andand send to P ₃ Wherein:

similarly, P ₃ Receiving P ₁ Broadcast K ₁ ＝E ₁ (k ₁ ) After that, the intermediate ciphertext D can be calculated by homomorphic algorithm _3,1 Andand send to P ₁ Wherein:

P ₃ receiving P ₂ Broadcast K ₂ ＝E ₂ (k ₂ ) After that, the intermediate ciphertext D can be calculated by homomorphic algorithm _3,2 Andand send to P ₂ Wherein:

S13：

further, each party P _i Received intermediate ciphertext D _j,i Anddecrypting by adopting corresponding homomorphic encryption private keys to obtain plaintext alpha respectively _j,i ,/>Referred to herein as intermediate plaintext, wherein: alpha _j,i ＝γ _j ·k _i -β _j,i ，/>

And may be based on the first random value k _i And a second random value gamma _i Intermediate plaintext alpha _j,i ,Calculating the intermediate value delta _i And may be based on private key share component x _i And a first random value k _i Intermediate plaintext alpha _j,i ,/>Calculating a private key share component masking value χ _i ：

/>

Here, there are two relations:

this is because:

in addition, a second random value γ can be calculated _i Corresponding public key Γ _i ＝γ _i G。

Further, P _i The intermediate value delta can be calculated _i And a second random value gamma _i Corresponding public key Γ _i To other parties.

Specific:

P ₁ received ciphertext D _2,1 Anddecrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _2,1 ,/>Wherein: alpha _2,1 ＝γ ₂ ·k ₁ -β _2,1 ，/>P ₁ Received ciphertext D _3,1 And->Decrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _3,1 ,/>Wherein: alpha _3,1 ＝γ ₃ ·k ₁ -β _3,1 ，Further calculate delta ₁ ＝γ ₁ k ₁ +(α _2,1 +β _2,1 +α _3,1 +β _3,1 )，/> In addition, P ₁ A second random value gamma can be calculated ₁ Corresponding public key Γ ₁ ＝γ ₁ G. Further, P ₁ The intermediate value delta can be calculated ₁ And a second random value gamma ₁ Corresponding public key Γ ₁ To other party P ₂ And P ₃ 。

P ₂ Received ciphertext D _1,2 Anddecrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _1,2 ,/>Wherein: alpha _1,2 ＝γ ₁ ·k ₂ -β _1,2 ，/>P ₂ Received ciphertext D _3,2 And->Decrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _3,2 ,/>Wherein: alpha _3,2 ＝γ ₃ ·k ₂ -β _3,2 ，Further calculate delta ₂ ＝γ ₂ k ₂ +(α _1,2 +β _1,2 +α _3,2 +β _3,2 )，/> In addition, P ₂ A second random value gamma can be calculated ₂ Corresponding public key Γ ₂ ＝γ ₂ G. Further, P ₂ The intermediate value delta can be calculated ₂ And a second random value gamma ₂ Corresponding public key Γ ₂ To other party P ₁ And P ₂ 。

P ₃ Received ciphertext D _1,3 Anddecrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _1,3 ,/>Wherein: alpha _1,3 ＝γ ₁ ·k ₃ -β _1,3 ，/>P ₃ Received ciphertext D _2,3 And->Decrypting by adopting corresponding homomorphic encryption private keys to respectively obtain intermediate plaintext alpha _2,3 ,/>Wherein: alpha _2,3 ＝γ ₂ ·k ₃ -β _2,3 ，Further calculate delta ₃ ＝γ ₃ k ₃ +(α _1,3 +β _1,3 +α _2,3 +β _2,3 )，/> In addition, P ₃ A second random value gamma can be calculated ₃ Corresponding public key Γ ₃ ＝γ ₃ G. Further, P ₃ The intermediate value delta can be calculated ₃ And a second random value gamma ₃ Corresponding public key Γ ₃ To other party P ₁ And P ₂ 。

To this end, P _i Local has delta _j∈[t+1] ，Γ _j∈[t+1] ，k _i ，χ _i . Thus, P _i The point r= (Σ) can be calculated _j∈[t+1] δ _j ) ^-1 ·(∑ _j∈[t+1] Γ _j )). In fact, as can be derived from the above relationship 1, r= (Σ) _j∈[t+1] δ _j ) ^-1 ·(∑ _j∈[t+1] Γ _j )＝((k ₁ +k ₂ +…+k _t+1 )·(γ ₁ +γ ₂ +…+γ _t+1 )) ^-1 ·(∑ _j∈[t+1] Γ _j )＝k ^-1 ·γ ^-1 ·(∑ _j∈[t+1] Γ _j )＝k ^-1 ·γ ^-1 ·

(∑ _j∈[t+1] γ _j G)＝k ^-1 ·γ ^-1 ·γG＝k ^-1 G, it can be seen that this is the same as the form of ECDSA described previously. P (P) _i R=f (R) can be calculated, f (R) can be the abscissa of the point R as before. Thus, P _i Can be stored locally (r, k) _i ,χ _i ) The off-line phase ends.

For example:

P ₁ local has delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ ,k ₁ ，χ ₁ . As above, P ₁ May be based on delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ The calculation results in a point R, where r=f (R), P ₁ Can be stored locally (r, k ₁ ,χ ₁ )。

Similarly, P ₂ Local has delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ ,k ₁ ，χ ₁ . As above, P ₂ May be based on delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ The calculation results in a point R, where r=f (R), P ₂ Can be stored locally (r, k ₂ ,χ ₂ )。

Similarly, P ₃ Local has delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ ,k ₁ ，χ ₁ . As above, P ₃ May be based on delta ₁ ,Γ ₁ ,δ ₂ ,Γ ₂ ,δ ₃ ,Γ ₃ The calculation results in a point R, where r=f (R), P ₃ Can be stored locally (r, k ₃ ,χ ₃ )。

In addition, in S11, each of the participants may also generate a first random value homomorphic ciphertext K _i Second zero knowledge proof of phi _i And broadcast to other participants; correspondingly, in S12, each participant receives a first random value homomorphic ciphertext K _i And a corresponding second zero knowledge proof Φ _i Thereafter, prove phi through the second zero knowledge _i Verifying the corresponding first random value homomorphic ciphertext K _i . Thus, the attack of malicious adversaries can be resisted. If the verification is passed, the flow of the embodiment can continue the subsequent process, otherwise, the description is illegal, and the flow can be terminated.

In addition, in S11, each of the participants may also generate a second random value public key Γ _i ＝γ _i Corresponding hash G of G _i ＝H ₁ (γ _i G)＝H ₁ (Γ _i ) And broadcast to other participants; correspondingly, in the subsequent offline stage, each participant is connected withReceiving a second random value public key Γ _i ＝γ _i G and corresponding hash G _i After that, through the hash g _i Verifying the corresponding second random value public key Γ _i . Thus, the attack of malicious adversaries can be resisted. If the verification is passed, the flow of the embodiment can continue the subsequent process, otherwise, the description is illegal, and the flow can be terminated.

In addition, in S12, each of the participants may also generate a third zero knowledge proof Φ _i,j Fourth zero knowledge proofΦ _i,j Attesting to intermediate ciphertext D _i,j Corresponding->Zero knowledge proof- >Prove intermediate ciphertext->Corresponding->Correspondingly, in S13, each participant receives the intermediate ciphertext D _i,j And a corresponding third zero knowledge proof phi _i,j Thereafter, prove phi through the third zero knowledge _i,j Verifying the corresponding intermediate ciphertext D _i,j And similarly, each party receives the intermediate ciphertext +.>And the corresponding fourth zero knowledge proof ++>After that, by this fourth zero knowledge +.>Verifying the corresponding intermediate ciphertext->Thus, the attack of malicious adversaries can be resisted. If the verification is passed, the flow of the embodiment can continue the subsequent process, otherwise, the description is illegal, and the flow can be terminated.

On-line stage: the at least t+1 participants each adopt their own first random value k _i Private key share component masking value χ _i And said coordinate component r signing the same message, resulting in a signature share sigma of at least t+1 number _i 。

For message m, its hash value is H (m). At least t+1 participants each P _i Using locally stored (r, k) _i ,χ _i ) H (m) can be calculated to obtain the signature share sig _i ＝(r,σ _i ) Specifically, sigma _i The following formula can be used for calculation:

σ _i ＝k _i H(m)+χ _i r

in this way, after any party obtains at least a t+1 number of signature shares, the at least t+1 number of signature shares may be aggregated into a total signature sig= (r, σ). The correctness of the total signature σ can be verified by using the aforementioned total public key X. This is because the form of the formula is identical to that in the ECDSA described above.

It should be noted first that the following relationship exists:

thus, at least t+1 number of signature shares aggregate into a total signature σ ] as:

here x=s ₁₀ +s ₂₀ +…+s _n0 =f (0), see σ here]=k·h (m) +k·x·r, substantially identical to the formula (a) in the ECDSA signature algorithm described aboveAlso, it is therefore apparent that the total public key X verification can be employed.

Continuing the example above, either party (either one of n=5 parties or one other than n=5 parties) obtains a signature share of t+1=3:

σ] ₁ ＝k ₁ H(m)+χ ₁ r

σ ₂ ＝k ₂ H(m)+χ ₂ r

σ ₃ ＝k ₃ H(m)+χ ₃ r

first, the following relationship exists:

then sigma = Σis calculated _i∈[1,3] σ _i ＝∑ _i∈[1,3] (k _i H(m)+χ _i r)＝∑ _i∈[1,3] k _i H(m)+∑ _j∈[1,3] χ _i r

＝(k ₁ +k ₂ +k ₃ )·H(m)+(k ₁ +k ₂ +k ₃ )·(x ₁ +x ₂ +x ₃ )·r＝k·H(m)+k·x·r

Here x=s ₁₀ +s ₂₀ +…+s ₅₀ =f (0), i.e. equal to the sum of the secrets set by each of the n participants in the distributed threshold signature protocol. It can be seen that σ=k·h (m) +k·x·r here is substantially the same as equation (a) in the ECDSA signature algorithm described above, and therefore, it is obvious that the total public key X can be used for verification.

In the above example, the case where t+1 is the right value will be mainly described. In practice, it may be the case that there are more than t+1 participants, which is x above ₁ +x ₂ +x ₃ ＝λ ₁ s ₁ +λ ₂ s ₂ +λ ₃ s ₃ For example, the relation of (2) is:

x ₁ +x ₂ +x ₃ +x ₄ ＝λ ₁ s ₁ +λ ₂ s ₂ +λ ₃ s ₃ +λ ₄ s ₄

the result of the derivation of this formula is also equal to f (0) =s ₁₀ +s ₂₀ +s ₃₀ +s ₄₀ +s ₅₀ I.e. also equal to the sum of the secrets set by each of the n participants in the distributed threshold signature protocol, which is also the result of the above calculation using lagrangian interpolation. It can be seen that when the number of participants in the distributed signature protocol phase is greater than t+1, the same aggregate signature can still be obtained through the above procedure as when t+1 is equal, and thus can still be verified by the total public key.

The effect of the embodiment of the present application is that, first, any threshold value can be supported. Second, to combat malicious adversaries, fireblock corporation published in CCS20, UC Non-Interactive, reactive, threshold ECDSA with Identifiable Aborts, uses a number of zero knowledge certificates. Compared with the method, the method and the device for proving the Paillier ciphertext have the advantages that only the Paillier ciphertext is required to be proved to belong to a specific range in the distributed signature protocol, no other zero knowledge proof is required, the calculation and communication complexity is reduced by 40%, and the scheme provided by the application can prove safety under a general group model.

Similar to the ECC-based cryptography scheme, the same k cannot be encrypted twice, otherwise it would be cracked by others to get k. Therefore, a new k is preferably used during each signature. It may be that the offline phase is performed again by at least t+1 participants to generate at least t+1 k _i Thereby obtaining a new k.

The above procedure may be that the distributed key generation phase is performed cooperatively by n participants once, and then the off-line phase + on-line phase is performed by at least t +1 participants each time the signature is made. It is also possible that after n participants cooperatively perform a distributed key generation phase, at least t+1 participants perform multiple offline phases, thereby generating multiple different k values, and thus different R values and corresponding R values, for signature of each subsequent online phase.

An embodiment of a computer device of the present application is described below, comprising:

a processor;

generating private key shares s by a distributed key generation protocol _i Generating a homomorphic encryption public-private key pair and sending the homomorphic encryption public key;

generating respective first random values k _i And a second random value gamma _i The homomorphic encryption algorithm of the homomorphic encryption public and private key pair is adopted and passes through an offline stage protocol and a second random value gamma _i Obtaining the coordinate component r and based on the respective private key shares s _i Obtaining a private key share component masking value χ _i ；

Using the first random value k of itself _i Private key share component masking value χ _i And said coordinate component r signing the same message, resulting in at least t+1 signature shares σ _i 。

The following describes an embodiment of a storage medium of the present application for storing a program, wherein the program when executed performs the following operations:

In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (Field Programmable Gate Array, FPGA)) is an integrated circuit whose logic function is determined by the programming of the device by a user. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented by using "logic compiler" software, which is similar to the software compiler used in program development and writing, and the original code before the compiling is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), but not just one of the hdds, but a plurality of kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), lava, lola, myHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog are currently most commonly used. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic controllers, and embedded microcontrollers, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.

The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation device is a server system. Of course, the application does not exclude that as future computer technology advances, the computer implementing the functions of the above-described embodiments may be, for example, a personal computer, a laptop computer, a car-mounted human-computer interaction device, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Although one or more embodiments of the present description provide method operational steps as described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps recited in the embodiments is merely one way of performing the order of steps and does not represent a unique order of execution. When implemented in an actual device or end product, the instructions may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even in a distributed data processing environment) as illustrated by the embodiments or by the figures. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, it is not excluded that additional identical or equivalent elements may be present in a process, method, article, or apparatus that comprises a described element. For example, if first, second, etc. words are used to indicate a name, but not any particular order.

For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, when one or more of the present description is implemented, the functions of each module may be implemented in the same piece or pieces of software and/or hardware, or a module that implements the same function may be implemented by a plurality of sub-modules or a combination of sub-units, or the like. The above-described apparatus embodiments are merely illustrative, for example, the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, read only compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.

One skilled in the relevant art will recognize that one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present description can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

One or more embodiments of the present specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments. In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present specification. In this specification, schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

The foregoing is merely an example of one or more embodiments of the present specification and is not intended to limit the one or more embodiments of the present specification. Various modifications and alterations to one or more embodiments of this description will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, or the like, which is within the spirit and principles of the present specification, should be included in the scope of the claims.

Claims

1. A method of implementing a distributed threshold signature, comprising:

an offline phase of distributed signing, each of at least t+1 participants performs: generating a first random value and a second random value of the self, adopting a homomorphic encryption algorithm of the homomorphic encryption public-private key pair, obtaining a coordinate component through an offline stage protocol and the second random value, and obtaining a private key share component masking value based on respective private key shares;

an online phase of the distributed signature, each of the at least t+1 participants performing: and signing the message by adopting the first random value, the private key share component masking value and the coordinate component of the signature to obtain a signature share.

2. The method of claim 1, each of the n participants generating a respective private key share via a distributed key generation protocol, comprising:

each of the n participants sets own secret and corresponding public key, generates hash value of own secret corresponding public key, and broadcasts the secret corresponding public key and hash value of secret corresponding public key;

each of the n participants receives the secret corresponding public key broadcast by the other participant and the hash value of the secret corresponding public key, and verifies the secret corresponding public key sent by the other participant through the hash value.

3. The method of claim 1, further comprising:

each of the n participants employing a first zero knowledge proof to provide proof of the generated homomorphic encryption public key;

after each of the n participants receives the homomorphic encryption public key and the corresponding first zero knowledge proof, the corresponding homomorphic encryption public key is verified through the first zero knowledge proof.

4. The method of claim 1, each of at least t+1 number of participants in the offline phase performing:

s11: generating a first random value and a second random value, calculating a first random value homomorphic ciphertext and broadcasting;

S12: receiving a first random value homomorphic ciphertext, calculating an intermediate ciphertext based on the first random value homomorphic ciphertext, and broadcasting;

s13: receiving intermediate ciphertext broadcast by other participants, decrypting to obtain intermediate plaintext, calculating an intermediate value based on a first random value and a second random value of the intermediate ciphertext and the intermediate plaintext obtained by decryption, calculating a public key corresponding to the second random value, and broadcasting the public key corresponding to the intermediate value and the second random value; calculating a private key share component based on the private key share, calculating a private key share component masking value based on the private key share component, the first random value and the intermediate plaintext, and storing the private key share component masking value;

s14: and calculating and storing coordinate components based on the public key corresponding to the intermediate value and the second random value.

5. The method of claim 4, wherein the calculating the intermediate ciphertext based on the first random value homomorphic ciphertext comprises:

and selecting two mask numbers, and calculating an intermediate ciphertext based on the two selected mask numbers, the second random value and the homomorphic ciphertext of the first random value.

6. The method of claim 4, wherein each of the participants also generates a second zero knowledge proof of the first random value homomorphic ciphertext and broadcasts to the other participants in S11;

correspondingly, in S12, after each participant receives the first random value homomorphic ciphertext and the corresponding second zero knowledge proof, the corresponding first random value homomorphic ciphertext is verified through the second zero knowledge proof.

7. The method of claim 4, each of the participants further generating a corresponding hash of the second random value public key and broadcasting to the other participants;

correspondingly, in the subsequent offline stage, after each participant receives the second random value public key and the corresponding hash, the corresponding second random value public key is verified through the hash.

8. The method of claim 5, wherein in S12, each of the participants may also generate a third zero-knowledge proof and a fourth zero-knowledge proof;

correspondingly, in S13, after each participant receives the intermediate ciphertext and the corresponding third zero knowledge proof, verifying the corresponding intermediate ciphertext through the third zero knowledge proof; after each participant receives the intermediate ciphertext and the corresponding fourth zero knowledge proof, the corresponding intermediate ciphertext is verified through the fourth zero knowledge proof.

9. The method of claim 1, wherein after any party obtains at least t+1 signature shares, the at least t+1 signature shares are aggregated into a total signature.

10. The method of claim 2, the n participants further generating a total public key via a distributed key generation protocol; after any party obtains the total signature and the total public key, the correctness of the total signature is verified by adopting the total public key.

11. A computer device, comprising:

a processor;

generating a first random value and a second random value, further adopting a homomorphic encryption algorithm of the homomorphic encryption public-private key pair, obtaining a coordinate component through an offline stage protocol and the second random value, and obtaining a private key share component masking value based on respective private key shares;

and signing the message by adopting the first random value, the private key share component masking value and the coordinate component of the signature to obtain a signature share.

12. A storage medium storing a program, wherein the program when executed performs the operations of: