CN117728959B

CN117728959B - Threshold signature method and device, electronic equipment and storage medium

Info

Publication number: CN117728959B
Application number: CN202410172276.1A
Authority: CN
Inventors: 刘乃嘉; 郭健; 李海花
Original assignee: China Academy of Information and Communications Technology CAICT
Current assignee: China Academy of Information and Communications Technology CAICT
Priority date: 2024-02-06
Filing date: 2024-02-06
Publication date: 2024-05-10
Anticipated expiration: 2044-02-06
Also published as: CN117728959A

Abstract

The embodiment of the disclosure discloses a threshold signature method and device, electronic equipment and storage medium, wherein the method comprises the following steps: when a plurality of participants receive target information, each participant respectively generates a first random value, and the threshold private key of each participant meets the following conditions: obtaining a public private key through a threshold private key of each participant by using an interpolation algorithm, wherein a public signature obtained based on the public private key is the same as a public signature obtained based on the threshold private key of each participant; each participant generates first verification information based on the first random value and sends the first verification information to other participants; responding to the first verification information of each participant passing verification, and each participant carrying out signature processing on the target information by using a threshold private key of the participant based on a homomorphic encryption algorithm to obtain a corresponding signature share; a common signature for the target information is determined based on the share signatures of the respective participants.

Description

Threshold signature method and device, electronic equipment and storage medium

Technical Field

The disclosure relates to the technical field of cryptography, in particular to a threshold signature method and device, electronic equipment and a storage medium.

Background

ECDSA (Elliptic Curve Digital Signature Algorithm ) is applied to information encryption in various fields. Such as applying a signature of transaction data on the blockchain, etc. In the related art, a digital wallet is generally used for managing a public and private key pair of a user, a specific digital wallet is used for managing the public and private key pair through an ECDSA, the digital wallet generally stores a private key in a seed mode, when the private key is required to be signed, the corresponding private key can be obtained through the seed, however, a great risk exists in the mode of storing the seed in a single point mode, the private key is lost when the seed is lost or leaked, and therefore the digital asset of the user has data security risks.

Disclosure of Invention

In order to solve the technical problems described above, embodiments of the present disclosure provide a threshold signature method and apparatus, an electronic device, and a storage medium.

In one aspect of the disclosed embodiments, a threshold signature method is provided, applied to a plurality of participants, including: in response to the plurality of participants receiving the target information, each of the plurality of participants respectively generating a first random value, each of the participants respectively holding a public key and a threshold private key, the public key being used to verify public signatures generated based on the threshold private keys of each of the participants, the threshold private keys of each of the participants satisfying the following conditions: obtaining public private keys through the threshold private keys of all the participants by using an interpolation algorithm, wherein the public signature obtained based on the public private keys is the same as the public signature obtained based on the threshold private keys of all the participants; each participant generates first verification information based on the first random value and sends the first verification information to other participants; responding to the first verification information of each participant passing verification, each participant respectively carrying out signature processing on the target information by using a threshold private key of each participant based on a homomorphic encryption algorithm to obtain a corresponding signature share; a common signature for the target information is determined based on the share signatures of the respective participants.

In another aspect of the embodiments of the present disclosure, there is provided a threshold signature apparatus applied to a plurality of participants, including: the first generation module is used for responding to the target information received by the plurality of participants, each participant in the plurality of participants respectively generates a first random value, each participant respectively holds a public key and a threshold private key, the public key is used for verifying a public signature generated based on the threshold private key of each participant, and the threshold private key of each participant meets the following conditions: obtaining public private keys through the threshold private keys of all the participants by using an interpolation algorithm, wherein the public signature obtained based on the public private keys is the same as the public signature obtained based on the threshold private keys of all the participants; the first generation module is used for generating first verification information based on the first random values respectively by all the participants and sending the first verification information to other participants; the first signature module is used for responding to the fact that the first verification information of each participant passes verification, each participant respectively carries out signature processing on the target information by utilizing a threshold private key of the first signature module based on homomorphic encryption algorithm, and a corresponding signature share is obtained; and the second signature module is used for determining a public signature of the target information based on the share signature of each participant.

In yet another aspect of the disclosed embodiments, there is provided an electronic device including: a memory for storing a computer program; and the processor is used for executing the computer program stored in the memory and realizing the threshold signature method when the computer program is executed.

In yet another aspect of the disclosed embodiments, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements a threshold signature method.

In the embodiment of the disclosure, when a plurality of participants receive target information, each participant generates a first random value, a threshold private key of each participant satisfies that a public private key can be obtained through interpolation algorithm of the threshold private key of each participant, and a public signature obtained based on the public private key is the same as a public signature obtained based on the threshold private key of each participant; each participant generates first verification information based on a first random value of the participant and sends the first verification information to other participants; when the first verification information of each participant passes verification, each participant carries out signature processing on the target information by using a threshold private key of the participant based on a homomorphic encryption algorithm to obtain a signature share corresponding to each participant; a common signature for the target information is then determined based on the share signatures of the respective participants. Therefore, the problem that the private key is poor in safety and easy to lose due to single-point storage of the private key is solved by respectively holding the threshold private keys by all the participants, the safety of the private key is improved, and the safety of data is further improved. Meanwhile, the authenticity of the identity of each participant is effectively ensured by verifying the first verification information of each participant, the problem of malignant signature is avoided, and in addition, the public signature of the target information is determined based on the share signature of each participant, so that the reliability of the signature is effectively ensured.

The technical scheme of the present disclosure is described in further detail below through the accompanying drawings and examples.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the disclosure and together with the description, serve to explain the principles of the disclosure.

The disclosure may be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings in which:

FIG. 1 is a flow chart of a threshold signature method provided by an exemplary embodiment of the present disclosure;

FIG. 2 is a flow chart of step S130 provided by an exemplary embodiment of the present disclosure;

FIG. 3 is a flow chart of obtaining a threshold key provided by an exemplary embodiment of the present disclosure;

FIG. 4 is a flow chart of obtaining a public key provided by an exemplary embodiment of the present disclosure;

FIG. 5 is a flow chart of a threshold signature method provided by another exemplary embodiment of the present disclosure;

FIG. 6 is a flow chart of a threshold signature method provided by yet another exemplary embodiment of the present disclosure;

FIG. 7 is a block diagram of a threshold signature apparatus provided in an exemplary embodiment of the present disclosure;

fig. 8 is a schematic structural diagram of an application embodiment of the electronic device of the present disclosure.

Detailed Description

Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that: the relative arrangement of the components and steps, numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless it is specifically stated otherwise.

It will be appreciated by those of skill in the art that the terms "first," "second," etc. in embodiments of the present disclosure are used merely to distinguish between different steps, devices or modules, etc., and do not represent any particular technical meaning nor necessarily logical order between them.

It should also be understood that in embodiments of the present disclosure, "plurality" may refer to two or more, and "at least one" may refer to one, two or more.

It should also be appreciated that any component, data, or structure referred to in the presently disclosed embodiments may be generally understood as one or more without explicit limitation or the contrary in the context.

In addition, the term "and/or" in this disclosure is merely an association relationship describing an association object, and indicates that three relationships may exist, for example, a and/or B may indicate: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" in the present disclosure generally indicates that the front and rear association objects are an or relationship.

It should also be understood that the description of the various embodiments of the present disclosure emphasizes the differences between the various embodiments, and that the same or similar features may be referred to each other, and for brevity, will not be described in detail.

Meanwhile, it should be understood that the sizes of the respective parts shown in the drawings are not drawn in actual scale for convenience of description.

The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application, or uses.

Techniques, methods, and apparatus known to one of ordinary skill in the relevant art may not be discussed in detail, but are intended to be part of the specification where appropriate.

It should be noted that: like reference numerals and letters denote like items in the following figures, and thus once an item is defined in one figure, no further discussion thereof is necessary in subsequent figures.

Embodiments of the present disclosure may be applicable to electronic devices such as terminal devices, computer systems, servers, etc., which may operate with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known terminal devices, computing systems, environments, and/or configurations that may be suitable for use with the terminal device, computer system, server, or other electronic device include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, hand-held or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, mainframe computer systems, and distributed cloud computing technology environments that include any of the foregoing, and the like.

Electronic devices such as terminal devices, computer systems, servers, etc. may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc., that perform particular tasks or implement particular abstract data types. The computer system/server may be implemented in a distributed cloud computing environment in which tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computing system storage media including memory storage devices.

In the disclosed embodiments:

The Block Chain (Block Chain) is a distributed account book technology based on a point-to-point network, each Node (Node) in the Block Chain network has the same complete data, and the nodes realize the data consistency on the Chain of each Node through a consensus mechanism. Nodes in a blockchain network, commonly referred to as computing devices in the blockchain network, that is, any computing device connected to the blockchain network (including cell phones, servers, etc.) are referred to as nodes, wherein the nodes may be used to store, run, validate, etc. blockdata in the blockchain network.

Fig. 1 is a flow chart illustrating a threshold signature method according to an exemplary embodiment of the present disclosure. The embodiment is applied to a plurality of participants, as shown in fig. 1, and includes the following steps:

in step S110, in response to the plurality of participants receiving the target information, each of the plurality of participants generates a first random value, respectively.

Wherein the plurality of participants may include, for example, but not limited to: enterprises, individuals or groups, etc. Each participant has a client, and the clients of the plurality of participants are communicatively connected. The client of each participant may be a computing device, which may be, for example, a computer, a server, a smart phone, or the like. In one particular implementation, the number of participants is greater than or equal to 3, and each participant's client may be deployed on a node in the blockchain network, each client being provided with a digital wallet for managing the participants' public key and threshold private key.

In one particular implementation, multiple participants are each connected to a signature platform that can be deployed on a node. And the user sends the target information to the signature platform through the client of the user, and the signature platform sends the target information to each client respectively. For each of a plurality of participants, the participant holds a public key and a threshold private key. The public key is used for verifying public signatures generated based on the threshold private keys of all the participants, and the threshold private keys of all the participants meet the following conditions: the public private key is obtained through the threshold private key of each participant by utilizing an interpolation algorithm, and the public signature obtained based on the public private key is the same as the public signature obtained based on the threshold private key of each participant.

The public private key may also be obtained by the private keys of the respective participants, e.g. the private keys of the respective participants may be added to obtain the public private key. The public private key may be used to sign information and to obtain a public signature of the information by signing the information with the public private key, which is the same as signing the information based on the threshold private key of each party. The public key may verify a public signature generated by the public-private key.

In an alternative embodiment, each party has a pair of public and private key pairs calculated using homomorphic encryption algorithms. The public key and the threshold private key of each participant can be calculated by using a homomorphic encryption algorithm and a secret sharing algorithm based on the private keys of the public and private key pairs of each participant. The homomorphic encryption algorithm may be a Paillier homomorphic encryption algorithm, and the secret sharing algorithm may be a Shamir secret sharing algorithm. The public private key is calculated by the threshold private key of each participant using an interpolation algorithm, for example, a lagrangian interpolation algorithm.

For convenience of description, the number of participants 3 is illustrated in this embodiment. The three participants are P ₁、P₂、P₃ respectively, wherein the identification of P ₁ is 1, the identification of the threshold private key is x ₁;P₂ is 2, the identification of the threshold private key is x ₂;P₃ is 3, and the threshold private key is x ₃. Calculating the Lagrangian difference coefficient of P ₁ based on the formula (1)Calculating the Lagrange difference coefficient of P ₂ based on formula (2)Calculating the Lagrangian difference coefficient/> of P ₃ based on formula (3); The public private key sk can be obtained based on the calculation of formula (4);

（1）

（2）

（3）

（4）。

step S120, each participant generates corresponding first verification information based on the first random value of the participant and sends the first verification information to other participants.

Wherein the first authentication information for each party may include a commitment and an open commitment for that party.

In one particular implementation, the promise may be represented by KGC and the open promise may be represented by KGD.

Each party can randomly generate a first random value gamma, then, a random point gamma is obtained based on gamma.G by using the first random value gamma and a generating element G of an elliptic curve corresponding to the party, the hash value of the random point gamma is taken as a commitment KGC, and the random point gamma is taken as an opening commitment KGD.

Each party sends its own first authentication information to the other parties of the plurality of parties, i.e., P ₁ sends the first authentication information of P ₁ to P ₂ and P ₃;P₂ sends the first authentication information of P ₂ to P ₁ and P ₃;P₃ sends the first authentication information of P ₃ to P ₁ and P ₂.

Step S130, in response to the first verification information of each participant passing verification, each participant performs signature processing on the target information by using a threshold private key of the participant based on a homomorphic encryption algorithm to obtain a corresponding signature share.

In one particular implementation, each party authenticates the first authentication information of the other party. Illustratively, P ₁ verifies the first verification information of P ₂ and the first verification information of P ₃, P ₂ verifies the first verification information of P ₁ and the first verification information of P ₃, and P ₃ verifies the first verification information of P ₁ and the first verification information of P ₂. Taking P ₁ to verify the first verification information of P ₂ as an example, P ₁ calculates a hash value of the open promise in the first verification information of P ₂, and if the hash value of the open promise is the same as the promise in the first verification information of P ₂, determines that the first verification information of P ₂ passes the verification.

When the first verification information of each party passes verification, for each party, the party carries out signature processing on the target information by using a threshold private key of the party based on a homomorphic encryption algorithm, for example, a Paillier homomorphic encryption algorithm, so as to obtain a signature share corresponding to the party.

Step S140, determining a public signature for the target information based on the share signatures of the respective participants.

Wherein, the public signature of the target information can be determined according to the share signature of each participant by utilizing the Paillier homomorphic encryption algorithm.

Fig. 2 is a flow chart of step S130 provided in an exemplary embodiment of the present disclosure. In an alternative implementation, as shown in fig. 2, step S130 in the embodiment of the present disclosure may include the following steps:

In step S131, each participant generates a second random value.

Wherein each participant generates a second random value, i.e. each participant holds the first random value and the second random value.

In step S132, any two of the multiple participants perform share conversion on the first multiplication shares of any two participants by using the homomorphic encryption algorithm, so as to obtain first addition shares of each of the any two participants.

Wherein the first multiplicative share of the arbitrary two participants is formed by a first random value of one of the arbitrary two participants and a second random value of the other participant.

In one particular implementation, for participants P _i and P _j, where i is 1,2, or 3 and j is 1,2, or 3. Assume that the first random value and the second random value of the party P _i are respectivelyAnd k _i,P_j are/>, respectivelyAnd k _j.P_i and P _j comprises: /(I)And/>。

The first multiplicative fraction can be added to the first multiplicative fraction as followsConverting to a first additive share, comprising:

p _i and P _j may each randomly generate an elliptic curve. P _i obtains ciphertext c _i based on equation (5), and sends ciphertext c _i to P _j, where Enc _N represents an encryption calculation;

c_i=Enc_N（k_i）（5）；

after P _j receives ciphertext c _i, P _j selects the original random number The/>Zn is all congruence class sets of modulo n, n being the order of elliptic curves. P _j generates ciphertext c _j using homomorphic equation (6), where/>Representing homomorphic multiplication calculations,/>Representing homomorphic addition calculation;

（6）

Sending seal c _j to P _i,P_i decrypts c _j using the homomorphic public key of P _i to obtain the first additive share of P _i ，/>; P _j will/>First additive portion/>, as P _j Wherein/>。

Similarly, the first multiplication share can be determined according to the aboveConversion to the first additive share mode, converting/>, in the first multiplicative shareConversion to a first additive fraction yields a first additive fraction/>, of P _j And a first additive share/>, of P _i I.e. the first additive fraction of P ₁ comprises a first additive fraction of a _1,2,α_1,3,β_1,2,β_1,3,P₂ comprises a first additive fraction of a _2,1,α_2,3,β_2,1,β_2,3,P₃ comprises a first additive fraction of a _3,1,α_3,2,β_3,1,β_3,2.

And step S133, performing share conversion on the second multiplication shares of the arbitrary two participants by using a homomorphic encryption algorithm to obtain second addition shares of each of the arbitrary two participants.

Wherein the second multiplicative share of any two participants is formed by the second random value of one of the any two participants and the threshold private key of the other participant.

In one particular implementation, the second multiplicative shares of P _i and P _j comprise: k _iw_j、k_jw_i, where w _j is the threshold private key additive share of P _j and w _i is the threshold private key additive share of P _i.

The second multiplicative fraction k _iw_j may be converted into a second additive fraction by:

P _j obtains a threshold private key additive share w _j using equation (7);

w_j=λ_j·x_j （7）

Wherein λ _j is the lagrangian difference coefficient of P _j, x _j is the threshold private key of P _j;

P _i obtains ciphertext c _i based on equation (5), and sends ciphertext c _i to P _j;

after P _j receives ciphertext c _i, P _j selects the original random number The/>. P _j generates ciphertext c _j1 by using homomorphic calculation formula (8);

（8）

Sending seal c _j1 to P _i,P_i to decrypt c _j1 to get the second additive share u _i,j,P_j of P _i to As a second additive fraction v _j,i of P _j, u _i,j+v_j,i= k_iw_j.

Similarly, k _jw_i in the second multiplication share may be converted into the second addition share according to the manner of converting k _iw_j in the second multiplication share into the second addition share, to obtain a second addition share u _j,i of P _j, and a second addition share v _j,i of P _j, that is, a first addition share including u _1,2,u_1,3,v_1,2,v_1,3,P₂ and a first addition share including u _2,1,u_2,3,v_2,1,v_2,3,P₃ and a first addition share including u _3,1,u_3,2,v_3,1,v_3,2 of P ₁.

In step S134, each participant performs signature processing on the target information based on the first added portion and the second added portion thereof, so as to obtain a corresponding signature portion, and sends the corresponding signature portion thereof to other participants.

Wherein, for P ₁, a first intermediate parameter θ ₁ and a second intermediate parameter are calculated based on the formula (9) and the formula (10)Wherein w ₁ is the threshold private key additive share of P ₁;

（9）

（10）

For P ₂, calculate third intermediate parameter θ ₂ and fourth intermediate parameter based on equation (11) and equation (12) Wherein w ₂ is the threshold private key additive share of P ₂;

（11）

（12）

For P ₃, a fifth intermediate parameter θ ₃ and a sixth intermediate parameter are calculated based on equation (13) and equation (14) Wherein w ₃ is the threshold private key additive share of P ₃;

（13）

（14）

P ₁ sends the first intermediate parameter θ ₁ to P ₂ and P ₃;P₂ sends the third intermediate parameter θ ₂ to P ₁ and P ₃;P₃ sends the fifth intermediate parameter θ ₃ to P ₂ and P ₃.

P ₁、P₂ and P ₃ calculate the inverse parameter θ ^-1 based on equation (15), respectively;

（15）

P ₁、P₂ and P ₃ calculate the signature random numbers r of P ₁、P₂ and P ₃ based on formulas (16), (17), respectively;

（16）

（17）

wherein R is a seventh intermediate parameter, f ₁ is an open promise in the first authentication information of P ₁, f ₂ is an open promise in the first authentication information of P ₂, f ₃ is an open promise in the first authentication information of P ₃, x is an abscissa of any point in the elliptic curve, i.e. x is an abscissa of any point in the P ₁ elliptic curve when P ₁, x is an abscissa of any point in the P ₂ elliptic curve when P ₂, and x is an abscissa of any point in the P ₃ elliptic curve when P ₃;

p ₁、P₂ and P ₃ calculate an eighth intermediate parameter M based on the target message M by using formula (18);

（18）

for P ₁, based on the eighth intermediate parameter m, using equation (19), a signature additive share s ₁ of P ₁ is calculated, where k ₁ is the second random value of P ₁;

（19）

The signature share (r, s ₁) corresponding to the P ₁ is formed by r and s ₁;

For P ₂, based on the eighth intermediate parameter m, using equation (20), a signature additive share s ₂ of P ₂ is calculated, where k ₂ is the second random value of P ₂;

（20）

the signature share (r, s ₂) corresponding to the P ₂ is formed by r and s ₂;

For P ₃, based on the eighth intermediate parameter m, using equation (21), a signature additive share s ₃ of P ₃ is calculated, where k ₃ is the second random value of P ₃;

（21）

The signature shares (r, s ₃) corresponding to P ₃ are formed by r and s ₃.

Accordingly, step S140 may include: p ₁、P₂ and P ₃ share s ₁、s₂ and s ₃,P₁、P₂, respectively, and P ₃ calculate a common additive share s, where s=s ₁+s₂+s₃, respectively; a common signature (r, s) of the target information is formed by r and s.

Fig. 3 is a schematic flow chart of obtaining a threshold key according to an exemplary embodiment of the present disclosure. In an alternative implementation, as shown in fig. 3, the embodiment of the disclosure further includes the following steps:

step S210, each participant generates a homomorphic public-private key pair, a third random value, a fourth random value and a fifth random value respectively.

Each participant randomly generates a third random value, a fourth random value and a fifth random value of the participant, wherein the third random value and the fourth random value of each participant belong to an elliptic curve scalar domain of the participant, and the fifth random value can be any random number.

In one particular implementation, each participant may utilize a Paillier homomorphic encryption algorithm to generate a pair of homomorphic public and private key pairs, including a homomorphic public key and a homomorphic private key.

Step S220, respectively, for a plurality of participants, the participant generates second authentication information of the participant according to the third random value, the fourth random value and the fifth random value of the participant, and sends the second authentication information of the participant to other participants.

In one specific implementation, for P ₁, the first Feldman (friedman) check tuple of P ₁ is taken as the second authentication information of P ₁, where the first Feldman check tuple of P ₁ includes: G1 is the generator of the elliptic curve of P ₁, a ₁ is the third random value of P ₁, B ₁ is the fourth random value of P ₁, a ₁ and B ₁ are the first verification parameters of P ₁; for P ₂, the first Feldman check tuple of P ₂ is taken as the second authentication information of P ₂, wherein the first Feldman check tuple of P ₂ comprises: /(I) G2 is the generator of the elliptic curve of P ₂, a ₂ is the third random value of P ₂, B ₂ is the fourth random value of P ₂, a ₂ and B ₂ are the first verification parameters of P ₂; for P ₃, the first Feldman check tuple of P ₃ is taken as the second authentication information of P ₃, wherein the first Feldman check tuple of P ₃ comprises: /(I)G3 is the generator of the elliptic curve of P ₃, a ₃ is the third random value of P ₃, B ₃ is the fourth random value of P ₃, a ₃ and B ₃ are the first verification parameters of P ₃.

P ₁ sends the second authentication information of P ₁ to P ₂ and P ₃,P₂ sends the second authentication information of P ₂ to P ₁ and P ₃,P₃ sends the second authentication information of P ₃ to P ₁ and P ₂.

In step S230, the participant generates a first t-1 order polynomial of the participant according to the third random value, the fourth random value and the fifth random value of the participant.

Where t is the threshold number.

In one specific implementation, the threshold number is the same as the number of participants, i.e., in the disclosed embodiment, the threshold number t=3. Building a first order 2 polynomial (i.e., a first t-1 polynomial) for P ₁,P₁: Where y is the identity of the party and u ₁ is the fifth random value of P ₁; building a first order 2 polynomial for P ₂,P₂: Wherein u ₂ is the fifth random value of P ₂; for P ₃,P₃, a polynomial of order 2 is constructed: Wherein u ₃ is the fifth random value of P ₃.

Step S240, the participant generates partial secret information corresponding to each participant based on the first t-1 order polynomial of the participant and the identification of each participant.

In a specific implementation manner, at P ₁, the identifiers 1,2, and 3 of P ₁、P₂ and P ₃ are substituted into the first 2 nd order polynomial constructed by P ₁ respectively, so as to obtain partial secret information of the lagrangian redundancy P ₁(1)（P₁ of P ₁), partial secret information of the lagrangian redundancy P ₁(2)（P₂ of P ₂, and partial secret information of the lagrangian redundancy P ₁(3)（P₃ of P ₃), the lagrangian redundancy P ₁ (2) of P ₂ is sent to P ₂, and the lagrangian redundancy P ₁ (3) of P ₃ is sent to P ₃;

In P ₂, substituting the identifications 1,2 and 3 of P ₁、P₂ and P ₃ into a first 2-order polynomial constructed by P ₂ respectively to obtain partial secret information of the Lagrangian redundancy P ₂(1)（P₁ of P ₁), partial secret information of the Lagrangian redundancy P ₂(2)（P₂ of P ₂ and partial secret information of the Lagrangian redundancy P ₂(3)（P₃ of P ₃), transmitting the Lagrangian redundancy P ₂ (1) of P ₁ to P ₁ and the Lagrangian redundancy P ₂ (3) of P ₃ to P ₃;

At P ₃, the identifications 1, 2 and 3 of P ₁、P₂ and P ₃ are respectively substituted into a first 2-order polynomial constructed by P ₃ to obtain partial secret information of the Lagrangian redundancy P ₃(1)（P₁ of P ₁), partial secret information of the Lagrangian redundancy P ₃(2)（P₂ of P ₂ and partial secret information of the Lagrangian redundancy P ₃(3)（P₃ of P ₃), the Lagrangian redundancy P ₃ (1) of P ₁ is sent to P ₁, and the Lagrangian redundancy P ₃ (2) of P ₂ is sent to P ₂. Thus, P ₁ holds P ₁(1)、p₂ (1) and P ₃(1);P₂ holds P ₁(2)、p₂ (2) and P ₃(2);P₃ holds P ₁(3)、p₂ (3) and P ₃ (3).

Step S250, in response to the second verification information of each party passing verification, the party determines the threshold private key of the party based on the partial secret information corresponding to the party generated by each party.

And each participant verifies the second verification information of each participant by utilizing a Feldman verification mode.

In a specific implementation manner, the second verification information may be verified by the following manner, which specifically includes: for P ₁, when、/>And/>The second verification information of each party passes the verification of P ₁, wherein U ₁ is the random point of the elliptic curve corresponding to P ₁,/>; For P ₂,/>、/>And/>The second verification information of each party passes the verification of P ₂, where U ₂ is a random point of the elliptic curve corresponding to P ₂,; For P ₃,/>，/>And is also provided withThe second verification information of each party passes the verification of P ₃, wherein U ₃ is the random point of the elliptic curve corresponding to P ₃,/>; When the second authentication information of each party passes the authentication of P ₁、P₂ and P ₃, the second authentication information of each party is determined to pass the authentication.

In one particular implementation, at P ₁, a threshold private key x ₁ of P ₁ is generated according to equation (22); at P ₂, generating a threshold private key x ₂ of P ₂ according to equation (23); at P ₃, generating a threshold private key x ₃ of P ₃ according to equation (24);

Fig. 4 is a schematic flow chart of obtaining a public key according to an exemplary embodiment of the present disclosure. In an alternative implementation, in an embodiment of the present disclosure, as shown in fig. 4, the embodiment of the present disclosure further includes the following steps:

step S310, for a plurality of participants, the participant generates random public information of the participant according to the fifth random value of the participant and the elliptic curve corresponding to the participant, and sends the random public information of the participant to other participants.

Wherein the random public information of each participant may include random points of the elliptic curve corresponding to the participant.

In a specific implementation manner, the random public information of P ₁ includes a random point U ₁ of an elliptic curve corresponding to P ₁, the random public information of U ₁;P₂ may be obtained based on U ₁=G1·u₁ and includes a random point U ₂ of an elliptic curve corresponding to P ₂, the random public information of U ₂;P₃ may be obtained based on U ₂=G2·u₂ and includes a random point U ₃ of an elliptic curve corresponding to P ₃, and U ₃ may be obtained based on U ₃=G3·u₃;

P ₁ shares the random public information of P ₁ to P ₂ and P ₃;P₂, shares the random public information of P ₂ to P ₁ and P ₃;P₃, and shares the random public information of P ₃ to P ₁ and P ₂. Namely, P ₁、P₂ and P ₃ each hold the random public information of P ₁, the random public information of P ₂, and the random public information of P ₃.

Step S320, the party generates a public key based on the random public information of each party.

Wherein each party adds the random public information of each party to obtain a public key.

In one particular implementation, at P ₁、P₂ and P ₃, the public key PK may be obtained based on pk=u ₁+U₂+U₃.

In an optional implementation manner, the threshold signature method in the embodiment of the present disclosure further includes: and determining the sliced public key of the participant based on the public key, the third random value, the fourth random value and the elliptic curve corresponding to the participant for the plurality of participants respectively, and sending the sliced public key of the participant to other participants.

In one particular implementation, at P ₁, a shard public key X ₁ of P ₁ is generated according to equation (25); at P ₂, generating a shard public key X ₂ of P ₂ according to equation (26); at P ₃, generating a shard public key X ₃ of P ₃ according to equation (27);

Wherein P ₁ shares the public key of fragments X ₁ of P ₁ with P ₂ and P ₃;P₂ and the public key of fragments X ₂ of P ₂ with P ₁ and P ₃;P₃ and the public key of fragments X ₃ of P ₃ with P ₁ and P ₂. Namely, P ₁、P₂ and P ₃ each hold a shard public key X ₁, shard public key X ₂, and shard public key X ₃.

In this embodiment, the participants may generate a public key based on the fragmented public keys of the respective participants.

In one particular implementation, P ₁、P₂ and P ₃ generate a public key PK using equation (28);

（28）。

fig. 5 is a flow chart illustrating a threshold signature method provided in another exemplary embodiment of the present disclosure. In an alternative embodiment, as shown in fig. 5, the method further comprises the steps of:

In step S410, each participant generates a sixth random value and a seventh random value, respectively.

Wherein each participant randomly generates a sixth random value and a seventh random value for the participant, the sixth random value and the seventh random value for each participant belonging to an elliptic curve scalar field for the participant.

Step S420, for a plurality of participants, the participant generates third authentication information of the participant according to the sixth random value and the seventh random value of the participant, and sends the third authentication information of the participant to other participants.

In one specific implementation, for P ₁, the second Feldman check tuple of P ₁ is taken as the third authentication information of P ₁, where the second Feldman check tuple of P ₁ includes: wherein/> Sixth random value of P ₁,/>Seventh random value of P ₁,/>And/>A second calibration parameter of P ₁; for P ₂, the second Feldman check tuple of P ₂ is taken as the third authentication information of P ₂, wherein the second Feldman check tuple of P ₂ comprises: wherein/> Sixth random value of P ₂,/>Seventh random value of P ₂,/>And/>A second calibration parameter of P ₂; for P ₃, the second Feldman check tuple of P ₃ is taken as the third authentication information of P ₃, wherein the second Feldman check tuple of P ₃ comprises: /(I)Wherein/>Sixth random value of P ₃,/>Seventh random value of P ₃,/>And/>Is the second checking parameter of P ₃.

P ₁ sends the third authentication information of P ₁ to P ₂ and P ₃;P₂ sends the third authentication information of P ₂ to P ₁ and P ₃;P₃ sends the third authentication information of P ₃ to P ₂ and P ₃.

Step S430, the participant constructs a second t-1 order polynomial of the participant based on the sixth random value and the seventh random value of the participant.

In one specific implementation, a second order 2 polynomial (i.e., a second t-1 order polynomial) is constructed for P ₁,P₁: ; a second order 2 polynomial is constructed for P ₂,P₂: /(I) ; For P ₃,P₃, a polynomial of order 2 is constructed: /(I)。

Step S440, the participant generates updated partial secret information corresponding to each participant based on the second t-1 order polynomial of the participant and the identification information of each participant.

In one specific implementation, at P ₁, the identities 1, 2,3 of P ₁、P₂ and P ₃ are substituted into the second order 2 polynomial constructed by P ₁, respectively, to obtain updated Lagrangian redundancy of P ₁ (Updated partial secret information of P ₁), updated Lagrangian redundancy of P ₂/>(Updated partial secret information of P ₂) and updated Lagrangian redundancy/>, of P ₃ (Updated partial secret information of P ₃).

In P ₂, the marks 1, 2 and 3 of P ₁、P₂ and P ₃ are respectively substituted into a second 2-order polynomial constructed by P ₂ to obtain updated Lagrangian redundancy of P ₁ (Updated partial secret information of P ₁), updated Lagrangian redundancy of P ₂/>(Updated partial secret information of P ₂) and updated Lagrangian redundancy/>, of P ₃ (Updated partial secret information of P ₃).

In P ₃, the marks 1, 2 and 3 of P ₁、P₂ and P ₃ are respectively substituted into a second 2-order polynomial constructed by P ₃ to obtain updated Lagrangian redundancy of P ₁ (Updated partial secret information of P ₁), updated Lagrangian redundancy of P ₂/>(Updated partial secret information of P ₂) and updated Lagrangian redundancy/>, of P ₃ (Updated partial secret information of P ₃).

In step S450, the party sends the updated partial secret information corresponding to the other parties respectively.

In one particular implementation, P ₁ adds up the updated Lagrangian redundancy of P ₂ Sent to P ₂, updated Lagrangian redundancy of P ₃/>Sending to P ₃;P₂ updated Lagrangian redundancy/>, of P ₁ Sent to P ₁, updated Lagrangian redundancy of P ₃/>Sending to P ₃;P₃ updated Lagrangian redundancy/>, of P ₁ Sent to P ₁, update P ₂ with Lagrangian redundancy/>And sent to P ₂.

P ₁ hold、/>And/>; P ₂ holding/>、/>And/>; P ₃ holding/>、And/>。

Step S460, in response to the third verification information of each participant passing verification, the participant performs update processing on the threshold private key of the participant based on the updated partial secret information corresponding to the participant generated by each participant, so as to obtain the updated threshold private key of the participant.

And each participant verifies the third verification information of each participant by utilizing a Feldman verification mode.

In a specific implementation manner, the third verification information may be verified by the following manner, which specifically includes: for P ₁, when、/>And/>The third verification information of each participant passes the verification of P ₁; for P ₂,/>、/>And is also provided withThe third verification information of each participant passes the verification of P ₂; for P ₃, when、/>And/>The third authentication information of each party passes the authentication of P ₃. When the third verification information of each party passes the verification of P ₁、P₂ and P ₃, the third verification information of each party is determined to pass the verification.

In a specific implementation manner, the threshold private key of the participant can be updated by the following steps:

At P ₁, an updated threshold private key of P ₁ is generated according to equation (29) ; At P ₂, an updated threshold private key/>, of P ₂ is generated according to equation (30); At P ₃, an updated threshold private key/>, of P ₃ is generated according to equation (31)；

（29）

（30）

（31）。

Fig. 6 is a flow chart illustrating a threshold signature method according to still another exemplary embodiment of the present disclosure. In an alternative embodiment, as shown in fig. 6, the method further comprises the steps of:

Step S510, for a plurality of participants, the participant determines an updated sliced public key of the participant based on the homomorphic public key, the sixth random value, the seventh random value and the elliptic curve corresponding to the participant, and sends the updated sliced public key of the participant to other participants.

In one particular implementation, at P ₁, an updated shard public key of P ₁ is generated according to equation (32); At P ₂, an updated shard public key/>, of P ₂ is generated according to equation (33); At P ₃, an updated shard public key/>, of P ₃ is generated according to equation (34)；

（32）

（33）

（34）

P ₁ fragments the update of P ₁ to the public keySharing to P ₂ and P ₃;P₂ updates the shard public key/>, of P ₂ Sharing to P ₁ and P ₃;P₃ updates the shard public key/>, of P ₃ Shared to P ₁ and P ₂. I.e., P ₁、P₂ and P ₃ both hold updated shard public keys/>Update shard public key/>And updating the shard public key/>。

In step S520, the party generates an updated public key according to the updated shard public key of each party.

In one particular implementation, P ₁、P₂ and P ₃ each generate an updated public key using equation (35)；

（35）。/>

Fig. 7 is a block diagram of a threshold signature apparatus provided in an exemplary embodiment of the present disclosure. As shown in fig. 7, the threshold signature method apparatus includes:

A first generating module 600, configured to, in response to the multiple parties receiving the target information, generate first random values respectively for each of the multiple parties, where each party holds a public key and a threshold private key, the public key is used to verify a public signature generated based on the threshold private key of each party, and the threshold private key of each party satisfies the following conditions: obtaining public private keys through the threshold private keys of all the participants by using an interpolation algorithm, wherein the public signature obtained based on the public private keys is the same as the public signature obtained based on the threshold private keys of all the participants;

A first generating module 610, configured to generate first verification information by each participant based on the first random values, and send the first verification information to other participants;

The first signature module 620 is configured to, in response to the first verification information of each participant passing verification, perform signature processing on the target information by using a threshold private key of each participant based on a homomorphic encryption algorithm, so as to obtain a corresponding signature share;

a second signature module 630 for determining a public signature of the target information based on the share signatures of the respective participants.

In one embodiment of the present disclosure, the first signature module 620 in an embodiment of the present disclosure includes:

The first generation submodule is used for respectively generating second random values by the participants;

The first conversion sub-module is used for carrying out share conversion on first multiplication shares of any two participants by using a homomorphic encryption algorithm to obtain first addition shares of each participant in the any two participants, wherein the first multiplication shares are formed by a first random value of one participant in the any two participants and a second random value of the other participant;

The second conversion sub-module is used for carrying out share conversion on the second multiplication share of any two participants by using a homomorphic encryption algorithm to obtain a second addition share of each participant in the any two participants, wherein the second multiplication share is formed by a second random value of one participant in the any two participants and a threshold private key of the other participant;

and the second generation sub-module is used for each participant to carry out signature processing on the target information based on the first addition share and the second addition share of each participant, so as to obtain a corresponding signature share.

In one embodiment of the present disclosure, the threshold signature apparatus in an embodiment of the present disclosure further includes:

the first acquisition module is used for respectively generating a homomorphic public-private key pair, a third random value, a fourth random value and a fifth random value by all the participants, wherein the homomorphic public-private key pair of any participant comprises a homomorphic public key and a homomorphic private key;

A third generating module, configured to generate second authentication information of the participants according to the third random value, the fourth random value, and the fifth random value, for the multiple participants, respectively, and send the second authentication information of the participants to other participants;

A fourth generation module, configured to generate a first t-1 order polynomial of the participant according to the third random value, the fourth random value, and the fifth random value, where t is a threshold number;

A fifth generating module, configured to generate, by the participants, partial secret information corresponding to each participant based on the first t-1 order polynomial and the identifiers of each participant, respectively;

and the sixth generation module is used for responding to the second verification information of each participant to pass verification, and the participant determines the threshold private key of the participant based on the partial secret information corresponding to the participant, which is generated by each participant.

A seventh generating module, configured to generate, for the multiple participants, random public information of the participants according to the fifth random value and an elliptic curve corresponding to the participant, and send the random public information of the participants to other participants;

and an eighth generation module, configured to generate the public key by the participants based on random public information of each participant.

And a ninth generation module, configured to determine, for each of the multiple participants, a fragmented public key of the participant based on the public key, the third random value, the fourth random value, and an elliptic curve corresponding to the participant, and send the fragmented public key of the participant to other participants.

a tenth generation module, configured to generate a sixth random value and a seventh random value respectively for each participant;

An eleventh generating module, configured to generate third authentication information of the participant according to a sixth random value and a seventh random value of the participant, and send the third authentication information of the participant to other participants, where the third authentication information is respectively for the multiple participants;

A twelfth generation module, configured to construct a second t-1 order polynomial of the participant based on the sixth random value and the seventh random value;

A thirteenth generating module, configured to generate updated partial secret information corresponding to each participant based on the second t-1 order polynomial and the identification information of each participant;

the fourteenth generation module is used for the participants to respectively send the updated partial secret information corresponding to the other participants;

And the first updating module is used for responding to the fact that the third verification information of each participant passes verification, and updating the threshold private key of each participant based on the updated partial secret information corresponding to the participant generated by each participant to obtain the updated threshold private key of the participant.

A fifteenth generation module, configured to determine, for each of the plurality of participants, an updated sliced public key of the participant based on the public key, a sixth random value of the participant, a seventh random value, and a corresponding elliptic curve, and send the updated sliced public key of the participant to other participants;

and the second updating module is used for generating an updated public key by the participants according to the updated sliced public key of each participant.

The threshold signature device in the embodiment of the present disclosure corresponds to the embodiment of the threshold signature method in the present disclosure, and the related contents may be referred to each other, which is not described herein again.

The beneficial technical effects corresponding to the exemplary embodiments of the threshold signature apparatus according to the embodiments of the present disclosure may refer to the corresponding beneficial technical effects of the corresponding exemplary method section described above, and will not be described herein.

In addition, the embodiment of the disclosure also provides an electronic device, which comprises:

A memory for storing a computer program;

and a processor, configured to execute the computer program stored in the memory, and when the computer program is executed, implement the threshold signature method according to any one of the embodiments of the disclosure.

Fig. 8 is a schematic structural diagram of an application embodiment of the electronic device of the present disclosure. Next, an electronic device according to an embodiment of the present disclosure is described with reference to fig. 8. The electronic device may be either or both of the first device and the second device, or a stand-alone device independent thereof, which may communicate with the first device and the second device to receive the acquired input signals therefrom.

As shown in fig. 8, the electronic device includes one or more processors and memory.

The processor may be a Central Processing Unit (CPU) or other form of processing unit having data processing and/or instruction execution capabilities, and may control other components in the electronic device to perform the desired functions.

The memory may include one or more computer program products that may include various forms of computer-readable storage media, such as volatile memory and/or non-volatile memory. The volatile memory may include, for example, random Access Memory (RAM) and/or cache memory (cache), and the like. The non-volatile memory may include, for example, read Only Memory (ROM), hard disk, flash memory, and the like. One or more computer program instructions may be stored on the computer readable storage medium that can be executed by a processor to implement the threshold signature method and/or other desired functions of the various embodiments of the present disclosure described above.

In one example, the electronic device may further include: input devices and output devices, which are interconnected by a bus system and/or other forms of connection mechanisms (not shown).

In addition, the input device may include, for example, a keyboard, a mouse, and the like.

The output device may output various information including the determined distance information, direction information, etc., to the outside. The output devices may include, for example, a display, speakers, a printer, and a communication network and remote output devices connected thereto, etc.

Of course, only some of the components of the electronic device relevant to the present disclosure are shown in fig. 8, components such as buses, input/output interfaces, and the like are omitted for simplicity. In addition, the electronic device may include any other suitable components depending on the particular application.

In addition to the methods and apparatus described above, embodiments of the present disclosure may also be a computer program product comprising computer program instructions which, when executed by a processor, cause the processor to perform steps in a threshold signature method according to various embodiments of the present disclosure described in the above section of the present description.

The computer program product may write program code for performing the operations of embodiments of the present disclosure in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server.

Furthermore, embodiments of the present disclosure may also be a computer-readable storage medium, having stored thereon computer program instructions, which when executed by a processor, cause the processor to perform steps in a threshold signature method according to various embodiments of the present disclosure described in the above section of the present description.

The computer readable storage medium may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

Those of ordinary skill in the art will appreciate that: all or part of the steps for implementing the above method embodiments may be implemented by hardware associated with program instructions, where the foregoing program may be stored in a computer readable storage medium, and when executed, the program performs steps including the above method embodiments; and the aforementioned storage medium includes: various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

The basic principles of the present disclosure have been described above in connection with specific embodiments, but it should be noted that the advantages, benefits, effects, etc. mentioned in the present disclosure are merely examples and not limiting, and these advantages, benefits, effects, etc. are not to be considered as necessarily possessed by the various embodiments of the present disclosure. Furthermore, the specific details disclosed herein are for purposes of illustration and understanding only, and are not intended to be limiting, since the disclosure is not necessarily limited to practice with the specific details described.

In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described in a different manner from other embodiments, so that the same or similar parts between the embodiments are mutually referred to. For system embodiments, the description is relatively simple as it essentially corresponds to method embodiments, and reference should be made to the description of method embodiments for relevant points.

The block diagrams of the devices, apparatuses, devices, systems referred to in this disclosure are merely illustrative examples and are not intended to require or imply that the connections, arrangements, configurations must be made in the manner shown in the block diagrams. As will be appreciated by one of skill in the art, the devices, apparatuses, devices, systems may be connected, arranged, configured in any manner. Words such as "including," "comprising," "having," and the like are words of openness and mean "including but not limited to," and are used interchangeably therewith. The terms "or" and "as used herein refer to and are used interchangeably with the term" and/or "unless the context clearly indicates otherwise. The term "such as" as used herein refers to, and is used interchangeably with, the phrase "such as, but not limited to.

The methods and apparatus of the present disclosure may be implemented in a number of ways. For example, the methods and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, firmware. The above-described sequence of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the sequence specifically described above unless specifically stated otherwise. Furthermore, in some embodiments, the present disclosure may also be implemented as programs recorded in a recording medium, the programs including machine-readable instructions for implementing the methods according to the present disclosure. Thus, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

It is also noted that in the apparatus, devices and methods of the present disclosure, components or steps may be disassembled and/or assembled. Such decomposition and/or recombination should be considered equivalent to the present disclosure.

The previous description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

The foregoing description has been presented for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the disclosure to the form disclosed herein. Although a number of example aspects and embodiments have been discussed above, a person of ordinary skill in the art will recognize certain variations, modifications, alterations, additions, and subcombinations thereof.

Claims

1. A threshold signature method, for use with a plurality of participants, comprising:

in response to the plurality of participants receiving the target information, each of the plurality of participants respectively generating a first random value, each of the participants respectively holding a public key and a threshold private key, the public key being used to verify public signatures generated based on the threshold private keys of each of the participants, the threshold private keys of each of the participants satisfying the following conditions: obtaining public private keys through the threshold private keys of all the participants by using an interpolation algorithm, wherein the public signature obtained based on the public private keys is the same as the public signature obtained based on the threshold private keys of all the participants;

Each participant generates first verification information based on the first random value and sends the first verification information to other participants;

Responding to the first verification information of each participant passing verification, and each participant respectively generating a second random value; any two participants in the plurality of participants perform share conversion on first multiplication shares of the any two participants by using a homomorphic encryption algorithm to obtain first addition shares of each participant in the any two participants, wherein the first multiplication shares are formed by a first random value of one participant in the any two participants and a second random value of the other participant; performing share conversion on the second multiplication share of any two participants by using a homomorphic encryption algorithm to obtain a second addition share of each participant in the any two participants, wherein the second multiplication share is formed by a second random value of one participant in the any two participants and a threshold private key of the other participant; each participant performs signature processing on the target information based on the first addition share and the second addition share of each participant, so as to obtain a corresponding signature share;

A common signature for the target information is determined based on the share signatures of the respective participants.

2. The method of claim 1, wherein each party obtains the party's threshold key by:

each participant generates a homomorphic public-private key pair, a third random value, a fourth random value and a fifth random value respectively, wherein the homomorphic public-private key pair of any participant comprises a homomorphic public key and a homomorphic private key;

Generating second authentication information of the participants according to the third random value, the fourth random value and the fifth random value by the participants respectively aiming at the multiple participants, and sending the second authentication information of the participants to other participants;

The participant generates a first t-1 order polynomial of the participant according to the third random value, the fourth random value and the fifth random value, wherein t is the threshold number;

the participants respectively generate partial secret information corresponding to each participant based on the first t-1 order polynomial and the identification of each participant;

And responding to the second verification information of each party to pass verification, and determining a threshold private key of each party by the party based on the partial secret information corresponding to the party generated by each party.

3. The method according to claim 2, characterized in that each party obtains the public key by:

the random public information of the participants is generated by the participants according to the fifth random value and the elliptic curve corresponding to the participants, and the random public information of the participants is sent to other participants;

the participants generate the public key based on random public information of each participant.

4. A method according to claim 3, further comprising:

And respectively aiming at the multiple participants, the participant determines the sliced public key of the participant based on the public key, the third random value, the fourth random value and the elliptic curve corresponding to the participant, and sends the sliced public key of the participant to other participants.

5. The method of any one of claims 1-4, further comprising:

each participant generates a sixth random value and a seventh random value respectively;

generating third verification information of the participants according to a sixth random value and a seventh random value of the participants by the participants respectively aiming at the multiple participants, and sending the third verification information of the participants to other participants;

the participant constructs a second t-1 order polynomial of the participant based on a sixth random value and a seventh random value of the participant;

The participants generate updated partial secret information corresponding to each participant respectively based on the second t-1 order polynomial and the identification information of each participant;

the participants respectively send the updated partial secret information corresponding to the other participants;

And responding to the third verification information of each party to pass verification, and updating the threshold private key of each party by the party based on the updated partial secret information corresponding to the party generated by each party to obtain the updated threshold private key of the party.

6. The method as recited in claim 5, further comprising:

The method comprises the steps that the updated fragmented public key of the participant is determined by the participant based on the public key, a sixth random value, a seventh random value and a corresponding elliptic curve respectively for the plurality of participants, and the updated fragmented public key of the participant is sent to other participants;

The participants generate updated public keys according to the updated sharded public keys of the participants.

7. A threshold signature apparatus for use with a plurality of parties, comprising:

The first generation module is used for responding to the target information received by the plurality of participants, each participant in the plurality of participants respectively generates a first random value, each participant respectively holds a public key and a threshold private key, the public key is used for verifying a public signature generated based on the threshold private key of each participant, and the threshold private key of each participant meets the following conditions: obtaining public private keys through the threshold private keys of all the participants by using an interpolation algorithm, wherein the public signature obtained based on the public private keys is the same as the public signature obtained based on the threshold private keys of all the participants;

the first generation module is used for generating first verification information based on the first random values respectively by all the participants and sending the first verification information to other participants;

the first signature module is used for responding to the fact that the first verification information of each participant passes verification, each participant respectively carries out signature processing on the target information by utilizing a threshold private key of the first signature module based on homomorphic encryption algorithm, and a corresponding signature share is obtained;

a second signature module for determining a public signature for the target information based on the share signatures of the respective participants;

the first signature module includes:

8. An electronic device, comprising:

A memory for storing a computer program;

A processor for executing a computer program stored in said memory and which, when executed, implements the threshold signature method of any of the preceding claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, which when executed by a processor, implements the threshold signature method of any of the preceding claims 1-6.