JPWO2020240289A5

JPWO2020240289A5 -

Info

Publication number: JPWO2020240289A5
Application number: JP2021569311A
Authority: JP
Publication date: 2023-03-30
Anticipated expiration: 2040-04-21

Claims

A computer-implemented method of performing knowledge proofs based on the Elliptic Curve Digital Signature Algorithm (ECDSA), the method comprising, at a verification node of a blockchain network:
obtaining a first transaction containing executable code, the code containing reference data for evaluating a challenge defined based on a joint r-value r _joint ;
receiving one or more second transactions containing information including at least the respective r-parts _ri and s-parts _si of each ECDSA signature of the pair of first ECDSA signatures i=1,2; each of the first ECDSA signatures is part of one of the one or more second transactions based on a respective first private key V _i corresponding to a respective first public key P _i ; signing; and
executing the code from the first transaction, wherein the code applies to the reference data in the first transaction and the r-part _ri received in the one or more second transactions. configured to verify whether the challenge is satisfied and conditionally return a true value based on the following criteria:

where r ₁ +r ₂ denote scalar addition and

p is the prime modulus and

k _i is the ephemeral key, G is the elliptic curve generator, [] _x denotes the x coordinate of […], [] _y denotes the y coordinate of […], '・' is the elliptic curve scalar a step indicating multiplication;
method including.

data indicative of λ ² is received ^as part of information received in at least one second transaction of said one or more second transactions, said determining 2. The method of claim 1, wherein the method is performed based on:

2. The method of claim 1, wherein the reference data in the first transaction includes values of p and [lambda] ² -r.

The method includes
obtaining a respective first public key of each first ECDSA signature of said first ECDSA signatures and applying a verification function of ECDSA to each first ECDSA signature based on said respective first public key and a signed portion; wherein said code is configured to return a true value, further conditioned on said verification of each first ECDSA signature of said first ECDSA signatures. , or 3.

5. The method of claim 4, wherein said step of obtaining said first public key comprises receiving said first public key as part of said information within said one or more second transactions.

The code is configured to output a true result regardless of whose public key was used as the first public key for each one, some, or all of the first ECDSA signatures. , the method according to any one of claims 1 to 5.

A method according to any preceding claim, wherein ECDSA is based on an elliptic curve of the form y ² =x ³ +7.

A method according to any preceding claim, wherein ECDSA is the secp256k1 algorithm.

A method according to any preceding claim, wherein each of said first ECDSA signatures is a signature of a different respective second party and said challenge is at least partially defined by said first party.

10. The method of claim 9, wherein the r and s portions of each of the first ECDSA signatures are generated by respective second parties using respective ephemeral keys k _i .

11. The method of claim 10, wherein respective temporary keys are provided by said first party to respective second parties, or vice versa.

where k _i is the respective ephemeral key, m _i is the respective signed part of the second transaction, and H _sig was used to hash m in generating the respective ECDSA signature. 12. The method of claim 11, which is a hash function and n is the prime order of the generator.

13. A method according to any of claims 7-12, comprising triggering a service for the first party, conditional on the result returned by said code being true.

A method according to any of claims 7 to 13, wherein said step of receiving said one or more second transactions comprises receiving each of said second transactions from one of second parties.

The information received within the second transaction includes a further cryptographic signature of at least one of the second parties using a second party's further private key, the further private key being a further public key. A method according to any one of claims 7 to 14, corresponding to

16. Method according to claim 15, wherein a mapping is available that enables a first party and/or a third party to retrieve the identity of said at least one second party based on said further public key.

16. or wherein said code is configured to verify said further cryptographic signature using said further public key and return a true value further conditioned upon said further cryptographic key being verified; 16. The method according to 16.

The method of any of claims 7-17, wherein the information received within the second transaction further comprises a cryptographic signature of the first party using the first party's private key.

The information received in the second transaction is one of a second party using the same respective private key as the first ECDSA signature, but having a different r-part value than the first ECDSA signature. including an additional ECDSA signature for each of the parts or all,
3. The code is configured to verify each of the additional ECDSA signatures using the respective first public key and return a true result further contingent upon the additional ECDSA signature being verified. 19. The method according to any one of 7-18.

A method according to any preceding claim, wherein the code is arranged to allow any two r-part values to be used as r ₁ and r ₂ from a large set of r-part values. .

the set includes at least three pairs of r-part values;
each pair of different k values is distributed to each of at least three second parties so that they can generate each of the pairs in the set;
_r1 is one of the r-part values from one of said second parties and _r2 is the r-part value from another of said second parties and
21. A method as claimed in claim 20 when dependent on any of claims 7 to 19, wherein said code enables any two of said at least three second parties to fulfill said challenge.

A method according to any preceding claim, wherein said information is received within the same second transaction.

Each of the transactions has a data structure that includes one or more inputs and one or more outputs, each output including a lock script, each input to an unlock script and an output of another transaction. contains a pointer to
The code is included in the lock script of the first transaction, the information is included in the unlock script in inputs of the second transaction, and the pointer in the inputs of the second transaction includes the referring to said output of a first transaction;
The method validates the transaction, subject to at least the code returning a true result;
In response to said verification, the following:
including the second transaction in a transaction pool for mining into one or more blocks by the validation node ; and/or
forwarding the second transaction to at least one other node of the blockchain network;
a step comprising at least one of
23. The method of claim 22, comprising:

A method according to any preceding claim, wherein said transaction is structured according to an account-based model and said code is contained in a smart contract contained in said first transaction.

25. The method of claim 24, wherein the information is received over multiple second transactions.

A computer program product, which, when executed by a node of a network, causes said node to perform the method of any of claims 1-25 .

A node of a network,
a memory including one or more memory units;
a processing device comprising one or more processing units;
including
A node, wherein the memory stores code, the code being configured to cause the processing device to perform the method of any one of claims 1 to 25 when executed on the processing device .

A first transaction for recording on a blockchain, said first transaction embodied on one or more computer-readable media, said first transaction comprising executable code,
The code is based on one or more second transactions including information including at least an r part r _i and an s part s _i of each ECDSA signature of each pair of first ECDSA signatures i=1,2. including reference data for evaluating a challenge defined based on the r-value r _joint , each of said first ECDSA signatures to a respective first private key V _i corresponding to a respective first public key P _i ; signing a second transaction portion of one of the one or more second transactions based on;
The code verifies whether the challenge is satisfied based on the reference data in the first transaction and the r- _part ri received in the one or more second transactions, and conditions it. Said challenge is configured to return a true value as the following criteria:

where r ₁ +r ₂ denote scalar addition and

p is a prime number and

k _i is the ephemeral key, G is the elliptic curve generator, [] _x denotes the x coordinate of […], [] _y denotes the y coordinate of […], '・' is the elliptic curve scalar A first transaction, showing multiplication.