TW202029687A - Threshold signature system based on secret sharing without dealer and method thereof - Google Patents

Abstract

A threshold signature system based on secret sharing and method thereof is disclosed. By selecting a plurality of execution nodes through a front end host, and executing a joint random secret sharing (JRSS) algorithm and a joint random zero-value secret sharing (JZSS) algorithm to generate a plurality of shares by the selected execution nodes, and computing and exchanging messages on the execution nodes through a multi-party computation (MPC), so as to generate a public key and a transaction signature of the corresponding shares according to the result of computing and exchanging message, and embedding the transaction signature in a raw transaction message and then broadcasting that to a blockchain network. The mechanism is help to improve the impartiality of the signature without generating a private key.

Description

Threshold type signature system and method based on secret sharing of no dispatcher

The invention relates to a signature system and a method thereof, in particular to a threshold type signature system and a method based on secret sharing without dispatchers.

In recent years, as governments, organizations, and people attach importance to information security, various applications based on electronic signatures (hereinafter referred to as signatures) have sprung up. Among them, the application of Multisig (Multisig) has attracted the most attention.

Generally speaking, multi-party signing means that multiple users sign the same message. For example, in a blockchain transaction (Blockchain Transaction), a transaction allows N users to use their own private key (Private Key) To sign it, that is to say, N private keys are allowed to be signed, and as long as there are M users signing (M<N), it means that the payment transaction is allowed. As the number of users who can participate in transactions increases, the transaction methods that can be applied are also more diverse. However, there are many problems with multi-party signatures. For example, multi-party signatures will increase transaction messages and result in more expensive handling fees; privacy is low, and outsiders can know which addresses M or N are, and then track other addresses in each address. Transaction; the realization of smart contract requires multiple transactions to complete; the replacement of M members needs to re-establish the wallet, or replace according to the content of the smart contract.

In view of this, some manufacturers have proposed a technology with a secret sharing algorithm. By decomposing the private key into multiple shared units (Share), each party holds a different shared unit to share the same blockchain. The transaction information is calculated to generate a signature. In this way, the size of the transaction message can be effectively controlled, and because the complete address is not used, it is more private. When members are replaced, all shared units can be updated, but the original private key is maintained, so it is more flexible Sex. However, this method will generate a private key on the server side. When the server side is hacked, the private key will be leaked, allowing unauthorized persons to use the private key for signing and destroying the integrity of the signature. The method has the problem of poor impartiality of the signature.

In summary, it can be seen that the prior art has always had the problem of poor integrity of signatures for a long time. Therefore, it is necessary to propose improved technical means to solve this problem.

The present invention discloses a threshold type signature system and method based on secret sharing without dispatchers.

First of all, the present invention discloses a threshold signature system based on secret sharing without dispatchers. The system includes a client and a server. The client is allowed to be one of multiple execution nodes, and to send transaction requests and key requests including threshold and total values, where the threshold is less than or equal to the total value, and the threshold and total value are both greater than the value A positive integer of 1.

On the server side, it includes a front-end host and multiple nodes. Wherein, the front-end host is used to receive the transaction request and the key request, and select the same number of execution nodes as the total value according to the key request, and generate according to the transaction request and the blockchain data format when the blockchain transaction is initiated The corresponding original transaction message is transmitted; the node is connected to the front-end host, and the node selected by the front-end host is used as the execution node. Each execution node includes: an execution module, a key module, a calculation module, and a signature module . Among them, the execution module is used to execute the Joint Random Secret Sharing (JRSS) algorithm, select random polynomials for calculation, and exchange calculation results with each execution node to generate the corresponding private key sharing unit, and execute two The second joint random secret sharing algorithm generates the corresponding first and second shared units, and then performs the second joint random zero secret sharing (JZSS) algorithm to generate the corresponding third shared unit And the fourth sharing unit; the key module is connected to the execution module to broadcast the product value of the generated private key sharing unit to the base point (Base Point), and calculate the public based on the sum of the product values broadcast by each execution node Key; The calculation module is connected to the execution module to calculate the corresponding first broadcast value and second broadcast according to the first shared unit, second shared unit, third shared unit, and fourth shared unit owned by each execution node Value, where the first broadcast value is the first shared unit multiplied by the second shared unit, plus the third shared unit, and the second broadcast value is the second shared unit multiplied by the base point, and the first broadcast calculated by each broadcast The numerical value and the second broadcast value, and the curve coordinate point is calculated according to all the first broadcast value and the second broadcast value; the signature module is connected to the execution module, the key module and the calculation module to perform the elliptic curve digital signature calculation Method (Elliptic Curve Digital Signature Algorithm, ECDSA) threshold signing agreement, based on the original transaction message, the X coordinate of the curve coordinate point, and the first shared unit, private key shared unit and fourth shared unit owned by each to perform calculations and exchange messages When the number of calculated and exchanged messages meets the threshold, at least one of the execution nodes generates a transaction signature based on the result of the calculation and exchange of messages, and embeds this transaction signature into the original transaction message to generate a signed transaction message, And broadcast the signed transaction message to the blockchain network.

In addition, the present invention discloses a threshold signature method based on secret sharing without dispatchers, which is applied in a network environment with a client and a server. The server includes a front-end host and multiple nodes. The steps include: client transmission A key request including the threshold value and total value is sent to the front-end host of the server, where the threshold value is less than or equal to the total value, and the threshold and total value are both positive integers greater than the value 1. The front-end host requests the key according to the received key , Select the same number as the total value from the nodes and clients as the execution nodes. Each execution node executes a joint random secret sharing algorithm to select random polynomials for calculations, and exchanges the calculation results with each execution node Generate the corresponding private key sharing unit; each execution node broadcasts the product value of the private key sharing unit to the base point, and calculates the public key according to the sum of the product values broadcast by each execution node; at the beginning of the blockchain transaction , The front-end host of the server receives the transaction request from the client, and generates the corresponding original transaction message according to the transaction request and the blockchain data format, and sends the original transaction message to the client and each execution node; each execution node executes two The second JRSS algorithm is used to generate the corresponding first shared unit and the second shared unit, and the second JZSS algorithm is executed to generate the corresponding third shared unit and the fourth shared unit; each execution node is based on its own first shared unit The unit, the second sharing unit, the third sharing unit, and the fourth sharing unit calculate the corresponding first broadcast value and the second broadcast value, where the first broadcast value is the first sharing unit multiplied by the second sharing unit, plus The third sharing unit, the second broadcast value is the second sharing unit multiplied by the base point; each execution node broadcasts the first broadcast value and the second broadcast value calculated separately, and is calculated based on all the first broadcast values and the second broadcast value The curve coordinate point; and the threshold signature agreement for each execution node to execute the elliptic curve digital signature algorithm, which is used according to the original transaction message, the X coordinate of the curve coordinate point and the first shared unit, private key shared unit and The four shared units perform calculations and exchange messages. When the number of calculations and exchanges meets the threshold, at least one of the execution nodes generates a transaction signature based on the results of the calculation and exchange of messages, and embeds the transaction signature into the original transaction message. Generate signed transaction messages and broadcast the signed transaction messages to the blockchain network.

The system and method disclosed in the present invention are as above. The difference from the prior art is that the present invention selects multiple execution nodes through the front-end host, and the execution nodes execute the joint random secret sharing algorithm and the joint random zero-value secret sharing algorithm to generate shared units , And calculate and exchange messages on the shared unit through secure multi-party operations, so as to generate the public key and transaction signature of the corresponding shared unit based on the results of the calculation and exchange of messages, and embed the transaction signature into the original transaction message and broadcast it to the blockchain And broadcast the signed transaction information to the blockchain network.

Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the fairness of the signature without generating a private key.

Hereinafter, the implementation of the present invention will be described in detail with the drawings and embodiments, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

Before explaining the threshold signature system and method based on secret sharing without dispatcher disclosed in the present invention, firstly, the self-defined terms of the present invention will be explained. The various "shares" mentioned in the present invention are as follows: ："Private Key Sharing Unit", "First Sharing Unit", "Second Sharing Unit", "Third Sharing Unit", "Fourth Sharing Unit" and "Signature Sharing Unit" all refer to the execution of secret sharing calculations Methods, such as: joint random secret sharing algorithm, joint random zero-value secret sharing algorithm, etc., the elements required for calculation, these elements will be executed in the secure multi-party calculation (Secure Multi-Party Computation, SMC/MPC) ), exchange between different execution nodes, and used to calculate the transaction signature (or "signature"), namely: "(r, s)", where "r" is the curve coordinate point The X coordinate of "s" is the signature value calculated by interpolation. The calculation method of transaction signature will be further explained later. Next, the first broadcast and the second broadcast numerical value and means when executed JRSS JZSS, other values need to be broadcast to the node is performed, such as: "v _i" and "w _i" Further, the dispatcher is not the It means that the private key is not generated and distributed by a single party, but the corresponding public key and the transaction signature conforming to the ECDSA signature format are calculated by multiple parties after the JRSS and JZSS jointly calculate and exchange messages.

The following diagrams will further explain the threshold signature system and method of the present invention based on secret sharing without dispatchers. Please refer to "Figure 1" first. "Figure 1" is the threshold of the present invention based on secret sharing without dispatchers. The system block diagram of the type signature system. This system includes: a client 110 and a server 120. Among them, the client 110 is used to allow being one of multiple execution nodes, and to send transaction requests and key requests including thresholds and total values, where the threshold is less than or equal to the total, and both the threshold and total are Is a positive integer greater than the value 1. In actual implementation, both the client 110 and the execution node 130 set the same secret sharing parameters in advance. The secret sharing parameters include elliptic curve, prime number, base point, and order values for executing the joint random secret sharing algorithm and The joint random zero-valued secret sharing algorithm is used. For example, the parameters on the curve of "Secp256k1" of the general algorithm of ECDSA can be used as the secret sharing parameters.

The server 120 includes: a front-end host 121 and a node 122, where the front-end host 121 is used to receive transaction requests and key requests, and select the same number of execution nodes 130 as the total value according to the key request, and in the initial block chain transaction When, according to the transaction request and the blockchain data format, the corresponding original transaction message is generated for transmission. In actual implementation, the transaction request may include a source address, such as the blockchain address of the client 110 (or “account address”), so that the server 120 can self-storage space (for example: data) based on the source address. The shared unit of the corresponding client 110 is queried in the library) to use the queried shared unit to calculate the original transaction message to generate the signature when the threshold signing agreement is executed. In addition, the blockchain data format includes the data format of the Bitcoin blockchain, the Ethereum blockchain or other similar blockchains. Assuming that the blockchain data format is the Bitcoin blockchain, Then the transaction request of the blockchain will be converted to the transaction data format of Bitcoin. If the data format of the blockchain is the Ethereum blockchain, the transaction request of the blockchain will be converted to the transaction data format of Ethereum.

The node 122 is connected to the front-end host 121, and uses the node 122 selected by the front-end host 121 as the execution node 130. In other words, the difference between the node 122 and the execution node 130 is only whether it is selected by the front-end host 121. Each execution node 130 includes: an execution module 131, a key module 132, a calculation module 133, and a signature module 134. The execution module 131 is used to execute a joint random secret sharing algorithm, select a random polynomial for calculation, and exchange calculation results with each execution node to generate a corresponding private key sharing unit, and execute a second joint random secret sharing algorithm To generate the corresponding first sharing unit and the second sharing unit, and then execute the second joint random zero value secret sharing algorithm to generate the corresponding third sharing unit and the fourth sharing unit. In actual implementation, the JRSS algorithm and the JZSS algorithm perform calculations and exchange messages through secure multi-party calculations. Whenever a value is calculated using MPC, each execution node 130 needs to be online at the same time. In addition, the purpose of executing the JRSS algorithm and the JZSS algorithm is mainly to make each execution node 130 generate random numbers, and these generated random numbers can be combined through calculations and then just converted into the desired value, such as: The value of d*r", where "d" represents the private key and "r" represents the X coordinate in the curve coordinate point. In this way, in the calculation formula with "d*r", whether there is "d" is no longer important, because the value of "d*r" is directly known. In order to improve security, the joint 130 may perform a random value of zero for each node performing secret sharing algorithm to generate a corresponding random number value "z _i", and this random number value with a respective private key sharing unit "Sd _i" phase Add a random value "Sd ^' _i ".

Key module 132 performs the connection module 131 to generate a multiplied value of the private key shared broadcast unit "Sd _i" to point "G", and the value calculated according to well sum of product values 130 for each execution node broadcasts key. For example, if the broadcast product values are "Sd ₁ *G", "Sd ₂ *G" and "Sd ₃ *G", the calculation formula of the public key "Q" is "Q=Sd ₁ *G+" Sd ₂ *G+Sd ₃ *G". In actual implementation, the public key can be hashed and used as the account address of the client 110 so that blockchain transactions can be carried out through the account address. The hashing refers to the use of Secure Hash Algorithm (SHA), such as : SHA3, SHA256, or similar algorithms for calculation.

The calculation module 133 is connected to the execution module 131 for calculating the corresponding first broadcast value and the corresponding first shared unit, second shared unit, third shared unit, and fourth shared unit owned by each execution node 130. The second broadcast value, where the first broadcast value is the first shared unit multiplied by the second shared unit, plus the third shared unit, and the second broadcast value is the second shared unit multiplied by the base point, and the calculated value of each broadcast The first broadcast value and the second broadcast value, and the curve coordinate points are calculated based on all the first broadcast values and the second broadcast value. For example, suppose that the first shared unit is "k _i ", the second shared unit is "a _i ", the third shared unit is "b _i ", the fourth shared unit is "c _i ", and the first broadcast value is "V _i ", the second broadcast value is "w _i ", and the base point is "G", then the calculation method of the first broadcast value is "v _i = k _i *a _i + b _i ", the second broadcast value is The calculation method is "w _i =a _i *G", where "i" represents the number of execution nodes 130, "i" is the value 1 for the first execution node 130, and "i" is the value 2 for the second Execution node 130, and so on, "i" is the value 5 representing the fifth execution node 130, that is, the value of "i" is equal to the total value. In particular, the second shared unit is "a _i ", the third shared unit is "b _i ", and the fourth shared unit is "c _i ". The purpose of the calculation formula is to avoid leakage. The first shared unit is "k _i" mask (mask). In addition, the calculation formula can be the value of the remaining number, taking "v _i = k _i *a _i + b _i "as an example, it can be "v _i = k _i *a _i + b _i mod q" , Where "q" is the divisor.

The signature module 134 is connected to the execution module 131, the key module 132, and the calculation module 133 to execute the threshold signature agreement of the elliptic curve digital signature algorithm, so as to be based on the original transaction message, the X coordinate of the curve coordinate point and Each has the first shared unit, a selected set of values, and the fourth shared unit to calculate and exchange messages. For example, suppose the value of the original transaction message after the hash processing is "e", and the X coordinate of the curve coordinate point is "r", the first sharing unit is "k _i", the private key sharing unit is "Sd _i" sharing unit and the fourth is "c _i", it can be "s _i = k _i ^-1 (e calculated according to the equation +Sd _i r)" calculates the signature sharing unit "s _i "of each execution node 130, and uses it as the message to be exchanged. When the number of calculated and exchanged messages meets the threshold (for example, the number of "s _i "and the threshold are both the value 3), at least one of the execution nodes 130 will generate a transaction signature based on the result of the calculation and exchange of messages. For example, since the execution node 130 will calculate the signature sharing unit by itself, it will also obtain the signature sharing unit calculated by other execution nodes 130 after exchanging messages. Therefore, all the execution nodes 130 calculated Each signature sharing unit uses Lagrangian interpolation to calculate the signature value "s". For example, assuming there are three execution nodes 130, the signature value is calculated as "s=L[(1,s ₁ )+(2,s ₂ )+(3,s ₃ )][0]”, where L stands for Lagrangian interpolation, and “[0]” stands for the value at x=0 and is in line with the curve coordinate The X coordinate "r" of the point forms a pair (Pair), and then the transaction signature "(r, s)" is obtained. Then, embed the transaction signature "(r, s)" into the original transaction message to generate a signed transaction message, and broadcast the signed transaction message to the blockchain network. In particular, during the calculation process, if the value of "r" or "s" is zero, then the calculation will be repeated until the value is not zero.

In particular, it should be noted that in actual implementation, each module described in the present invention can be implemented in various ways, including software, hardware, or any combination thereof. For example, in some embodiments, each module can be It can be implemented by software and hardware or one of them. In addition, the present invention can also be implemented partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, System on Chip (SoC), Complex Programmable Logic Device (CPLD), Field Programmable Gate Array (FPGA) and so on. The present invention can be a system, method and/or computer program. The computer program may include a computer-readable storage medium loaded with computer-readable program instructions for enabling the processor to implement various aspects of the present invention. The computer-readable storage medium may be a tangible storage medium that can hold and store instructions used by an instruction execution device. equipment. The computer-readable storage medium can be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer-readable storage media include hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. The computer-readable storage medium used here is not interpreted as the instantaneous signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, optical signals through fiber optic cables), or through wires Transmission of electrical signals. In addition, the computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to various computing/processing devices, or downloaded via a network, such as the Internet, local area network, wide area network and/or wireless network To an external computer device or external storage device. The network may include copper transmission cables, optical fiber transmission, wireless transmission, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network, and forwards the computer-readable program instructions for storage in the computer-readable storage media in each computing/processing device in. The computer program instructions for performing the operations of the present invention may be combined language instructions, instruction set architecture instructions, machine instructions, machine-related instructions, micro instructions, firmware instructions, or source code or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby, PHP, etc., as well as conventional programs Procedural programming language, such as C language or similar programming language. Computer readable program instructions can be executed entirely on the computer, partly on the computer, executed as a stand-alone software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server Executed on.

Please refer to "Figure 2A" and "Figure 2B". "Figure 2A" and "Figure 2B" are the flowcharts of the threshold signature method based on the secret sharing of no dispatcher in the present invention. In the network environment of 110 and the server 120, the server 120 includes a front-end host 121 and a node 122, and the steps include: the client 110 sends a key request including a threshold value and a total value to the front-end host 121 of the server 120 , Where the threshold value is less than or equal to the total value, and both the threshold value and the total value are positive integers greater than the value 1 (step 210); the front-end host 121 selects from the node 122 and the client 110 according to the received key request The same number as the total value is used as multiple execution nodes 130. Each execution node 130 executes a joint random secret sharing algorithm to select a random polynomial for calculation, and exchange the calculation results with each execution node to generate a corresponding Private key sharing unit (step 220); each execution node 130 broadcasts the product value of the private key sharing unit to the base point, and calculates the public key based on the sum of the product values broadcast by each execution node 130 (step 230); At the beginning of the blockchain transaction, the front-end host 121 of the server 120 receives the transaction request from the client 110, generates the corresponding original transaction message according to the transaction request and the blockchain data format, and sends the original transaction message to Client 110 and each execution node 130 (step 240); each execution node 130 executes a second joint random secret sharing algorithm to generate the corresponding first and second shared units, and executes a second joint random zero value The secret sharing algorithm is used to generate the corresponding third sharing unit and fourth sharing unit (step 250); each execution node 130 according to its own first sharing unit, second sharing unit, third sharing unit and fourth sharing unit Calculate the corresponding first broadcast value and second broadcast value, where the first broadcast value is the first shared unit multiplied by the second shared unit, plus the third shared unit, and the second broadcast value is the second shared unit multiplied by Base point (step 260); each execution node 130 broadcasts its own calculated first broadcast value and second broadcast value, and calculates the curve coordinate point based on all the first broadcast values and the second broadcast value (step 270); each execution The node 130 executes the threshold signing agreement of the elliptic curve digital signature algorithm for calculation and exchange based on the original transaction message, the X coordinate of the curve coordinate point, and the first shared unit, private key shared unit, and fourth shared unit owned by each Message, when the number of calculated and exchanged messages meets the threshold, at least one of the execution nodes 130 generates a transaction signature based on the result of the calculation and exchange of messages, and embeds the transaction signature into the original transaction message to generate a signed transaction Message and broadcast the signed transaction message to the blockchain network (step 280). Through the above steps, multiple execution nodes 130 can be selected through the front-end host 121. The execution nodes 130 execute the joint random secret sharing algorithm and the joint random zero-value secret sharing algorithm to generate shared units, and perform secure multi-party operations on the shared units. Calculate and exchange messages so as to generate the public key and transaction signature of the corresponding shared unit based on the results of the calculation and message exchange, and embed the transaction signature into the original transaction message and broadcast it to the blockchain network.

The following description will be given in the form of embodiment in conjunction with "Figure 3" and "Figure 4". Please refer to "Figure 3" first. "Figure 3" is the application of the present invention to generate a private key sharing unit and calculate a public key. Schematic. In actual implementation, after the client 110 sends a key request to the front-end host 121 of the server 120, the front-end host 121 of the server 120 will send a request from the node 122 of the server 120 and the client 110 according to the received key request. The same number as the total value is selected as the execution node 130. Then, each execution node 130 executes the JRSS algorithm to select a random polynomial "d _i "for calculation. For example, assuming there are three execution nodes 130, the first execution node 130 selects the random polynomial "d ₁ =x ² +x+1", and the values 1 to 3 are respectively brought into x to obtain three calculation results; the second execution node 130 selects a random polynomial "d ₂ = x ² + x+3", and also changes the values 1 to 3 are brought into x to obtain three calculation results, and so on, the third execution node 130 selects a random polynomial "d ₃ = x ² + x+4", and also brings the values 1 to 3 into x to get Three calculation results. Next, each execution node 130 will exchange the calculation results (ie: each execution node 130 will provide the calculation result corresponding to the value 1 to the first execution node 130, and provide the calculation result corresponding to the value 2 To the second execution node 130, and the calculation result corresponding to the value 3 is provided to the third execution node 130) to generate the corresponding shared unit (ie: private key sharing unit "Sd _i "), which can be stored in database. Then, continue to perform JRSS algorithm calculations and exchange messages through MPC to broadcast the generated private key sharing unit "Sd _i "to the base point "G" product value "Sd _i *G", and broadcast according to each execution node 130 The public key "Q" is calculated by the sum of the product values of, and the public key can be stored in the database corresponding to the corresponding private key sharing unit. For example, assuming the threshold value is 2 and the total number is 3, the front-end host 121 will select three execution nodes 130. When these execution nodes execute the JRSS algorithm, assume that the first execution node 130 generates a private key sharing unit "Sd ₁ ", the second execution node 130 generates the private key sharing unit "Sd ₂ ", and the third execution node 130 generates the private key sharing unit "Sd ₃ ", and multiply the base point "G" to obtain "Sd" respectively. ₁ *G", "Sd ₂ *G" and "Sd ₃ *G" are used as the product value of the base point of the private key sharing unit and broadcast. In this way, each execution node 130 will have the product values "Sd ₁ *G", "Sd ₂ *G" and "Sd ₃ *G" of the three private key sharing units to the base point. At this time, each execution node 130 As long as the product values of these three private key sharing units to the base point are added, the public key "Q" can be calculated, and the calculation formula is "Q=Sd ₁ *G+Sd ₂ *G+Sd ₃ *G" . In this way, it can be ensured that no one can know the private key "d", because "d=Sd ₁ +Sd ₂ +Sd ₃ ", but there is a problem on the elliptic curve, even if "d*G" and "G", it is still very difficult to know "d". In addition, the public key "Q" can be used as the account address of the client 130 after hashing. It should be added that, as mentioned earlier, the number of nodes 122 and client 110 of the server 120 and the client 110 are selected as the execution node 130. The purpose is to allow the client 110 to have the opportunity to participate in it, not It is calculated and stored only by the server 120. In other words, if the client 110 is selected as one of the execution nodes 130, then the client 110 can participate in the calculation and storage. If the client 110 is not selected, then the execution node 130 of the server 120 will perform the calculation and storage. store. Therefore, the client 110 may include all modules and functions of the execution node 130, so that when the front-end host 121 selects the client 110, it can become one of the execution nodes 130.

As shown in "Figure 4", "Figure 4" is a schematic diagram of calculating and generating signatures using the present invention. At the beginning of the blockchain transaction, the client 110 will send a transaction request to the server 120, and the server 120 will query the corresponding client 110 from the storage space (for example: database) according to the source address of the transaction request. Shared unit. At the same time, the server 120 will generate the original transaction message according to the transaction request and the blockchain data format. That is to say, assuming that the blockchain data format uses the data format of Ethereum, the original transaction message generated will conform to the Ethereum data format. Data format; assuming that the blockchain data format is the data format of Bitcoin, the original transaction message generated will conform to the data format of Bitcoin. Then, the server 120 sends the generated original transaction message to the client 110 and the execution node 130. Assuming that the client 110 is one of the execution nodes, the execution node 130 of the client 110 and the server 120 will perform MPC to perform threshold signatures on the original transaction message, where MPC includes multiple executions of the JRSS algorithm and the JZSS algorithm Steps of calculating and exchanging messages, finally generate a transaction signature and embed the original transaction message to generate a signed transaction message, and broadcast the generated signed transaction message to the blockchain network.

In practical implementation, since the beginning of the database does not exist corresponding shared cell, so the i-th execution node 130 performs secondary JRSS algorithm to generate a corresponding share of the first unit "k _i" and the second shared cell "A _i ", and execute the second JZSS algorithm to generate the corresponding third shared unit "b _i "and fourth shared unit "c _i ". Next, each node 130 according to a first execution units each have shared "k _i", the second sharing unit "a _i", the third sharing unit "b _i" and the fourth shared element "c _i" corresponding to the first computing broadcasting a value "v _i" and the second broadcast values "w _i", wherein the first broadcast value "v _i" of a first shared element "k _i" is multiplied by the second sharing unit "a _i" plus The third shared unit "b _i ", that is, "v _i = k _i *a _i + b _i "; the second broadcast value "w _i "is the second shared unit "a _i " multiplied by the base point "G", also That is "w _i =a _i *G". Then, each execution node 130 broadcasts the first broadcast value "v _i "and the second broadcast value "w _i " calculated separately, and performs Lagrangian interpolation calculations based on all the first broadcast values, and executes the above three Take node 130 as an example, that is: "v=L[(1,v ₁ )+(2,v ₂ )+(3,v ₃ )][0]", where L represents Lagrangian interpolation, ""[0]" represents the value at x=0", and then multiply the reciprocal of the calculation result by the sum of all the second broadcast values, namely: "w=w ₁ +w ₂ +w ₃ " to calculate the curve coordinate point "(R _x , R _y )", the calculation method is "(R _x , R _y )=w*v ^-1 ". Next, each execution node 130 executes the threshold signature agreement of the elliptic curve digital signature algorithm, which is used according to the original transaction message "m", the X coordinate of the curve coordinate point (ie: r=R _x ), and their own a shared cell "k _i", the private key sharing unit "Sd _i" and the fourth shared element "c _i" is calculated and exchange messages, when the amount of calculation and to exchange messages satisfy the threshold, the node 130 by the execution of at least 1. Generate a transaction signature "(r, s)" based on the results of calculation and exchange of messages, where "r" is the X coordinate of the curve coordinate point; the calculation method of "s" is that each execution node 130 exchanges their respective calculations The result calculated by the formula "s _i = k _i ^-1 (e+Sd _i r)" is calculated by interpolation (Interpolation), where "e" is the original transaction message "m" after hashing. For example, if there are three execution nodes 130, the calculation formula of the first execution node 130 is "s ₁ = k ₁ ^-1 (e+Sd ₁ r)"; the calculation formula of the second execution node 130 is "S ₂ = k ₂ ^-1 (e+Sd ₂ r)"; the calculation formula of the third execution node 130 is "s ₃ = k ₃ ^-1 (e+Sd ₃ r)", which is calculated by MPC and After exchanging messages, each execution node 130 has "s ₁ ", "s ₂ "and "s ₃ ". Therefore, the signature value "s" can be calculated using Lagrangian interpolation, for example: "s =L[(1,s ₁ )+(2,s ₂ )+(3,s ₃ )][0]”, where L stands for Lagrangian interpolation, and “[0]” stands for x =0. In this way, the value of "r" and the value of "s" can be combined into a pair as the transaction signature "(r, s)". Finally, embed the transaction signature into the original transaction message to generate a signed transaction message, and broadcast the signed transaction message to the blockchain network.

In summary, it can be seen that the difference between the present invention and the prior art is that multiple execution nodes are selected by the front-end host, and the execution nodes execute the joint random secret sharing algorithm and the joint random zero-value secret sharing algorithm to generate shared units, and through Secure multi-party calculations calculate and exchange messages on the shared unit, so as to generate the corresponding public key and transaction signature of the shared unit based on the results of the calculation and exchange of messages, and embed the transaction signature into the original transaction message and broadcast it to the blockchain network. With this technical means, the problems of the prior art can be solved, and the technical effect of improving the fairness of the signature can be achieved without generating a private key.

Although the present invention is disclosed in the foregoing embodiments as above, it is not intended to limit the present invention. Anyone familiar with similar art can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

110: client 120: server 121: front-end host 122: node 130: execution node 131: execution module 132: key module 133: calculation module 134: signature module Step 210: client transmission includes a threshold A key of the value and a total value is requested to the front-end host of the server, where the threshold value is less than or equal to the total value, and the threshold and the total value are both positive integers greater than the value 1. Step 220: the front-end host According to the received key request, the self node and the client select the same number as the total number as multiple execution nodes, and each execution node executes a joint random secret sharing algorithm to select a random Polynomial is calculated, and the calculation result is exchanged with each execution node to generate a corresponding private key sharing unit. Step 230: Each execution node broadcasts a product value of the private key sharing unit generated by each execution node to a base point, and according to each execution The total value of the product value broadcast by the node calculates a public key. Step 240: At the beginning of the blockchain transaction, the front-end host of the server receives a transaction request from the client, and based on the transaction request and the blockchain data Format to generate a corresponding original transaction message, and send the original transaction message to the client and each execution node Step 250: Each execution node executes the joint random secret sharing algorithm twice to generate a corresponding first share Unit and a second shared unit, and execute a second-time-joint random zero-valued secret sharing algorithm to generate a corresponding third shared unit and a fourth shared unit Step 260: Each execution node according to its own first The sharing unit, the second sharing unit, the third sharing unit, and the fourth sharing unit calculate a corresponding first broadcast value and a second broadcast value, where the first broadcast value is the first sharing unit multiplied by After the second sharing unit, the third sharing unit is added, and the second broadcast value is the second sharing unit multiplied by the base point. Step 270: Each execution node broadcasts the first broadcast value and the first broadcast value calculated by each execution node. Two broadcast values, and calculate a curve coordinate point according to all the first broadcast values and the second broadcast values. Step 280: Each execution node executes a threshold signature agreement of the elliptic curve digital signature algorithm for the original transaction The message, an X coordinate of the curve coordinate point, and the first sharing unit, the private key sharing unit, and the fourth sharing unit owned by each of them perform calculations and exchange messages, when the number of calculations and exchange messages meets the threshold At this time, at least one of the execution nodes generates a transaction signature according to the result of calculation and exchange of messages, and embeds the transaction signature into the original transaction message to generate a signed transaction message, and the signed transaction message Broadcast transaction information to the blockchain network

Figure 1 is a system block diagram of the threshold signature system based on secret sharing without dispatchers of the present invention. Fig. 2A and Fig. 2B are flowcharts of the threshold signature method based on the secret sharing of no dispatcher of the present invention. Figure 3 is a schematic diagram of applying the present invention to generate a private key sharing unit and calculate a public key. Figure 4 is a schematic diagram of calculating and generating signatures using the present invention.

110: client

120: server

121: front-end host

122: Node

130: execution node

131: Execution module

132: Key Module

133: Computing Module

134: Signature Module

Claims (10)

A threshold-type signature system based on secret sharing without dispatchers. The system includes: a client to allow being one of multiple execution nodes, and transmitting a transaction request and a threshold value and a total value A key request, wherein the threshold value is less than or equal to the total value, and the threshold value and the total value are both positive integers greater than the value 1; and a server end including: a front-end host for receiving The transaction request and the key request, and according to the key request, select the same number of execution nodes as the total value, and at the beginning of the blockchain transaction, generate the corresponding corresponding to the transaction request and the blockchain data format An original transaction message for transmission; and a plurality of nodes connected to the front-end host, and the node selected by the front-end host is used as the execution node, each execution node includes: an execution module for executing a joint Joint Random Secret Sharing (JRSS) algorithm, selects a random polynomial for calculation, exchanges calculation results with each execution node to generate a corresponding private key sharing unit, and executes the joint random secret sharing calculation twice Method to generate a corresponding first shared unit and a second shared unit, and then perform a second joint random zero secret sharing (Joint Random Zero Secret Sharing, JZSS) algorithm to generate a corresponding third shared unit and a The fourth sharing unit; a key module connected to the execution module for broadcasting a product value of the generated private key sharing unit to a base point, and calculating the sum of the product values broadcast by each execution node A public key; a calculation module connected to the execution module to calculate according to the first shared unit, the second shared unit, the third shared unit, and the fourth shared unit owned by each execution node Correspondingly a first broadcast value and a second broadcast value, where the first broadcast value is the first shared unit multiplied by the second shared unit and the third shared unit is added, and the second broadcast value is The second sharing unit multiplies the base point, broadcasts the first broadcast value and the second broadcast value calculated respectively, and calculates a curve coordinate point based on all the first broadcast values and the second broadcast value; and The signature module is connected to the execution module, the key module and the calculation module to execute a threshold signature agreement of the elliptic curve digital signature algorithm, according to the original transaction message and a curve coordinate point The X coordinate and the first sharing unit, the private key sharing unit, and the fourth sharing unit owned by each of them perform calculations and exchange messages. When the number of calculations and exchange messages meets the threshold, the execution node at least One of them generates a transaction signature based on the results of calculation and exchange of messages, and embeds the transaction signature into the original transaction message to generate a signed transaction message, and broadcasts the signed transaction message to the blockchain network road. According to the first item of the scope of patent application, the threshold signature system based on secret sharing without dispatcher, wherein the client and the execution node are preset with the same secret sharing parameter, and the secret sharing parameter includes elliptic curve, prime number, and The values of the base point and the order are used for executing the joint random secret sharing algorithm and the joint random zero-value secret sharing algorithm. According to item 1 of the scope of patent application, a threshold signature system based on secret sharing without dispatchers, where each execution node is based on the original transaction message, the X coordinate, and the first shared unit and the private key owned by each execution node The sharing unit and the fourth sharing unit calculate a corresponding signature sharing unit, and perform a secure multi-party operation to broadcast the signature sharing unit of each execution node to calculate a signature value by interpolation, and according to the X The coordinates and the signature value generate the transaction signature. According to the first item of the scope of patent application, the threshold signature system based on secret sharing without assignees, in which the public key is hashed and used as an account address of the client, which is used to conduct blockchain transactions through the account address. The hash processing includes Secure Hash Algorithm (SHA). According to the threshold signature system based on the secret sharing of no dispatcher according to item 1 of the scope of patent application, each execution node executes the joint random zero-value secret sharing algorithm to generate a corresponding random value, and the random value is combined with The respective private key sharing units are added. A threshold-type signature method based on secret sharing without dispatchers is applied in a network environment with a client and a server. The server includes a front-end host and multiple nodes. The steps include: A key request of a threshold value and a total value is requested to the front-end host of the server, wherein the threshold value is less than or equal to the total value, and the threshold value and the total value are both positive integers greater than the value 1. According to the received key request, the front-end host selects the same number as the total number from the node and the client as multiple execution nodes, and each execution node performs a joint random secret sharing (Joint Random Secret Sharing). , JRSS) algorithm to select a random polynomial for calculation, and exchange calculation results with each execution node to generate a corresponding private key sharing unit; each execution node broadcasts the generated private key sharing unit to a base point And calculate a public key according to the sum of the product values broadcast by each execution node; at the beginning of the blockchain transaction, the front-end host of the server receives a transaction request from the client, and according to The transaction request and the blockchain data format generate a corresponding original transaction message, and send the original transaction message to the client and each execution node; each execution node executes the joint random secret sharing algorithm twice to generate Corresponding to a first sharing unit and a second sharing unit, and performing a second joint random zero secret sharing (Joint Random Zero Secret Sharing, JZSS) algorithm to generate a corresponding third sharing unit and a fourth sharing unit Unit; each execution node calculates a corresponding first broadcast value and a second broadcast value according to the first shared unit, the second shared unit, the third shared unit, and the fourth shared unit owned by each execution node, wherein, The first broadcast value is the first shared unit multiplied by the second shared unit, plus the third shared unit, and the second broadcast value is the second shared unit multiplied by the base point; each execution node broadcasts its own The first broadcast value and the second broadcast value are calculated, and a curve coordinate point is calculated based on all the first broadcast values and the second broadcast value; and a threshold for each execution node to execute the elliptic curve digital signature algorithm Signing agreement for calculating and exchanging messages based on the original transaction message, an X coordinate of the curve coordinate point, and the first sharing unit, the private key sharing unit and the fourth sharing unit owned by each, When the number of calculated and exchanged messages meets the threshold, at least one of the execution nodes generates a transaction signature based on the result of the calculation and exchange of messages, and embeds the transaction signature into the original transaction message to generate a signed transaction Chapter transaction information, and broadcast the signed transaction information to the blockchain network. According to item 6 of the scope of patent application, the threshold signature method based on secret sharing without dispatcher, wherein the client and the execution node are preset with the same secret sharing parameter, the secret sharing parameter includes elliptic curve, prime number, and The values of the base point and the order are used for executing the joint random secret sharing algorithm and the joint random zero-value secret sharing algorithm. According to item 6 of the scope of patent application, the threshold type signature method based on secret sharing without dispatcher, wherein each execution node is based on the original transaction message, the X coordinate, and the first shared unit and the private key owned by each The sharing unit and the fourth sharing unit calculate a corresponding signature sharing unit, and perform a secure multi-party operation to broadcast the signature sharing unit of each execution node to calculate a signature value by interpolation, and according to the X The coordinates and the signature value generate the transaction signature. According to item 6 of the scope of patent application, the threshold-style signature method based on secret sharing without assignors, in which the public key is hashed and used as an account address of the client to perform blockchain transactions through the account address. The hash processing includes Secure Hash Algorithm (SHA). According to the threshold signature method based on the secret sharing of no dispatcher in item 6 of the scope of patent application, each execution node executes the joint random zero-value secret sharing algorithm to generate a corresponding random value, and the random value is combined with The respective private key sharing units are added.

Images