TW202345542A - Threshold signature generation system based on garbled circuit and method thereof - Google Patents

Abstract

A threshold signature generation system based on garbled circuit and method thereof is disclosed. By providing a first Boolean circuit and a second Boolean circuit as the garbled circuit for two hosts to input a plurality of input parameters and jointly to perform secure multi-party computation, so as to the two hosts each obtain a first evaluation value of the first Boolean circuit and a second evaluation value of the second Boolean circuit, and broadcasting the product of the random number and the base point of each host, and verifying whether the input parameters of both parties are correct and whether the results obtained by the garbled circuit are the same, and then generating a Edwards-curve Digital Signature Algorithm (EdDSA) signature that can pass the verification when they are correct and the same. The mechanism is help to improve the security when generating the EdDSA signature.

Description

Threshold signature generation system and method based on confusion circuit

The present invention relates to a signature generation system and a method thereof, in particular to a threshold signature generation system and method based on a confusion circuit.

In recent years, with the popularity and vigorous development of blockchain, various blockchain-based transaction technologies have sprung up. However, the traditional method of simply generating a signature (or signature) by one party is no longer safe enough, which makes manufacturers eager to find ways to generate signatures more securely.

Generally speaking, the traditional signature method is for one party to the transaction to encrypt with the private key, and then provide the encryption result to the other party for verification using the public key corresponding to the private key. However, if the private key is lost, the signature may be forged. Therefore, in order to strengthen the security of assets and transactions, some manufacturers have further developed technical means that can generate a corresponding number of signatures through multiple different private keys, and only when a certain number of signatures are obtained, the transaction will be successful. In this way Come, even if one of the private keys is stolen, lost, etc., the security of the transaction can be ensured. However, this method is no longer secure when the number of lost private keys reaches the threshold, so there is still a problem of insufficient security.

In view of this, various manufacturers urgently need a method that can generate a verifiable EdDSA signature without requiring a complete private key, and fully complies with the generation method defined by EdDSA. This method can greatly increase the number of EdDSA signatures generated. Security, effectively preventing the private key from being illegally obtained due to memory cache side-channel attacks, and thus the possibility of forged signatures.

To sum up, it can be seen that there has long been a problem of insufficient security in the traditional generation of EdDSA signatures in the previous technology. Therefore, it is necessary to propose improved technical means to solve this problem.

The invention discloses a threshold signature generation system and method based on confusion circuit.

First, the present invention discloses a threshold signature generation system based on a confusion circuit, which includes: two hosts, a first host and a second host respectively. The first host has a secret d ₁ , a secret k ₁ , and an X coordinate. x ₁ and level value n ₁ , the second host has secret d ₂ , secret k ₂ , X coordinate x ₂ and level value n ₂ , and secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following Operation formula to generate secret d and secret k:

"BK(x1,n1) * d1 + BK(x2,n2) * d2 = d"; and

"BK(x1,n1) * k1 + BK(x2,n2) * k2 = k".

Among them, "BK(x _j , n _j )" represents the Birkhoff Coefficient, j is 1 or 2, and let the EdDSA public key A be d * B, and let the verification ellipse point L be k * B , B is the base point of Ed25519 or sr25519 elliptic curve group. Each host includes: confusion module, generation module, first calculation module, second calculation module, verification module and signature Mods. Among them, the obfuscation module is used to establish a first Bollinger circuit and a second Bollinger circuit as a confusion circuit. The first Bollinger circuit allows the input of multiple input parameters. The input parameters include parameter v1, parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value. Each input parameter is allowed to bring in a set of bit values. The second Bollinger circuit is allowed to input parameter v1, parameter v2 and parameter r1. and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2", where, H ₂ (k, m) represents the concatenation of secret k and message m and then hashing. H ₂ represents the hash function, usually selected as SHA-512. m is the message. The parameter n is the number and parameters of the given elliptic curve group. The value of v1 is "BK(x ₁ ,n ₁ )k ₁ mod n", and the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n"; the generated module is used to generate the module for the host When there is a host, a random number is generated as the parameter r1 and the first hash value is disclosed, and when the host is a second host, a random number is generated as the parameter r2 and the second hash value is disclosed, where the first hash value The operation formula of the value is "H(r1 * B)", the operation formula of the second hash value is "H(r2 * B)", H represents the hash function; the first calculation module connects the generation module and the confusion module , when the host is the first host, use its own parameter v1, parameter r1 and message m to input to the first Bollinger circuit, and when the host is the second host, use its own parameter v2 and parameter r2 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the second host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute The second Bollinger circuit obtains the second evaluation value and discloses the first public value. The calculation formula of the first public value is "r1 * B"; the second calculation module is connected to the generation module and the confusion module, using When the host is the second host, use its own parameter v2, parameter r2 and message m to input to the first Bollinger circuit, and when the host is the first host, use its own parameter v1 and parameter r1 to input to the first Bollinger circuit, used to jointly execute the first Bollinger circuit, so that the first host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute The second Bollinger circuit obtains the second evaluation value and discloses the second public value. The calculation formula of the second public value is "r2 * B"; the verification module is connected to the first calculation module and the second calculation module , used to verify whether the hash value calculated by the first public value (i.e.: "r1 * B") and the second public value (i.e.: "r2 * B") obtained by itself is consistent with the first hash value received (i.e. That is: "H(r1 * B)") and the second hash value (ie: "H(r2 * B)") are equal and whether the product of the second evaluation value and the base point is equal to the verification ellipse point L, the first public value and The sum of the second public values is equal. When the verification results are all equal, the first signature value R is calculated based on the message m, the first public value, the second public value and the base point, and based on the first signature value R, EdDSA The public key A and the message m calculate the hash value c, and then calculate the corresponding value S _i based on the secret k, the message m, the hash value c, its own Birkhoff coefficient b _i and the secret d _i , where , i is a positive integer; and the signature module connection verification module is used to execute the Secure Validation Protocol to mutually verify the first evaluation obtained by both the first host and the second host in the first Bollinger circuit. The values are the same. When they are the same, all the values _{Si are} added to generate the second signature value s, and the EdDSA digital signature is generated based on the first signature value R and the second signature value s.

Next, the present invention discloses a threshold signature generation method based on a confusion circuit. The steps include: (A) providing a first host and a second host. The first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , secret k ₂ , X coordinate x ₂ and level value n ₂ , while secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following operations Formula to generate secret d and secret k:

"BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d"; and

"BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k".

Among them, "BK(x _j , n _j )" represents the Birkhoff coefficient, j is 1 or 2, and let the EdDSA public key A be d * B, and let the verification ellipse point L be k * B, and B be Ed25519 Or the base point of the sr25519 elliptic curve group; (B) Provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit. The first Bollinger circuit allows the input of multiple input parameters, and the input parameters include parameters v1, Parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value. Each of the input parameters is allowed to bring in a set of bit values. The second Bollinger circuit allows the input of parameter v1 and parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2 ”, where H ₂ (k, m) represents the concatenation of secret k and message m before hashing, the parameter n is the number of given elliptic curve groups, and the value of parameter v1 is “BK (x ₁ ,n ₁ )k ₁ mod n", the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n"; (C) The first host generates random numbers as parameter r1 and discloses the first hash value, and the second host generates The random number is used as parameter r2 and the second hash value is disclosed, where the calculation formula of the first hash value is "H(r1 * B)", and the calculation formula of the second hash value is "H(r2 * B)", H represents hash function; (D) The first host uses its own parameter v1, parameter r1 and message m and the second host uses its own parameter v2 and parameter r2 to jointly execute the first Bollinger circuit, causing the second host to execute the first Bollinger circuit according to the first The Bollinger circuit obtains the first evaluation value, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and discloses the first public value. The calculation formula of the value is "r1 * B"; (E) The second host uses its own parameter v2, parameter r2 and message m and the first host uses its own parameter v1 and parameter r1 to jointly execute the first Bollinger circuit, so that the second host uses its own parameter v1 and parameter r1 to jointly execute the first Bollinger circuit. A host obtains the first evaluation value according to the first Bollinger circuit, then uses the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and discloses the second public value, The calculation formula of the second public value is "r2 * B"; (F) The first host and the second host each verify whether the hash value calculated by the first public value and the second public value obtained by itself is consistent with the received value. The first hash value and the second hash value are equal and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value, when the verification results are all equal, The first signature value R is calculated based on the message m, the first public value, the second public value and the base point, and the hash value c is calculated based on the first signature value R, the EdDSA public key A and the message m, and then the hash value c is calculated based on the secret k, The message m, the hash value c, its own Birkhoff coefficient b _i and the secret d _i calculate the corresponding value S _i , where i is a positive integer; (G) Both the first host and the second host execute security The verification protocol (Secure Validation Protocol) mutually verifies that the first evaluation value obtained by both parties in the first Bollinger circuit is the same; and (H) the first host and the second host respectively add up all the values _Si to generate the second signature value s, and generate an EdDSA digital signature based on the first signature value R and the second signature value s. Among them, step (D) and step (E) are allowed to be executed at the same time, and step (G) and step (H) are allowed to be executed at the same time.

The system and method disclosed by the present invention are as above. The difference from the prior art is that the present invention provides a first Bollinger circuit and a second Bollinger circuit as a confusion circuit for two hosts to input multiple input parameters and jointly execute security. Multi-party calculations enable the two hosts to each obtain the first evaluation value of the first Bollinger circuit and the second evaluation value of the second Bollinger circuit, and broadcast the product of the random number and the base point of each host to verify the input parameters of both parties. Whether it is correct and whether the result obtained through the obfuscation circuit is the same, and then when it is correct and the same, an EdDSA signature that can pass the verification is generated, thereby achieving the technical effect of improving the security of generating the EdDSA signature.

Through the above technical means, the present invention can achieve the technical effect of improving the security of generating EdDSA signatures.

The embodiments of the present invention will be described in detail below with reference to the drawings and examples, so that the implementation process of how to apply technical means to solve technical problems and achieve technical effects of the present invention can be fully understood and implemented accordingly.

First, before describing the threshold signature generation system and method based on obfuscated circuits disclosed in the present invention, the terms defined by the present invention are first explained. The "EdDSA public key (indicated by "A") described in the present invention ” refers to the key that is published to all parties for signature (or signature) verification. Next, during the EdDSA private key generation process, a hash function (such as SHA512) will be used for hashing, and the first half of the hash value obtained after hashing will be used as the private key, and the second half will be the private key of the present invention. The purpose of "verification ellipse point (indicated by "L")" is to ensure that when both parties execute the obfuscation circuit, the input used by both parties is the correct input. In actual implementation, the value of EdDSA public key A is equal to d * B, and the value of verification ellipse point L is equal to k * B, where d and k are secrets (such as ciphertext, private key), and B is Ed25519 Or the base point of sr25519 elliptic curve group.

The following is a further explanation of the threshold signature generation system and method based on the obfuscation circuit of the present invention with reference to the figures. Please refer to "Figure 1" first. "Figure 1" shows the threshold type signature generation system based on the obfuscation circuit of the present invention. System block diagram of the first embodiment. This system includes: two hosts (100a, 100b), respectively the first host 100a and the second host 100b. The first host 100a has a secret d ₁ , a secret k ₁ , X coordinate x ₁ and rank value (Rank) n ₁ , the second host 100b has secret d ₂ , secret k ₂ , X coordinate x ₂ and rank value n ₂ , and secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following operational expressions to generate secret d and secret k:

"BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d"; and

"BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k".

Among them, "BK(x _j , n _j )" represents the Birkhoff coefficient, j is 1 or 2, and let the EdDSA public key A be d * B, and let the verification ellipse point L be k * B, and B be Ed25519 Or the base point of the SR25519 elliptic curve group, each host (100a, 100b) includes: a confusion module 110, a generation module 120, a first calculation module 130, a second calculation module 140, a verification module 150 and Signature module 160. Among them, the obfuscation module 110 is used to establish a first Bollinger circuit and a second Bollinger circuit as a confusion circuit. The first Bollinger circuit allows the input of multiple input parameters, and the input parameters include parameter v1, parameter v2, Parameter r1, parameter r2, parameter n and message m and output a first evaluation value. Each of the input parameters is allowed to bring in a set of bit values. The second Bollinger circuit allows input of parameter v1, parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2", where , H ₂ (k, m) represents the concatenation of secret k and message m and then hashing. The parameter n is the number of given elliptic curve groups. The value of parameter v1 is "BK (x ₁ ,n ₁ )k ₁ mod n ”, the value of parameter v2 is “BK(x ₂ ,n ₂ )k ₂ mod n”. Specifically, a confusion circuit is essentially a Boolean circuit that constructs a function from the perspective of a Boolean circuit to perform calculations so that participants can calculate the answer for a certain value without knowing the participants By inputting specific numbers into the function, secure multi-party computation in obfuscated circuits can be implemented circuit-wise. In actual implementation, the first Bollinger circuit and the second Bollinger circuit can implement confusion circuits and secure multi-party computation (Multi-Party Computation) through at least one of AND operation (AND) and exclusive OR operation (XOR). , MPC), and has multiple input lines (Wire) to input the input parameters. The set of bit values brought in by each input parameter is a 256-bit value. Taking six input parameters as an example, the total Bringing in six 256-bit values, the first Bollinger circuit satisfies the condition "MPCEdDSA(v1,v2,r1,r2,n,m) = H2(k,m) + r1 + r2 mod n" Logic circuit, the second Bollinger circuit is a logic circuit that satisfies the condition "ModAdd(v1,v2,r1,r2) = k + r1 + r2". In particular, it should be noted that, unlike ECDSA, the generation method of secret k ₁ and secret k ₂ has been clearly defined in EdDSA, instead of using random random numbers.

The generation module 120 is used to generate random numbers as parameters r1 and disclose the first hash value when the host (100a, 100b) is the first host 100a, and when the host (100a, 100b) is the second host 100a. When the host 100b is used, a random number is generated as the parameter r2 and the second hash value is disclosed, in which the calculation formula of the first hash value is "H(r1 * B)" and the calculation formula of the second hash value is "H(r2) * B)", H represents hash function.

The first calculation module 130 is connected to the generation module 120 and the obfuscation module 110. When the host (100a, 100b) is the first host 100a, it uses its own parameter v1, parameter r1 and message m to input to the first brin circuit, and when the host (100a, 100b) is the second host 100b, use its own parameter v2 and parameter r2 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the second host can The first Bollinger circuit obtains the first evaluation value, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and discloses the first public value. The expression of a public value is "r1 * B". In actual implementation, the first public value can be disclosed through broadcast.

The second computing module 140 is connected to the generation module 120 and the confusion module 110, and is used to use its own parameter v2, parameter r2 and message m to input to the first computer when the host (100a, 100b) is the second host 100b. Bollinger circuit, and when the host (100a, 100b) is the first host 100a, use its own parameter v1 and parameter r1 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the first The host obtains the first evaluation value based on the first Bollinger circuit, then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and discloses the second public value, so The calculation formula of the second public value is "r2 * B". Similarly, in actual implementation, the second public value can be disclosed through broadcasting.

The verification module 150 is connected to the first calculation module 130 and the second calculation module 140 to verify whether the hash value calculated by the first public value and the second public value obtained by itself is the same as the received first hash value. The second hash value is equal and the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value (ie: ModAdd(v1,v2,r1,r2) * B = Verification Ellipse point L + r1 * B + r2 * B, where ModAdd(v1,v2,r1,r2) represents the second evaluation value "k + r1 + r2" output by the second Bollinger circuit), when the verification results are all When they are equal, the first signature value R is calculated based on the message m, the first public value, the second public value and the base point, and the hash value c is calculated based on the first signature value R, the EdDSA public key A and the message m, and then based on The secret k, the message m, the hash value c, its own Birkhoff coefficient b _i and the secret _di are used to calculate the corresponding value S _i , where i is a positive integer. In actual implementation, the calculation formula of the first signature value R is "R = MPCEdDSA(v1,v2,r1,r2,n,m) * B – r1 * B – r2 * B", where, "MPCEdDSA (v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n", "MPCEdDSA(v1,v2,r1,r2,n,m)" represents the first Bollinger circuit; "H ₂ (k,m) + r1 + r2 mod n" is the first evaluation value; the calculation formula of the hash value c is "c = SHA512(R || A || m)", where , SHA512 is a hash function, and the symbol "||" represents concatenation. Suppose R is the string "aa" and A is the string "bb", then "R || A" is the string "aabb". In actual implementation, assuming that "ModAdd(v1,v2,r1,r2) * B" and "verification ellipse point L + r1 * B + r2 * B" are not equal, it means that the identity "v1 + v2 = verification ellipse point" cannot be satisfied. L", that is to say, the parameters v1 and v2 entered by both parties are not correct inputs, so execution stops. In other words, "ModAdd ( v1,v2,r1,r2) * B = (k + r1 + r2) * B", and then confirm that the inputs of the obfuscation circuit are correct. If any error occurs in the middle, it will cause a verification error.

The signature module 160 is connected to the verification module 150 to execute the security verification protocol to mutually verify that the first evaluation values obtained by the first host 100a and the second host 100b in the first Bollinger circuit are the same. When they are the same, the sum is added. All the numerical values S _i are used to generate a second signature value s, and an EdDSA digital signature is generated based on the first signature value R and the second signature value s. In actual implementation, the calculation formula of the numerical value S _i is "S _i = r + c * b _i * d _i ", where r = H ₂ (k,m).

It should be noted that in actual implementation, the modules described in the present invention can be implemented in various ways, including software, hardware or any combination thereof. For example, in some implementations, each module can be implemented using software and hardware, or one of them. In addition, the present invention can also be implemented partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), Complex Programmable Logic Device (CPLD), Field Programmable Gate Array (FPGA), etc. are implemented. The invention may be a system, method and/or computer program. The computer program may include a computer-readable storage medium having computer-readable program instructions for causing a processor to implement various aspects of the invention. The computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. equipment. The computer-readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. As used herein, computer-readable storage media is not to be construed as a reference to transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., optical signals through fiber optic cables), or through electrical wires. transmitted electrical signals. In addition, the computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to various computing/processing devices, or downloaded through a network, such as the Internet, a local area network, a wide area network, and/or a wireless network. to an external computer device or external storage device. Networks may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, hubs and/or gateways. A network card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium in each computing/processing device middle. Computer program instructions that perform operations of the present invention may be combination language instructions, instruction set architecture instructions, machine instructions, machine-related instructions, micro-instructions, firmware instructions, or source code or object code written in any combination of one or more programming languages. (Object Code), the programming languages include object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as C language or similar programming language. The computer program instructions may execute entirely on the computer, partly on the computer, as stand-alone software, partly on the client computer and partly on a remote computer, or entirely on the remote computer or server execute on.

Please refer to "Figure 2A" to "Figure 2C". "Figure 2A" to "Figure 2C" are method flow charts of the first embodiment of the threshold signature generation method based on confusion circuits of the present invention. The steps are The method includes: providing a first host and a second host. The first host has secret d ₁ , secret k ₁ , X coordinate x ₁ and level value n ₁ . The second host has secret d ₂ , secret k ₂ , X The coordinate x ₂ and the level value n ₂ , while the secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following calculation formulas to generate secret d and secret k:

BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d,

BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k,

Among them, "BK(x _j , n _j )" represents the Birkhoff coefficient, j is 1 or 2, and let the EdDSA public key A be d * B, and let the verification ellipse point L be k * B, and B be Ed25519 Or the base point of the sr25519 elliptic curve group (step 210); provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit, the first Bollinger circuit allows the input of multiple input parameters, the input parameters include the parameter v1 , parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit is allowed to input parameters v1, Parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2", where H ₂ (k,m) represents the concatenation of secret k and message m before hashing, message m, parameter n is the number of given elliptic curve groups, and the value of parameter v1 is "BK (x ₁ , n ₁ )k ₁ mod n", the value of parameter v2 is "BK (x ₂ ,n ₂ )k ₂ mod n" (step 220); the first host generates random numbers as parameter r1 and discloses the first hash value , the second host generates random numbers as parameter r2 and discloses the second hash value, where the calculation formula of the first hash value is "H(r1 * B)", and the calculation formula of the second hash value is "H(r2) * B)", H represents the hash function (step 230); the first host uses its own parameter v1, parameter r1 and message m and the second host uses its own parameter v2 and parameter r2 to jointly execute the first Bollinger circuit, so that The second host obtains the first evaluation value according to the first Bollinger circuit, then uses the same parameters v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and discloses the first public value. , the calculation formula of the first public value is "r1 * B" (step 240); the second host uses its own parameter v2, parameter r2 and message m to jointly execute the first host using its own parameter v1 and parameter r1. A Bollinger circuit enables the first host to obtain the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, And publish a second public value, the calculation formula of the second public value is "r2 * B" (step 250); the first host and the second host each verify the calculation of the first public value and the second public value obtained by themselves. Whether the obtained hash value is equal to the received first hash value and the second hash value and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value, When the verification results are all equal, the first signature value R is calculated based on the message m, the first public value, the second public value and the base point, and the hash is calculated based on the first signature value R, the EdDSA public key A and the message m. value c, and then calculate the corresponding value _{S i based} on the secret k, message m, hash value c, its own Birkhoff coefficient b _i and the secret di, where i is a positive integer (step 260); Both the first host and the second host execute the Secure Validation Protocol to mutually verify that the first evaluation values obtained by both parties in the first Bollinger circuit are the same (step 270); and the first host and the second host add up respectively. All the values _{Si are} used to generate a second signature value s, and an EdDSA digital signature is generated based on the first signature value R and the second signature value s (step 280). Among them, steps 240 and 250 are allowed to be executed simultaneously, and steps 270 and 280 are allowed to be executed simultaneously.

The following description will be made in the form of an embodiment with reference to "Fig. 3". "Fig. 3" is a schematic diagram of a confusion circuit applying the present invention. In actual implementation, the obfuscation circuit of the present invention includes a first Bollinger circuit 310 and a second Bollinger circuit 320 . Among them, the first Bollinger circuit 310 provides input lines to input parameter v1 (ie: "BK(x ₁ ,n ₁ )k ₁ mod n"), parameter v2 (ie: "BK(x ₂ ,n ₂ )k ₂ mod n"), parameter r1 (i.e., a random number randomly selected by the first host 100a), parameter r2 (i.e., a random number randomly selected by the second host 100b), parameter n (i.e., the number of given elliptic curve groups ) and message m, which can be expressed as "MPCEdDSA(v1,v2,r1,r2,n,m)", and output the first evaluation value "H ₂ (k,m) + r1 + r2 mod n" (where, " H ₂ (k,m)" can be regarded as "SHA512(k || m)", which represents the value obtained by first concatenating the secret k and the message m and then hashing it); the second Bollinger circuit 320 provides an input line to input the parameter v1 , parameter v2, parameter r1 and parameter r2 can be expressed as "ModAdd(v1,v2,r1,r2)", and the second evaluation value "k + r1 + r2" is output. When establishing the above-mentioned first Bollinger circuit 310, at least one of the "AND operation (AND)" and "XOR operation (XOR)" can be used to satisfy the condition "MPCEdDSA(v1,v2,r1,r2,n, m) = H ₂ (k,m) + r1 + r2 mod n" logic circuit. When establishing the second Bollinger circuit 320, "AND" and "XOR" are also used. )" At least one of them constructs a logic circuit that satisfies the condition "ModAdd(v1,v2,r1,r2) = k + r1 + r2". It should be noted in particular that in the same signature, the parameters v1, parameter v2, parameter r1, parameter r2, etc. input by the first Bollinger circuit 310 are also the parameters v1, parameter v2, parameter input by the second Bollinger circuit 320. r1 and parameter r2, and each signature will reselect parameter r1 and parameter r2.

In summary, it can be seen that the difference between the present invention and the prior art is that by providing the first Bollinger circuit and the second Bollinger circuit as confusion circuits for two hosts to input multiple input parameters and jointly perform secure multi-party calculations, Let the two hosts each obtain the first evaluation value of the first Bollinger circuit and the second evaluation value of the second Bollinger circuit, and broadcast the product of the random number and the base point of each host to verify whether the input parameters of both parties are correct and Whether the results obtained by obfuscating the circuit are the same, and then generating an EdDSA signature that can pass verification when correct and the same, this technical means can solve the problems existing in the previous technology, thereby improving the security of generating EdDSA signatures. Technical efficacy.

Although the present invention has been disclosed in the foregoing embodiments, they are not intended to limit the present invention. Anyone skilled in the similar art can make some modifications and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention is The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

100a, 100b: Host 110: Confusion module 120: Generation module 130: First calculation module 140: Second calculation module 150: Verification module 160: Signature module 310: First Bollinger circuit 320: No. Two Bollinger Circuit Step 210: Provide a first host and a second host. The first host has a secret d ₁ , a secret k ₁ , an X coordinate x ₁ and a level value n ₁ , and the second host _{There is a} secret d _{2 , a} secret k _{2 ,} an Secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ , n ₂ ) * k ₂ = k, where BK(x _j , n _j ) represents the Birkhoff coefficient, j is 1 or 2, and let an EdDSA public key A be d * B, and let a verification ellipse point L is k * B, and B is a base point of the Ed25519 or sr25519 elliptic curve group. Step 220: Provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit. The first Bollinger circuit allows multiple inputs. Parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and output a first evaluation value, each of the input parameters is allowed to enter a group Bit value, the second Bollinger circuit allows input of the parameter v1, the parameter v2, the parameter r1 and the parameter r2 and outputs a second evaluation value, the first evaluation value is H ₂ (k,m) + r1 + r2 mod n, the second evaluation value is k + r1 + r2, where H ₂ (k, m) represents the concatenation of the secret k and the message m before hashing, and the parameter n is a given elliptic curve The number of groups, the value of parameter v1 is BK(x1,n1)k1 mod n, the value of parameter v2 is BK(x2,n2)k2 mod n. Step 230: The first host generates random numbers as the The parameter r1 discloses a first hash value. The second host generates a random number as the parameter r2 and discloses a second hash value. The calculation formula of the first hash value is H(r1 * B). The calculation formula of the second hash value is H(r2 * B), and H represents the hash function. Step 240: The first host uses its own parameter v1, the parameter r1 and the message m, and the second host uses its own Parameter v2 and parameter r2 jointly execute the first Bollinger circuit, so that the second host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1 and The parameter r2 jointly executes the second Bollinger circuit to obtain the second evaluation value, and discloses a first public value. The calculation formula of the first public value is r1 * B. Step 250: The second host uses its own The parameter v2, the parameter r2 and the message m and the first host use the parameter v1 and the parameter r1 to jointly execute the first Bollinger circuit, so that the first host obtains the first Bollinger circuit according to the first Bollinger circuit. Evaluation value, and then use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a second public value, the second public value The calculation formula of the value is r2 * B. Step 260: The first host and the second host each verify whether the hash value calculated by the first public value and the second public value obtained by itself is consistent with the received first public value. The hash value is equal to the second hash value and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value, when the verification results are all equal , each calculates a first signature value R based on the message m, the first public value, the second public value and the base point, and calculates a first signature value R based on the first signature value R, the EdDSA public key A and the message m Calculate a hash value c, and then calculate a corresponding value S _i based on the secret k, the message m, the hash value c, its own Birkhoff coefficient b _i and the secret d _i , where , i is a positive integer. Step 270: Both the first host and the second host execute the Secure Validation Protocol to mutually verify that the first evaluation value obtained by both parties in the first Bollinger circuit is the same. Step 280: The first host and the second host respectively add up all the values _Si to generate a second signature value s, and generate an EdDSA digital signature based on the first signature value R and the second signature value s.

Figure 1 is a system block diagram of the threshold signature generation system based on obfuscation circuits of the present invention. Figures 2A to 2C are method flow charts of the threshold signature generation method based on obfuscation circuits of the present invention. Figure 3 is a schematic diagram of a confusion circuit using the present invention.

100a,100b: Host

110:Confusion module

120: Generate module

130:The first computing module

140: Second computing module

150: Verification module

160:Signature module

Claims (10)

A threshold signature generation system based on confusion circuit. The system includes: two hosts, namely a first host and a second host. The first host has a secret d ₁ , a secret k ₁ , and an X coordinate. x ₁ and a level value n ₁ , the second host has a secret d ₂ , a secret k ₂ , an X coordinate x ₂ and a level value n ₂ , and at the same time the secret d ₁ , the secret k ₁ , the secret d ₂ and the secret k ₂ satisfy the following operational expressions to generate a secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k, where, BK(x _j , n _j ) represents the Birkhoff coefficient, j is 1 or 2, and let an EdDSA The key A is d * B, and let a verification ellipse point L be k * B, and B is a base point of the Ed25519 or sr25519 elliptic curve group. Each of the hosts includes: a confusion module to establish a confusion circuit A first Bollinger circuit and a second Bollinger circuit, the first Bollinger circuit allows the input of multiple input parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a Parameter n and a message m and output a first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit is allowed to input the parameter v1, the parameter v2, the parameter r1 and This parameter r2 also outputs a second evaluation value, the first evaluation value is H ₂ (k,m) + r1 + r2 mod n, and the second evaluation value is k + r1 + r2, where H ₂ ( k,m) represents concatenating the secret k and the message m and then hashing it. The parameter n is the number of the given elliptic curve group. The value of the parameter v1 is BK(x ₁ ,n ₁ )k ₁ mod n. The value of the parameter v2 is BK (x ₂ , n ₂ )k ₂ mod n; a generation module used to generate random numbers as the parameter r1 when the host is the first host and disclose a first A hash value, and when the host is the second host, a random number is generated as the parameter r2 and a second hash value is disclosed, wherein the calculation formula of the first hash value is H(r1 * B) , the calculation formula of the second hash value is H (r2 * B), H represents the hash function; a first calculation module, connected to the generation module and the confusion module, when the host is the first host When the host is the second host, use the parameter v1, the parameter r1 and the message m to input to the first Bollinger circuit, and when the host is the second host, use the parameter v2 and the parameter r2 to input to the The first Bollinger circuit is used to jointly execute the first Bollinger circuit, so that the second host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, and parameter r1 and the parameter r2 jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a first public value, the calculation formula of the first public value is r1 * B; a second calculation module, connected The generation module and the confusion module are used to input the parameter v2, the parameter r2 and the message m to the first Bollinger circuit when the host is the second host, and when the host is the second host, When the host is the first host, it uses its own parameter v1 and parameter r1 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the first host can execute the first Bollinger circuit according to the first Bollinger circuit. Obtain the first evaluation value, then use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a second public value, The calculation formula of the second public value is r2 * B; a verification module connected to the first calculation module and the second calculation module to verify the first public value and the second public value obtained by itself Whether the calculated hash value is equal to the received first hash value and the second hash value and whether the product of the second evaluation value and the base point is equal to the verification ellipse point L, the first public value and the third The sum of the two public values is equal. When the verification results are equal, a first signature value R is calculated based on the message m, the first public value, the second public value and the base point, and based on the first signature The chapter value R, the EdDSA public key A and the message m calculate a hash value c, and then calculate a hash value c based on the secret k, the message m, the hash value c, its own Birkhoff coefficient b _i and the above The secret di _i calculates a corresponding value S _i , where i is a positive integer; and a signature module is connected to the verification module to execute the Secure Validation Protocol to mutually verify the first host The first evaluation value obtained by both the second host and the second host in the first Bollinger circuit is the same. When they are the same, all the values _Si are added to generate a second signature value s, and according to the first The signature value R and the second signature value s generate an EdDSA digital signature. For example, the threshold signature generation system based on confusion circuit of claim 1, wherein the first Bollinger circuit and the second Bollinger circuit are generated by at least one of AND operation (AND) and exclusive OR operation (XOR). The method implements confusing circuits and secure multi-party computation (Multi-Party Computation, MPC), and has multiple input wires (Wires) to input the input parameters. The set of bit values brought in by each input parameter is 256 bits. The value of the element, the first Bollinger circuit is a logic circuit that meets the following conditions: MPCEdDSA(v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n, as described The second Bollinger circuit is a logic circuit that meets the following conditions: ModAdd(v1,v2,r1,r2) = k + r1 + r2. For example, in the threshold signature generation system based on obfuscation circuit of claim 1, the calculation formula of the first signature value R is as follows: R = MPCEdSA(v1,v2,r1,r2,n,m) * B – r1 * B – r2 * B, Wherein, MPCEdSA(v1,v2,r1,r2,n,m) represents the first Bollinger circuit, and the first evaluation value is obtained. For example, the threshold signature generation system based on confusion circuit of claim 1, wherein the calculation formula of the value _Si is as follows: _Si = r + c * b _i * d _i , where r = H ₂ (k,w ). For example, in the threshold signature generation system based on obfuscation circuit of claim 1, the calculation formula of the hash value c is as follows: c = SHA512(R || A || m), where SHA512 is a hash function, and the symbol || represents concatenation. A threshold signature generation method based on confusion circuit, the steps include: (A) Provide a first host and a second host, the first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and a level value n ₁ , and the second host has a secret d ₂ , a secret k ₂ , an X coordinate x ₂ and a level value n ₂ , and at the same time the secret d ₁ , the secret k ₁ , the secret d ₂ And the secret k ₂ satisfies the following operational expressions to generate a secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ , n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k, where BK(x _j , n _j ) represents the Birkhoff coefficient, j is 1 or 2, and let an EdDSA public key A is d * B, and let a verification ellipse point L be k * B, and B is a base point of the Ed25519 or sr25519 elliptic curve group; (B) Provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit Circuit, the first Bollinger circuit allows input of multiple input parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and outputs a first evaluation value , each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit is allowed to input the parameter v1, the parameter v2, the parameter r1 and the parameter r2 and output a second evaluation value, the The first evaluation value is H ₂ (k,m) + r1 + r2 mod n, and the second evaluation value is k + r1 + r2, where H ₂ (k,m) represents the combination of the secret k and the message m After concatenation, hash is performed. The parameter n is the number of the given elliptic curve group. The value of the parameter v1 is BK(x ₁ ,n ₁ )k ₁ mod n. The value of the parameter v2 is BK(x ₂ ,n ₂ )k ₂ mod n; (C) The first host generates random numbers as the parameter r1 and discloses a first hash value, and the second host generates random numbers as the parameter r2 and discloses a second hash value , where the calculation formula of the first hash value is H(r1 * B), the calculation formula of the second hash value is H(r2 * B), H represents the hash function; (D) The first host uses its own The parameter v1, the parameter r1 and the message m and the second host use its own parameter v2 and parameter r2 to jointly execute the first Bollinger circuit, so that the second host obtains the first Bollinger circuit according to the first Bollinger circuit. first evaluation value, and then use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a first public value, and the third The calculation formula of a public value is r1 * B; (E) The second host uses its own parameter v2, the parameter r2 and the message m and the first host uses its own parameter v1 and the parameter r1 to jointly execute the The first Bollinger circuit enables the first host to obtain the first evaluation value according to the first Bollinger circuit, and then use the same parameter v1, the parameter v2, the parameter r1 and the parameter r2 to jointly execute the second cloth The forest circuit obtains the second evaluation value and discloses a second public value. The calculation formula of the second public value is r2 * B; (F) The first host and the second host each verify the third value obtained by themselves. Whether the hash value calculated from a public value and the second public value is equal to the received first hash value and the second hash value and whether the product of the second evaluation value and the base point is equal to the verification ellipse point L , the sum of the first public value and the second public value is equal. When the verification results are all equal, a first signature is calculated based on the message m, the first public value, the second public value and the base point. seal value R, and calculate a hash value c based on the first signature value R, the EdDSA public key A and the message m, and then calculate a hash value c based on the secret k, the message m, the hash value c, and its own Burkholder Calculate a corresponding value _Si based on the Birkhoff coefficient b _i and the secret _di , where i is a positive integer; (G) Both the first host and the second host execute the Security Validation Protocol ) to mutually verify that the first evaluation value obtained by both parties in the first Bollinger circuit is the same; and (H) the first host and the second host respectively add up all the values _Si to generate a second signature seal value s, and generate an EdDSA digital signature based on the first signature value R and the second signature value s; wherein step (D) and step (E) are allowed to be executed simultaneously, and step (G) and step ( H) Simultaneous execution is allowed. For example, the threshold signature generation method based on confusion circuit of claim 6, wherein the first Bollinger circuit and the second Bollinger circuit are generated by at least one of AND operation (AND) and exclusive OR operation (XOR). The method implements confusing circuits and secure multi-party computation (Multi-Party Computation, MPC), and has multiple input wires (Wires) to input the input parameters. The set of bit values brought in by each input parameter is 256 bits. The value of the element, the first Bollinger circuit is a logic circuit that meets the following conditions: MPCEdDSA(v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n, as described The second Bollinger circuit is a logic circuit that meets the following conditions: ModAdd(v1,v2,r1,r2) = k + r1 + r2. For example, in the threshold signature generation method based on obfuscation circuit of claim 6, the calculation formula of the first signature value R is as follows: R = MPCEdSA(v1,v2,r1,r2,n,m) * B – r1 * B – r2 * B, Wherein, MPCEdSA(v1,v2,r1,r2,n,m) represents the first Bollinger circuit, and the first evaluation value is obtained. Such as the threshold signature generation method based on confusion circuit in claim 6, wherein the calculation formula of the value S _i is as follows: S _i = r + c * b _i * d _i , where r = H ₂ (k,m ). For example, in request item 6, the threshold signature generation method based on obfuscation circuit, the calculation formula of the hash value c is as follows: c = SHA512(R || A || m), where SHA512 is a hash function, and the symbol || represents concatenation.

Images