TWI795284B - Threshold signature generation system based on garbled circuit and method thereof - Google Patents

Abstract

A threshold signature generation system based on garbled circuit and method thereof is disclosed. By providing a first Boolean circuit and a second Boolean circuit as the garbled circuit for two hosts to input a plurality of input parameters and jointly to perform secure multi-party computation, so as to the two hosts each obtain a first evaluation value of the first Boolean circuit and a second evaluation value of the second Boolean circuit, and broadcasting the product of the random number and the base point of each host, and verifying whether the input parameters of both parties are correct and whether the results obtained by the garbled circuit are the same, and then generating a Edwards-curve Digital Signature Algorithm (EdDSA) signature that can pass the verification when they are correct and the same. The mechanism is help to improve the security when generating the EdDSA signature.

Description

Threshold signature generation system and method based on obfuscation circuit

The invention relates to a signature generating system and method thereof, in particular to a threshold-type signature generating system and method based on an obfuscation circuit.

In recent years, with the popularization and vigorous development of blockchain, various blockchain-based transaction technologies have sprung up like mushrooms. However, the traditional method of simply generating a signature (or signature) by one party is no longer secure enough, which makes various manufacturers eager to find a more secure way to generate a signature.

Generally speaking, in the traditional signature method, one party to the transaction encrypts with a private key, and then provides the encrypted result to the other party of the transaction to use the public key corresponding to the private key for verification. However, if the private key is lost, the signature may be forged. Therefore, in order to strengthen the security of assets and transactions, some manufacturers have further developed technical means that can generate a corresponding number of signatures through multiple different private keys, and only when they have a certain number of signatures can the transaction be successful. Come, even if one of the private keys is stolen, lost, etc., the security of the transaction can be ensured. However, this method is no longer safe when the number of lost private keys meets the threshold, so there is still a problem of insufficient security.

In view of this, various manufacturers urgently need a method that can generate verifiable EdDSA signatures without the need for a complete private key, and is fully compliant with the generation method defined by EdDSA. This method can greatly increase the generation of EdDSA signatures. Security, effectively avoiding the possibility of illegally obtaining private keys due to memory cache bypass attacks, and then having forged signatures.

To sum up, it can be seen that there has been a problem of insufficient security in the traditional generation of EdDSA signatures in the prior art for a long time, so it is necessary to propose improved technical means to solve this problem.

The invention discloses a threshold-type signature generation system and method based on an obfuscation circuit.

First, the present invention discloses a threshold-type signature generation system based on an obfuscation circuit, which includes: two hosts, namely the first host and the second host, the first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , secret k ₂ , X coordinate x ₂ and level value n ₂ , while secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following Formula to generate secret d and secret k:

"BK(x1,n1) * d1 + BK(x2,n2) * d2 = d"; and

"BK(x1,n1) * k1 + BK(x2,n2) * k2 = k".

Among them, "BK(x _j , n _j )" represents the Birkhoff Coefficient (Birkhoff Coefficient), j is 1 or 2, and let the EdDSA public key A be d * B, and let the verification ellipse point L be k * B , B is the base point (Base point) of the Ed25519 or sr25519 elliptic curve group, and each host includes: confusion module, generation module, first calculation module, second calculation module, verification module and signature mod. Among them, the confusion module is used to establish the first Bollinger circuit and the second Bollinger circuit as a confusing circuit, and the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1, parameter v2, parameter r1, parameter r2, parameter n, and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit allows input of parameter v1, parameter v2, and parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2", wherein, H ₂ (k,m) represents the hashing of the secret k and the message m in series, H ₂ represents the hash function, usually SHA-512, m is the message, and the parameter n is the number of the given elliptic curve group, the parameter The value of v1 is "BK(x ₁ ,n ₁ )k ₁ mod n", the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n"; the generated module is used for When a host is a host, generate a random random number as a parameter r1 and disclose a first hash value, and when the host is a second host, generate a random random number as a parameter r2 and disclose a second hash value, wherein the first hash The calculation formula of the value is "H(r1 * B)", the calculation formula of the second hash value is "H(r2 * B)", H represents the hash function; the first calculation module is connected to the generation module and the confusion module , when the host is the first host, use its own parameter v1, parameter r1 and message m to input to the first Bollinger circuit, and when the said host is the second host, use its own parameter v2 and parameter r2 to input To the first Bollinger circuit, to jointly execute the first Bollinger circuit, so that the second host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute The second Bollinger circuit obtains the second evaluation value, and discloses the first public value, the calculation formula of the first public value is "r1 * B"; the second calculation module is connected to the generation module and the confusion module, using When the host is the second host, use its own parameter v2, parameter r2 and message m to input to the first Bollinger circuit, and when the host is the first host, use its own parameter v1 and parameter r1 to input To the first Bollinger circuit, to jointly execute the first Bollinger circuit, so that the first host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute The second Bollinger circuit obtains the second evaluation value, and discloses the second public value, the calculation formula of the second public value is "r2 * B"; the verification module is connected to the first calculation module and the second calculation module , to verify whether the hash value calculated by the first public value obtained by itself (ie: "r1 * B") and the second public value (ie: "r2 * B") is consistent with the received first hash value ( ie: "H(r1 * B)") and the second hash value (ie: "H(r2 * B)") is equal and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value, and the second public value. When the verification results are all equal, according to the message m , the first public value, the second public value and the base point to calculate the first signature value R, and calculate the hash value c according to the first signature value R, EdDSA public key A and message m, and then according to the secret k, message m, The hash value c, its own Birkhoff coefficient b _i and the secret d _i calculate the corresponding value S _i , where i is a positive integer; and the signature module is connected to the verification module to execute The Secure Validation Protocol (Secure Validation Protocol) is used to mutually verify that the first evaluation values obtained by both the first host and the second host in the first Bollinger circuit are the same, and when they are the same, add all the values S _i to generate the second signature value s, and generate an EdDSA digital signature according to the first signature value R and the second signature value s.

Next, the present invention discloses a threshold signature generation method based on an obfuscation circuit, the steps of which include: (A) providing a first host and a second host, the first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , secret k ₂ , X coordinate x ₂ and level value n ₂ , while secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following operations Formula to generate secret d and secret k:

"BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d"; and

"BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k".

Among them, "BK(x _j , n _j )" represents the Burkhoff coefficient, j is 1 or 2, and the EdDSA public key A is d * B, and the verification ellipse point L is k * B, B is Ed25519 or the base point of sr25519 elliptic curve group; (B) providing a first Bollinger circuit and a second Bollinger circuit as a confusion circuit, the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameters v1, Parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Boolean circuit allows input of parameter v1, parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", and the second evaluation value is "k + r1 + r2 ”, where H ₂ (k,m) represents hashing after concatenation of secret k and message m, parameter n is the number of given elliptic curve groups, and the value of parameter v1 is “BK(x ₁ ,n ₁ )k ₁ mod n", the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n"; (C) the first host generates a random random number as parameter r1 and discloses the first hash value, and the second host generates A random random number is used as the parameter r2 and the second hash value is disclosed, wherein the calculation formula of the first hash value is "H(r1 * B)", and the calculation formula of the second hash value is "H(r2 * B)", H stands for hash function; (D) The first host uses its own parameter v1, parameter r1 and message m and the second host uses its own parameter v2 and parameter r2 to jointly execute the first Bollinger circuit, so that the second host uses the first The Bollinger circuit obtains the first evaluation value, and then uses the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the first public value, the first public The calculation formula of the value is "r1 * B"; (E) The second host uses its own parameter v2, parameter r2 and message m to execute the first Bollinger circuit with the first host using its own parameter v1 and parameter r1, so that the second host A host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the second public value, The calculation formula of the second public value is "r2 * B"; (F) The first host and the second host each verify whether the hash value calculated by the first public value and the second public value obtained by itself is consistent with the received The first hash value and the second hash value are equal and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value, when the verification results are all equal, Calculate the first signature value R according to the message m, the first public value, the second public value and the base point, and calculate the hash value c according to the first signature value R, the EdDSA public key A and the message m, and then according to the secret k, The corresponding value S _i is calculated from the message m, the hash value c, its own Berkhov coefficient b _i and the secret d _i , where i is a positive integer; (G) both the first host and the second host execute security The verification protocol (Secure Validation Protocol) is to mutually verify that the first evaluation value obtained by the two parties in the first Bollinger circuit is the same; and (H) the first host and the second host respectively add up all the values S _i to generate the second signature value s, and generate an EdDSA digital signature according to the first signature value R and the second signature value s. Wherein, step (D) and step (E) are allowed to be executed at the same time, and step (G) and step (H) are allowed to be executed at the same time.

The system and method disclosed in the present invention are as above, and the difference from the prior art is that the present invention provides the first Bollinger circuit and the second Bollinger circuit as a confusing circuit for two hosts to input multiple input parameters and jointly execute security Multi-party calculation, so that the two hosts can obtain the first evaluation value of the first Bollinger circuit and the second evaluation value of the second Bollinger circuit, and broadcast the product of the random random number and the base point of each host, so as to verify the input parameters of both parties Whether it is correct and whether the results obtained through the obfuscation circuit are the same, and then generate an EdDSA signature that can pass verification when it is correct and the same, so as to achieve the technical effect of improving the security of generating the EdDSA signature.

Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the security of generating EdDSA signatures.

The implementation of the present invention will be described in detail below in conjunction with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

First of all, before explaining the obfuscated circuit-based threshold-type signature generation system and method disclosed in the present invention, the self-defined terms of the present invention will be described first. The "EdDSA public key" (indicated by "A") "Refers to the public key known to all parties for signature (or signature) verification. Next, because in the EdDSA private key generation process, a hash function (such as: SHA512) is used for hashing, and the first half of the hash value obtained after hashing is used as the private key, and the second half is the The purpose of "verifying the ellipse point (indicated by "L")" is to confirm that when the two parties execute the obfuscation circuit, the input used by both parties is the correct input. In actual implementation, the value of EdDSA public key A is equal to d * B, and the value of verification ellipse point L is equal to k * B, where d and k are secrets (such as: ciphertext, private key), and B is Ed25519 or the base points of SR25519 elliptic curve groups.

The following is a further description of the threshold-type signature generation system based on the obfuscation circuit and its method in accordance with the drawings. Please refer to "Fig. 1" first. "Fig. 1" is the threshold-type signature generation system based on the obfuscation circuit of the present invention The system block diagram of the first embodiment, the system includes: two hosts (100a, 100b), respectively the first host 100a and the second host 100b, the first host 100a has secret d ₁ , secret k ₁ , X coordinate x ₁ and rank value (Rank) n ₁ , the second host 100b has secret d ₂ , secret k _{2 , X coordinate x 2 and} rank value n ₂ , and secret d ₁ , secret k ₁ , and secret d ₂ and secret k ₂ satisfy the following formula to generate secret d and secret k:

"BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d"; and

"BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k".

Among them, "BK(x _j , n _j )" represents the Burkhoff coefficient, j is 1 or 2, and the EdDSA public key A is d * B, and the verification ellipse point L is k * B, B is Ed25519 or the base point of sr25519 elliptic curve group, each of the hosts (100a, 100b) includes: confusion module 110, generation module 120, first calculation module 130, second calculation module 140, verification module 150 and Signature module 160. Wherein, the confusion module 110 is used to establish a first Bollinger circuit and a second Bollinger circuit as a confusing circuit, and the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1, parameter v2, Parameter r1, parameter r2, parameter n and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Boolean circuit allows input of parameter v1, parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", the second evaluation value is "k + r1 + r2", wherein , H ₂ (k,m) means to hash the secret k and the message m in series, the parameter n is the number of given elliptic curve groups, the value of the parameter v1 is "BK(x ₁ ,n ₁ )k ₁ mod n ", the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n". Specifically, the confusion circuit is essentially a Boolean circuit (Boolean circuit), which uses the viewpoint constructor of the Boolean circuit to perform calculations, so that participants can calculate the answer for a certain value without knowing that the participants The specific number entered in the function, the secure multi-party calculation in the confusing circuit can be realized by means of a circuit. In actual implementation, the first Bollinger circuit and the second Bollinger circuit can implement at least one of AND operation (AND) and exclusive OR operation (XOR) to realize confusion circuit and secure multi-party computation (Multi-Party Computation) , MPC), and has multiple input lines (Wire) to input the input parameters, the set of bit values brought by each input parameter is a value of 256 bits, taking six input parameters as an example, the total Bring in six 256-bit values, and the first Bollinger circuit satisfies the condition "MPCEdDSA(v1,v2,r1,r2,n,m) = H2(k,m) + r1 + r2 mod n" A logic circuit, the second Bollinger circuit is a logic circuit satisfying the condition "ModAdd(v1, v2, r1, r2) = k + r1 + r2". In particular, it should be noted that, unlike ECDSA, the generation methods of secret k ₁ and secret k ₂ have been clearly defined in EdDSA instead of random random number generation.

The generating module 120 is used to generate a random random number as the parameter r1 and disclose the first hash value when the host (100a, 100b) is the first host 100a, and to disclose the first hash value when the host (100a, 100b) is the second When the host 100b generates a random random number as the parameter r2 and discloses the second hash value, wherein, the calculation formula of the first hash value is "H(r1 * B)", and the calculation formula of the second hash value is "H(r2 * B)", H stands for hash function.

The first calculation module 130 is connected to the generation module 120 and the confusion module 110, and when the host (100a, 100b) is the first host 100a, use its own parameter v1, parameter r1 and message m to input to the first Bollinger circuit, and when the host (100a, 100b) is the second host 100b, use its own parameter v2 and parameter r2 to input to the first Bollinger circuit, so as to jointly execute the first Bollinger circuit, so that the second host according to The first Bollinger circuit obtains the first evaluation value, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the first public value. The calculation formula of a public value is "r1 * B". In actual implementation, the first public value may be disclosed in a broadcast (Broadcast) manner.

The second calculation module 140 is connected to the generation module 120 and the confusion module 110, so that when the host (100a, 100b) is the second host 100b, it uses its own parameter v2, parameter r2 and message m to input to the first Bollinger circuit, and when the host (100a, 100b) is the first host 100a, use its own parameter v1 and parameter r1 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the first The host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the second public value, so The calculation formula of the second public value is "r2 * B". Likewise, in actual implementation, the second public value may be disclosed in a broadcast manner.

The verification module 150 is connected to the first calculation module 130 and the second calculation module 140 to verify whether the hash value calculated by the first public value and the second public value obtained by itself is consistent with the received first hash value and The second hash value is equal and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value (ie: ModAdd(v1,v2,r1,r2) * B = verification Ellipse point L + r1 * B + r2 * B, where ModAdd(v1, v2, r1, r2) represents the second evaluation value "k + r1 + r2" output by the second Bollinger circuit), when the verification results are all When they are equal, calculate the first signature value R according to the message m, the first public value, the second public value and the base point, and calculate the hash value c according to the first signature value R, the EdDSA public key A and the message m, and then according to The secret k, the message m, the hash value c, the Birkhoff coefficient b _i of itself, and the secret d _i calculate the corresponding value S _i , where i is a positive integer. In actual implementation, the calculation formula of the first signature value R is "R = MPCEdDSA(v1,v2,r1,r2,n,m) * B - r1 * B - r2 * B", wherein, "MPCEdDSA (v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n", "MPCEdDSA(v1,v2,r1,r2,n,m)" represents the first Bollinger circuit; "H ₂ (k,m) + r1 + r2 mod n" is the first evaluation value; the calculation formula of the hash value c is "c = SHA512(R || A || m)", where , SHA512 is a hash function, the symbol "||" represents concatenation, assuming that R is the string "aa" and A is the string "bb", then "R || A" is the string "aabb". In actual implementation, assuming that "ModAdd(v1,v2,r1,r2) * B" is not equal to "verification ellipse point L + r1 * B + r2 * B", it means that the identity "v1 + v2 = verification ellipse point" cannot be satisfied L", that is to say, the parameters v1 and v2 input by both parties are not correct inputs, so the execution is stopped. In other words, the verification ellipse point L known to both parties (namely: "k * B"), the previously broadcast first public value "r1 * B" and the second public value "r2 * B" can verify "ModAdd( v1,v2,r1,r2) * B = (k + r1 + r2) * B", and then confirm that the input of the confusion circuit is correct, if any error in the middle will cause a verification error.

The signature module 160 is connected to the verification module 150 to execute the security verification protocol to mutually verify that the first evaluation values obtained by the first host 100a and the second host 100b in the first Bollinger circuit are the same. All the values S _i are used to generate a second signature value s, and an EdDSA digital signature is generated according to the first signature value R and the second signature value s. In practical implementation, the calculation formula of the value S _i is "S _i = r + c * b _i * d _i ", where r = H ₂ (k,m).

In particular, it should be noted that in actual implementation, the modules described in the present invention can be implemented in various ways, including software, hardware or any combination thereof. For example, in some implementations, each module can use software and hardware or one of them. In addition, the present invention can also be realized partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), complex programmable logic device (Complex Programmable Logic Device, CPLD), field programmable logic gate array (Field Programmable Gate Array, FPGA) and so on. The present invention can be a system, method and/or computer program. The computer program may include a computer-readable storage medium loaded with computer-readable program instructions for causing a processor to implement various aspects of the present invention, the computer-readable storage medium may be a tangible and equipment. A computer readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer-readable storage media include hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. As used herein, computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, light signals through fiber optic cables), or transmitted electrical signals. Additionally, the computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to various computing/processing devices, or downloaded over a network, such as the Internet, local area network, wide area network, and/or wireless network to an external computer device or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in computer-readable storage media in each computing/processing device middle. The computer program instructions for performing the operations of the present invention may be assembly language instructions, instruction set architecture instructions, machine instructions, machine-related instructions, micro instructions, firmware instructions, or source code or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming languages, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as: C language or similar programming language. The computer program instructions may be executed entirely on the computer, partly on the computer, as a stand-alone piece of software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server to execute.

Please refer to "Fig. 2A" to "Fig. 2C". "Fig. 2A" to "Fig. 2C" are the method flow chart of the first embodiment of the threshold-type signature generation method based on the confusion circuit of the present invention, and its steps Including: providing a first host and a second host, the first host has secret d ₁ , secret k ₁ , X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , secret k ₂ , X Coordinate x ₂ and level value n ₂ , while secret d ₁ , secret k ₁ , secret d ₂ and secret k ₂ satisfy the following formulas to generate secret d and secret k:

BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d,

BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k,

Among them, "BK(x _j , n _j )" represents the Burkhoff coefficient, j is 1 or 2, and the EdDSA public key A is d * B, and the verification ellipse point L is k * B, B is Ed25519 Or the base point of the sr25519 elliptic curve group (step 210); providing the first Bollinger circuit and the second Bollinger circuit as a confusing circuit, the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1 , parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit allows the input parameters v1, Parameter v2, parameter r1 and parameter r2 and output a second evaluation value, the first evaluation value is "H ₂ (k,m) + r1 + r2 mod n", and the second evaluation value is "k + r1 + r2", where H ₂ (k,m) represents the hashing of secret k and message m in series, message m, parameter n is the number of given elliptic curve groups, and the value of parameter v1 is "BK(x ₁ , n ₁ )k ₁ mod n", the value of parameter v2 is "BK(x ₂ ,n ₂ )k ₂ mod n" (step 220); the first host generates a random random number as parameter r1 and discloses the first hash value , the second host generates a random random number as the parameter r2 and discloses the second hash value, wherein the calculation formula of the first hash value is "H(r1 * B)", and the calculation formula of the second hash value is "H(r2 * B)", H represents the hash function (step 230); the first host uses its own parameter v1, parameter r1 and message m and the second host uses its own parameter v2 and parameter r2 to jointly execute the first Boolean circuit, so that The second host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the first public value , the calculation formula of the first public value is "r1 * B" (step 240); the second host uses its own parameter v2, parameter r2 and message m and the first host uses its own parameter v1 and parameter r1 to jointly execute the second A Bollinger circuit, so that the first host obtains a first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute a second Bollinger circuit to obtain a second evaluation value, And disclose the second public value, the calculation formula of the second public value is "r2 * B" (step 250); the first host and the second host respectively verify the calculation of the first public value and the second public value obtained by themselves Whether the output hash value is equal to the received first hash value and second hash value and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value and the second public value, When the verification results are all equal, calculate the first signature value R according to the message m, the first public value, the second public value and the base point, and calculate the first signature value R, Ed The DSA public key A and the message m calculate the hash value c, and then calculate the corresponding value S _i according to the secret k, the message m, the hash value c, its own Burkhov coefficient b _i and the secret d _i , where i is a positive integer (step 260); both the first host and the second host implement the Secure Validation Protocol (Secure Validation Protocol) to mutually verify that the first evaluation value obtained by both parties in the first Bollinger circuit is the same (step 270); and A host and a second host respectively add up all the values S _i to generate a second signature value s, and generate an EdDSA digital signature according to the first signature value R and the second signature value s (step 280 ). Wherein, step 240 and step 250 are allowed to be executed at the same time, and steps 270 and 280 are allowed to be executed at the same time.

The following description will be made in the form of an embodiment in conjunction with "Fig. 3", where "Fig. 3" is a schematic diagram of an obfuscation circuit applying the present invention. In practice, the confusion circuit of the present invention includes a first Bollinger circuit 310 and a second Bollinger circuit 320 . Among them, the first Bollinger circuit 310 provides input lines to input parameters v1 (ie: "BK(x ₁ ,n ₁ )k ₁ mod n"), parameters v2 (ie: "BK(x ₂ ,n ₂ )k ₂ mod n"), parameter r1 (namely: a random number randomly selected by the first host 100a), parameter r2 (namely: a random number randomly selected by the second host 100b), parameter n (namely: the number of given elliptic curve groups ) and message m, which can be expressed as "MPCEdDSA(v1,v2,r1,r2,n,m)", and output the first evaluation value "H ₂ (k,m) + r1 + r2 mod n" (where, " H ₂ (k,m)" can be regarded as "SHA512(k || m)", which represents the value obtained by first concatenating the secret k and the message m and then hashing); the second Bollinger circuit 320 provides an input line to input the parameter v1 , parameter v2, parameter r1 and parameter r2 can be expressed as "ModAdd(v1, v2, r1, r2)", and output the second evaluation value "k + r1 + r2". When establishing the above-mentioned first Bollinger circuit 310, at least one of "and operation (AND)" and "exclusive or operation (XOR)" can be used to satisfy the condition "MPCEdDSA(v1,v2,r1,r2,n, m) = H ₂ (k,m) + r1 + r2 mod n" logic circuit, and when building the second Bollinger circuit 320, it also uses "and operation (AND)" and "exclusive or operation (XOR) )" At least one of the structures satisfies the condition "ModAdd(v1,v2,r1,r2) = k + r1 + r2" logic circuit. In particular, it should be noted that in the same signature, the parameters v1, v2, r1, and r2 input by the first Bollinger circuit 310 are also the parameters v1, v2, and r2 input by the second Bollinger circuit 320. r1 and parameter r2, and parameters r1 and parameter r2 will be reselected for each signature.

In summary, it can be seen that the difference between the present invention and the prior art lies in that by providing the first Bollinger circuit and the second Bollinger circuit as confusing circuits for two hosts to input multiple input parameters and jointly execute secure multi-party calculations, Make the two hosts obtain the first evaluation value of the first Bollinger circuit and the second evaluation value of the second Bollinger circuit, and broadcast the product of the random random number and the base point of each host, so as to verify whether the input parameters of both parties are correct and Whether the results obtained by confusing the circuit are the same, and then generate an EdDSA signature that can pass the verification when it is correct and the same. This technical means can solve the problems existing in the previous technology, and then achieve the goal of improving the security of generating the EdDSA signature. Technical efficacy.

Although the present invention is disclosed above with the aforementioned embodiments, it is not intended to limit the present invention. Any person familiar with similar skills may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be subject to what is defined in the scope of patent application attached to this manual.

100a, 100b: host 110: confusion module 120: generation module 130: first calculation module 140: second calculation module 150: verification module 160: signature module 310: first Bollinger circuit 320: second Two Bollinger circuit step 210: provide a first host and a second host, the first host has a secret d ₁ , a secret k ₁ , an X coordinate x ₁ and a level value n ₁ , and the second host have a secret d ₂ , a secret k ₂ , an X coordinate x ₂ and a level value n ₂ , and at the same time the secret d ₁ , the secret k ₁ , the secret d ₂ and the secret k ₂ satisfy the following formula to generate a Secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ , n ₂ ) * k ₂ = k, where BK(x _j , n _j ) represents the Burkhoff coefficient, j is 1 or 2, and let an EdDSA public key A be d * B, and let a verification ellipse point L is k*B, B is a basic point of Ed25519 or sr25519 elliptic curve group Step 220: provide a first Bollinger circuit and a second Bollinger circuit as a confusing circuit, and this first Bollinger circuit allows multiple inputs Parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and output a first evaluation value, each of the input parameters is allowed to bring in a group Bit value, the second Bollinger circuit allows input of the parameter v1, the parameter v2, the parameter r1 and the parameter r2 and outputs a second evaluation value, the first evaluation value is H ₂ (k,m) + r1 + r2 mod n, the second evaluation value is k + r1 + r2, wherein, H ₂ (k, m) represents hashing after concatenating the secret k and the message m, and the parameter n is a given elliptic curve The number of groups, the value of the parameter v1 is BK(x1,n1)k1 mod n, the value of the parameter v2 is BK(x2,n2)k2 mod n Step 230: The first host generates a random random number as the The parameter r1 discloses a first hash value, and the second host generates a random random number as the parameter r2 and discloses a second hash value, wherein the calculation formula of the first hash value is H(r1 * B), and the The calculation formula of the second hash value is H(r2*B), H represents the hash function step 240: the first host uses its own parameter v1, the parameter r1 and the message m and the second host uses its own The parameter v2 and the parameter r2 jointly execute the first Bollinger circuit, so that the second host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same parameter v1, the parameter v2, the parameter r1 and The parameter r2 jointly executes the second Bollinger circuit to obtain the second evaluation value, And disclose a first public value, the calculation formula of the first public value is r1 * B Step 250: The second host uses its own parameter v2, the parameter r2 and the message m and the first host uses its own the The parameter v1 and the parameter r1 jointly execute the first Bollinger circuit, so that the first host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same parameter v1, the parameter v2, the parameter r1 and The parameter r2 jointly executes the second Bollinger circuit to obtain the second evaluation value, and discloses a second public value. The calculation formula of the second public value is r2 * B. Step 260: the first host and the second Each host verifies whether the hash value calculated by the first public value and the second public value obtained by itself is equal to the received first hash value and the second hash value, and whether the second evaluation value is equal to the base point's Whether the product is equal to the sum of the verification ellipse point L, the first public value and the second public value, when the verification results are all equal, according to the message m, the first public value, the second public value and The base point calculates a first signature value R, and calculates a hash value c based on the first signature value R, the EdDSA public key A, and the message m, and then calculates a hash value c based on the secret k, the message m, and the hash value c. A corresponding value S _i is calculated from a Birkhoff coefficient b _i of itself and the secret d _i , where i is a positive integer. Step 270: Both the first host and the second host execute Secure Validation Protocol (Secure Validation Protocol) to mutually verify that the first evaluation value obtained by both parties in the first Bollinger circuit is the same. Step 280: the first host and the second host respectively add up all the values S _i to Generate a second signature value s, and generate an EdDSA digital signature based on the first signature value R and the second signature value s

Fig. 1 is a system block diagram of the threshold type signature generation system based on the confusion circuit of the present invention. Fig. 2A to Fig. 2C are method flow charts of the method for generating a threshold-type signature based on an obfuscation circuit in the present invention. Fig. 3 is a schematic diagram of an obfuscation circuit applying the present invention.

100a, 100b: host

110: Confusion Module

120: Generate modules

130: The first computing module

140: Second computing module

150: Verification module

160: Signature module

Claims (10)

A threshold-type signature generation system based on obfuscation circuits, the system includes: two hosts, respectively a first host and a second host, the first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and a level value n ₁ , the second host has a secret d ₂ , a secret k ₂ , an X coordinate x ₂ and a level value n ₂ , while the secret d ₁ , the secret k ₁ , the secret d ₂ and the secret k ₂ satisfy the following formula to generate a secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ ,n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k, where BK(x _j , n _j ) represents the Burkhoff coefficient, j is 1 or 2, and let an EdDSA formula The key A is d * B, and let a verification elliptic point L be k * B, B is a base point of Ed25519 or sr25519 elliptic curve group, each of said hosts includes: an obfuscation module, used to establish as an obfuscation circuit A first Bollinger circuit and a second Bollinger circuit, the first Bollinger circuit allows input of multiple input parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a Parameter n and a message m and output a first evaluation value, each of the input parameters is allowed to bring in a set of bit values, the second Bollinger circuit allows input of the parameter v1, the parameter v2, the parameter r1 and The parameter r2 and output a second evaluation value, the first evaluation value is H ₂ (k, m) + r1 + r2 mod n, the second evaluation value is k + r1 + r2, wherein, H ₂ ( k, m) means that the secret k and the message m are concatenated and hashed, the parameter n is the number of given elliptic curve groups, the value of the parameter v1 is BK(x ₁ ,n ₁ )k ₁ mod n, The value of the parameter v2 is BK(x ₂ ,n ₂ )k ₂ mod n; a generation module, used to generate a random random number as the parameter r1 and disclose a first host when the host is the first host A hash value, and when the host is the second host, a random random number is generated as the parameter r2 and a second hash value is disclosed, wherein the calculation formula of the first hash value is H(r1 * B) , the calculation formula of the second hash value is H(r2 * B), H represents a hash function; a first calculation module, connected to the generation module and the confusion module, when the host is the first host When the host is the second host, use its own parameter v1, the parameter r1 and the message m to input to the first Bollinger circuit, and when the host is the second host, use its own parameter v2 and the parameter r2 to input to the The first Bollinger circuit is used to jointly execute the first Bollinger circuit, so that the second host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same The parameter v1, the parameter v2, the parameter r1 and the parameter r2 jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a first public value, the formula of the first public value is r1 * B; A second calculation module, connected to the generation module and the confusion module, used to input the parameter v2, the parameter r2 and the message m to the computer when the host is the second host The first Bollinger circuit, and when the host is the first host, use its own parameter v1 and the parameter r1 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the The first host obtains the first evaluation value according to the first Bollinger circuit, and then uses the same parameter v1, the parameter v2, the parameter r1, and the parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a second public value, the calculation formula of the second public value is r2 * B; a verification module, connected to the first calculation module and the second calculation module, to verify the obtained by itself Whether the hash value calculated by the first public value and the second public value is equal to the received first hash value and the second hash value and whether the product of the second evaluation value and the base point is equal to the verification ellipse point L. The sum of the first public value and the second public value is equal, and when the verification results are all equal, a first sign is calculated according to the message m, the first public value, the second public value and the base point seal value R, and calculate a hash value c based on the first signature value R, the EdDSA public key A, and the message m, and then calculate a hash value c based on the secret k, the message m, the hash value c, and its own Birkenstock Birkhoff (Birkhoff) coefficient b _i and the secret d _i calculate a corresponding value S _i , where i is a positive integer; and a signature module connected to the verification module to execute the security verification protocol (Secure Validation Protocol) to mutually verify that the first evaluation value obtained by both the first host and the second host in the first Bollinger circuit is the same, and if they are the same, add up all the values S _i to generate a second signature value s, and generate an EdDSA digital signature according to the first signature value R and the second signature value s. The threshold-type signature generation system based on obfuscated circuits as claimed in claim 1, wherein the first Bollinger circuit and the second Bollinger circuit are at least one of AND operation (AND) and exclusive OR operation (XOR) Confused circuits and secure multi-party computation (Multi-Party Computation, MPC) are implemented in a way, and there are multiple input wires (Wire) to input the input parameters, and the set of bit values brought by each input parameter is 256 bits The value of element, the first Bollinger circuit is a logic circuit satisfying the following conditions: MPCEdDSA(v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n, the The second Boolean circuit is a logic circuit that satisfies the following condition: ModAdd(v1,v2,r1,r2) = k + r1 + r2. For example, the threshold-type signature generation system based on obfuscated circuits in claim 1, wherein the calculation formula of the first signature value R is as follows: R = MPCEdDSA(v1,v2,r1,r2,n,m) * B - r1 * B - r2 * B, Wherein, MPCEdDSA(v1, v2, r1, r2, n, m) represents the first Bollinger circuit, and obtains the first evaluation value. As in claim item 1, the threshold-type signature generation system based on obfuscated circuits, wherein the calculation formula of the value S _i is as follows: S _i = r + c * b _i * d _i , where r = H ₂ (k,w ). For example, the threshold-type signature generation system based on obfuscated circuits in claim 1, wherein the calculation formula of the hash value c is as follows: c = SHA512(R || A || m), where SHA512 is a hash function, and the symbol || represents concatenation. A threshold-type signature generation method based on an obfuscation circuit, the steps of which include: (A) providing a first host and a second host, the first host has a secret d ₁ , a secret k ₁ , and an X coordinate x ₁ and a level value n ₁ , and the second host has a secret d ₂ , a secret k ₂ , an X coordinate x ₂ and a level value n ₂ , while the secret d ₁ , the secret k ₁ , the secret d ₂ And the secret k ₂ satisfies the following formula to generate a secret d and a secret k: BK(x ₁ ,n ₁ ) * d ₁ + BK(x ₂ ,n ₂ ) * d ₂ = d, BK(x ₁ , n ₁ ) * k ₁ + BK(x ₂ ,n ₂ ) * k ₂ = k, where BK(x _j , n _j ) represents the Burkhoff coefficient, j is 1 or 2, and let an EdDSA public key A is d * B, and let a verification elliptic point L be k * B, B is a base point of Ed25519 or sr25519 elliptic curve group; (B) Provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit A circuit, the first Bollinger circuit allows input of a plurality of input parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and output a first evaluation value , each of the input parameters is allowed to bring in a set of bit values, the second Boolean circuit allows input of the parameter v1, the parameter v2, the parameter r1 and the parameter r2 and outputs a second evaluation value, the The first evaluation value is H ₂ (k,m) + r1 + r2 mod n, and the second evaluation value is k + r1 + r2, wherein H ₂ (k,m) represents the combination of the secret k and the message m Hash after concatenation, the parameter n is the number of given elliptic curve groups, the value of the parameter v1 is BK(x ₁ ,n ₁ )k ₁ mod n, the value of the parameter v2 is BK(x ₂ ,n ₂ )k ₂ mod n; (C) The first host generates a random random number as the parameter r1 and discloses a first hash value, and the second host generates a random random number as the parameter r2 and discloses a second hash value , wherein, the calculation formula of the first hash value is H(r1 * B), the calculation formula of the second hash value is H(r2 * B), and H represents the hash function; (D) The first host uses itself The parameter v1, the parameter r1 and the message m and the second host use its own parameter v2 and the parameter r2 to jointly execute the first Boolean circuit, so that the second host can obtain the The first evaluation value, and then use the same parameter v1, the parameter v2, the parameter r1 and the parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a first public value, the first public value The calculation formula of a public value is r1 * B; (E) The second host uses its own parameter v2, the parameter r2 and The message m and the first host use the parameter v1 and the parameter r1 to execute the first Bollinger circuit together, so that the first host can obtain the first evaluation value according to the first Bollinger circuit, and then use the same The parameter v1, the parameter v2, the parameter r1 and the parameter r2 jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a second public value, the formula of the second public value is r2 * B; (F) The first host and the second host each verify whether the hash value calculated by the first public value and the second public value obtained by itself is consistent with the received first hash value and the second The hash values are equal and whether the product of the second evaluation value and the base point is equal to the sum of the verification ellipse point L, the first public value, and the second public value. When the verification results are all equal, each according to the message m , the first public value, the second public value and the base point to calculate a first signature value R, and calculate a hash value c according to the first signature value R, the EdDSA public key A and the message m, Then calculate a corresponding value S _i according to the secret k, the message m, the hash value c, a Birkhoff coefficient b _i of itself, and the secret d _i , where i is a positive integer; (G) Both the first host and the second host execute the Secure Validation Protocol to mutually verify that the first evaluation value obtained by the two parties in the first Bollinger circuit is the same; and (H) the first The host and the second host respectively add up all the values S _i to generate a second signature value s, and generate an EdDSA digital signature according to the first signature value R and the second signature value s; wherein, Step (D) and step (E) are allowed to be performed simultaneously, and steps (G) and step (H) are allowed to be performed simultaneously. As in claim 6, the method for generating a threshold signature based on an obfuscated circuit, wherein the first Bollinger circuit and the second Bollinger circuit are at least one of an AND operation (AND) and an exclusive OR operation (XOR) Confused circuits and secure multi-party computation (Multi-Party Computation, MPC) are implemented in a way, and there are multiple input wires (Wire) to input the input parameters, and the set of bit values brought by each input parameter is 256 bits The value of element, the first Bollinger circuit is a logic circuit satisfying the following conditions: MPCEdDSA(v1,v2,r1,r2,n,m) = H ₂ (k,m) + r1 + r2 mod n, the The second Boolean circuit is a logic circuit that satisfies the following condition: ModAdd(v1,v2,r1,r2) = k + r1 + r2. For example, the threshold signature generation method based on obfuscated circuit in claim 6, wherein the calculation formula of the first signature value R is as follows: R = MPCEdDSA(v1,v2,r1,r2,n,m) * B - r1 * B - r2 * B, Wherein, MPCEdDSA(v1, v2, r1, r2, n, m) represents the first Bollinger circuit, and obtains the first evaluation value. As in claim item 6, the threshold-type signature generation method based on obfuscated circuits, wherein the calculation formula of the value S _i is as follows: S _i = r + c * b _i * d _i , where r = H ₂ (k,m ). For example, the threshold-type signature generation method based on obfuscation circuit in claim 6, wherein the calculation formula of the hash value c is as follows: c = SHA512(R || A || m), where SHA512 is a hash function, and the symbol || represents concatenation.

Images