WO2022193789A1

WO2022193789A1 - Anonymous multi-signature method, computer device, and storage medium

Info

Publication number: WO2022193789A1
Application number: PCT/CN2021/143838
Authority: WO
Inventors: 马登极; 王志文; 吴思进
Original assignee: 杭州复杂美科技有限公司
Priority date: 2021-03-19
Filing date: 2021-12-31
Publication date: 2022-09-22
Also published as: CN113112268A

Abstract

An anonymous multi-signature method, a computer device, and a storage medium. The method comprises: respectively acquiring first signature data and corresponding first public keys and first elliptic curve random numbers (S11); generating, according to the first public keys, signature identifier information for identifying whether each user that has the right to participate in multi-signature has participated in the present multi-signature (13); generating first proof information according to first target data, the signature identifier information, the first signature data and the corresponding first public keys and first elliptic curve random numbers (S15); and generating a first anonymous multi-signature transaction comprising the first target data and the first proof information and sending same to a blockchain network (S17), such that the first anonymous multi-signature transaction is executed by means of an anonymous multi-signature contract, and the first target data, the first proof information and a verification parameter are input into a zero-knowledge proof circuit for anonymous multi-signature verification. The method implements the anonymous multi-signature on a blockchain.

Description

Anonymous multi-signature method, computer device and storage medium

technical field

The present application relates to the field of Internet technologies, in particular to an anonymous multi-signature method, computer equipment and storage medium.

Background technique

The current blockchain multi-signature schemes are all publicly signed schemes:

Users participating in multi-signature sign and generate transactions through their own private keys and send them to the blockchain network;

The blockchain node executes the transaction through the multi-signature contract, and verifies the signature through the user's public key: if the verification is successful, the user's signature is recorded in the contract;

When the number of signing users recorded in the contract exceeds the number of users required for multi-signature, for example, 2/3 of the total number of users, the multi-signature verification is successful.

The above scheme very clearly exposes which users participate in multi-signature and which users do not participate in multi-signature.

When some users want to participate in this multi-signature, and do not want to expose their information about participating in this multi-signature, the above scheme cannot meet the needs of such users.

Zero-Knowledge Proof was proposed by S. Goldwasser, S. Micali and C. Rackoff in the early 1980s. It refers to the ability of the prover to convince the verifier that an assertion is correct without providing any useful information to the verifier. A zero-knowledge proof is essentially a protocol involving two or more parties, a series of steps that two or more parties need to take to complete a task. The prover proves to the verifier and convinces it that it knows or possesses a certain message, but the proof process cannot reveal any information about the proved message to the verifier.

SUMMARY OF THE INVENTION

In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide an anonymous multi-signature method, computer equipment and storage medium for realizing anonymous multi-signature on the blockchain.

In the first aspect, the present invention provides an anonymous multi-signature method. An anonymous multi-signature contract is configured on the blockchain, and a zero-knowledge proof circuit for verifying the anonymous multi-signature is configured in the anonymous multi-signature contract. Generated validation parameters, the method includes:

Obtaining the first signature data generated by each first user participating in this multi-signature to the first target data signature and the corresponding first public key and the first elliptic curve random number;

Generate signature identification information for identifying whether each user authorized to participate in multi-signature participates in this multi-signature according to each first public key;

generating the first certification information according to the first target data, the signature identification information, each first signature data, the corresponding first public key and the first elliptic curve random number;

Generate a first anonymous multi-signature transaction including the first target data and the first certification information and send it to the blockchain network for the blockchain node to execute the first anonymous multi-signature transaction through the anonymous multi-signature contract, and the first target data. , the first proof information and verification parameters are input into the zero-knowledge proof circuit for anonymous multi-signature verification:

Verify that the number of signing users identified by the signature identification information is not less than the number of signatures required for multi-signature; and,

Verify whether the signature of each first user identified by the signature identification information passes the verification:

If any of the above verification fails, the anonymous multi-signature verification fails;

If the above two verifications are successful, the anonymous multi-signature verification is successful.

In the second aspect, the present invention provides an anonymous multi-signature method suitable for blockchain nodes. An anonymous multi-signature contract is configured on the blockchain, and a zero-knowledge proof circuit for verifying the anonymous multi-signature is configured in the anonymous multi-signature contract. And, according to the verification parameters generated by the zero-knowledge proof circuit, the method includes:

The first anonymous multi-signature transaction is executed through the anonymous multi-signature contract, and the first target data, the first proof information and the verification parameters are input into the zero-knowledge proof circuit for anonymous multi-signature verification:

Wherein, the first anonymous multi-signature transaction includes first target data and first certification information, and is generated by the first user terminal;

The first certification information is generated by the first user terminal according to the first target data, the signature identification information, each first signature data and the corresponding first public key and the first elliptic curve random number;

The signature identification information is used to identify whether each user authorized to participate in the multi-signature participates in the multi-signature this time, and is generated by the first user terminal according to each first public key.

In a third aspect, the present invention also provides a computer apparatus comprising one or more processors and a memory, wherein the memory contains instructions executable by the one or more processors to cause the one or more processors to perform operations in accordance with the present invention The anonymous multi-signature method provided by each embodiment.

In a fourth aspect, the present invention further provides a storage medium storing a computer program, the computer program causing a computer to execute the anonymous multi-signature method provided according to each embodiment of the present invention.

The anonymous multi-signature method, computer device and storage medium provided by the embodiments of the present invention configure a zero-knowledge proof circuit for simultaneously verifying whether the number of signatures is sufficient and whether each signature can pass the verification in a smart contract, and configure the circuit to generate The verification parameters of the blockchain allow anonymous multi-signature transactions publicly submitted to the blockchain to include only the target data and the certification information generated according to the signature data and other information, without including any information that may expose the user's identity, such as the public key, so as to achieve Anonymous multi-signature on the blockchain.

Description of drawings

Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is a flowchart of an anonymous multi-signature method according to an embodiment of the present invention.

FIG. 2 is a flowchart of another anonymous multi-signature method provided by an embodiment of the present invention.

FIG. 3 is a schematic structural diagram of a computer device according to an embodiment of the present invention.

Detailed ways

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the related invention, but not to limit the invention. In addition, it should be noted that, for the convenience of description, only the parts related to the invention are shown in the drawings.

It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

As shown in FIG. 1, in this embodiment, the present invention provides an anonymous multi-signature method. An anonymous multi-signature contract is configured on the blockchain, and a zero-knowledge proof circuit for verifying anonymous multi-signature is configured in the anonymous multi-signature contract. , and, according to the verification parameters generated by the zero-knowledge proof circuit, the method includes:

S11: respectively acquiring first signature data generated by each first user participating in this multi-signature signing the first target data, the corresponding first public key and the first elliptic curve random number;

S13: Generate signature identification information for identifying whether each user who has the right to participate in multi-signature participates in this multi-signature according to each first public key;

S15: Generate first certification information according to the first target data, the signature identification information, each first signature data, the corresponding first public key and the first elliptic curve random number;

S17: Generate a first anonymous multi-signature transaction including the first target data and the first certification information and send it to the blockchain network, so that the blockchain node can execute the first anonymous multi-signature transaction through the anonymous multi-signature contract, and the first anonymous multi-signature transaction The target data, the first proof information and the verification parameters are input into the zero-knowledge proof circuit for anonymous multi-signature verification:

In this embodiment, the signature algorithm adopts the schnorr signature algorithm, and the generation algorithm of the signature data is as follows:

s=r+ke, e=hash(P||R||m);

Among them, s is the signature data, r is the random number, k is the private key, P is the public key, R is the elliptic curve random number generated according to r, and m is the target data of the signature.

The verification algorithm for signed data is as follows:

s*G=(r+ke)*G=r*G+(k*G)e=R+Pe;

Among them, G is the base point of the elliptic curve.

In this embodiment, the zero-knowledge proof circuit configured in the anonymous multi-signature contract is generated according to the above algorithms.

Specifically, those skilled in the art can understand how to generate a zero-knowledge proof circuit according to an algorithm in a zero-knowledge proof system, where the zero-knowledge proof circuit at least includes the generation algorithm Setup(), the proof algorithm Prove() and the verification algorithm Verify(). The specific process will not be repeated here.

In more embodiments, the signature algorithm can also be configured as other signature algorithms commonly used in the field according to actual requirements, as long as the verification algorithm of the signature algorithm can meet the requirements of zero-knowledge proof, that is, the public information submitted by the anonymous multi-signature exchange The same technical effect can be achieved by entering and attesting without revealing information about the user's identity.

The method shown in FIG. 1 can be applied to both the client and different computer devices such as an auxiliary centralized server, which will be specifically described with reference to the following examples.

The above method is exemplarily explained by taking an example of an anonymous multi-signature registered in the contract that all 9 users have the right to sign and requires at least 6 of the 9 users to pass the signature.

First, when performing anonymous multi-signature registration, the verification parameter ver_key1 needs to be generated according to the public keys P _A -P _I or address addr _A -addr _I of 9 users and the above generation algorithm Setup(), namely:

Setup(P _A -P _I )→verify parameter ver_key1; or,

Setup(addr _A -addr _I )→verify parameter ver_key1;

Then ver_key1 is submitted to the blockchain through an anonymous multi-signature registration transaction, and ver_key1 is deployed to the anonymous multi-signature contract for subsequent verification.

After successful registration, when users A, C, D, F, G, and H need to perform anonymous multi-signature on the target data data1, they need to summarize the public keys of each user, the signature data for data1, and the elliptic curve corresponding to the signature. To generate proof information and generate anonymous multi-signature transactions, that is, a device is required to perform the method shown in Figure 1.

In this embodiment, the user terminal of user A performs the method as an example for illustrative illustration; in other embodiments, the user terminal of each user can also use the public key, signature data and signature corresponding to the The elliptic curve random number is submitted to an auxiliary centralized server with confidential credit, and the centralized server executes the method shown in FIG. 1; in more embodiments, other methods that can be understood by those skilled in the art can also be Different devices implement the method shown in Figure 1, as long as the device can obtain the data provided by each client, generate transactions and send them to the blockchain network, the same technical effect can be achieved.

In step S11, the user terminal of user A obtains the following data respectively:

The user terminal of user A uses the private key p _A and the random number r1 to sign the signature data s _A generated by data1, the public key P _A of user A, and the elliptic curve random number R1 generated according to r1;

The user terminal of user C uses the private key p _C and the random number r2 to sign the signature data s _C generated by data1, the public key PC of user _C , and the elliptic curve random number R2 generated according to r2;

The user terminal of user D uses the private key p _D and the random number r3 to sign the signature data s _D generated by data1, the public key P _D of user D, and the elliptic curve random number R3 generated according to r3;

The user terminal of user F uses the private key p _F and the random number r4 to sign the signature data s _F generated by data1, the public key P _F of user F, and the elliptic curve random number R4 generated according to r4;

The user terminal of user G uses the private key p _G and the random number r5 to sign the signature data s _G generated by data1, the public key P _G of the user G, and the elliptic curve random number R5 generated according to r5;

The user terminal of user H uses the private key p _H and the random number r6 to sign the signature data s _H generated by data1, the public key P _H of the user H, and the elliptic curve random number R6 generated according to r6.

In step S13, the user terminal of user _A generates according to each of the first public keys PA, PC, _PD , _PF , _PG , and _PH for identifying whether each user who has the right to participate in the multi _- signature participates in this time The signature identification information of the multi-signature is 101101110 (may also use 0 to identify participation and 1 to identify non-participation, then the signature identification information is 010010001; it can also be identified in other ways that can be understood by those skilled in the art).

In step S15, the user terminal of user A takes the first target data data1 as a public input, and takes the signature data s _A -s _H , public keys P _A -P _H , and elliptic curve random numbers R1-R6 obtained in step S11 as Private input, input the above-mentioned proof algorithm Prove(), and generate the first proof information prove1, namely:

Prove(data1, s _A -s _H , P _A -P _H , R1-R6)→prove1.

In step S17, the user terminal of user A packages and generates an anonymous multi-signature transaction tx1 including the first target data data1 and the first proof information prove1, and sends the tx1 to the blockchain network.

The blockchain node receives, broadcasts, packages and executes tx1 through the anonymous multi-signature contract, and inputs the first target data data1, the first proof information prove1 and the verification parameter ver_key1 into the verification algorithm Verify() of the zero-knowledge proof circuit, and performs anonymous multi-signature Validation, i.e.:

Verify(data1, prove1, ver_key1)→Yes/No.

Specifically, the verification algorithm Verify() ensures that the following two verifications are simultaneously performed inside the zero-knowledge proof circuit:

Verify whether the number of signature users (6) identified by the signature identification information 101101110 is not less than the number of signatures required for multi-signature (6);

Verify whether the signature of each first user identified by the signature identification information passes the verification.

If any of the above two verifications fails, the output result of the verification algorithm Verify() is No, and the anonymous multi-signature verification fails;

If the above two verifications are successful, the output result of the verification algorithm Verify() is Yes, and the anonymous multi-signature verification is successful.

In the above example, the information disclosed on the blockchain through the execution results of tx1 and tx1 only includes the target data data1, which can only be used for verification, the proof information prove1 that cannot be parsed, and the verification result is success or failure, and No information is disclosed that would reveal the identity of the signing user.

The above embodiment configures a zero-knowledge proof circuit in the smart contract for simultaneously verifying whether the number of signatures is sufficient and whether each signature can pass the verification, and configures the verification parameters generated according to the circuit, so that the anonymous public submission to the blockchain can be achieved. Multi-signature transactions can only include target data and certification information generated based on information such as signature data, without including any information that may expose the user's identity, such as the public key, thus realizing anonymous multi-signature on the blockchain.

FIG. 2 is a flowchart of another anonymous multi-signature method provided by an embodiment of the present invention. The method shown in FIG. 2 may be performed in conjunction with the method shown in FIG. 1 .

As shown in FIG. 2 , in this embodiment, the present invention also provides an anonymous multi-signature method suitable for blockchain nodes, where an anonymous multi-signature contract is configured on the blockchain, and an anonymous multi-signature contract is configured in the anonymous multi-signature contract for verification An anonymous multi-signature zero-knowledge proof circuit, and, according to the verification parameters generated by the zero-knowledge proof circuit, the method includes:

S21: Execute the first anonymous multi-signature transaction through the anonymous multi-signature contract, and input the first target data, the first proof information and the verification parameters into the zero-knowledge proof circuit for anonymous multi-signature verification:

Preferably, the above zero-knowledge proof circuit is generated according to the following algorithm:

s=r+ke;

e=hash(P||R||m);

s*G=(r+ke)*G=r*G+(k*G)e=R+Pe;

Among them, s is the signature data, r is the random number, k is the private key, P is the public key, R is the elliptic curve random number generated according to r, m is the target data of the signature, and G is the base point of the elliptic curve.

For the anonymous multi-signature principle of the method shown in Fig. 2, reference may be made to the method shown in Fig. 1, and details are not repeated here.

As shown in FIG. 3 , as another aspect, the present application also provides a computer device 300 , comprising one or more central processing units (CPUs) 301 , which can operate according to a program stored in a read only memory (ROM) 302 Or a program loaded from the storage section 308 into the random access memory (RAM) 303 executes various appropriate actions and processes. In the RAM 303, various programs and data necessary for the operation of the device 300 are also stored. The CPU 301 , the ROM 302 , and the RAM 303 are connected to each other through a bus 304 . An input/output (I/O) interface 305 is also connected to bus 304 .

The following components are connected to the I/O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 308 including a hard disk, etc. ; and a communication section 309 including a network interface card such as a LAN card, a modem, and the like. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I/O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 310 as needed so that a computer program read therefrom is installed into the storage section 308 as needed.

In particular, according to an embodiment of the present disclosure, the method described in any of the above embodiments may be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing any of the methods described above. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 309 and/or installed from the removable medium 311 .

As yet another aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium may be a computer-readable storage medium included in the apparatus of the foregoing embodiment; A computer-readable storage medium in a device. The computer-readable storage medium stores one or more programs that are used by one or more processors to perform the methods described in the present application.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by dedicated hardware-based systems that perform the specified functions or operations , or can be implemented by a combination of dedicated hardware and computer instructions.

The units or modules involved in the embodiments of the present application may be implemented in a software manner, and may also be implemented in a hardware manner. The described units or modules may also be provided in the processor, for example, each unit may be a software program provided in a computer or a mobile smart device, or may be a separately configured hardware device. Wherein, the names of these units or modules do not constitute limitations on the units or modules themselves under certain circumstances.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principles. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, and should also cover, without departing from the concept of the present application, the above-mentioned technical features or Other technical solutions formed by any combination of its equivalent features. For example, a technical solution is formed by replacing the above-mentioned features with the technical features disclosed in this application (but not limited to) with similar functions.

Claims

An anonymous multi-signature method, characterized in that an anonymous multi-signature contract is configured on the blockchain, the anonymous multi-signature contract is configured with a zero-knowledge proof circuit for verifying anonymous multi-signature, and, according to the zero-knowledge proof verification parameters generated by a circuit, the method comprising:

Obtaining the first signature data generated by each first user participating in this multi-signature to the first target data signature and the corresponding first public key and the first elliptic curve random number;

Generate signature identification information for identifying whether each user who has the right to participate in multi-signature participates in this multi-signature according to each of the first public keys;

generating first certification information according to the first target data, the signature identification information, each of the first signature data, the corresponding first public key and the first elliptic curve random number;

A first anonymous multi-signature transaction including the first target data and the first certification information is generated and sent to the blockchain network for the blockchain node to execute the first anonymous multi-signature contract through the anonymous multi-signature contract Sign the transaction, input the first target data, the first proof information and the verification parameters into the zero-knowledge proof circuit for anonymous multi-signature verification:

Verifying whether the number of signature users identified by the signature identification information is not less than the number of signatures required for multi-signature; and,

Verify whether the signature of each of the first users identified by the signature identification information passes the verification:

If any of the above verification fails, the anonymous multi-signature verification fails;

If the above two verifications are successful, the anonymous multi-signature verification is successful.
The method according to claim 1, wherein the zero-knowledge proof circuit is generated according to the following algorithm:

s=r+ke;

e=hash(P||R||m);

s*G=(r+ke)*G=r*G+(k*G)e=R+Pe;

Among them, s is the signature data, r is the random number, k is the private key, P is the public key, R is the elliptic curve random number generated according to r, m is the target data of the signature, and G is the base point of the elliptic curve.
An anonymous multi-signature method, characterized in that an anonymous multi-signature contract is configured on the blockchain, the anonymous multi-signature contract is configured with a zero-knowledge proof circuit for verifying anonymous multi-signature, and, according to the zero-knowledge proof The verification parameters generated by the circuit, the method is applicable to a blockchain node, and the method includes:

Execute the first anonymous multi-signature transaction through the anonymous multi-signature contract, and input the first target data, the first proof information and the verification parameters into the zero-knowledge proof circuit for anonymous multi-signature verification:

Verify that the number of signing users identified by the signature identification information is not less than the number of signatures required for multi-signature; and,

Verify whether the signature of each first user identified by the signature identification information passes the verification:

If any of the above verification fails, the anonymous multi-signature verification fails;

If the above two verifications are successful, the anonymous multi-signature verification is successful;

Wherein, the first anonymous multi-signature transaction includes the first target data and the first certification information, and is generated by the first client;

The first certification information is generated by the first user terminal according to the first target data, the signature identification information, each first signature data, the corresponding first public key and the first elliptic curve random number;

The signature identification information is used to identify whether each user authorized to participate in the multi-signature participates in the multi-signature this time, and is generated by the first user terminal according to each of the first public keys.
The method according to claim 3, wherein the zero-knowledge proof circuit is generated according to the following algorithm:

s=r+ke;

e=hash(P||R||m);

s*G=(r+ke)*G=r*G+(k*G)e=R+Pe;

Among them, s is the signature data, r is the random number, k is the private key, P is the public key, R is the elliptic curve random number generated according to r, m is the target data of the signature, and G is the base point of the elliptic curve.
A computer device, characterized in that the device comprises:

one or more processors;

memory for storing one or more programs,

The one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-4.
A storage medium storing a computer program, characterized in that, when the program is executed by a processor, the method according to any one of claims 1-4 is implemented.