A three-party collaborative SM2 digital signature generation method and system to resist malicious adversaries

Abstract

This invention discloses a method and system for generating three-party collaborative SM2 digital signatures to resist malicious adversaries. The method includes three-party collaborative key generation and three-party collaborative signing. This invention can promptly detect whether a malicious adversary deviates from the predetermined steps of the protocol during execution, and can hold the perpetrator accountable after the malicious adversary's attack causes the protocol to terminate. This scheme uses a three-party collaborative signature based on secret sharing and employs multiplication triples for security verification. It fully considers the security, reliability, and performance of collaborative signature technology, achieving a security level resistant to malicious adversary attacks while ensuring secure, reliable, and rapid digital signature generation in a three-party environment, achieving a balance between key generation and signing efficiency. This invention has advantages such as high security, high flexibility, and high performance, and can be applied to any application scenario supporting secure multi-party computation.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an efficient three-party collaborative SM2 digital signature generation method and system for resisting malicious adversaries. Background Technology

[0002] SM2 is an algorithm that uses elliptic curve cryptography to implement digital signatures. Based on the mathematical properties of elliptic curves, it provides a secure and efficient method for digital signatures. Digital signature technology is widely used in cryptocurrencies, digital certificates, secure communications, and other fields. Similar to traditional signatures, it simulates the function of paper signatures or seals through specific cryptographic algorithms, thereby ensuring the integrity, authenticity, and non-repudiation of digital resources. While SM2 signature technology is theoretically secure, it may face some threats and attacks in practical applications. The most serious security threat is the leakage of the private key. If the private key is leaked, hackers or attackers can use it to generate valid signatures and impersonate legitimate users to conduct fraudulent activities. Therefore, protecting the security of the private key is crucial.

[0003] Collaborative signature technology allows multiple participants to jointly generate a key, preventing any single entity or a small group of colluders from obtaining the complete private key without authorization. Multiple signers jointly complete the signature, ensuring that all parties agree and authorize the content of the signature, preventing a single entity from abusing its signing authority. This technology is highly useful in scenarios requiring multi-party participation and consent, such as multi-party contracts and multi-party authorizations. However, collaborative signature technology can also increase complexity and computational costs, and existing technologies cannot guarantee a balance between security, reliability, and performance when applying these techniques. Summary of the Invention

[0004] This invention proposes a three-party collaborative SM2 digital signature generation method and system based on secret sharing and designed to resist malicious adversaries. This invention can promptly detect whether malicious adversaries deviate from the predetermined steps of the protocol during execution, and can hold the perpetrator accountable after the protocol terminates due to an attack. It fully considers the security, reliability, and performance of collaborative signature technology, achieving a security level resistant to malicious adversary attacks while ensuring secure, reliable, and rapid digital signature generation in a three-party environment, achieving a balance between key generation and signing efficiency.

[0005] The technical solution adopted in this invention is as follows:

[0006] The first aspect provides a three-party collaborative SM2 digital signature generation method resistant to malicious adversaries, including:

[0007] The three parties use a pseudo-random function and a shared key to generate a secret sharing of the signing private key, and jointly generate a signature verification public key based on the cryptographic sharing of their respective signing private keys;

[0008] The three parties use the secret sharing replication technique to recover the secret value to be shared, interactively calculate the intermediate variables of the complete signature, and obtain the complete signature based on the message to be signed, the signature verification public key, and the intermediate variables of the complete signature.

[0009] In one implementation, the three parties use a pseudo-random function and a shared key to generate a secret sharing of the signing private key, and jointly generate a signature verification public key based on the cryptographic sharing of their respective signing private keys, including:

[0010] Each participant initializes a counter and generates its own shared key based on the initialization ideal function;

[0011] Each participant uses a pseudo-random function and the shared key they hold to secretly share the signature private key;

[0012] Each participant calculates the public key component based on the cryptographic sharing of their own signature private key, and sends the calculated public key component to other participants;

[0013] Each participant determines the validity of a public key component by comparing its own calculated public key component with the received component. If all public key components are consistent, it indicates that each participant is honestly executing the protocol, and the public key component is valid. At this point, a public signature verification public key is calculated based on each public key component. If there are inconsistencies in the public key components, it indicates that a malicious participant is dishonestly executing the protocol, the public key component is invalid, and the protocol is terminated.

[0014] In one implementation, the three parties use a replication-based secret-sharing technique to recover the secret value to be shared, interactively compute intermediate variables for the complete signature, and use the multiplication triplet verification protocol π. Mult-TripleVerify Verification is performed. If successful, a complete signature is obtained based on the message to be signed, the signature verification public key, and intermediate variables for the complete signature, including:

[0015] Each participant updates the counter and secretly shares the random number k using a pseudo-random function and the shared key they hold;

[0016] Each participant calculates a signature parameter component based on the secret sharing of their own random number k, and sends their calculated signature parameter component to other participants. Each participant determines the validity of the signature parameter component by checking whether their calculated signature parameter component matches the received signature parameter component. If all signature parameter components match, it means that each participant is honestly executing the protocol, and the signature parameter component is valid. The first signature parameter is then calculated based on the signature parameter component. If there are inconsistencies in the signature parameters, it means that a malicious participant is dishonestly executing the protocol, the signature parameter component is invalid, and the protocol is terminated.

[0017] Each participant updates the counter and secretly shares the random number ρ calculated using a pseudo-random function and the shared key they hold;

[0018] Each participant calculates the intermediate parameter α component based on their shared key and the secret sharing of the random number ρ;

[0019] Each participant sends its intermediate parameter α component to the other participants, using the multiplication triplet to verify the protocol π. Mult-TripleVerify Perform verification; if successful, proceed to the next step.

[0020] Each participant calculates the intermediate parameter β component based on the first signature parameter, hash function, and the secret sharing of their respective signature private key, and sends their calculated intermediate parameter β component to other participants, who then calculate the intermediate parameter based on the intermediate parameter β component.

[0021] Each participant calculates a signature parameter component based on intermediate parameters β and α, and sends the calculated signature parameter component to other participants, using the multiplication triplet verification protocol π. Mult-TripleVerify Verification is performed. After verification, the second signature parameter is calculated based on all signature parameter components. The first signature parameter and the second signature parameter together form a complete signature generated collaboratively by the three parties.

[0022] In one implementation, the pseudo-random function is F(·), and each participant uses the pseudo-random function and the shared key they hold to calculate the secret sharing of the signing private key, including:

[0023] The first participant, P1, calculates x1 = F(k). 13 +count1) and x2=F(k 12 +count1), the second participant P2 calculates x2=F(k 12 +count2) and x3=F(k 23 +count2), the third participant P3 calculates x1=F(k 13 +count3) and x3=F(k 23+count3), where x1 and x2 are the secret sharing of the signature private key calculated by the first participant, k 13 and k 12 The shared key held by the first participant, count1 is the counter corresponding to the first participant, and k 12 and k 23 Here, x1 is the shared key held by the second participant, x2 is the counter corresponding to the second participant, x3 and x2 are the secret sharing of the signature private key calculated by the second participant, and x3 is the counter corresponding to the third participant. 13 and k 23 x1 and x3 are the secret sharing of the signature private key calculated by the third party, which is a shared key held by the third party.

[0024] In one implementation, each participant calculates an intermediate parameter β component based on a first signature parameter, a hash function, and a secret sharing of their respective signature private keys, and sends their calculated intermediate parameter β component to other participants, including:

[0025] First participant P1 calculates Then, the intermediate parameter β component β1 = h1ρ1 + h1ρ2 + h2ρ1 is calculated, where h1 and h2 are the intermediate parameters calculated by the first participant, ρ1 and ρ2 are the secret sharing of the random number ρ calculated by the first participant; H(·) is the cryptographic function derived from the cryptographic hash function, m is the message to be signed, and x1 and x2 are the secret sharing of the signing private key calculated by the first participant.

[0026] Second participant P2 calculates Calculate the intermediate parameter β component β2 = h2ρ2 + h2ρ3 + h3ρ2, where h3 and h2 are the intermediate parameters calculated by the second participant, ρ2 and ρ3 are the secret sharing of the random number ρ obtained by the second participant, and x3 and x2 are the secret sharing of the signature private key calculated by the second participant.

[0027] Third-party participant P3 calculates Calculate the intermediate parameter β component β3 = h3ρ3 + h3ρ1 + h1ρ3, where h1 and h3 are intermediate parameters calculated by the third participant, ρ3 and ρ1 are the secret sharing of the random number ρ calculated by the third participant, and x1 and x3 are the secret sharing of the signature private key calculated by the third participant.

[0028] The first participant sends the intermediate parameter β component β1 to the second and third participants; the second participant sends the intermediate parameter β component β2 to the first and third participants; and the third participant sends the intermediate parameter β component β3 to the first and second participants. Then each participant P... iHold (β1,β2,β3).

[0029] Based on the same inventive concept, a second aspect of the present invention provides a three-party collaborative SM2 signature generation system, comprising:

[0030] The three-party collaborative key generation module is used by the three participating parties to generate a secret sharing of a signature private key using a pseudo-random function and a shared key, and to jointly generate a signature verification public key based on the cryptographic sharing of their respective signature private keys.

[0031] The three-party collaborative signature module is used by three participating parties to recover the secret value to be shared using the copy secret sharing technology, calculate the intermediate variables of the complete signature through interaction, and obtain the full signature based on the message to be signed, the signature verification public key, and the intermediate variables of the complete signature.

[0032] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the three-party collaborative SM2 digital signature generation method against malicious adversaries as described in the first aspect.

[0033] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the three-party collaborative SM2 digital signature generation method against malicious adversaries as described in the first aspect.

[0034] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0035] This invention provides a three-party collaborative SM2 digital signature generation method resistant to malicious adversaries. It can promptly detect whether malicious adversaries deviate from the predetermined steps of the protocol during execution and can hold the perpetrator accountable after the protocol terminates due to an attack. This scheme uses a three-party collaborative signature based on secret sharing and employs multiplication triples for security verification. It fully considers the security, reliability, and performance of collaborative signature technology, achieving a security level resistant to malicious adversary attacks while ensuring secure, reliable, and rapid digital signature generation in a three-party environment, achieving a balance between key generation and signing efficiency. The sharing of the secret component in the three-party signature is optimized, reducing communication volume between participants and improving communication efficiency. Furthermore, a parallel strategy can be adopted to enhance system performance. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart of a three-party collaborative key generation protocol provided in an embodiment of the present invention;

[0038] Figure 2 A flowchart of a three-party collaborative signature protocol provided in an embodiment of the present invention;

[0039] Figure 3 This is an overall framework diagram of the three-party collaborative SM2 signature generation system for resisting malicious adversaries provided in an embodiment of the present invention. Detailed Implementation

[0040] While collaborative signature technology is highly useful in scenarios requiring multi-party participation and consent, it can also increase complexity and computational costs by managing multiple signature parts and ensuring that merging them does not compromise signature security. Therefore, a careful balance between security, reliability, and performance is necessary when applying these technologies.

[0041] Based on the above considerations, this invention designs a three-party collaborative SM2 digital signature generation method and system based on replicated secret sharing to resist malicious adversaries. This method can promptly detect whether malicious adversaries deviate from the predetermined steps of the protocol during execution, and can hold the perpetrator accountable after the protocol terminates due to an attack. This scheme uses a three-party collaborative signature based on replicated secret sharing and employs multiplication triples for security verification. It fully considers the security, reliability, and performance of collaborative signature technology, achieving a security level resistant to malicious adversary attacks while ensuring secure, reliable, and rapid digital signature generation in a three-party environment, thus achieving a balance between key generation and signing efficiency.

[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Example 1

[0044] This invention discloses a three-party collaborative SM2 digital signature generation method resistant to malicious adversaries, comprising:

[0045] The three parties use a pseudo-random function and a shared key to generate a secret sharing of the signing private key, and jointly generate the first signature verification public key based on the cryptographic sharing of their respective signing private keys;

[0046] The three parties use the secret sharing replication technique to recover the secret value to be shared, and interactively calculate the intermediate variables for the complete signature. Based on the message to be signed, the signature verification public key, and the intermediate variables for the complete signature, they obtain the complete signature.

[0047] To ensure universality, the parameters selected in this invention are consistent with the standard parameters of the SM2 signature algorithm. Specific symbol descriptions are as follows:

[0048] P1, P2, P3: First participant, second participant, third participant;

[0049] q: a large prime number.

[0050] The set of integers consisting of 1, 2, ..., q-1.

[0051] Elliptic curve group of order N.

[0052] G: elliptic curve Generator.

[0053] x i Participant P i The private key for signing.

[0054] Q: Digital signature verification of public key.

[0055] k·P: a point on the elliptic curve that is k times the value of point P, where k is a positive integer.

[0056] H(·): A cryptographic function derived from a cryptographic hash function.

[0057] Initialize the ideal function to generate the seed key for copy secret sharing.

[0058] F(·): Pseudo-random function PRF.

[0059] Algorithms for generating zero-knowledge proofs about discrete logarithmic relations.

[0060] Zero-knowledge proof of the discrete logarithmic relation.

[0061] π Mult-TripleVerify : Multiplication triplet verification protocol.

[0062] m: Message to be signed.

[0063] Specifically, the three-party collaborative SM2 digital signature generation method for resisting malicious adversaries proposed in this invention includes three-party collaborative key generation and three-party collaborative signature steps.

[0064] In one implementation, the three-party collaborative key generation step includes: the three signing parties initializing an ideal function. The generated shared key is used by the participants to generate a secret signature private key using a pseudo-random function F(·). Together, they generate a publicly available signature verification public key Q, denoted as P for each signing participant. i (i∈{1,2,3}). Please see below. Figure 1 Specifically, this can be achieved through the following steps:

[0065] a) Each participant P i Initialize the corresponding counter count i And based on ideal functions Each generates its own shared key, and P1 holds the shared key (k). 12 ,k 13 P2 holds the shared key (k) 12 ,k 23 P3 holds the shared key (k 13 ,k 23 ). Where the random number k 12 ,k 23 ,

[0066] b) Each participant P i The secret sharing of the signature private key is calculated using a pseudo-random function F(·) and the held shared key.

[0067] P1 calculates the secret sharing of private key x. Where x1=F(k 13 +count1) and x2=F(k 12 +count1), then calculate Given Q2 = x2·G, send the message (com-prove, 1, Q1, x1) to the ideal function. (This can be viewed as P1 sending a commitment com to P2, which is a zero-knowledge proof of the public key share Q1 and its discrete logarithmic relation π1.)

[0068] c) P2 receives the ideal function After receiving the message (proof-receipt, 1), update the counter count and ensure its consistency, then calculate... Where x2=F(k) 12 +count2) and x3=F(k23 +count2), calculate Q2 = x2·G and Q3 = x3·G, then send the message (com-prove, 2, Q2, x2) to the ideal function. This can be viewed as P2 sending a commitment com, which is a zero-knowledge proof of the public key share Q2 and its discrete logarithmic relation π2, to P3.

[0069] d) P3 receives the ideal function After receiving the message (proof-receipt, 2), update the counter count and ensure its consistency, then calculate... Where x1=F(k 13 +count3) and x3=F(k 23 +count3). Calculate Q1 = x1·G and Q3 = x3·G. Then send the message (prove, 3, Q3, x3) to the ideal function. This can be viewed as sending the public key share Q3 and its discrete logarithmic relation zero-knowledge proof π3 to P1.

[0070] e) When participant P1 receives the ideal function After receiving the message (proof, 3, Q3), the validity of the zero-knowledge proof (proof) is verified. If the proof is invalid, it indicates that participant P3 maliciously tampered with the protocol flow, sending an incorrect public key share Q′3 where Q′3 ≠ Q3. Based on the message sid = 3, participant P3 can be held accountable, and the protocol flow is terminated. If the proof is valid, it indicates that participant P3 followed the protocol flow, and the public key share Q3 sent satisfies the discrete logarithm relation Q3 = x3·G. At this time, participant P1 holds valid signature public key shares Q1, Q2, Q3, and calculates and stores the complete signature public key Q = Q1 + Q2 + Q3. Participant P1 sends the message (decom-proof, 1) to the ideal function.

[0071] f) When participant P2 receives the ideal function After receiving the message (decom-proof, 1, Q1), the validity of the zero-knowledge proof (proof) is verified. If the proof is invalid, it indicates that participant P1 maliciously tampered with the protocol flow, sending an incorrect public key share Q′1 where Q′1 ≠ Q1. Based on the message sid = 1, participant P1 can be held accountable, and the protocol flow is terminated. If the proof is valid, it indicates that participant P1 followed the protocol flow, and the public key share Q1 sent satisfies the discrete logarithmic relationship Q1 = x1·G. At this time, participant P2 holds valid signature public key shares Q1, Q2, Q3, and calculates and stores the complete signature public key Q = Q1 + Q2 + Q3. Participant P2 sends the message (decom-proof, 2) to the ideal function.

[0072] g) When participant P3 receives the ideal function After receiving the message (decom-proof, 2, Q2), verify the validity of the zero-knowledge proof proof. If the zero-knowledge proof proof is invalid, it indicates that participant P2 maliciously tampered with the protocol flow and sent an incorrect public key share Q. ′ 2 and Q ′ Since 2 ≠ Q2, participant P2 can be held accountable based on message sid = 2, terminating the protocol process. If the zero-knowledge proof is valid, it indicates that participant P2 followed the protocol process, and the public key share Q2 sent satisfies the discrete logarithmic relationship Q2 = x²·G. At this point, participant P3 holds valid signature public key shares Q1, Q2, and Q3, and calculates and stores the complete signature public key Q = Q1 + Q2 + Q3.

[0073] It should be noted that, This operation represents the request for a secret share or secret sharing, and is used to calculate the secret share held by the participants.

[0074] In one implementation, the three-party collaborative signature step includes: the three signing parties jointly executing a distributed signature generation protocol, using a replicated secret sharing technique to recover the secret value to be shared, and then using an ideal function. Interactive computation of intermediate variables, using multiplication triples to verify the π protocol. Mult-TripleVerify After verification, the complete signature value σ = (r, s) is finally calculated. Please refer to [link / reference]. Figure 2 Specifically, this can be achieved through the following steps:

[0075] a) Each participant P i Update counter count i And secretly share the random number k calculated using the pseudo-random function F(·) and the held shared key. Participant P1 calculates... Where k1=F(k 13 +count1) and k2=F(k12 +count1), calculate Where R1 = k1·G and R2 = k2·G, the message (com-prove, 1, R1, k1) is sent to the ideal function. (This can be viewed as P1 sending a commitment com to P2 with a zero-knowledge proof of the signature parameter share R1 and its discrete logarithmic relation π1.)

[0076] b) Calculation of P2 for Participants Where k2=F(k 12 +count2) and k3=F(k 23 +count2), calculate Where R2 = k2·G and R3 = k3·G, then send the message (com-prove,2,R2,k2) to the ideal function. (This can be viewed as P2 sending a zero-knowledge proof of the signature parameter share R2 and its discrete logarithmic relation π2 to P3 as a commitment com.)

[0077] c) Participant P3 Calculation Where k1=F(k 13 +count3) and k3=F(k 23 +count3), calculate Where R1 = k1·G and R3 = k3·G, the message (prove, 3, R3, k3) is sent to the ideal function. (This can be viewed as P3 sending the signature parameter share R3 and its discrete logarithmic relation zero-knowledge proof π3 to P1.)

[0078] d) When participant P1 receives the ideal function After receiving the message (proof, 3, R3), the validity of the zero-knowledge proof (proof) is verified. If the proof is invalid, it indicates that participant P3 maliciously tampered with the protocol flow, sending an incorrect signature parameter share R′3 where R′3 ≠ R3. Based on the message sid = 3, participant P3 can be held accountable, and the protocol flow is terminated. If the proof is valid, it indicates that participant P3 followed the protocol flow, and the public key share R3 sent satisfies the discrete logarithm relation R3 = k3·G. At this time, participant P1 holds valid signature parameter shares R1, R2, and R3, and calculates and stores the complete signature parameter R = R1 + R2 + R3. Participant P1 sends the message (decom-proof, 1) to the ideal function. This can be viewed as P1 sending the signature parameter R1 and its discrete logarithmic relation zero-knowledge proof π1 to P2.

[0079] e) When participant P2 receives the ideal function After receiving the message (decom-proof, 1, R1), the validity of the zero-knowledge proof (proof) is verified. If the proof is invalid, it indicates that participant P1 maliciously tampered with the protocol flow, sending an incorrect signature parameter share R′1 where R′1 ≠ R1. Based on message sid = 1, participant P1 can be held accountable, and the protocol flow is terminated. If the proof is valid, it indicates that participant P1 followed the protocol flow, and the sent signature parameter share R1 satisfies the discrete logarithmic relation R1 = k1·G. At this point, participant P2 holds valid signature parameter shares R1, R2, and R3, and calculates and stores the complete signature parameter R = R1 + R2 + R3. Participant P2 then sends the message (decom-proof, 2) to the ideal function. This can be viewed as P1 sending the signature parameter R2 and its discrete logarithmic relation zero-knowledge proof π2 to P2.

[0080] f) When participant P3 receives the ideal function After receiving the message (decom-proof, 2, R2), the validity of the zero-knowledge proof (proof) is verified. If the proof is invalid, it indicates that participant P1 maliciously tampered with the protocol flow, sending an incorrect signature parameter share R′2 where R′2 ≠ R2. Based on the message sid = 2, participant P2 can be held accountable, and the protocol flow is terminated. If the proof is valid, it indicates that participant P2 followed the protocol flow, and the public key share R2 sent satisfies the discrete logarithm relation R2 = k2·G. At this time, participant P2 holds valid signature parameter shares R1, R2, R3, and calculates and stores the complete signature parameter R = R1 + R2 + R3.

[0081] g) After the above steps, let the signature parameter r = R. x +H(m)(R x (The x-coordinate value of R). Each participant P i Update counter count i And secretly share the random number ρ calculated using the pseudo-random function F(·) and the held shared key. Where P1 is calculated... Where ρ1=F(k 13 +count1) and ρ2=F(k 12 +count1), P2 calculation Where ρ2=F(k 12 +count2) and ρ3=F(k 23 +count2), P3 calculation Where ρ1=F(k 13 +count3) and ρ3=F(k 23 +count3).

[0082] h) Each participant Pi Calculate the intermediate parameter α component Participant P1 calculation Participant P2 calculation Participant P3 calculation And the participating party P i The portion α to be held i Send to P i-1 At this point, participant P1 holds (α1, α2), participant P3 holds (α2, α3), and participant P3 holds (α1, α3).

[0083] i) For P i Shares held and Participants P1, P2, and P3 jointly execute the multiplication triple verification protocol π. Mult-TripleVerify If the output is "accept", it means that each participant honestly calculates its share α. i If the output is ⊥, it indicates that a malicious participant has tampered with the share α. i The agreement is terminated.

[0084] j) Calculation of participant P1 Calculate the intermediate parameter β component β1=h1ρ1+h1ρ2+h2ρ1, and calculate the participant P2. Calculate the intermediate parameter β component β2=h2ρ2+h2ρ3+h3ρ2, and calculate the participant P3. Calculate the intermediate parameter β component β3 = h3ρ3 + h3ρ1 + h1ρ3. And the participant P... i The held component β i Send to P i-1 At this point, participant P1 holds (β1, β2), participant P2 holds (β2, β3), and participant P3 holds (β1, β3). Where ρ = ρ1 + ρ2 + ρ3;

[0085] k) For P i Shares held and Participants P1, P2, and P3 jointly execute the multiplication triple verification protocol π. Mult-TripleVerify If the output is "accept", it means that each participant honestly calculates its share β. i If the output is ⊥, it indicates that a malicious participant has tampered with the share β. i The agreement is terminated.

[0086] l) Each participant P i The intermediate parameter β component β is held i Send to participant P i+1That is, participant P1 sends β1 to participant P2, participant P2 sends β2 to participant P3, and participant P3 sends β3 to participant P1. Thus, each participant P... i Given intermediate parameter β components β1, β2, β3, calculate the intermediate parameter. And calculate β -1 modq.

[0087] m) Participant P1 calculates the signature parameter component s1=α1β -1 ,s2=α2β -1 Participant P2 calculates the signature parameter component s2 = α2β -1 ,s3=α3β -1 Participant P3 calculates the signature parameter component s1 = α1β -1 ,s3=α3β -1 And the participating party P i The held signature parameter component s i Send to participant P i+1 That is, participant P1 sends s1 to participant P2, participant P2 sends s2 to participant P3, and participant P3 sends s3 to participant P1. Thus, each participant P... i Holding the signature parameter components s1, s2, and s3, calculate the second signature parameter. The three parties collaborated to generate a complete signature {r,s}.

[0088] In general, the present invention has the following advantages and beneficial effects compared with the prior art:

[0089] 1. To resist malicious adversaries, the system introduces consistency checks and accountability mechanisms, enabling it to detect malicious behavior in a timely manner. When the protocol is terminated, the system can return the identity of the party that caused the execution failure, thus facilitating post-event accountability and ensuring the flexibility and robustness of digital signatures.

[0090] 2. Security: Security depends directly on the security of multi-prover zero-knowledge proofs and secure multi-party computation protocols, which can satisfy the correctness and privacy of three-party collaborative signatures.

[0091] 3. High performance: The sharing of the secret component in the three-party signature is optimized, which reduces the amount of communication between the participants and improves communication efficiency. At the same time, a parallel strategy can be adopted to improve system performance.

[0092] Example 2

[0093] Based on the same inventive concept, this embodiment discloses a three-party collaborative SM2 signature generation system. Please refer to [link / reference]. Figure 3 ,include:

[0094] The three-party collaborative key generation module 101 is used by the three participating parties to generate a secret sharing of a signature private key using a pseudo-random function and a shared key, and to jointly generate a first signature verification public key based on the cryptographic sharing of their respective signature private keys.

[0095] The three-party collaborative signature module 102 is used by three participating parties to recover the secret value to be shared using the copy secret sharing technology, calculate the intermediate variables of the complete signature through interaction, and obtain the complete signature based on the message to be signed, the signature verification public key, and the intermediate variables of the complete signature.

[0096] The three-party collaborative key generation module 101 is used to execute the three-party collaborative key generation steps or protocol, and the three-party collaborative signature module 102 is used to execute the three-party collaborative signature steps or protocol.

[0097] Since the system described in Embodiment 2 of this invention is the system used to implement the three-party collaborative SM2 digital signature generation method against malicious adversaries in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0098] Example 3

[0099] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in Embodiment 1.

[0100] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the three-party collaborative SM2 digital signature generation method against malicious adversaries in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0101] Example 4

[0102] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in Embodiment 1.

[0103] Since the computer device described in Embodiment 4 of this invention is the same computer device used to implement the three-party collaborative SM2 digital signature generation method against malicious adversaries in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0104] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A three-party collaborative SM2 digital signature generation method resistant to malicious adversaries, characterized in that, include: The three parties use a pseudo-random function and a shared key to generate a secret sharing of the signing private key, and jointly generate a signature verification public key based on the cryptographic sharing of their respective signing private keys; The three parties use a secret-sharing replication technique to recover the secret value to be shared, interactively calculate intermediate variables for the complete signature, and use a multiplication triplet verification protocol. Upon successful verification, the complete signature is obtained based on the message to be signed, the signature verification public key, and the intermediate variables for the complete signature. The specific process of generating the complete signature includes: The three parties use a secret-sharing replication technique to recover the secret value to be shared, interactively calculate intermediate variables for the complete signature, and obtain the complete signature based on the message to be signed, the signature verification public key, and the intermediate variables for the complete signature, including: Each participant updates its counter and calculates a random number using a pseudo-random function and the shared key it holds. Secret sharing; Each participant uses their own random number. The secret is to share the calculated signature parameter components and send the calculated signature parameter components to other participants. Each participant determines the validity of the signature parameter components by whether their calculated signature parameter components are consistent with the received signature parameter components. If all signature parameter components are consistent, it means that each participant is honestly executing the protocol and the signature parameter components are valid. The first signature parameter is calculated based on the signature parameter components. If there are inconsistent signature parameters, it means that a malicious participant is dishonestly executing the protocol, the signature parameter components are invalid, and the protocol is terminated. Each participant updates its counter and calculates a random number using a pseudo-random function and the shared key it holds. Secret sharing; Each participant uses the first signature parameter, their respective shared key, and a random number. Secret sharing of intermediate parameters Quantity; Each participant will hold Send to other participants, using the multiplication triplet verification protocol. Perform verification; if successful, proceed to the next step. Each participant calculates intermediate parameters based on a secret sharing of their respective signing private keys. Components, and the intermediate parameters calculated by itself. The component is sent to other participants; Each participant is based on intermediate parameters. The component calculates the signature parameter component and sends the calculated signature parameter component to other participants, using the multiplication triplet verification protocol. Verification is performed. After verification, the second signature parameter is calculated based on all signature parameter components. The first signature parameter and the second signature parameter together form a complete signature generated collaboratively by the three parties.

2. The three-party collaborative SM2 digital signature generation method for resisting malicious adversaries as described in claim 1, characterized in that, The three parties use a pseudo-random function and a shared key to generate a secret sharing of the signing private key, and jointly generate a signature verification public key based on the cryptographic sharing of their respective signing private keys, including: Each participant initializes a counter and generates its own shared key based on the initialization ideal function; Each participant uses a pseudo-random function and the shared key they hold to secretly share the signature private key; Each participant calculates the public key component based on the cryptographic sharing of their own signature private key and sends the calculated public key component to other participants. Each participant determines the validity of a public key component by comparing its own calculated public key component with the received component. If all public key components are consistent, it indicates that each participant is honestly executing the protocol, and the public key component is valid. At this point, a public signature verification public key is calculated based on each public key component. If there are inconsistencies in the public key components, it indicates that a malicious participant is dishonestly executing the protocol, the public key component is invalid, and the protocol is terminated.

3. The three-party collaborative SM2 digital signature generation method for resisting malicious adversaries as described in claim 1, characterized in that, The pseudo-random function is Each participant uses a pseudo-random function and the shared key they hold to secretly share the signing private key, including: First Participant calculate and Second Participant calculate and Third party calculate and ,in, and Secret sharing of the signature private key calculated for the first participant. and The shared key held by the first participating party. For the counter corresponding to the first participant, and The shared key held by the second participant. For the counter corresponding to the second participant, and Secret sharing of the signature private key calculated for the second participant. For the counter corresponding to the third participant, and A shared key held by a third party. and Secret sharing of the signature private key calculated for a third party.

4. The three-party collaborative SM2 digital signature generation method for resisting malicious adversaries as described in claim 1, characterized in that, Each participant calculates intermediate parameters based on the initial signature parameters, the hash function, and the secret sharing of their respective signature private keys. Components, and the intermediate parameters calculated by itself. The components are sent to other participants, including: First Participant calculate Then calculate the intermediate parameters. Quantity ,in, and Intermediate parameters calculated for the first participant. and The random number calculated for the first participant Secret sharing; A cryptographic function derived from a cryptographic hash function. The message is pending signature. and Secret sharing of the signature private key calculated for the first participant; Second Participant calculate Calculate intermediate parameters Quantity ,in, and Intermediate parameters calculated for the second participant. and The random number calculated for the second participant Secret sharing; and Secret sharing of the signature private key calculated for the second participant; Third party calculate Calculate intermediate parameters Quantity ,in, and Intermediate parameters calculated for third-party participants. and Random numbers calculated for third-party participants Secret sharing; and Secret sharing of the signature private key calculated for a third party; The first participant will hold the intermediate parameters. Quantity The intermediate parameters are sent to the second and third participants, with the second participant holding them. Quantity The data is sent to both the first participant and the third participant; the third participant will hold the intermediate parameters. Quantity Sending to the first participant and the second participant, then each participant... hold .

5. A three-party collaborative SM2 digital signature generation system resistant to malicious adversaries, characterized in that, include: The three-party collaborative key generation module is used by the three participating parties to generate a secret sharing of a signature private key using a pseudo-random function and a shared key, and to jointly generate a signature verification public key based on the cryptographic sharing of their respective signature private keys. The three-party collaborative signature module is used by three participating parties to recover the secret value to be shared using a copy-and-share technique. It interactively calculates intermediate variables for the complete signature and uses a multiplication triplet verification protocol. Verification is performed, and after successful verification, a complete signature is obtained based on the message to be signed, the signature verification public key, and intermediate variables for the complete signature. The three-party collaborative signature module is specifically used for: Each participant updates its counter and calculates a random number using a pseudo-random function and the shared key it holds. Secret sharing; Each participant uses their own random number. The secret is to share the calculated signature parameter components and send the calculated signature parameter components to other participants. Each participant determines the validity of the signature parameter components by whether their calculated signature parameter components are consistent with the received signature parameter components. If all signature parameter components are consistent, it means that each participant is honestly executing the protocol and the signature parameter components are valid. The first signature parameter is calculated based on the signature parameter components. If there are inconsistent signature parameters, it means that a malicious participant is dishonestly executing the protocol, the signature parameter components are invalid, and the protocol is terminated. Each participant updates its counter and calculates a random number using a pseudo-random function and the shared key it holds. Secret sharing; Each participant uses the first signature parameter, their respective shared key, and a random number. Secret sharing of intermediate parameters Quantity; Each participant will hold Send to other participants, using the multiplication triplet verification protocol. Perform verification; if successful, proceed to the next step. Each participant calculates intermediate parameters based on a secret sharing of their respective signing private keys. Components, and the intermediate parameters calculated by itself. The component is sent to other participants; Each participant is based on intermediate parameters. The component calculates the signature parameter component and sends the calculated signature parameter component to other participants, using the multiplication triplet verification protocol. Verification is performed. After verification, the second signature parameter is calculated based on all signature parameter components. The first signature parameter and the second signature parameter together form a complete signature generated collaboratively by the three parties.

6. The three-party collaborative SM2 digital signature generation system for resisting malicious adversaries as described in claim 5, characterized in that, The three-party collaborative key generation module is specifically used for: Each participant initializes a counter and generates its own shared key based on the initialization ideal function; Each participant uses a pseudo-random function and the shared key they hold to secretly share the signature private key; Each participant calculates the public key component based on the cryptographic sharing of their own signature private key and sends the calculated public key component to other participants. Each participant determines the validity of a public key component by comparing its own calculated public key component with the received component. If all public key components are consistent, it indicates that each participant is honestly executing the protocol, and the public key component is valid. At this point, a public signature verification public key is calculated based on each public key component. If there are inconsistencies in the public key components, it indicates that a malicious participant is dishonestly executing the protocol, the public key component is invalid, and the protocol is terminated.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the three-party collaborative SM2 digital signature generation method against malicious adversaries as described in any one of claims 1 to 4.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the three-party collaborative SM2 digital signature generation method against malicious adversaries as described in any one of claims 1 to 4.

Images