A private key hosting and recovery method and system for blockchain system

Abstract

The present invention discloses a private key trusteeship and recovery method and system for a blockchain system, including using a private key d i Transaction message M with random number k i After signing, the transaction message M i With the signature value (r i ,s i ) is stored in the blockchain; the signature value (r i ,s i ) is the unique identifier of the block where it is located i and unique identifier h i With private key d i The corresponding relationship; the N shares k of the random number k j Stored in the corresponding custodian j , where j∈[1,N]; when recovering the private key, use the unique identifier h i Retrieve the transaction message M from the blockchain i With the signature value (r i ,s i );Stored in the custodian p j The share k j , restore the random number k; based on the transaction message M i , signature value (r i ,s i ), random number k and unique identifier h i With private key d i The corresponding relationship between the recovery of the private key d i The present invention can use the same random number k for multiple private keys d i Batch custody avoids the heavy overhead of entrusting users to manage multiple private keys separately.

Description

Technical Field

[0001] The present invention belongs to the technical field of blockchain and cryptography, and in particular relates to a private key trusteeship and recovery method and system for a blockchain system. Background Art

[0002] Blockchain is a decentralized, shared, and unchangeable database that can record various transaction information and ownership information of any asset in a reliable and secure manner, and the recorded information will be permanently preserved.

[0003] Blockchain technology is the underlying support technology for encrypted digital currencies, and has received a lot of attention since the advent of cryptocurrency. The control of funds in a cryptocurrency address depends on the control of the corresponding private key. In cryptocurrency transactions, the payer uses the private key to calculate a digital signature on the transaction information to prove the ownership of the funds. It can be seen that the user's core assets can only be controlled by the private key, and it is particularly important to protect the private key of the blockchain.

[0004] However, in real life, personal carelessness, computer hardware failure, loss of storage hard disks, and theft from exchanges can all lead to the loss of private keys. Once a user's private key is completely lost, the corresponding assets are out of control, and the user's monetary property will be lost forever. Therefore, it is necessary to study the custody and recovery methods of blockchain private keys to ensure that the user's private key can be recovered from the custodian after the private key is accidentally lost, and at the same time, to ensure that the private key information is not stolen by the custodian.

[0005] The existing blockchain private key protection technology uses secret sharing to split the private key and distribute it to different custodians to avoid the problem of information leakage and single point failure of the custodian caused by centralized storage of private keys. The problems with this custodian method are: on the one hand, there are cases where blockchain users have multiple private keys, and custodial management of each private key will bring heavy expenses to users; on the other hand, collusion between custodians will leak private key information. Summary of the invention

[0006] The present invention provides a private key hosting and recovery method and system for a blockchain system, which achieves the purpose of indirect batch hosting of private keys by hosting random numbers, ensuring that users can recover their private keys by cooperating with multiple custodians after losing their private keys.

[0007] In order to achieve the above object, the technical solution of the present invention includes:

[0008] A private key hosting and recovery method for a blockchain system, comprising the following steps:

[0009] 1) The user generates m pairs of public and private keys (Q i ,d i ), where i∈[1,m];

[0010] 2) Using private key d i Transaction message M with random number k i After signing, the transaction message M i With the signature value (r i ,s i ) is stored in the blockchain;

[0011] 3) Store the signature value (r i ,s i ) is the unique identifier of the block where it is located i and unique identifier h i With private key d i The corresponding relationship, and the N shares k of the random number k j Stored in the corresponding custodian j , where j∈[1,N];

[0012] 4) When recovering the private key, use the unique identifier h i Retrieve the transaction message M from the blockchain i With the signature value (r i ,s i );

[0013] 5) By storing it in the custodian p j The share k j , restore the random number k;

[0014] 6) Based on transaction message M i , signature value (r i ,s i ), random number k and unique identifier h i With private key d i The corresponding relationship between the recovery of the private key d i .

[0015] Furthermore, the unique identifier includes: a block header hash value.

[0016] Furthermore, the random number k is generated and managed by the following strategy:

[0017] 1) One way is that after the user generates a random number k, he uses the Shamir secret sharing scheme or the additive secret sharing scheme to share k j Distribute to the custodian j ;

[0018] 2) Another way is for each custodian to j Randomly generate share k j And send it to the user so that the user can generate a random number k using an additive secret sharing scheme.

[0019] Further, generate a public-private key pair (Qi ,d i ), the signature algorithms used include: ECDSA algorithm, Schnorr algorithm or SM2 algorithm.

[0020] Furthermore, when the signature algorithm is ECDSA, the calculation formula for recovering the private key is: i =(s i ·kH(M i ))·r i -1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

[0021] Furthermore, when the signature algorithm is Schnorr, the calculation formula for recovering the private key is: i =(s i -k)·(H(Q i ||r i ||M i )) -1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

[0022] Furthermore, when the signature algorithm is SM2, the calculation formula for recovering the private key is: i =(ks i )·(s i +r i ) - 1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

[0023] A private key hosting and recovery system for a blockchain system, which consists of several users and a blockchain, wherein the user generates m pairs of public and private keys (Q i ,d i ), where i∈[1,m]; using the private key d i Transaction message M with random number k i After signing, the transaction message M i With the signature value (r i ,s i ) is stored in the blockchain; the signature value (r i ,s i ) is the unique identifier of the block where it is located i and unique identifier h iWith private key d i The corresponding relationship, and the N shares k of the random number k j Stored in the corresponding custodian j , where j∈[1,N]; when recovering the private key, use the unique identifier h i Retrieve the transaction message M from the blockchain i With the signature value (r i ,s i );Stored in the custodian p j The share k j , restore the random number k; based on the transaction message M i , signature value (r i ,s i ) and random number k, recover private key d i .

[0024] Compared with the prior art, the present invention has the following advantages:

[0025] The present invention secretly shares the random number k, and the shares of k are held by multiple custodians. Even if the custodians conspire to recover k, they cannot recover d without knowing the signature (r, s). In addition, the same user in the blockchain system may have multiple private keys. The present invention can use the same k to perform batch custody of multiple private keys, avoiding the heavy overhead caused by the user's custody of multiple private keys separately. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of the private key trusteeship and recovery method of the present invention. DETAILED DESCRIPTION

[0027] In view of the problems existing in the prior art, the present invention proposes a private key hosting and recovery method for a blockchain system. In order to make the technical solution of the present invention clearer, the solution of the present invention is further described in detail with reference to the accompanying drawings and examples.

[0028] The private key hosting and recovery method of the present invention uses the same random number k to host multiple private keys, such as Figure 1 As shown, including: the user has m private keys d i , where i∈[1,m] uses d i For message M i Calculate the signature (r i ,s i ), m private keys use the same random number k when calculating signatures, signature (r i ,s i ) is stored in the block header with hash value h i For m private keys, the user records each pair of d i and hi When a private key d needs to be restored i When the message M based on the random number k and the corresponding private key i , and signature (r i ,s i ) to recover the private key.

[0029] Example 1

[0030] 1) The user determines the elliptic curve system parameters E(F q ), G and n, the elliptic curve E is defined in the finite field F q G represents the base point of order n on the elliptic curve E, and the values ​​of various parameters are pre-set according to the ECDSA algorithm.

[0031] 2) The user generates a random number d between [1, n-1] as the private key, that is: d∈[1, n-1].

[0032] 3) The user calculates the public key Q = d·G, where · represents the elliptic curve point multiplication operation.

[0033] 4) There are two ways to generate k: The first way is that the user generates a random number k between [1, n-1], that is, k∈[1, n-1]. The second way is that N trustees each generate a random number k. 1 , k 2 , …, k N The custodian stores the random numbers generated by each party and sends them to the user. The user calculates (k 1 +k 2 +…+k N ) mod n to get k.

[0034] 5) User calculates k·G=(x 1 ,y 1 ), calculate r = x 1 mod n, mod represents the modulo operation, if r=0, k is regenerated.

[0035] 6) The user generates a message digest e=Hash(M) of the transaction information M to be signed, where Hash represents a predetermined cryptographic hash function.

[0036] 7) User calculates s = k -1 (e+d·r)mod n.

[0037] 8) The signature of the transaction information M to be signed is (r, s).

[0038] 9) The transaction information M and signature value (r, s) are recorded in the blockchain, and the user writes down the block header hash value h of the block.

[0039] 10) Custody of random number k: When using the first random number generation method, the user calculates the secret sharing share of random number k and distributes it to multiple custodians. Specifically, the user can use the Shamir secret sharing scheme to secretly share the random number k and obtain the share k of random number k. j , j∈[1,N], the share k of random number k j Sent to the custodian p j ; You can also use the additive secret sharing scheme to secretly share the random number k, and share k of the random number k j Sent to the custodian p j When the second random number generation method is used, the trustee p j Generate a share k locally j .

[0040] 11) Reconstruction of random number k after private key d is lost: The user sends a request to the custodian to recover the random number k, obtains a share of the random number k from the custodian, and uses a secret recovery algorithm to reconstruct the random number k.

[0041] 12) The user retrieves the block information with the block hash value h and obtains the transaction information M and signature value (r, s).

[0042] 13) The user can use M, k, r, and s to calculate the private key: d = (s·kH(M))·r -1 mod n, where H is the hash calculation.

[0043] Example 2

[0044] 1) The user determines the elliptic curve system parameters E(F q ), G and n, the elliptic curve E is defined in the finite field F q G represents the base point of order n on the elliptic curve E, and the values ​​of various parameters are pre-set according to the Schnorr algorithm.

[0045] 2) The user generates a random number d between [1, n-1] as the private key, that is: d∈[1, n-1].

[0046] 3) The user calculates the public key Q = d·G, where · represents the elliptic curve point multiplication operation.

[0047] 4) The user generates a random number k. There are two ways to generate k: the first way is that the user generates a random number k between [1, n-1], that is, k∈[1, n-1]. The second way is that N custodians each generate a random number k. 1 , k 2 , …, k NThe custodian stores the random numbers generated by each party and sends them to the user. The user calculates (k 1 +k 2 +…+k N ) mod n to get k.

[0048] 5) User calculates k·G=(x 1 ,y 1 ), calculate r = x 1 mod n.

[0049] 6) The user generates a message digest e=Hash(M) of the transaction information M to be signed, where Hash represents a predetermined cryptographic hash function.

[0050] 7) The user calculates s = d·H(Q||r||M)+k mod n.

[0051] 8) The signature of the transaction information M to be signed is (r, s).

[0052] 9) The transaction information M and signature value (r, s) are recorded in the blockchain, and the user writes down the block header hash value h of the block.

[0053] 10) Custody of random number k: When using the first random number generation method, the user calculates the secret sharing share of random number k and distributes it to multiple custodians. Specifically, the user can use the Shamir secret sharing scheme to secretly share the random number k and obtain the share k of random number k. j , j∈[1,N], the share k of random number k j Sent to the custodian p j ; You can also use the additive secret sharing scheme to secretly share the random number k, and share k of the random number k j Sent to the custodian p j When the second random number generation method is used, the trustee p j Generate a share k locally j .

[0054] 11) Reconstruction of random number k after private key d is lost: The user sends a request to the custodian to recover the random number k, obtains a share of the random number k from the custodian, and uses a secret recovery algorithm to reconstruct the random number k.

[0055] 12) The user retrieves the block information with the block hash value h and obtains the transaction information M and signature value (r, s).

[0056] 13) The user can use M, k, r, s, Q to calculate the private key: d = (sk) · (H (Q||r||M)) -1 mod n.

[0057] Example 3

[0058] 1) The user determines the elliptic curve system parameters E(F q ), G and n, the elliptic curve E is defined in the finite field F q G represents the base point of order n on the elliptic curve E, and the values ​​of various parameters are pre-set according to the SM2 algorithm.

[0059] 2) The user generates a random number d between [1, n-1] as the private key, that is: d∈[1, n-1].

[0060] 3) The user calculates the public key Q = d·G, where · represents the elliptic curve point multiplication operation.

[0061] 4) The user generates a random number k. There are two ways to generate k: the first way is that the user generates a random number k between [1, n-1], that is, k∈[1, n-1]. The second way is that N custodians each generate a random number k. 1 , k 2 , …, k N The custodian stores the random numbers generated by each party and sends them to the user. The user calculates (k 1 +k 2 +…+k N ) mod n to get k.

[0062] 5) User calculates k·G=(x 1 ,y 1 ).

[0063] 6) The user generates a message digest of the transaction information M to be signed: e = Hash (M), r = e + x 1 mod n.

[0064] 7) User calculates s = (1 + d) -1 (kr·d)mod n.

[0065] 8) The signature of the transaction information M to be signed is (r, s).

[0066] 9) The transaction information M and signature value (r, s) are recorded in the blockchain, and the user writes down the block header hash value h of the block.

[0067] 10) Custody of random number k: When using the first random number generation method, the user calculates the secret sharing share of random number k and distributes it to multiple custodians. Specifically, the user can use the Shamir secret sharing scheme to secretly share the random number k and obtain the share k of random number k. j , j∈[1,N], the share k of random number k j Sent to the custodian pj ; You can also use the additive secret sharing scheme to secretly share the random number k, and share k of the random number k j Sent to the custodian p j When the second random number generation method is used, the trustee p j Generate a share k locally j .

[0068] 11) Reconstruction of random number k after private key d is lost: The user sends a request to the custodian to recover the random number k, obtains a share of the random number k from the custodian, and uses a secret recovery algorithm to reconstruct the random number k.

[0069] 12) The user retrieves the block information with the block hash value h and obtains the transaction information M and signature value (r, s).

[0070] 13) The user can calculate the private key using k, r, and s: d = (ks) (s+r) -1 mod n.

[0071] Finally, it should be noted that the above implementation cases are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention is described in detail using examples, ordinary technicians in the field should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A private key hosting and recovery method for a blockchain system, comprising the following steps: 1) The user generates m pairs of public and private keys (Q i , d i ), where i∈[1,m]; 2) Using private key d i Transaction message M with random number k i After signing, the transaction message M i With the signature value (r i ,s i ) is stored in the blockchain; 3) Store the signature value (r i ,s i ) is the unique identifier of the block where it is located i and unique identifier h i With private key d i The corresponding relationship, and the N shares k of the random number k j Stored in the corresponding custodian j , where j∈[1,N]; 4) When recovering the private key, use the unique identifier h i Retrieve the transaction message M from the blockchain i With the signature value (r i ,s i ); 5) By storing it in the custodian p j The share k j , restore the random number k; 6) Based on transaction message M i , signature value (r i ,s i ) and random number k, recover private key d i .

2. The method according to claim 1, characterized in that The unique identifier includes: block header hash value.

3. The method according to claim 1, characterized in that The random number k is generated and managed by the following strategy: 1) One way is that after the user generates a random number k, he uses the Shamir secret sharing scheme or the additive secret sharing scheme to share k j Distribute to the custodian j ; 2) Another way is for each custodian to j Randomly generate share k j And send it to the user so that the user can generate a random number k using an additive secret sharing scheme.

4. The method according to claim 1, characterized in that Generate a public-private key pair (Q i , d i ), the signature algorithms used include: ECDSA algorithm, Schnorr algorithm or SM2 algorithm.

5. The method according to claim 4, characterized in that When the signature algorithm is ECDSA, the formula for recovering the private key is: i =(s i ·kH(M i ))·r i -1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

6. The method according to claim 4, characterized in that When the signature algorithm is Schnorr, the calculation formula for recovering the private key is: i =(s i -k)·(H(Q i ||r i ||M i )) -1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

7. The method according to claim 4, characterized in that When the signature algorithm is SM2, the calculation formula for recovering the private key is: i =(ks i )·(s i +r i ) -1 mod n, where mod represents the modulus operation and n represents the elliptic curve E(F q ) The order of the base point G, F q represents a finite field.

8. A private key hosting and recovery system for a blockchain system, comprising a number of users and a blockchain, characterized in that: The user generates m pairs of public and private keys (Q i , d i ), where i∈[1,m]; using the private key d i Transaction message M with random number k i After signing, the transaction message M i With the signature value (r i ,s i ) is stored in the blockchain; the signature value (r i ,s i ) is the unique identifier of the block where it is located i and unique identifier h i With private key d i The corresponding relationship, and the N shares k of the random number k j Stored in the corresponding custodian j , where j∈[1,N]; when recovering the private key, use the unique identifier h i Retrieve the transaction message M from the blockchain i With the signature value (r i ,s i );Stored in the custodian p j The share k j , restore the random number k; based on the transaction message M i , signature value (r i ,s i ) and random number k, recover private key d i .

Images