A random number batch preprocessing system suitable for distributed cryptographic protocols

Abstract

This invention specifically relates to a batch random number preprocessing system suitable for distributed cryptographic protocols. This system includes a distributed cluster, a random number aggregation module, a random number extraction module, an addressing and location module, and a message share processing module. This system, independent of counters, utilizes the XOR distance of the Kademlia algorithm to calculate the binding relationship between messages and random numbers, achieving consistent random number selection. It reduces the number of real-time computation rounds in distributed cryptographic protocols, minimizing latency, and is particularly suitable for concurrent scenarios, capable of processing multiple messages simultaneously and ensuring consistency in the random numbers selected by all parties.

Description

Technical Field

[0001] This invention relates to the field of cryptography, and in particular to a random number batch preprocessing system suitable for distributed cryptographic protocols. Background Technology

[0002] With worsening air pollution and traffic congestion, more and more cities are tightening the issuance of vehicle license plates, opting instead for a lottery system. Existing lottery algorithms sometimes employ a centralized approach, with a single computer generating the results, leading to a lack of public trust in the outcomes. Other methods use a distributed approach, but their performance is poor, requiring multiple rounds of communication each time, making it difficult to generate a large number of random numbers.

[0003] In many corporate marketing campaigns, prize draws with first, second, and third prizes are frequently held. Currently, the lottery software runs on a standalone machine, which, like generating lottery results on a standalone machine, makes the results easily manipulated by the organizer. Participants are always worried that the grand prize will be predetermined, thus dampening their enthusiasm for participating.

[0004] Almost all modern computer programming languages ​​provide pseudo-random number generation algorithms, such as the `java.util.Random` class in Java. However, these algorithms are centralized and vulnerable to attack. Influenced by the decentralized and secure multi-party computation principles of blockchain, experts have designed many distributed random number generation protocols. The basic idea is that random numbers are generated through negotiation among multiple participants. Each participant provides a random number, and the final random number is calculated from these numbers using a method similar to a voting mechanism.

[0005] The significance of distributed random number generation is that, as long as there is even one honest participant among the n participants, the final generated random number will still be "random," and the final random number is uncontrollable. Even if the n-1 participants collude, they cannot control the generated random number.

[0006] Distributed cryptography propagates the operation of a cryptosystem among multiple participants in a fault-tolerant manner. Consider an n-party threshold failure model, where at most f parties fail; such a distributed cryptosystem is called a threshold cryptosystem.

[0007] Distributed cryptosystems are based on secret sharing and consist of distributed protocols that can tolerate faulty participants. They are typically used only in public-key cryptosystems because of their "good" algebraic properties.

[0008] Secret sharing is the foundation of threshold cryptography. In a secret sharing scheme of (f+1)-out-of-n, an element s of a finite field Fq is shared among n parties, such that at least f+1 parties are required to recover s. Any group consisting of f or fewer parties should not obtain any information about s.

[0009] The "multiplex" cryptographic protocol, exemplified by MuSig, is an n-out-of-n threshold cryptographic scheme, a simplified scheme that requires all participants to participate in the computation. The characteristics of multiplex cryptographic schemes are simplicity and the elimination of the need for a secret distributor.

[0010] Based on the problems existing in the current random number extraction process, this invention proposes a batch random number preprocessing system suitable for distributed cryptographic protocols. Summary of the Invention

[0011] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient random number batch preprocessing system suitable for distributed cryptographic protocols.

[0012] This invention is achieved through the following technical solution:

[0013] A random number batch preprocessing system suitable for distributed cryptographic protocols, characterized in that it includes a distributed cluster, a random number aggregation module, a random number extraction module, an addressing and positioning module, and a message share processing module;

[0014] Each node in the distributed cluster generates local random numbers, and u*v random numbers form a matrix K. i Random number public key matrix R i and broadcast R i ;

[0015] The random number aggregation module aggregates the random number public keys of each node into u*v global random number public keys, which form a matrix R:

[0016] Each node in the distributed cluster uses matrix R to calculate a random number index, and then uses the random number index to link matrix R and matrix R... i Sum matrix K i The same row of identifiers is linked together to ensure that each node uses the same row for subsequent password calculations;

[0017] The addressing and positioning module calculates the distance between the hash of m and the random number ID, and finds the nearest random number ID;

[0018] After each node of the distributed cluster receives the message m to be processed, it extracts a random number and a random number public key from its local cache through the random number extraction module.

[0019] Each node in the distributed cluster calculates its message processing share for the retrieved random number through the message share processing module, broadcasts it, and aggregates it to obtain the final result.

[0020] The distributed cluster's n nodes generate u*v random numbers, forming a matrix K. i Saved in local cache; each node uses the formula (where 1≤i≤u, 1≤j≤v)) Generate a random number public key matrix R. i Each node broadcasts a random number public key matrix R. i ; Node P of the distributed cluster i Store the random number matrix Ki and the random number public key matrix R in the local cache. i The format is as follows:

[0021]

[0022] Matrix K i sum matrix R i The first column is the lookup key (index), and the following columns are the values, with superscripts r. (i) Let represent the matrix generated by the i-th node.

[0023] The random number aggregation module uses the formula or (1≤j≤v, 1≤i≤u) Aggregate the random number public keys of each node in the distributed cluster to form u*v global random number public keys. The global random number public keys form a matrix R as follows:

[0024]

[0025] Depending on the distributed cryptography protocol, aggregation may be performed using multiplication or addition. Multiplication means that the global random number public key equals the product of the random number public keys of all nodes; the calculation formula is as follows: Addition is

[0026] The formula for calculating the random number index for each node in the distributed cluster is ID. i =H(R) 1，1 R 2,2 , ..., R i,v ), where H() represents the hash algorithm, 1≤i≤u.

[0027] Each node in the distributed cluster has two local caches, namely a random number matrix K. i and the public key matrix R of random numbers i ; Matrix K i sum matrix R i All use IDi As a query key (index).

[0028] The random number index ID of each node in the distributed cluster i The query keys are the same, the values ​​are different, and the matrix R calculated from each node is the same.

[0029] The addressing and positioning module uses the Kademlia algorithm to calculate the distance between the hash h of m and the random number ID, and finds the random number ID0 that is closest to the hash h of m:

[0030] The random number extraction module uses the random number ID0, which is closest to m in hash h, as the query key to extract the random number k from the local cache. i,1 k i,2 , ..., k i,v and the public key r for random numbers i,1 r i,2 ,...,r i,v Each node in the distributed cluster performs subsequent processing according to the distributed cryptographic protocol.

[0031] For example, for MuSig2, taking node P1 as an example, the subsequent calculations are as follows:

[0032]

[0033] Then calculate:

[0034]

[0035]

[0036] Where s1 is the signature share of node P1, and x1 is the private key of node P1. This is the aggregated public key.

[0037] When a node in a distributed cluster receives the entire message processing share s from all other nodes... i After (1≤i≤n), the message processing shares are aggregated to obtain the final result through the random number aggregation module. The aggregation formula is as follows:

[0038]

[0039] The beneficial effects of this invention are: the random number batch preprocessing system applicable to distributed cryptographic protocols does not rely on counters, but uses the XOR distance of the Kademlia algorithm to calculate the binding relationship between messages and random numbers, thus achieving consistent selection of random numbers. It can reduce the number of real-time calculation rounds in distributed cryptographic protocols and reduce latency. It is especially suitable for concurrent scenarios, and can process multiple messages simultaneously, ensuring that the random numbers selected by all parties are consistent. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Appendix Figure 1 This is a schematic diagram of the random number batch preprocessing method applicable to distributed cryptographic protocols according to the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0043] In distributed cryptographic protocols, multiple rounds of concurrent communication are typically required. Often, in the first round (or the first two rounds), the parties negotiate to obtain v random numbers (v≥1), which form the basis for message processing in subsequent rounds.

[0044] To improve the execution efficiency of distributed protocols, especially when multiple messages need to be processed (such as signing or decryption), pre-processing the first round (or the first two rounds) allows for rapid execution of subsequent rounds upon receiving the message to be processed. This is called batch preprocessing. The purpose of batch preprocessing is to prepare multiple sets of random numbers in advance, which can be directly retrieved and used when needed.

[0045] Assume a distributed cryptographic protocol has n participants, and a total of u sets of random numbers need to be negotiated, each set containing v random numbers (v≥1). Each participant needs to cache u*v random numbers locally, i.e., cache the matrix shown in the diagram below (u rows, v columns). The local random number matrix of participant Pi is represented as Ki:

[0046] (Random number Ki matrix)

[0047] The random number matrix is ​​cached locally and must be kept confidential. Using the formula... (where 1≤i≤u, 1≤j≤v) Generate a random number public key matrix, and the random number public key matrix of participant Pi is represented as Ri:

[0048] (Random number public key Ri matrix)

[0049] Each participant's random number public key matrix needs to be broadcast to the other participants.

[0050] When a message is received, each party needs to select one row (1 set) from the two matrices mentioned above to participate in the calculation. However, the random numbers selected by each party must be consistent. That is, if row t is selected, all participating parties must select row t; otherwise, the calculation results will be inconsistent.

[0051] The intuitive idea is to maintain a global counter, starting from 1 and increasing to m. However, this approach is often unreliable, especially in concurrent scenarios.

[0052] In concurrent scenarios, when multiple participants are processing multiple messages simultaneously, it becomes difficult to establish an effective association between messages and counters. For example, when participants A and B receive messages a and b simultaneously, it's easy for A to consider a as the first message and b as the second, while B considers a as the second message and b as the first. This leads A to use r... 1,1 ,...,r 1,v To process message a, B uses r. 2,1 ,...,r 2,v Using this method to process message 'a' will cause the distributed protocol to fail.

[0053] This random number batch preprocessing system for distributed cryptographic protocols includes a distributed cluster, a random number aggregation module, a random number extraction module, an addressing and positioning module, and a message share processing module.

[0054] Each node in the distributed cluster generates local random numbers, and u*v random numbers form a matrix K. i Random number public key matrix R i and broadcast R i ;

[0055] The random number aggregation module aggregates the random number public keys of each node into u*v global random number public keys, which form a matrix R:

[0056] Each node in the distributed cluster uses matrix R to calculate a random number index, and then uses the random number index to link matrix R and matrix R... i Sum matrix K i The same row of identifiers is linked together to ensure that each node uses the same row for subsequent password calculations;

[0057] The addressing and positioning module calculates the distance between the hash of m and the random number ID, and finds the nearest random number ID;

[0058] After each node of the distributed cluster receives the message m to be processed (e.g., performing multi-signature on message m), it extracts a random number and a random number public key from its local cache through the random number extraction module.

[0059] Each node in the distributed cluster calculates its message processing share for the retrieved random number through the message share processing module, broadcasts it, and aggregates it to obtain the final result.

[0060] The distributed cluster's n nodes generate u*v random numbers (matrix Ki) and store these random numbers in their local cache. Each node uses the formula... (where 1≤i≤u, 1≤j≤v)) Generate a random number public key matrix R. i Each node broadcasts its random number public key matrix. For the MuSig style, an additional commitment / open step is added, but the random number public key matrix is ​​still ultimately formed and broadcast. At this point, any node will have the following set of matrices:

[0061]

[0062] Among them, the superscript r (i) Let represent the matrix generated by the i-th node.

[0063] The random number aggregation module uses the formula or (1≤j≤v, 1≤i≤u) Aggregate the random number public keys of each node in the distributed cluster to form u*v global random number public keys. The global random number public keys form a matrix R as follows:

[0064]

[0065] Aggregation is performed using either multiplication or addition depending on the distributed cryptography protocol. Multiplication means that the global random number public key equals the product of the random number public keys of all nodes; the calculation formula is... Addition is

[0066] The formula for calculating the random number index for each node in the distributed cluster is ID. i =H(R) 1，1 R 2,2 , ..., R i,v ), where H() represents the hash algorithm, 1≤i≤u.

[0067] Each node in the distributed cluster has two local caches, namely a random number matrix K. i and the public key matrix R of random numbers i ; Matrix K i sum matrix R i All use ID iAs a query key (index). For example, for a certain node P i Local cache matrix R i The key of the i-th record is ID. i =H(R) i,1 R i,2 , ..., R i,v The value is r. i,1 r i,2 ,...,r i , v For matrix K i Then the key is ID. i =H(R) i,1 R i,2 , ..., R i,v The value is k. i,1 k i,2 , ..., k i,v ;

[0068] The random number index ID of each node in the distributed cluster i The query keys are the same, but the values ​​are different, and the matrix R calculated by each node is the same. This ensures that after the random number index is determined, each node retrieves data from the same row of the matrix. Node P i The local cache takes the following form:

[0069] random numbers Random number public key

[0070] Matrix K i sum matrix R i The first column is the lookup key (index), and the following columns are the values.

[0071] The addressing and positioning module uses the Kademlia algorithm to calculate the distance between the hash h of m and the random number ID. First, it calculates h = H(m). Depending on the multi-party protocol, other values ​​may be added to H(), for example... This is the aggregated public key for multi-signature. Then, the following loop is performed to find the random number ID0 that is closest to the hash h of m:

[0072]

[0073] The random number extraction module uses the random number ID0, which is closest to m in hash h, as the query key to extract the random number k from the local cache. i,1 k i,2 , ..., k i,v and the public key r for random numbersi,1 r i,2 ,...,r i,v Each node in the distributed cluster performs subsequent processing according to the distributed cryptographic protocol.

[0074] For example, for MuSig2, taking node P1 as an example, the subsequent calculations are as follows:

[0075]

[0076] Then calculate:

[0077]

[0078]

[0079]

[0080] Where s1 is the signature share of node P1, and x1 is the private key of node P1. This is the aggregated public key.

[0081] When a node P in a distributed cluster i Receive the full message processing share s from all other nodes. i After (1≤i≤n), the message processing shares are aggregated to obtain the final result through the random number aggregation module. The aggregation formula is as follows:

[0082]

[0083] The same applies to other distributed cryptographic protocols, only the formulas differ.

[0084] Each node in the distributed cluster uses the Kademlia algorithm to establish a relationship between the message to be processed and a random number, and performs target addressing. When the message is determined, all parties unanimously select the public key of the random number closest to the message, and then use the selected public key and secret key to perform subsequent distributed multi-party computations, such as threshold signatures and multi-signatures. Furthermore, these random number sets can be reused; that is, the random number set can be stored in the node's cache and reused repeatedly within a certain time period.

[0085] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A random number batch preprocessing system suitable for distributed cryptographic protocols, characterized in that: Including distributed clusters, The module includes a random number aggregation module, a random number extraction module, an addressing and positioning module, and a message share processing module. Each node in the distributed cluster generates local random numbers, and u*v random numbers form a matrix K. i Random number public key matrix R i and broadcast R i ; The distributed cluster's n nodes generate u*v random numbers, forming a matrix K. i Saved in local cache; each node uses the formula Where 1≤i≤u, 1≤j≤v, generate a random number public key matrix R. i Each node broadcasts a random number public key matrix R. i ; The random number aggregation module aggregates the random number public keys of each node into u*v global random number public keys, which form a matrix R: Each node in the distributed cluster calculates a random number index using matrix R, and then uses the random number index to link matrix R and matrix R... i Sum matrix K i The same row of identifiers is linked together to ensure that each node uses the same row for subsequent password calculations; The addressing and positioning module calculates the distance between the hash of m and the random number ID, and finds the nearest random number ID; After each node of the distributed cluster receives the message m to be processed, it extracts a random number and a random number public key from its local cache through the random number extraction module. Each node in the distributed cluster calculates its message processing share for the retrieved random number through the message share processing module, broadcasts it, and aggregates it to obtain the final result.

2. The random number batch preprocessing system for distributed cryptographic protocols according to claim 1, characterized in that: The node P of the distributed cluster i Store the random number matrix Ki and the random number public key matrix R in the local cache. i The format is as follows: random number K i : Random number public key R i : Matrix K i sum matrix R i The first column is the random number index ID. i The query key is used as the query key, and all other columns are values, with superscripts r. (i) Let represent the matrix generated by the i-th node.

3. The random number batch preprocessing system for distributed cryptographic protocols according to claim 2, characterized in that: The random number aggregation module uses the formula or Where 1≤j≤v, 1≤i≤u, the random number public keys of each node in the distributed cluster are aggregated to form u*v global random number public keys. The matrix R composed of the global random number public keys is as follows:

4. The random number batch preprocessing system for distributed cryptographic protocols according to claim 3, characterized in that: The formula for calculating the random number index for each node in the distributed cluster is ID. i =H(R) 1，1 R 2,2 , ..., R i,v ), where H() represents the hash algorithm, 1≤i≤u.

5. The random number batch preprocessing system for distributed cryptographic protocols according to claim 4, characterized in that: The random number index ID of each node in the distributed cluster i They are the same, but the values ​​are different. The matrix R calculated by each node is the same.

6. The random number batch preprocessing system for distributed cryptographic protocols according to claim 5, characterized in that: The addressing and positioning module uses the Kademlia algorithm to calculate the distance between the hash h of m and the random number ID, and finds the random number ID0 that is closest to the hash h of m; the random number extraction module uses the found random number ID0 that is closest to the hash h of m as the query key to extract the random number k from the local cache. i,1 k i,2 , ..., k i,v and the public key r for random numbers i,1 r i,2 ,...,r i,v Each node in the distributed cluster performs subsequent processing according to the distributed cryptographic protocol.

7. The random number batch preprocessing system for distributed cryptographic protocols according to claim 6, characterized in that: When node P of the distributed cluster i Receive the total message processing share s from all other nodes. i If 1 ≤ i ≤ n, then the message processing shares are aggregated to obtain the final result through the random number aggregation module. The aggregation formula is as follows:

Images