A two-party collaborative EdDSA signature algorithm resistant to differential fault attacks

Abstract

The present invention provides a two-party collaborative EdDSA signature algorithm resistant to differential fault attacks, including: step one, P1 and P2 jointly generate the required secret key; wherein P1 is the first participant and P2 is the second participant; step two, P1 and P2 interact to generate a signature (R, s); step three, the signature (R, s) is verified. The present invention designs a two-party collaborative EdDSA digital signature algorithm resistant to differential fault attacks, which not only has the advantages of high security, easy verification, smaller secret key and signature space, but also the entire signature process must be jointly participated in by both communicating parties to generate a two-party collaborative signature, reducing the risk of signature private key leakage, resisting excessive concentration of signer rights, preventing single point failure, and enhancing the security of the signature algorithm; in addition, by introducing random numbers into the signature algorithm, malicious attacks are prevented from injecting faults into the EdDSA signature process using physical means such as electromagnetic radiation and lasers, and the key information of the cryptographic system is analyzed and inferred, thereby protecting the asset security of the currency.

Description

Technical Field

[0001] The present invention relates to the field of digital signature security technology, and in particular to a two-party collaborative EdDSA signature algorithm resistant to differential fault attacks. Background Art

[0002] In recent years, cryptocurrencies such as Bitcoin and Ethereum, which use blockchain as the underlying technology, have set off a wave of digital economy. In June 2019, Facebook, the world's largest social platform, launched a stable cryptocurrency based on the alliance chain. The current transaction speed of this stable cryptocurrency is about 1,000 transactions per second. Compared with the elliptic curve digital signature algorithm (full name in English: Elliptic Curve Digital Signature Algorithm, English abbreviation: ECDSA) of Bitcoin transaction orders, the stable cryptocurrency uses the Edwards Curve Digital Signature Algorithm (full name in English: Edwards Curves Digital Signature Algorithm, English abbreviation: EdDSA) with higher computational efficiency to ensure the validity of the transaction order, and its signature private key ensures the ownership of the currency assets. If the signature key is stolen or lost, the security of the currency assets will be seriously threatened.

[0003] Related technologies generally use a single-key signature method to implement EdDSA signatures, that is, a single signer uses his own key to sign information. However, single-key signatures are difficult to avoid single-point failure problems, and the loss or leakage of private keys will cause major security problems. Because EdDSA is a deterministic signature algorithm, it is vulnerable to differential fault attacks, resulting in the leakage of signature private keys.

[0004] In other words, the EdDSA signature algorithm in the related art not only cannot avoid the single point failure problem, but is also susceptible to differential failure attacks that may lead to the leakage of the signature private key. Summary of the invention

[0005] In response to the above-mentioned problems in the prior art, the present application proposes a two-party collaborative EdDSA signature algorithm that is resistant to differential fault attacks, which solves the problem that the EdDSA signature algorithm is susceptible to differential fault attacks and causes the leakage of signature private keys.

[0006] The two-party collaborative EdDSA signature algorithm resistant to differential fault attacks of the present invention includes:

[0007] Step 1: P1 and P2 jointly generate the required secret key;

[0008] Among them, P1 is the first participant and P2 is the second participant;

[0009] Step 2: P1 and P2 interact to generate a signature (R, s);

[0010] Step 3: Verify the generated signature (R, s).

[0011] In one embodiment, step one specifically includes the following steps:

[0012] In the first step, P1 arbitrarily selects α1∈{0,1} * As the private key, calculate make P1 calculation As P1's auxiliary signature private key, P1 calculates A1=x1B as P1's auxiliary signature public key;

[0013] In the second step, P1 generates a zero-knowledge proof π1 about the discrete logarithm relationship of (x1, A1) and sends the commitment commit1 of (A1, π1) to P2;

[0014] The third step, P2 arbitrarily selects α2∈{0,1} * As the private key, calculate make P2 calculation As P2's auxiliary private key for signature, P2 calculates A2=x2B as P2's auxiliary public key for signature;

[0015] Step 4: P2 generates a zero-knowledge proof π2 about the discrete logarithm relationship of (x2, A2) and sends (A2, π2) to P1.

[0016] Step 5: P1 verifies the correctness of (A2,π2). If it is incorrect, the protocol execution process is terminated. If it is correct, P1 reveals the commitment commit1 and sends the revealed commitment output value decommit1 and (A1,π1) to P2.

[0017] Step 6: P2 verifies the correctness of (A1,π1). If it is incorrect, the protocol execution process is terminated; if it is correct, the protocol execution continues.

[0018] Step 7: P1 generates a Paillier homomorphic encryption key pair (pk, sk) and calculates c key =Enc pk (x1), P1 calculates the signature public key A = x1·A2, and calculates the encryption public key pk zero-knowledge proof π3 and the ciphertext c key Zero-knowledge proof π4, pk, π3, π4 and c key Send to P2, P1 saves (x1, A, pk, sk);

[0019] Step 8: P2 verifies the correctness of π3 and π4. If they are incorrect, the protocol execution process is terminated. If they are correct, the signature public key A = x2·A1 is calculated and saved (x2, A, c key ,pk);

[0020] Among them, H1, H2 are cryptographic hash functions; α1, α2 are the signature private keys held by P1 and P2 respectively; x1, x2 are the auxiliary signature private keys held by P1 and P2 respectively, satisfying x = x1 x2; A1, A2 are the auxiliary signature public keys held by P1 and P2 respectively; commit1 is the sender's temporary commitment to π1 to the receiver in a hidden way, input message π1, and output commitment value commit1; c key , is a homomorphic ciphertext; mod n is a modulo n operation; Enc pk It is a homomorphic encryption operation, and the corresponding encryption key is pk; b′ is a fixed value of 256 on the Edwards curve Edwards25519.

[0021] In one embodiment, step 2 specifically includes the following steps:

[0022] The first step is that P1 calculates e=H2(m), and P1 arbitrarily selects a random number calculate Calculate R1=r1·B, P1 generates a zero-knowledge proof π5 about the discrete logarithm relationship of (r1, R1), calculates the commitment commit2 of (R1, π5) and sends it to P2;

[0023] The second step is that P2 calculates e=H2(m), and P2 arbitrarily selects a random number calculate Calculate R2 = r2·B, P2 generates a zero-knowledge proof π6 about the discrete logarithm relationship of (r2, R2), and sends (R2, π6) to P1;

[0024] In the third step, P1 verifies the correctness of (R2,π6). If it is incorrect, the protocol execution process is terminated. If it is correct, P1 reveals the commitment commit2 and sends the revealed commitment output value decommit2 and (R1,π5) to P2.

[0025] Step 4: P2 verifies the correctness of (R1,π5); if it is incorrect, the protocol execution process is terminated; if it is correct, P2 calculates R = R1 + R2, calculates h = H2(R,A,e) mod n, and calculates c1 = Enc pk (r2) and v = x2·h, then calculate c2 = v⊙c key ,make calculate Send c3 to P1;

[0026] Step 5: P1 calculates R=R1+R2, and P1 uses sk to decrypt c3, and finally obtains the digital signature (R, s) of message m.

[0027] in, is the set representing 1, 2, 3, ..., n-1; k1, k2 are random numbers selected by P1 and P2, satisfying B is the base point B∈E on the Edwards curve Edwards25519 c,d (F q );r1·B is the r1 times of point B on Edwards curve Edwards25519, that is, r1 is a positive integer; c1, c2, c3 are homomorphic ciphertexts; commit2 is the sender's temporary commitment to π5 to the receiver in a hidden way. The input message is π5 and the output is the commitment value commit2.

[0028] In one embodiment, in the fifth step, P1 decrypts c3 using sk as follows:

[0029] Calculate s = (r1 + s′) mod n = (r + xh) mod n;

[0030] in, Dec sk It is a homomorphic decryption operation, and the corresponding decryption key is sk.

[0031] In one embodiment, the calculation formula of Edwards curve Edwards25519 is: cx 2 +y 2 =1+dx 2 y 2 .

[0032] In one embodiment, H1: {0,1} * →{0,1} 2b′ , H2: {0,1} * →Z n .

[0033] The above technical features can be combined in various suitable ways or replaced by equivalent technical features as long as the purpose of the present invention can be achieved.

[0034] The two-party collaborative EdDSA signature algorithm resistant to differential fault attacks provided by the present invention has at least the following beneficial effects compared with the prior art:

[0035] The present invention designs a two-party collaborative EdDSA digital signature algorithm that is resistant to differential fault attacks. It not only has the advantages of high security, easy verification, and smaller secret key and signature space, but also the entire signing process must be jointly participated by both communicating parties to generate a two-party collaborative signature, which reduces the risk of signature private key leakage, resists excessive concentration of signer rights, prevents single point failure, and enhances the security of the signature algorithm; in addition, by introducing random numbers into the signature algorithm, malicious attacks using physical means such as electromagnetic radiation and lasers to inject faults into the EdDSA signing process are prevented, and the key information of the cryptographic system is analyzed and calculated, thereby protecting the asset security of the currency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The present invention will be described in more detail below based on embodiments and with reference to the accompanying drawings, wherein:

[0037] Figure 1 It is a method step diagram of two-party collaborative EdDSA signature algorithm according to an embodiment of the present invention;

[0038] Figure 2 Schematic diagram of a two-party collaborative EdDSA key generation process according to an embodiment of the present invention;

[0039] Figure 3 It is a schematic diagram of the two-party collaborative EdDSA signature algorithm process in an embodiment of the present invention.

[0040] In the drawings, like reference numerals are used for like parts. The drawings are not necessarily to scale. DETAILED DESCRIPTION

[0041] The present invention will be further described below in conjunction with the accompanying drawings.

[0042] Symbols and definitions in this application:

[0043] E c,d : Edwards curve Edwards25519, specifically cx 2 +y 2 =1+dx 2 y 2 ;

[0044] B: base point B∈E on Edwards curve Edwards25519 c,d (F q );

[0045] n: represents the order of the base point B, satisfying nB=0 and 2 3 n=#E c,d ;

[0046] b′: The fixed value on Edwards25519 is 256;

[0047] H1, H2: cryptographic hash function, H1 means the input is a bit string of arbitrary length {0,1} * , the output is a 2b′ bit long cryptographic hash function, namely H1: {0,1} * →{0,1} 2b′ , H2: {0,1} * →Z n ;

[0048] h: 512-bit message digest generated by hashing α1 or α2 with hash function H1, representing each bit of message digest of h;

[0049] represents the set of 1,2,3,...,n-1;

[0050] {0,1} 2b′ : A set of bit strings of length 2b′;

[0051] {0,1} * : A set of bit strings of arbitrary length;

[0052] P1, P2: two parties that calculate the signature key and the signature, the first party and the second party;

[0053] a·b: represents the multiplication of two numbers a and b;

[0054] mod n: modulo n operation, for example, 25mod 6=1;

[0055] α1, α2: The signature private keys held by P1 and P2 respectively, satisfying α1, α2∈{0,1} b′ ;

[0056] x1,x2: auxiliary private keys held by P1 and P2 respectively, satisfying x=x1·x2;

[0057] A1, A2: public keys held by P1 and P2 respectively;

[0058] R1, R2: The points on the Edwards curve calculated by P1 and P2 respectively, satisfying R = R1 + R2;

[0059] k1, k2: random numbers selected by P1 and P2, satisfying

[0060] r1·B: r1 times the point B on the Edwards curve, that is r1 is a positive integer,

[0061] Satisfy R1=r1·B;

[0062] Enc pk: Homomorphic encryption operation, the corresponding encryption key is pk;

[0063] Dec sk : Homomorphic decryption operation, the corresponding decryption key is sk;

[0064] c key ,c1,c2,c3: homomorphic ciphertext;

[0065] Homomorphic addition operators, such as Where c1=Enc pk (m1), c2=Enc pk (m2);

[0066] ⊙: Homomorphic multiplication operator, such as Dec sk (k⊙c1)=k·m1;where c1=Enc pk (m1);

[0067] commit1: The sender temporarily commits to the receiver π1 in a hidden way, inputs message π1, and outputs the commitment value commit1;

[0068] decommit1: reveal commitment phase, input message π1 and commitment commit1, output shows the value of π1;

[0069] It should be noted that the differential fault attack in this application is a type of side channel attack. The attacker uses physical means such as electromagnetic radiation and laser to inject faults in the encryption and signing process, forcing an operation error to occur during the execution of the cryptographic algorithm. The attacker can obtain the correct ciphertext of the same message under the key, as well as the erroneous ciphertext generated after the fault is induced, and finally deduce the key information of the cryptographic system based on the correct ciphertext and the erroneous ciphertext. Resistance to differential fault attacks means that even if the attacker uses differential fault attacks to attack the signature, forcing an operation error to occur during the execution of the cryptographic algorithm, the attacker cannot obtain the key information of the cryptographic system.

[0070] The present invention designs a two-party collaborative EdDSA digital signature algorithm that is resistant to differential fault attacks. It not only has the advantages of high security, easy verification, and smaller secret key and signature space, but also the entire signing process must be jointly participated by both communicating parties to generate a two-party collaborative signature, which reduces the risk of signature private key leakage, resists excessive concentration of signer rights, prevents single point failure, and enhances the security of the signature algorithm; in addition, by introducing random numbers into the signature algorithm, malicious attacks using physical means such as electromagnetic radiation and lasers to inject faults into the EdDSA signing process are prevented, and the key information of the cryptographic system is analyzed and calculated, thereby protecting the asset security of the currency.

[0071] like Figure 1As shown, the present invention provides a two-party collaborative EdDSA signature algorithm that is resistant to differential fault attacks.

[0072] Step 1: P1 and P2 jointly generate the required secret key;

[0073] Among them, P1 is the first participant and P2 is the second participant;

[0074] Step 2: P1 and P2 interact to generate a signature (R, s);

[0075] Step 3: Verify the generated signature (R, s).

[0076] Specifically, Figure 2 As shown, assuming that the message to be signed is a bit string m, in order to obtain the signature (R, s) of the message m, the first participant P1 and the second participant P2 communicate as follows:

[0077] Step 1. Initialize the key generation. P1 and P2 jointly generate the required key.

[0078] Step 1): Participant P1 arbitrarily selects α1∈{0,1} * As the private key, calculate make P1 calculation As P1's auxiliary signature private key, P1 calculates A1=x1B as P1's auxiliary signature public key; P1 generates a zero-knowledge proof π1 about the discrete logarithm relationship of (x1, A1), and sends the commitment commit1 of (A1, π1) to P2;

[0079] Step 2): P2 P1 arbitrarily select α2∈{0,1} * As the private key, calculate make P2 calculation As P2's auxiliary signature private key, P2 calculates A2=x2B as P2's auxiliary signature public key; P2 generates a zero-knowledge proof π2 about the discrete logarithm relationship of (x2, A2) and sends (A2, π2) to P1;

[0080] Step 3): P1 verifies the correctness of (A2,π2). If it is incorrect, the protocol execution process is terminated; if it is correct, P1 reveals the commitment commit1 and sends the revealed commitment output value decommit1 and (A1,π1) to P2;

[0081] Step 4): P2 verifies the correctness of (A1,π1). If it is incorrect, terminate the protocol execution process; if it is correct, continue to execute the protocol;

[0082] Step 5): P1 generates a Paillier homomorphic encryption key pair (pk, sk), and P1 calculates c key =Enc pk (x1), calculate the signature public key A = x1·A2, calculate the encryption public key pk zero-knowledge proof π3 and ciphertext c key Zero-knowledge proof π4, pk, π3, π4 and c key Send to P2, P1 saves (x1, A, pk, sk);

[0083] Step 6): P2 verifies the correctness of π3 and π4. If they are incorrect, the protocol execution process is terminated; if they are correct, the signature public key A = x2·A1 is calculated and saved (x2, A, c key ,pk).

[0084] Specifically, Figure 3 As shown, step 2. The two parties cooperate with the EdDSA signature algorithm and define the message to be signed as a bit string m. In order to obtain the digital signature σ=(R,s) of the message m, P1 and P2 interact to generate the signature as follows:

[0085] Step 1): Participant P1 calculates e=H2(m), and P1 arbitrarily selects a random number calculate Calculate R1 = r1·B, P1 generates a zero-knowledge proof π3 about the discrete logarithm relationship of (r1, R1), calculates the commitment commit2 of (R1, π5) and sends it to P2;

[0086] Step 2): Participant P2 calculates e=H2(m), and P2 arbitrarily selects a random number calculate Calculate R2 = r2·B, P2 generates a zero-knowledge proof π6 about the discrete logarithm relationship of (r2, R2), and sends (R2, π6) to P1;

[0087] Step 3): Participant P1 verifies the correctness of (R2,π6). If it is incorrect, the protocol execution process is terminated; if it is correct, P1 reveals the commitment commit2 and sends the revealed commitment output value decommit2 and (R1,π5) to P2;

[0088] Step 4): Participant P2 verifies the correctness of (R1,π5). If it is incorrect, the protocol execution process is terminated; if it is correct, participant P2 calculates R=R1+R2, calculates h=H2(R,A,e)mod n, and calculates c1=Enc pk (r2) and v = x2·h, then calculate c2 = v⊙c key ,make Right now Send c3 to P1;

[0089] Step 5): Participant P1 calculates R=R1+R2, and P1 uses sk to decrypt c3, that is, Calculate s = (r1 + s′) mod n = (r + xh) mod n; finally obtain the digital signature (R, s) of the message m.

[0090] Step 3. The verification algorithm of the collaborative EdDSA signature of the two parties is the same as the EdDSA signature verification method. P1 calculates h=H2(R,A,e)mod n; then checks whether the equation sB=R+hA holds. If so, the signature (R,s) is a valid signature of the message m, otherwise, the signature is invalid.

[0091] The present invention implements a two-party collaborative EdDSA signature scheme that is resistant to differential fault attacks. During the signing process, it is ensured that the two parties participating in the signature will not expose their respective signature keys, and the signature must be completed by both parties at the same time, thereby improving the security and fairness of the signature scheme. At the same time, the present invention takes into account that the EdDSA signature is a deterministic signature that cannot resist differential fault attacks. In the signing process, random numbers are introduced to resist signature differential fault attacks, thereby further improving the security of the EdDSA signature and ensuring the asset security of the cryptocurrency.

[0092] In the description of the present invention, it is necessary to understand that the terms "upper", "lower", "bottom", "top", "front", "back", "inside", "outside", "left", "right", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0093] Although the present invention is described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the present invention. It should therefore be understood that many modifications may be made to the exemplary embodiments and that other arrangements may be devised without departing from the spirit and scope of the present invention as defined by the appended claims. It should be understood that the various dependent claims and features described herein may be combined in a manner different from that described in the original claims. It should also be understood that features described in conjunction with individual embodiments may be used in other described embodiments.

Claims

1. A two-party collaborative EdDSA signature algorithm resistant to differential fault attacks, characterized in that: include: Step 1: P1 and P2 jointly generate the required secret key; Among them, P1 is the first participant and P2 is the second participant; Step 2: P1 and P2 interact to generate a signature (R, s); Step 3: Verify the generated signature (R, s); The step 1 specifically includes the following steps: In the first step, P1 arbitrarily selects α1∈{0,1} * As the private key, calculate make P1 calculation As P1's auxiliary private key for signature, P1 calculates A1=x1B as P1's auxiliary public key for signature; In the second step, P1 generates a zero-knowledge proof π1 about the discrete logarithm relationship of (x1, A1) and sends the commitment commit1 of (A1, π1) to P2; The third step, P2 arbitrarily selects α2∈{0,1} * As the private key, calculate make P2 calculation As P2's auxiliary private key for signature, P2 calculates A2=x2B as P2's auxiliary public key for signature; Step 4: P2 generates a zero-knowledge proof π2 about the discrete logarithm relationship of (x2, A2) and sends (A2, π2) to P1. Step 5: P1 verifies the correctness of (A2,π2). If it is incorrect, the protocol execution process is terminated. If it is correct, P1 reveals the commitment commit1 and sends the revealed commitment output value decommit1 and (A1,π1) to P2. Step 6: P2 verifies the correctness of (A1,π1). If it is incorrect, the protocol execution process is terminated; if it is correct, the protocol execution continues. Step 7: P1 generates a Paillier homomorphic encryption key pair (pk, sk) and calculates c key =Enc pk (x1), P1 calculates the signature public key A = x1·A2, and calculates the encryption public key pk zero-knowledge proof π3 and the ciphertext c key Zero-knowledge proof π4, pk, π3, π4 and c key Send to P2, P1 saves (x1, A, pk, sk); Step 8: P2 verifies the correctness of π3 and π4. If they are incorrect, the protocol execution process is terminated. If they are correct, the signature public key A = x2·A1 is calculated and saved (x2, A, c key ,pk); Among them, H1, H2 are cryptographic hash functions; α1, α2 are the signature private keys held by P1 and P2 respectively; x1, x2 are the auxiliary signature private keys held by P1 and P2 respectively, satisfying x = x1 x2; A1, A2 are the auxiliary signature public keys held by P1 and P2 respectively; commit1 is the sender's temporary commitment to π1 to the receiver in a hidden way, input message π1, and output commitment value commit1; decommit1 is the output value of revealing commitment commit1; c key , is a homomorphic ciphertext; mod n is a modulo n operation; Enc pk is a homomorphic encryption operation, and the corresponding encryption key is pk; b′ is a fixed value of 256 on Edwards curve Edwards25519; A represents the EdDSA signature public key; A1 and A2 represent the public keys held by P1 and P2 respectively; They represent the first 256 bits and the last 256 bits of the value calculated by the hash functions H1 and H2 respectively; h is the 512-bit message digest generated by the hash function H1 after hashing α1 or α2; E c,d is the Edwards curve Edwards25519; B is the base point B∈E on the Edwards curve Edwards25519 c,d (F q ); n represents the order of the base point B, satisfying nB=0 and 2 3 n=#E c,d ; The step 2 specifically includes the following steps: The first step is that P1 calculates e=H2(m), and P1 arbitrarily selects a random number calculate Calculate R1=r1·B, P1 generates a zero-knowledge proof π5 about the discrete logarithm relationship of (r1, R1), calculates the commitment commit2 of (R1, π5) and sends it to P2; The second step is that P2 calculates e=H2(m), and P2 arbitrarily selects a random number calculate Calculate R2 = r2·B, P2 generates a zero-knowledge proof π6 about the discrete logarithm relationship of (r2, R2), and sends (R2, π6) to P1; In the third step, P1 verifies the correctness of (R2,π6). If it is incorrect, the protocol execution process is terminated. If it is correct, P1 reveals the commitment commit2 and sends the revealed commitment output value decommit2 and (R1,π5) to P2. Step 4: P2 verifies the correctness of (R1,π5); if it is incorrect, the protocol execution process is terminated; if it is correct, P2 calculates R = R1 + R2, calculates h = H2(R,A,e) mod n, and calculates c1 = Enc pk (r2) and v = x2·h, then calculate c2 = v⊙c key ,make calculate Send c3 to P1; Step 5: P1 calculates R=R1+R2, and P1 uses sk to decrypt c3, and finally obtains the digital signature (R, s) of message m. Where m is the message to be signed, e is the hash value of the hash function H2 for the signed message m, is the set representing 1, 2, 3, ..., n-1; k1, k2 are random numbers selected by P1 and P2, satisfying r1, r2 represent the hash values ​​calculated by hash functions H1, H2; B is the base point B∈E on the Edwards curve Edwards25519 c,d (F q );r1·B is the r1 times of point B on Edwards curve Edwards25519, that is, r1 is a positive integer; c1, c2, c3 are homomorphic ciphertexts; commit2 is the sender's temporary commitment to π5 to the receiver in a hidden way, inputting the message π5 and outputting the commitment value commit2; decommit2 is to reveal the output value of commitment commit2; ⊙ is the homomorphic multiplication operator symbol; is the homomorphic addition operator, π1, π2, π3, π4, π5, π6 represent the generated zero-knowledge proof; v represents the product of the signer P2's private key x2 and the hash value h of the hash function H2.

2. The two-party collaborative EdDSA signature algorithm resistant to differential fault attacks according to claim 1 is characterized in that: In the fifth step, P1 uses sk to decrypt c3: Calculate s = (r1 + s′) mod n = (r + xh) mod n; in, Dec sk It is a homomorphic decryption operation, and the corresponding decryption key is sk.

3. The two-party collaborative EdDSA signature algorithm resistant to differential fault attacks according to claim 1 is characterized in that: The Edwards curve Edwards25519 is specifically: cx 2 +y 2 =1+dx 2 y 2 .

4. The two-party collaborative EdDSA signature algorithm resistant to differential fault attacks according to claim 1, characterized in that: The H1: {0,1} * →{0,1} 2b′ , the H2: {0,1} * →Z n ; Among them, {0,1} 2b′ Represents a set of bit strings of length 2b′; {0,1} * Represents a collection of bit strings of arbitrary length.

Images