A two-party collaborative signature method and system based on ECDSA algorithm

Abstract

The technical solution of the present invention provides a method and system for collaborative signature between two parties based on the ECDSA algorithm. By splitting the private key, the two communicating parties store their own sub-private keys separately. When the two parties sign collaboratively, they exchange multiple signature components generated by each party, and finally calculate the complete signature. In addition, by designing the collaborative signature algorithm, the components of the private key are introduced in the calculation of the k value corresponding to the standard ECDSA signature algorithm, avoiding the risk of attackers calculating the components of the private key by repeatedly intercepting the exchanged information between the two parties, and further enhancing the security of the algorithm. The technical solution of the present invention solves the security problem of the private key in the ECDSA algorithm software cryptographic module, and introduces the components of the private key in the calculation of the k value corresponding to the standard ECDSA signature algorithm, making it difficult for attackers to calculate the components of the private key based on the data exchanged between the two parties, thereby enhancing the confidentiality of the private key and greatly improving the security of the collaborative signature.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptography application technology, and in particular to a collaborative signature method and system for communicating parties based on an ECDSA algorithm. Background Art

[0002] The application of public key cryptography can ensure the non-forgeability and non-repudiation of digital signatures. The public key cryptography system needs to ensure the security of private keys, and often requires the use of special cryptographic hardware to safely store and use the user's private key. However, in Internet of Vehicles, smart home and other Internet of Things applications and cloud computing systems, there are a large number of devices that are not equipped with hardware cryptographic modules, and public key cryptography needs to be applied to ensure the security of information systems. When introducing software cryptographic modules to meet the needs of such devices, special attention should be paid to the security of private keys to prevent private key leakage.

[0003] The Elliptic Curve Digital Signature Algorithm (ECDSA) is a simulation of the Digital Signature Algorithm (DSA) using elliptic curve public key cryptography. In order to solve the problem of private key security in the ECDSA algorithm software cryptographic module, there are a few collaborative signature schemes in the prior art. The private key is stored in parts. When the private key needs to be used for signing, each part of the depositor uses its own sub-private key to perform cryptographic operations and exchange partial operation results with each other. The final cryptographic operation result is equivalent to the result of directly using the private key for digital signing.

[0004] However, due to the characteristics of the ECDSA algorithm, the collaborative signature scheme in the prior art still has a large security risk. If an attacker intercepts the information exchanged between the communicating parties during the collaborative signature process multiple times, it is easy for the attacker to find unrelated equations about the private key components and calculate some of the private key components by solving the private key component equations, thereby threatening the security of the ECDSA algorithm. Summary of the invention

[0005] The purpose of the present invention is to provide a bilateral collaborative signature method and system with higher security performance in response to the demand for security and confidentiality of the ECDSA algorithm software cryptographic module, so as to further improve the private key security of the ECDSA algorithm software cryptographic module.

[0006] In order to achieve the above-mentioned object, the technical solution of the present invention provides a two-party collaborative signature method based on the ECDSA algorithm, the method involves a first communication party and a second communication party, the first communication party and the second communication party share the ECDSA algorithm elliptic curve E and a base point G with an order of n on E; the method includes a collaborative public key generation stage and a collaborative signature stage;

[0007] The collaborative generation of public keys includes:

[0008] S101, the first communication party generates a random number d1∈[1,n-1], takes d1 as the sub-private key of the first communication party, calculates the first partial public key P1= [d1]G according to d1 and the base point G, and sends P1 to the second communication party;

[0009] S102, the second communication party generates random numbers d2, d3∈[1,n-1], takes d2, d3 as the sub-private key of the second communication party, calculates the public key P according to d2, d3, P1 and the base point G, and makes P public;

[0010] The collaborative signing phase includes:

[0011] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0012] S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and the base point G, and sends e and Q to the second communication party;

[0013] S203, the second communication party generates random numbers k2, k3∈[1,n-1], calculates the elliptic curve point W according to k2, k3, d3 and the received Q, the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0014] S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and r, k2, k3, d2, d3, respectively, and sends r, s1, s2 to the first communication party;

[0015] S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) mod n, and return to step S202 when s=0;

[0016] S206, the first communication party outputs a complete signature (r, s) and a message M;

[0017] Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

[0018] Based on the above, the collaborative signing stage may also be:

[0019] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0020] S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and the base point G, and sends e and Q to the second communication party;

[0021] S203, the second communication party generates a random number k2∈[1,n-1], calculates the elliptic curve point W according to k2, d3 and the received Q, the coordinates of W are (x1,y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0022] S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and k2, d2, d3, r, respectively, and sends r, s1, s2 to the first communication party;

[0023] S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) mod n, and return to step S202 when s=0;

[0024] S206. The first communication party outputs the complete signature (r, s) and message M.

[0025] The present invention also provides a two-party collaborative signature system based on the ECDSA algorithm, comprising a first communication party and a second communication party, wherein the first communication party comprises a first cryptographic operation module and a first communication module, and the second communication party comprises a second cryptographic operation module and a second communication module, and the first communication party and the second communication party are connected in communication via the first communication module and the second communication module; the first communication party and the second communication party share an ECDSA algorithm elliptic curve E and a base point G with an order of n on E; the first communication party and the second communication party collaboratively generate a public key, and perform collaborative signing when a signature is required;

[0026] The collaborative signing phase includes:

[0027] The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, takes d1 as the sub-private key of the first communication party, and calculates the first partial public key P1=[d1]G according to d1 and the base point G; and then sends P1 to the second communication party through the first communication module;

[0028] The second communication party receives P1 through the second communication module, generates random numbers d2 and d3∈[1,n-1] through the second cryptographic operation module, uses d2 and d3 as the sub-private key of the second communication party, and then calculates the public key P according to d2, d3, P1 and the base point G, and publishes the public key P through the second communication module;

[0029] The collaborative signing phase includes:

[0030] The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module;

[0031] The second communication party receives e and Q through the second communication module, generates random numbers k2 and k3∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, k3, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restarts the collaborative signing process; if r≠0, generates the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3, respectively, and sends r, s1, s2 to the first communication party through the second communication module;

[0032] The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, restart the collaborative signing process; if s≠0, the first communication party outputs the complete signature (r, s) and message M;

[0033] Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

[0034] Based on the above, the collaborative signing stage may also be:

[0035] The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module;

[0036] The second communication party receives e and Q through the second communication module, generates a random number k2∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restart the collaborative signing process; if r≠0, generate the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3 respectively, and send r, s1, s2 to the first communication party through the second communication module;

[0037] The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, the collaborative signing process is restarted; if s≠0, the first communication party outputs the complete signature (r, s) and message M.

[0038] The present invention has outstanding substantive features and significant progress compared to the prior art, specifically:

[0039] 1. In the technical solution of the present invention, the two communicating parties generate their own sub-private keys and partial public keys respectively, and one party calculates the complete public key based on its own sub-private key and the partial public keys of both parties and publishes it. The security of the private key is guaranteed by the algorithm design of splitting and storing the private key and jointly generating the public key. When used in a software cryptographic module that does not rely on cryptographic hardware, the effect of enhancing the security and confidentiality of user data can be achieved.

[0040] 2. In the technical solution of the present invention, when two parties sign collaboratively, they need to exchange multiple signature components generated by each party and finally calculate the complete signature and message. Since the collaboration of the two communicating parties is required to complete the calculation, the security and unforgeability of the collaborative signature are enhanced.

[0041] 3. The technical solution of the present invention also introduces the private key component in the calculation of the k value corresponding to the standard ECDSA signature algorithm during the collaborative signature process. The existence of the private key component makes it difficult to simplify and calculate the items in the information exchanged by the two communicating parties during the collaborative signature process, thereby avoiding the risk of attackers calculating the private key component by intercepting the exchanged information between the two parties multiple times, further enhancing the security of the key and ensuring the security of the signature algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of a process according to Embodiment 1 of the present invention.

[0043] Figure 2 It is a schematic diagram of the process according to Example 2 of the present invention.

[0044] Figure 3 It is a schematic diagram of the process according to Example 3 of the present invention.

[0045] Figure 4 It is a schematic diagram of a process according to Example 4 of the present invention.

[0046] Figure 5 It is a schematic diagram of the process according to Example 5 of the present invention.

[0047] Figure 6 It is a schematic diagram of the process according to Example 6 of the present invention. DETAILED DESCRIPTION

[0048] In the present invention, the point multiplication operation on the elliptic curve E is represented by the form of [k]G, where [k]G represents the k-times point G, and k is a positive integer; mod n represents the modulo n operation; and k is the -1 The inverse element k is expressed in the form of -1 mod n; * indicates numerical multiplication; for elliptic curve point addition / subtraction operations, as well as numerical addition / subtraction operations, the symbols used are plus sign "+" / minus sign "-". If it is elliptic curve point addition / subtraction, "+" / "-" indicates point addition / subtraction operations, and if it is numerical addition / subtraction, "+" / "-" indicates numerical addition / subtraction operations.

[0049] Example 1

[0050] This embodiment provides a collaborative signature method between two communicating parties based on the ECDSA algorithm. Figure 1 As shown, the method involves a first communication party and a second communication party, wherein the first communication party and the second communication party share an ECDSA algorithm elliptic curve E and a base point G of order n on E; the method includes a collaborative public key generation phase and a collaborative signature phase, and is characterized in that:

[0051] The collaborative public key generation phase includes:

[0052] S101, the first communication party generates a random number d1∈[1,n-1], takes d1 as the sub-private key of the first communication party, calculates the first partial public key P1= [d1]G according to d1 and the base point G, and sends P1 to the second communication party;

[0053] S102, the second communication party generates random numbers d2, d3∈[1,n-1], takes d2, d3 as the sub-private key of the second communication party, calculates the public key P according to d2, d3, P1 and the base point G, and makes P public;

[0054] The collaborative signing phase includes:

[0055] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0056] S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and the base point G, and sends e and Q to the second communication party;

[0057] S203, the second communication party generates random numbers k2, k3∈[1,n-1], calculates the elliptic curve point W according to k2, k3, d3 and the received Q, the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0058] S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and r, k2, k3, d2, d3, respectively, and sends r, s1, s2 to the first communication party;

[0059] S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) mod n, and return to step S202 when s=0;

[0060] S206, the first communication party outputs a complete signature (r, s) and a message M;

[0061] Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

[0062] In this embodiment, the random numbers d1 and k1 generated by the first communicating party are respectively obtained by one or more random number operations between [1, n-1], and / or the random numbers d2, d3, k2, k3 generated by the second communicating party are respectively obtained by one or more random number operations between [1, n-1]; the operations include linear operations, multiplication, and inversion.

[0063] In this embodiment, the s calculated by the first communication party according to d1, k1 and the received s1, s2 in step S205 can be simplified to s = k -1 * (e + d * r) mod n, where d is obtained by linear operation and / or multiplication and / or inversion operation of d1, d2, d3, and k contains k1, d2 and / or d3.

[0064] During the generation of the two parties' sub-private keys and calculation of the public key, although the first part of the public key P1 needs to be transmitted, due to the existence of the elliptic curve discrete logarithm problem, it is impossible to infer any data related to the private key through P1, so the private key can be ensured to be safe.

[0065] In the collaborative signature process, public data Q, s1, and s2 also need to be transmitted, but due to the existence of the elliptic curve discrete logarithm problem, it is impossible to infer any data related to the private key through Q. In addition, since the private key component is also introduced in the calculation corresponding to the k value in the algorithm, the existence of the private key component and the complex operational relationship between it and other variables, including modular inversion and other operations, make it difficult to simplify and infer items in the information exchanged between the two communicating parties in the collaborative signature process, and it is difficult to infer the private key component from s1 and s2, thereby avoiding the risk of attackers inferring the private key component through multiple exchanges of information between the two parties, further enhancing the security of the key and ensuring the security of the signature algorithm.

[0066] Example 2

[0067] This embodiment is a specific implementation of embodiment 1, wherein Figure 2 As shown, in step S102, the second communication party calculates the public key P = [d2]G + [d3 -1 ]P1;

[0068] In step S203, the second communication party calculates the elliptic curve point W = [k3 -1 * (k2+ d3) -1 ]Q;

[0069] In S204, the second communication party calculates the third partial signature s1 = k3*( k2+ d3) *( e + r *d2) mod n according to e and r, k2, k3, d2, and d3 respectively, and the fourth partial signature s2 = (k3*d3 -1 * k2 *r+ k3* r) mod n.

[0070] The proof of the correctness of the collaborative signature is as follows:

[0071] The complete public key P = [d2]G + [d3 -1 ]P1= [d2+ d1* d3 -1 ]G It can be seen that the relationship between the private key d and the sub-private keys d1, d2, and d3 in the ECDSA algorithm is: d = (d2+ d1 *d3 -1 ) mod n 。

[0072] Let k = k1 * k3 -1 *(k2 + d3) -1 mod n,

[0073] During the co - signature process, Q = [k1]G, W = [k3 -1 * (k2 + d3) -1 Q, whose coordinates are (x1,y1), r = x1 mod n;

[0074] s1 = k3*( k2 + d3) * ( e + r *d2) mod n, s2 = (k3*d3 -1 * k2 *r + k3* r) mod n, so

[0075] s = k1 -1 * (s1 + d1 * s2) mod n

[0076] = k1 -1 * (k3* ( k2 + d3) * ( e + r *d2)+ d1 * r * (k3*d3 -1 *k2 + k3)) mod n

[0077] = k1 -1 * (k3* ( k2 + d3) * ( e + r *d2)+ d1 * r * k3* (d3 -1 *k2 + 1)) mod n

[0078] = k1 -1 *k3* (( k2 + d3) * ( e + r *d2) + d1 * r *d3 -1 *(k2 + d3)) mod n

[0079] = k1 -1 * k3*(k2 + d3) * ( e + r *d2 + d1 * r *d3 -1 ) mod n

[0080] = (k1 -1 * k3*(k2 + d3)) *( e + (d2 + d1 *d3 -1 )* r ) mod n

[0081] = k -1 * (e + d*r) mod n

[0082] It can be seen that the above collaborative signature algorithm can sign correctly.

[0083] In the collaborative signature process, through the structural design of s1 and s2, the private key component d3 is introduced into the random number k corresponding to the standard ECDSA algorithm, from s1 = k3*(k2+d3)*(e+r*d2)modn, s2 = (k3*d3 -1 *k2 *r+ k3* r) mod n, it can be seen that due to the complexity of the calculation, it is difficult to infer the data related to the private key from s1 and s2, which ensures the security of the collaborative signature process. The attacker cannot infer the other party's sub-private key from the transmitted data, and cannot calculate the private key, thus ensuring that the ECDSA algorithm has higher security.

[0084] Example 3

[0085] This embodiment is another specific implementation of embodiment 1, wherein Figure 3 As shown, in step S102, the second communication party calculates the public key P = [d2]P1+[ d2*d3 -1 ]G;

[0086] In step S203, the second communication party calculates the elliptic curve point W = [k3 -1 * (k2+ d3) -1 ]Q;

[0087] In step S204, the second communication party calculates the third partial signature s1 = k3*( k2+d3) ( e + r *d2 * d3) according to e and r, k2, k3, d2, and d3 respectively. -1 )mod n, the fourth part signature s2 = k3* d2 *r *( k2 +d3 ) mod n.

[0088] From P = [d2]P1 + [d2*d3 -1 ]G = [d1*d2]G+[ d2*d3 -1 ]G = [d1*d2+ d2*d3 -1 ]G It can be seen that the relationship between the private key d and the sub-private keys d1, d2, and d3 in the ECDSA algorithm is d = (d1*d2+ d2*d3 -1 ) mod n.

[0089] The proof of the correctness of the collaborative signature is as follows:

[0090] Let k = k1*k3-1 *(k2+ d3) -1 ,

[0091] In the collaborative signature process, Q = [k1]G, W = [k3 -1 *(k2+ d3) -1 ]Q, whose coordinates are (x1,y1), r = x1mod n;

[0092] s1 = k3*( k2+d3) ( e + r *d2* d3 -1 )mod n, s2 = k3* d2 *r *( k2 + d3 )modn, so

[0093] s = k1 -1 * (s1 + d1 * s2) mod n

[0094] = k1 -1 * (k3* ( k2+ d3)* ( e + r *d2* d3 -1 )+ d1 * r * k3*d2*(k2 +d3)) modn

[0095] = k1 -1 *k3* ( k2+ d3)* (( e + r *d2* d3 -1 ) + d1 * r *d2 ) mod n

[0096] = k1 -1 * k3*(k2+ d3)* ( e + r *(d2* d3 -1 + d1 *d2)) mod n

[0097] = k -1 *(e + r *(d2* d3 -1 + d1 *d2) ) mod n

[0098] = k -1 * (e + d*r) mod n

[0099] It can be seen that the above collaborative signature algorithm can sign correctly.

[0100] In the collaborative signature process, through the structural design of s1 and s2, the private key component d3 is introduced into the random number k corresponding to the standard ECDSA algorithm. From s1 = k3*( k2+d3) ( e + r *d2* d3 -1)mod n, s2 = k3* d2*r *( k2 + d3 )mod nIt can be seen that due to the complexity of the calculation, it is difficult to infer the data related to the private key from s1 and s2, which ensures the security of the collaborative signature process. The attacker cannot infer the other party's sub-private key from the transmitted data, and cannot calculate the private key, thus ensuring that the ECDSA algorithm has higher security.

[0101] Example 4

[0102] This embodiment is another specific implementation of embodiment 1. Specifically, Figure 4 As shown, the collaborative signing phase is replaced by the following steps:

[0103] S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e;

[0104] S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and the base point G, and sends e and Q to the second communication party;

[0105] S203, the second communication party generates a random number k2∈[1,n-1], calculates the elliptic curve point W according to k2, d3 and the received Q, the coordinates of W are (x1,y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0;

[0106] S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and k2, d2, d3, r, respectively, and sends r, s1, s2 to the first communication party;

[0107] S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) mod n, and return to step S202 when s=0;

[0108] S206. The first communication party outputs the complete signature (r, s) and message M.

[0109] In this embodiment, the random numbers d1, d2, d3, k1, and k2 are respectively obtained by one or more random number operations between [1, n-1]; the operations include linear operations, multiplication, and inversion.

[0110] In this embodiment, the s calculated by the first communication party in step S205 according to d1, k1 and the received s1, s2 can be simplified to s = k -1* (e + d * r) mod n, where d is obtained by linear operation and / or multiplication and / or inversion operation of d1, d2, d3, and k contains k1, d2 and / or d3.

[0111] Example 5

[0112] This embodiment is a specific implementation of embodiment 4, wherein Figure 5 As shown, in step S102, the second communication party calculates the public key P = [d2]P1+[ d2*d3 -1 ]G;

[0113] In step S203, the second communication party calculates the elliptic curve point W = [(k2*d3)] according to k2, d3 and the received Q. -1 ]Q;

[0114] In step S204, the second communication party calculates the third partial signature s1 = k2* (d3*e + r *d2 )mod n and the fourth partial signature s2 = k2 *d2*d3*r mod n according to e and k2, d2, d3, and r respectively.

[0115] From P = [d2]P1 + [d2*d3 -1 ]G = [d1*d2]G+[ d2*d3 -1 ]G = [d1*d2+ d2*d3 -1 ]G It can be seen that the relationship between the private key d and the sub-private keys d1, d2, and d3 in the ECDSA algorithm is d = (d1*d2+ d2*d3 -1 ) mod n.

[0116] The proof of the correctness of the collaborative signature is as follows:

[0117] Let k = k1 * k3 -1 *d3 -1 mod n,

[0118] In the collaborative signature process, Q = [k1]G, W = [(k2* d3) -1 ]Q, whose coordinates are (x1,y1), r = x1 modn;

[0119] s1 = k2* (d3*e + r *d2 )mod n, s2 = k2 *d2*d3*r mod n, so

[0120] s = k1 -1* (s1 + d1 * s2) mod n

[0121] = k1 -1 ( k2*( d3*e + d2* r ) + d1* k2* d2*d3*r ) mod n

[0122] = k1 -1 (k2 * d3*e + k2*d2* r + d1* k2* d2*d3*r) mod n

[0123] = k1 -1 *k2 * d3* (e + d2*d3 -1 * r + d1* d2*r) mod n

[0124] = (k1 -1 *k2 * d3) * (e + r*( d1* d2 + d2*d3 -1 )) mod n

[0125] = k -1 (e+ r*( d1* d2 + d2*d3 -1 )) mod n

[0126] = k -1 ( e + r *d ) mod n

[0127] It can be seen that the above collaborative signature algorithm can sign correctly.

[0128] In the collaborative signature process, through the structural design of s1 and s2, the private key component d3 is introduced into the random number k corresponding to the standard ECDSA algorithm. From s1 = k2* (d3*e + r *d2 )mod n, s2 = k2 *d2*d3*r mod n, it can be seen that due to the complexity of calculation, it is difficult to infer the data related to the private key from s1 and s2, which ensures the security of the collaborative signature process. The attacker cannot infer the other party's sub-private key from the transmitted data, and cannot calculate the private key, thus ensuring that the ECDSA algorithm has higher security.

[0129] Example 6

[0130] This embodiment is another specific implementation of embodiment 4, wherein Figure 6 As shown, in step S102, the second communication party calculates the public key P = [d2*d3 -1 ] P1;

[0131] In step S203, the second communication party calculates the elliptic curve point W = [(k2* d3 + d3)] according to k2, d3 and the received Q. -1 ]Q;

[0132] In step S204, the second communication party calculates the third partial signature s1 = ( k2* d3*e + e *d3 )mod n and the fourth partial signature s2 = ( k2 *d2*r +d2*r )mod n according to e and k2, d2, d3, and r respectively.

[0133] By P = [d2*d3 -1 ] P1 = [ d1*d2*d3 -1 ]G It can be seen that the relationship between the private key d and the sub-private keys d1, d2, and d3 in the ECDSA algorithm is d = d1*d2*d3 -1 mod n.

[0134] The proof of the correctness of the collaborative signature is as follows:

[0135] Let k = k1*( k2* d3+*d3) -1 mod n,

[0136] In the collaborative signature process, Q = [k1]G, W = [(k2* d3 + d3) -1 ]Q, whose coordinates are (x1,y1), r = x1mod n;

[0137] s1 = ( k2* d3*e + e *d3 ) mod n, s2 = ( k2 *d2*r +d2*r ) mod n, so

[0138] s = k1 -1 * (s1 + d1 * s2) mod n

[0139] = k1 -1 * ( k2* d3*e + d3 *e + d1 * k2*d2 * r + d1 * d2*r) mod n

[0140] = k1 -1 (e* (k2* d3+d3) + d3 -1 * d1 *d2* r* ( k2*d3 + d3)) mod n

[0141] = k1 -1* (k2* d3+d3) *(e + d1 *d2*d3 -1 *r) mod n

[0142] =k -1 (e + d1 *d2*d3 -1 *r ) mod n

[0143] = k -1 ( e + r *d ) mod n

[0144] In the collaborative signature process, through the structural design of s1 and s2, the private key component d3 is introduced into the random number k corresponding to the standard ECDSA algorithm. From s1 = (k2*d3*e + e*d3) mod n, s2 = (k2*d2*r +d2*r) mod n, it can be seen that due to the complexity of calculation, it is difficult to infer the data related to the private key from s1 and s2, which ensures the security of the collaborative signature process. The attacker cannot infer the other party's sub-private key from the transmitted data, and cannot calculate the private key, thus ensuring that the ECDSA algorithm has higher security.

[0145] Example 7

[0146] Based on the same inventive concept as the above method, this embodiment provides a two-party collaborative signature system based on the ECDSA algorithm, including a first communication party and a second communication party, the first communication party includes a first cryptographic operation module and a first communication module, the second communication party includes a second cryptographic operation module and a second communication module, the first communication party and the second communication party are connected in communication through the first communication module and the second communication module; the first communication party and the second communication party share the ECDSA algorithm elliptic curve E and the base point G with an order of n on E; the first communication party and the second communication party jointly generate a public key, and perform collaborative signing when signing is required;

[0147] The collaborative signing phase includes:

[0148] The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, takes d1 as the sub-private key of the first communication party, and calculates the first partial public key P1=[d1]G according to d1 and the base point G; and then sends P1 to the second communication party through the first communication module;

[0149] The second communication party receives P1 through the second communication module, generates random numbers d2 and d3∈[1,n-1] through the second cryptographic operation module, uses d2 and d3 as the sub-private key of the second communication party, and then calculates the public key P according to d2, d3, P1 and the base point G, and publishes the public key P through the second communication module;

[0150] The collaborative signing phase includes:

[0151] The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module;

[0152] The second communication party receives e and Q through the second communication module, generates random numbers k2 and k3∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, k3, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restarts the collaborative signing process; if r≠0, generates the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3, respectively, and sends r, s1, s2 to the first communication party through the second communication module;

[0153] The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, restart the collaborative signing process; if s≠0, the first communication party outputs the complete signature (r, s) and message M;

[0154] Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

[0155] Example 8

[0156] This embodiment is another specific implementation of Embodiment 7, wherein the collaborative signature phase may also be:

[0157] The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module;

[0158] The second communication party receives e and Q through the second communication module, generates a random number k2∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restart the collaborative signing process; if r≠0, generate the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3 respectively, and send r, s1, s2 to the first communication party through the second communication module;

[0159] The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, the collaborative signing process is restarted; if s≠0, the first communication party outputs the complete signature (r, s) and message M.

[0160] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A bilateral collaborative signature method based on an ECDSA algorithm, the method involving a first communication party and a second communication party, wherein the first communication party and the second communication party share an ECDSA algorithm elliptic curve E and a base point G with an order of n on E; The method comprises a collaborative public key generation phase and a collaborative signature phase, and is characterized in that: The collaborative public key generation phase includes: S101, the first communication party generates a random number d1∈[1,n-1], takes d1 as the sub-private key of the first communication party, calculates the first partial public key P1= [d1]G according to d1 and the base point G, and sends P1 to the second communication party; S102, the second communication party generates random numbers d2, d3∈[1,n-1], takes d2, d3 as the sub-private key of the second communication party, calculates the public key P according to d2, d3, P1 and the base point G, and makes P public; The collaborative signing phase includes: S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e; S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q =[k1]G according to k1 and the base point G, and sends e and Q to the second communication party; S203, the second communication party generates random numbers k2, k3∈[1,n-1], calculates the elliptic curve point W according to k2, k3, d3 and the received Q, the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0; S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and r, k2, k3, d2, d3, respectively, and sends r, s1, s2 to the first communication party; S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) modn, and return to step S202 when s=0; S206, the first communication party outputs a complete signature (r, s) and a message M; Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

2. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 1, characterized in that: In step S102, the second communication party calculates the public key P = [d2]G + [d3 -1 ]P1; In step S203, the second communication party calculates the elliptic curve point W = [k3 -1 * (k2+ d3) -1 ]Q; In S204, the second communication party calculates the third partial signature s1 = k3*( k2+ d3) *( e + r *d2)mod n according to e and r, k2, k3, d2, and d3 respectively, and the fourth partial signature s2 = (k3*d3 -1 * k2 *r+ k3* r) mod n.

3. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 1, characterized in that: In step S102, the second communication party calculates the public key P = [d2]P1+[d2*d3] according to d2, d3 and the received P1 -1 ]G; In step S203, the second communication party calculates the elliptic curve point W = [k3 -1 * (k2+ d3) -1 ]Q; In step S204, the second communication party calculates the third partial signature s1 = k3 * (k2 + d3) (e + r * d2 * d3) according to e and r, k2, k3, d2, and d3 respectively. -1 )mod n, the fourth part signature s2 = k3* d2 *r *( k2 + d3 )mod n.

4. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 1, characterized in that: The random numbers d1, d2, d3, k1, k2, and k3 are respectively obtained by one or more random number operations between [1, n-1]; the operations include linear operations, multiplication, and inversion.

5. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 1, characterized in that: The collaborative signing stage may also be: S201, the first communication party uses a predetermined hash function on the message M to be signed to obtain a message digest e; S202, the first communication party generates a random number k1∈[1,n-1], generates a first partial signature Q =[k1]G according to k1 and the base point G, and sends e and Q to the second communication party; S203, the second communication party generates a random number k2∈[1,n-1], calculates the elliptic curve point W according to k2, d3 and the received Q, the coordinates of W are (x1,y1), and then calculates the second partial signature r = x1 mod n according to W, and returns to step S202 when r=0; S204, the second communication party generates a third partial signature s1 and a fourth partial signature s2 based on the received e and k2, d2, d3, r, respectively, and sends r, s1, s2 to the first communication party; S205, the first communication party calculates s= k1 according to d1, k1 and received s1, s2 -1 * (s1 + d1 * s2) modn, and return to step S202 when s=0; S206. The first communication party outputs the complete signature (r, s) and message M.

6. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 5 is characterized in that: In step S102, the second communication party calculates the public key P = [d2]P1+[d2*d3] according to d2, d3 and the received P1 -1 ]G; In step S203, the second communication party calculates the elliptic curve point W = [(k2* d3) -1 ]Q; In step S204, the second communication party calculates the third partial signature s1 = k2 * (d3 * e + r * d2 ) mod n and the fourth partial signature s2 = k2 * d2 * d3 * r mod n according to e and k2, d2, d3, and r respectively.

7. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 5, characterized in that: In step S102, the second communication party calculates the public key P = [d2*d3 -1 ] P1; In step S203, the second communication party calculates the elliptic curve point W = [(k2* d3 + d3) -1 ]Q; In step S204, the second communication party calculates the third partial signature s1 = (k2* d3*e + e *d3 )mod n and the fourth partial signature s2 = ( k2 *d2*r +d2*r )mod n according to e and k2, d2, d3, and r respectively.

8. The method for collaborative signing between two parties based on the ECDSA algorithm according to claim 5, characterized in that: The random numbers d1, d2, d3, k1, and k2 are obtained by respectively performing one or more random number operations between [1, n-1]; the operations include linear operations, multiplication, and inversion.

9. A two-party collaborative signature system based on the ECDSA algorithm, characterized in that: The method comprises a first communication party and a second communication party, wherein the first communication party comprises a first cryptographic operation module and a first communication module, and the second communication party comprises a second cryptographic operation module and a second communication module, and the first communication party and the second communication party are connected in communication via the first communication module and the second communication module; the first communication party and the second communication party share an elliptic curve E of an ECDSA algorithm and a base point G of an order n on E; The first communication party and the second communication party jointly generate a public key, and jointly sign when a signature is required; The collaborative signing phase includes: The first communication party generates a random number d1∈[1,n-1] through the first cryptographic operation module, takes d1 as the sub-private key of the first communication party, and calculates the first partial public key P1=[d1]G according to d1 and the base point G; and then sends P1 to the second communication party through the first communication module; The second communication party receives P1 through the second communication module, generates random numbers d2 and d3∈[1,n-1] through the second cryptographic operation module, uses d2 and d3 as the sub-private key of the second communication party, and then calculates the public key P according to d2, d3, P1 and the base point G, and publishes the public key P through the second communication module; The collaborative signing phase includes: The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module; The second communication party receives e and Q through the second communication module, generates random numbers k2 and k3∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, k3, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restarts the collaborative signing process; if r≠0, generates the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3, respectively, and sends r, s1, s2 to the first communication party through the second communication module; The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, restart the collaborative signing process; if s≠0, the first communication party outputs the complete signature (r, s) and message M; Among them, mod n represents the modulo n operation, * represents numerical multiplication, and the form of [k]G represents the k-times point G on the elliptic curve E, and k -1 The inverse element k is expressed in the form of -1 mod n, k is a positive integer.

10. A two-party collaborative signature system based on the ECDSA algorithm according to claim 9, characterized in that: The collaborative signing stage may also be: The first communication party uses a predetermined hash function on the signed message M through the first cryptographic operation module to obtain a message digest e; generates a random number k1∈[1,n-1], generates a first partial signature Q = [k1]G according to k1 and G, and sends e and Q to the second communication party through the first communication module; The second communication party receives e and Q through the second communication module, generates a random number k2∈[1,n-1] through the second cryptographic operation module, calculates the elliptic curve point W according to k2, d3 and the received Q, and the coordinates of W are (x1, y1), and then calculates the second partial signature r = x1 mod n according to W; if r=0, restart the collaborative signing process; if r≠0, generate the third partial signature s1 and the fourth partial signature s2 based on the received e and r, d2, d3 respectively, and send r, s1, s2 to the first communication party through the second communication module; The first communication party receives r, s1, s2 through the first communication module, and calculates s= k1 according to d1 and the received s1 and s2 through the first cryptographic operation module. -1 * (s1 + d1 * s2) mod n; if s=0, the collaborative signing process is restarted; if s≠0, the first communication party outputs the complete signature (r, s) and message M.

Images