Digital signature method, device, electronic device and storage medium

Abstract

The present disclosure relates to the field of quantum computing technology, in particular to the field of information security in quantum computing, and specifically to a digital signature method, device, electronic device, and storage medium. The specific implementation scheme is as follows: obtaining a secret value shared by q first participants to obtain q secret values, where q ≥ 3 and is an integer; generating a private key shard and a collaborative public key based on the q secret values; in response to determining that t' second participants participating in signature generation among the q first participants meet the signature generation requirements, generating a signature shard based on the private key shard, the collaborative public key, and the information to be signed, where 0 < t' ≤ q and is an integer; generating a digital signature based on the signature shard generated by itself and the signature shards generated by the other participants among the t' second participants except itself. The use of the present disclosure can improve the flexibility of digital signatures.

Description

Technical Field

[0001] The present disclosure relates to the field of quantum computing technology, in particular to the field of information security in quantum computing, and specifically to a digital signature method, device, electronic device, and storage medium. Background Art

[0002] Digital signatures are a fundamental public-key cryptography task. Their purpose is to authenticate the sender of information, thereby ensuring the authenticity of the source. They also ensure the integrity of the information and protect it from tampering. Currently, digital signatures are widely used in digital asset management, e-government, e-commerce, electronic securities, and other information exchanges.

[0003] However, as far as existing digital signature algorithms are concerned, the completion of the above information exchange transactions usually involves multiple parties, and these multiple parties are required to jointly participate in key generation in the early stage, and they are also required to jointly participate in signature generation in the later stage. That is, the number of participants needs to be consistent before and after, so the flexibility is low. Summary of the Invention

[0004] The present disclosure provides a digital signature method, device, electronic device and storage medium.

[0005] According to one aspect of the present disclosure, a digital signature method is provided, comprising:

[0006] Obtain the secret values shared by q first parties to obtain q secret values, where q ≥ 3 and is an integer;

[0007] Based on q secret values, generate private key shards and collaborative public keys;

[0008] In response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirement, generating a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed, where 0 < t' ≤ q and is an integer;

[0009] Generate a digital signature based on the signature fragment generated by itself and the signature fragments generated by the other participants among the t' second participants except itself.

[0010] According to a second aspect of the present disclosure, there is provided a digital signature device, comprising:

[0011] a secret value acquisition unit, configured to acquire secret values shared by q first parties to obtain q secret values, where q is ≥ 3 and is an integer;

[0012] A secret key generation unit, configured to generate private key fragments and collaborative public keys based on q secret values;

[0013] a signature fragment generation unit, configured to generate a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed, in response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirement, where 0 < t' ≤ q and t' is an integer;

[0014] The digital signature generating unit is configured to generate a digital signature based on the signature fragments generated by itself and the signature fragments generated by the other participants among the t' second participants except itself.

[0015] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0016] at least one processor;

[0017] a memory communicatively coupled to the at least one processor;

[0018] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method provided by the first aspect.

[0019] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the method provided by the first aspect.

[0020] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program, which implements the method provided in the first aspect when executed by a processor.

[0021] The present disclosure can improve the flexibility of digital signatures.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0024] Figure 1 A flowchart of a digital signature method provided in an embodiment of the present disclosure;

[0025] Figure 2 A diagram for explaining a digital signature method according to an embodiment of the present disclosure;

[0026] Figure 3 A diagram illustrating a process of obtaining a secret value provided by an embodiment of the present disclosure;

[0027] Figure 4 An auxiliary illustration of a collaborative public key generation process provided in an embodiment of the present disclosure;

[0028] Figure 5 A diagram for explaining the process of generating a temporary public key according to an embodiment of the present disclosure;

[0029] Figure 6 A diagram illustrating a digital signature generation process according to an embodiment of the present disclosure;

[0030] Figure 7 A complete flowchart of a digital signature method provided in an embodiment of the present disclosure;

[0031] Figure 8 A schematic diagram of an application scenario of a digital signature method provided in an embodiment of the present disclosure;

[0032] Figure 9 A schematic structural block diagram of a digital signature device provided in an embodiment of the present disclosure;

[0033] Figure 10 A schematic structural block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0035] The embodiment of the present disclosure provides a digital signature method, which can be applied to an electronic device, which is a digital computer used by a certain signing party (the first party that participates in key generation in the early stage and the second party that participates in signature generation in the later stage). Figure 1 The flowchart diagram shown here illustrates a digital signature method provided by an embodiment of the present disclosure. It should be noted that although a logical order is shown in the flowchart diagram, in some cases, the steps shown or described may also be performed in other orders.

[0036] Step S101: Obtain secret values shared by q first participants to obtain q secret values, where q ≥ 3 and is an integer;

[0037] Step S102: Generate private key fragments and collaborative public keys based on q secret values;

[0038] Step S103: In response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirements, generate signature fragments based on the private key fragments, the coordinated public key, and the information to be signed, where 0 < t' ≤ q and t' is an integer;

[0039] Step S104: Generate a digital signature based on the signature fragment generated by itself and the signature fragments generated by the other participants among the t' second participants except itself.

[0040] Among them, q first parties are parties participating in key generation, q≥3 and is an integer.

[0041] In the embodiment of the present disclosure, based on the Edwards-curve (EdDSA) digital signature algorithm, when executing step S101, the secret value shared by itself and the secret values shared by other participants except itself among the q first participants are obtained to obtain q secret values, and then when executing step S102, private key shards and collaborative public keys are generated based on the q secret values.

[0042] See also Figure 2 , for example, q=3, and the three first participants include the first participant U11, the first participant U12, and the first participant U13. Taking the digital computer C1 used by the first participant U11 as the execution subject, when executing step S101, the secret value f1(1) shared by the first participant U11, the secret value f2(1) shared by the first participant U12, and the secret value f3(1) shared by the first participant U13 can be obtained to obtain three secret values, and then when executing step S102, based on these three secret values, a private key fragment e1 and a collaborative public key P are generated; taking the digital computer C2 used by the first participant U12 as the execution subject, when executing step S101, the secret value f2(2) shared by the first participant U12, and the secret value f3(1) shared by the first participant U11 can be obtained. The secret value f1(2) shared by the first participant U13 and the secret value f3(2) shared by the first participant U13 are used to obtain three secret values, and then when executing step S102, the private key fragment e2 and the collaborative public key P are generated based on the three secret values; the digital computer C3 used by the first participant U13 is used as the execution subject, and when executing step S101, the secret value f3(3) shared by the first participant U13, the secret value f1(3) shared by the first participant U11 and the secret value f2(3) shared by the first participant U12 can be obtained to obtain three secret values, and then when executing step S102, the private key fragment e3 and the collaborative public key P are generated based on the three secret values.

[0043] Similarly, in the embodiment of the present disclosure, based on the EdDSA digital signature algorithm, when executing step S103, in response to determining that t' second participants participating in signature generation among the q first parties meet the signature generation requirements, a signature fragment is generated based on the private key fragment, the collaborative public key and the information to be signed, and then when executing step S104, a digital signature is generated based on the signature fragment generated by itself and the signature fragments generated by other participants among the t' second participants except itself, where 0<t'≤q and is an integer, that is, the total number of second participants t' can be less than or equal to the total number of first parties q.

[0044] Furthermore, in a specific example, "determining that t' second participants participating in signature generation among q first participants meet the signature generation requirement" may include: obtaining a participation threshold value t, where 0 < t ≤ q and is an integer; and determining that t' second participants meet the signature generation requirement when the total number of second participants t' ≥ t. For example, if the participation threshold value t = 1, then when the total number of second participants t' ≥ 1, t' second participants are determined to meet the signature generation requirement; for another example, if the participation threshold value t = 2, then when the total number of second participants t' ≥ 2, then t' second participants are determined to meet the signature generation requirement. The participation threshold value t may be a preset fixed value or a variable value dynamically set based on the total number of first participants q. For example, a participation threshold ratio may be obtained, and then the product of the total number of first participants q and the participation threshold ratio may be calculated as the participation threshold value t. This embodiment of the present disclosure does not impose any specific limitations on this.

[0045] The information to be signed includes one of the following: digital asset information, digital files, software installation packages, and public key certificates, which are also not specifically limited in the embodiments of the present disclosure.

[0046] continue Figure 2 For example, it is assumed that among the three first participants, the first participant U11 (for the convenience of description, hereinafter referred to as the second participant U21) and the first participant U13 (for the convenience of description, hereinafter referred to as the second participant U22) participate in signature generation and meet the signature generation requirements. The digital computer C1 used by the second participant U21 is used as the execution subject. When executing step S103, a signature fragment S1 is generated based on the private key fragment e1, the collaborative public key P and the information to be signed M. Then, when executing step S104, a digital signature σ is generated based on the signature fragment S1 generated by the second participant U21 and the signature fragment S2 generated by the second participant U22. The digital computer C3 used by the second participant U22 is used as the execution subject. When executing step S103, a signature fragment S2 is generated based on the private key fragment e3, the collaborative public key P and the information to be signed M. Then, when executing step S104, a digital signature σ is generated based on the signature fragment S2 generated by the second participant U22 and the signature fragment S1 generated by the second participant U21.

[0047] In the above example, the first participant U11 who participated in the key generation in the early stage became the second participant U21 who participated in the signature generation later; the first participant U13 who participated in the key generation in the early stage became the second participant U22 who participated in the signature generation later.

[0048] The digital signature method provided by the embodiment of the present disclosure can obtain the secret value shared by q first participants to obtain q secret values, and based on the q secret values, generate a private key shard and a collaborative public key. Thereafter, in response to determining that t' second participants participating in the signature generation among the q first participants meet the signature generation requirements, a signature shard is generated based on the private key shard, the collaborative public key and the information to be signed, where 0 < t' ≤ q and is an integer. Then, based on the signature shard generated by itself and the signature shards generated by other participants among the t' second participants except itself, a digital signature is generated. That is, when a digital signature is generated by the digital signature method provided by the embodiment of the present disclosure, the total number t' of second participants participating in the signature generation can be less than or equal to the total number q of first participants participating in the key generation. Compared with the existing technology, no strict requirements are put forward in terms of the consistency of the number of participants before and after. Therefore, the flexibility of the digital signature can be improved.

[0049] In some optional implementations, “obtaining secret values shared by q first parties to obtain q secret values” may include the following steps:

[0050] Get a random secret;

[0051] Generate q secret values from the random secret using a verifiable threshold secret sharing method, and share the q secret values with q first parties respectively;

[0052] Obtain the secret value shared by itself and the secret values shared by the other participants except itself among the q first participants to obtain q secret values.

[0053] Among them, the q first participants can be represented as U11, U12...U1 q .

[0054] Assume that n is a positive integer, and there exists an integer set [1,n]={1,2,……,n}, p is a positive integer, F p represents a finite field with p elements, and element a∈F p , element b∈F p Then, the finite field F can be defined by elements a and b. p An elliptic curve on is:

[0055] E(p,a,b)={(x,y)∈F p ×Fp |y 2 =x 3 +ax+b mod p}

[0056] Let O represent a special point on the elliptic curve E(p,a,b), also called the infinity point or the zero point, which is the identity element of the additive group of the elliptic curve E(p,a,b), E(F p ) represents the set of all points and no points O in the elliptic curve E(p,a,b), G is E(F p ) set, which can generate an additive cyclic group of order n. Then, each first participant can obtain the elliptic curve group parameters required by the EdDSA digital signature algorithm, which can be recorded as para0 = {E, G, n}.

[0057] In a specific example, the first participant U1 i You can choose That is, generate a random private key value x of b bit length i , and then the random private key value x i A hash operation is performed to obtain a key hash value, and a random secret is obtained based on the key hash value and the elliptic curve group parameters. Subsequently, a verifiable threshold secret sharing method, such as the Feldman method, can be used to generate q secret values from the random secret. Each of these q secret values is shared with q first participants. The first participant then obtains the secret value shared by the first participant and the secret values shared by the other participants except the first participant, thereby obtaining q secret values.

[0058] First participant U1 i For a random private key value x i Perform hash operation to obtain the secret key hash value, which can be represented as:

[0059]

[0060] First participant U1 i According to the secret key hash value and elliptic curve group parameters, the random secret can be represented as follows:

[0061]

[0062] Where c is the cofactor, p satisfies c≤p≤b, and b is 2 b-1 > an integer of p.

[0063] First participant U1 i Generate a random secret into a secret value f through a verifiable threshold secret sharing method i (j) can be characterized as:

[0064]

[0065] Among them, f i (j) is provided by the first participant U1 i Share with the first participant U1 j The secret value of , and 1≤j≤q, t is the participation threshold, γ ik In addition, as mentioned above, in the embodiment of the present disclosure, the participation threshold t can be a preset fixed value or a variable value dynamically set according to the total number q of the first participants.

[0066] Please combine Figure 3 , exemplarily, q=3, and the three first participants include the first participant U11, the first participant U12 and the first participant U13.

[0067] Then, let the digital computer C1 used by the first participant U11 be the execution subject. When executing the above steps, the first participant U11 can perform a hash operation on the random private key value x1 to obtain the secret key hash value H(x1), and then obtain the random secret α1 based on the secret key hash value H(x1) and the elliptic curve group parameters, and generate the random secret α1 into secret values f1(1), secret value f1(2) and secret value f1(3) through the verifiable threshold secret sharing method, and then share the secret value f1(1) with the first participant U11, share the secret value f1(2) with the first participant U12, and share the secret value f1(3) with the first participant U13; let the digital computer C2 used by the first participant U12 be the execution subject. When executing the above steps, the first participant U12 can perform a hash operation on the random private key value x2 to obtain the secret key hash value H(x2), and then obtain the random secret α2 based on the secret key hash value H(x2) and the elliptic curve group parameters, and then share the random secret α3 through the verifiable threshold secret sharing method. Verify the threshold secret sharing method, generate the random secret α2 into secret value f2(1), secret value f2(2) and secret value f2(3), then share the secret value f2(1) with the first participant U11, share the secret value f2(2) with the first participant U12, and share the secret value f2(3) with the first participant U13; use the digital computer C3 used by the first participant U13 as the execution subject, and when executing the above steps, the first participant U13 can perform the random private key value x3. A hash operation is performed to obtain the secret key hash value H(x3), and then a random secret α3 is obtained based on the secret key hash value H(x3) and the elliptic curve group parameters. The random secret α3 is generated into secret values f3(1), f3(2) and f3(3) through a verifiable threshold secret sharing method, and then the secret value f3(1) is shared with the first participant U11, the secret value f3(2) is shared with the first participant U12, and the secret value f3(3) is shared with the first participant U13.

[0068] Finally, for the first participant U11, it can obtain three secret values, namely secret value f1(1), secret value f2(1) and secret value f3(1); for the first participant U12, it can obtain three secret values, namely secret value f1(2), secret value f2(2) and secret value f3(2); for the first participant U13, it can obtain three secret values, namely secret value f1(3), secret value f2(3) and secret value f3(3).

[0069] Through the above steps of "obtaining secret values shared by q first participants to obtain q secret values," in the disclosed embodiment, the obtained random secret can be generated into a secret value using a verifiable threshold secret sharing method, and the secret value is then shared among the q first participants. The secret value shared by the first participant and the secret values shared by the first participant other than the first participant are then obtained to obtain q secret values. Because the verifiable threshold secret sharing method is used, which is generally efficient and highly secure, the execution efficiency and security of the digital signature method can be improved.

[0070] In some optional implementations, “generating private key shards and a collaborative public key based on q secret values” may include the following steps:

[0071] Generate private key shards and collaborative public key shards based on q secret values, as well as the elliptic curve group parameters and interpolation polynomial coefficients required by the EdDSA digital signature algorithm;

[0072] Broadcast the collaborative public key shards;

[0073] Obtain the collaborative public key shard broadcast by itself and the collaborative public key shards broadcast by the other participants among the q first participants except itself, to obtain q collaborative public key shards;

[0074] The collaborative public key is generated based on q collaborative public key shards.

[0075] In the embodiment of the present disclosure, the coefficients of the Lagrange interpolation polynomial can also be set to:

[0076]

[0077] in, Indicates the i-th first participant U1 i The corresponding Lagrange interpolation polynomial coefficients, and 1≤i≤q.

[0078] In addition, in the embodiment of the present disclosure, the signature private key d can be composed by q private key shares:

[0079]

[0080] Among them, d i For the first participant U1 i The corresponding private key score, and 1≤i≤q.

[0081] Based on the above description, in a specific example, after obtaining q secret values, a private key score can be first calculated based on the q secret values and the elliptic curve group parameters. Then, a private key shard can be generated based on the private key score and the elliptic curve group parameters. Then, a collaborative public key shard can be generated based on the private key shard and the elliptic curve group parameters. Thereafter, the collaborative public key shard is broadcast, and the collaborative public key shard broadcasted by the first party and the collaborative public key shards broadcasted by the first party other than the first party are obtained to obtain q collaborative public key shards. A collaborative public key is then generated based on the q collaborative public key shards.

[0082] First participant U1 i After obtaining q secret values, the private key score can be calculated based on the q secret values and the elliptic curve group parameters as follows:

[0083]

[0084] Among them, f j (i) is the jth first participant U1 j Share with the first participant U1 i The secret value of , and 1≤i≤q, 1≤j≤q.

[0085] First participant U1 i According to the private key score and elliptic curve group parameters, the generation of private key shards can be characterized as follows:

[0086]

[0087] First participant U1 i Based on the private key sharding and elliptic curve group parameters, the generation of collaborative public key sharding can be characterized as follows:

[0088] P i =[e i ]G

[0089] First participant U1 i After obtaining the collaborative public key shards broadcast by itself and the collaborative public key shards broadcast by the other participants except itself among the q first participants to obtain q collaborative public key shards, the collaborative public key generated according to the q collaborative public key shards can be represented as follows:

[0090]

[0091] Among them, P jFor the jth first participant U1 j Broadcast collaborative public key shards.

[0092] Please combine Figure 4 , exemplarily, q=3, and the three first participants include the first participant U11, the first participant U12 and the first participant U13.

[0093] Then, let the digital computer C1 used by the first participant U11 be the execution subject. When executing the above steps, after the first participant U11 obtains the secret value f1(1), the secret value f2(1) and the secret value f3(1), it can calculate the private key score d1 according to the three secret values and the elliptic curve group parameters, and then generate the private key fragment e1 according to the private key score d1 and the elliptic curve group parameters. According to the private key fragment e1 and the elliptic curve group parameters, it generates the collaborative public key fragment P1 and broadcasts it. Let the digital computer C2 used by the first participant U12 be the execution subject. When executing the above steps, after the first participant U12 obtains the secret value f1(2), the secret value f2(2) and the secret value f3(2), it can generate the collaborative public key fragment P1 according to the private key fragment e1 and the elliptic curve group parameters, and broadcast it. The first participant U13 uses the digital computer C3 as the execution subject to execute the above steps. After obtaining the secret value f1(3), the secret value f2(3) and the secret value f3(3), the first participant U13 can calculate the private key score d3 according to the three secret values and the elliptic curve group parameters, and then generate the private key shard e2 according to the private key score d2 and the elliptic curve group parameters, and generate the collaborative public key shard P2 according to the private key shard e2 and the elliptic curve group parameters, and broadcast it. The first participant U13 uses the digital computer C3 as the execution subject to execute the above steps. After obtaining the secret value f1(3), the secret value f2(3) and the secret value f3(3), the first participant U13 can calculate the private key score d3 according to the three secret values and the elliptic curve group parameters, and then generate the private key shard e3 according to the private key score d3 and the elliptic curve group parameters, and generate the collaborative public key shard P3 according to the private key shard e3 and the elliptic curve group parameters, and broadcast it.

[0094] Finally, for the first participant U11, it can obtain the collaborative public key fragment P1 broadcast by itself, the collaborative public key fragment P2 broadcast by the first participant U12, and the collaborative public key fragment P3 broadcast by the first participant U13, to obtain three collaborative public key fragments, and then generate the collaborative public key P based on these three collaborative public key fragments; for the first participant U12, it can obtain the collaborative public key fragment P2 broadcast by itself, and the collaborative public key fragment P1 broadcast by the first participant U11 and the collaborative public key shard P3 broadcast by the first participant U13 to obtain three collaborative public key shards, and then generate the collaborative public key P based on these three collaborative public key shards; for the first participant U13, it can obtain the collaborative public key shard P3 broadcast by itself, as well as the collaborative public key shard P1 broadcast by the first participant U11 and the collaborative public key shard P2 broadcast by the first participant U12 to obtain three collaborative public key shards, and then generate the collaborative public key P based on these three collaborative public key shards.

[0095] Through the above steps included in "generating private key shards and collaborative public keys based on q secret values", in the embodiment of the present disclosure, private key shards and collaborative public key shards can be generated based on the q secret values, and the elliptic curve group parameters and interpolation polynomial coefficients required by the EdDSA digital signature algorithm, and then the collaborative public key shards are broadcast, and the collaborative public key shards broadcast by themselves and the collaborative public key shards broadcast by other participants among the q first participants except themselves are obtained to obtain q collaborative public key shards, and a collaborative public key is generated based on the q collaborative public key shards. Since the generation process of the private key shards and the collaborative public key both need to rely on the q first participants, it can be ensured that the private key shards and the collaborative public key are strongly correlated with the q first participants, thereby improving the security of the signature generation method.

[0096] In some optional implementations, “determining that t′ second participants among the q first participants who participate in signature generation meet the signature generation requirements” may include the following steps:

[0097] Identify the signature generation requirement and obtain an identification result;

[0098] If the identification result indicates that the signature generation requirement is the first generation requirement, determining a participation threshold value t such that t' second participants meet the first generation requirement when the total number of second participants t'≥t, where 0<t≤q is an integer;

[0099] In a case where the identification result indicates that the signature generation requirement is the second generation requirement, determining the target party, so as to determine that the t' second parties meet the second generation requirement when the target party is included in the t' second parties;

[0100] When the identification result indicates that the signature generation requirement is the third generation requirement, the participation threshold value t and the target participant are determined to determine that t' second participants meet the third generation requirement when the total number of second participants t'≥t and the target participant is included in the t' second participants.

[0101] The signature generation requirements can be pre-set on a trusted device, locked in an unchangeable state, and sent to digital computers used by the q first parties. These requirements can be indirectly represented by the required characterization data. The trusted device can be one of the q first parties or a third-party device, and this is not specifically limited in this embodiment.

[0102] In the embodiment of the present disclosure, the signature generation requirement is identified to obtain an identification result, which is used to indicate that the signature generation requirement is one of the first generation requirement, the second generation requirement, and the third generation requirement. The first generation requirement is: the total number of second participants t'≥t; the second generation requirement is: the target participant is included in t' second participants; the third generation requirement is: the total number of second participants t'≥t, and the target participant is included in t' second participants, where 0<t≤q, and is an integer. In addition, as mentioned above, in the embodiment of the present disclosure, the participation threshold value t can be a preset fixed value, or it can be a variable value dynamically set according to the total number of first participants q. It should be noted that in the embodiment of the present disclosure, when the identification result indicates that the signature generation requirement is the second generation requirement, there is actually a participation threshold value t, but the participation threshold value t is a preset fixed value, which can be 1.

[0103] In a specific example, after obtaining the secret value shared by q first participants to obtain q secret values, and then generating private key fragments and collaborative public keys based on the q secret values, the t' second participants participating in the signature generation among the q first participants can each broadcast their own basic identity identifier as broadcast content separately, and then obtain the broadcast content broadcast by themselves, as well as the broadcast content broadcast by other participants among the t' second participants except themselves, to obtain t' basic identity identifiers, and use the total data t' of the basic identity identifiers as the total number t' of second participants.

[0104] In another specific example, after obtaining the secret value shared by q first participants to obtain q secret values, and then generating private key shards and collaborative public keys based on the q secret values, the t' second participants participating in the signature generation among the q first participants can each generate a temporary public key shard based on the information to be signed and the elliptic curve group parameters, and then broadcast their own basic identity identification and the temporary public key shard as broadcast content, and then obtain the broadcast content broadcast by themselves, as well as the broadcast content broadcast by other participants among the t' second participants except themselves, to obtain t' basic identity identifications, and use the total data t' of the basic identity identifications as the total number t' of second participants.

[0105] In addition, based on the above description, in the embodiment of the present disclosure, after obtaining t' basic identity identifiers, a standard identity identifier can be obtained, and then, when the standard identity identifier is included in the t' basic identity identifiers, it is determined that the target participant is included in the t' second participants, and the second participant corresponding to the standard identity identifier is used as the target participant.

[0106] Through the above steps of "determining that t' second participants participating in signature generation among q first parties meet the signature generation requirements", in the embodiment of the present disclosure, the signature generation requirement can be preset to one of the first generation requirement, the second generation requirement and the third generation requirement. Therefore, based on the adjustable control of the signature generation requirement, the diversity and adaptability of the signature generation requirement can be guaranteed, thereby further improving the flexibility of the signature generation method.

[0107] In some optional implementations, “identifying the signature generation requirement and obtaining an identification result” may include the following steps:

[0108] Obtain required characterization data;

[0109] In a case where the requirement characterization data includes a participation threshold value t but does not include a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is a first generation requirement;

[0110] In a case where the requirement characterization data does not include the participation threshold value t but includes a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is a second generation requirement;

[0111] In a case where the requirement characterization data includes the participation threshold value t and the standard identity identifier, an identification result indicating that the signature generation requirement is the third generation requirement is obtained.

[0112] The characterization data is required to be pre-set based on a trusted device, then locked in an unchangeable state, and sent to digital computers used by q first parties.

[0113] In the embodiment of the present disclosure, the requirement characterization data may include at least one of a participation threshold value t and a target participant. Based on this, in the embodiment of the present disclosure, when the requirement characterization data includes the participation threshold value t but does not include a standard identity identifier, an identification result is obtained indicating that the signature generation requirement is a first generation requirement; when the requirement characterization data does not include the participation threshold value t but includes a standard identity identifier, an identification result is obtained indicating that the signature generation requirement is a second generation requirement; and when the requirement characterization data includes both the participation threshold value t and a standard identity identifier, an identification result is obtained indicating that the signature generation requirement is a third generation requirement.

[0114] Through the above steps of "identifying the signature generation requirements and obtaining the identification results", in the embodiment of the present disclosure, the requirement characterization data can be obtained, and based on the requirement characterization data, the identification results can be directly obtained to simplify the identification process of the signature generation requirements, thereby improving the execution efficiency of the digital signature method.

[0115] In addition, as mentioned above, in the embodiment of the present disclosure, “determining that the t′ second participants include the target participant” may include the following steps:

[0116] Obtaining t' basic identity identifiers of the second participants to obtain t' basic identity identifiers;

[0117] Get a standard identity;

[0118] In the case that the t' basic identity identifiers include the standard identity identifier, it is determined that the t' second participants include the target participant, and the second participant corresponding to the standard identity identifier is used as the target participant.

[0119] For example, q = 3, and the three first participants include first participant U11, first participant U12, and first participant U13. Assume that t' = 2, and among the three first participants, first participant U11 (hereinafter referred to as second participant U21 for ease of description) and first participant U13 (hereinafter referred to as second participant U22 for ease of description) serve as second participants participating in signature generation. The basic identity identifier of second participant U21 is User1, and the basic identity identifier of second participant U22 is User3.

[0120] Then, when the standard identity identifier is User3, the above two basic identity identifiers include the standard identity identifier User3. Therefore, it can be determined that the second participant U21 and the second participant U22 include the target participant, and the second participant U22 corresponding to the standard identity identifier User3 is used as the target participant.

[0121] Through the above steps included in "determining that the target party is included in t' second parties", in the embodiment of the present disclosure, the basic identity identifiers of t' second parties can be obtained to obtain t' basic identity identifiers, and then the standard identity identifier is obtained. When the standard identity identifier is included in the t' basic identity identifiers, it is directly determined that the target party is included in the t' second parties, so as to simplify the identification process required for signature generation, thereby improving the execution efficiency of the digital signature method.

[0122] In some optional implementations, “determining the participation threshold t” may include the following steps:

[0123] Get participation threshold ratio;

[0124] The product of the total number q of the first participants and the participation threshold ratio is calculated as the participation threshold value t.

[0125] The participation threshold ratio may be preset, for example, it may be set to 60%, 80%, 90%, etc., and the embodiment of the present disclosure does not impose any specific limitation on this.

[0126] For example, q=10, and the participation threshold ratio is 90%, then the product 9 of the total number of first participants 10 and the participation threshold ratio 90% can be calculated as the participation threshold value t.

[0127] Through the above steps included in "determining the participation threshold value t", in the embodiment of the present disclosure, the participation threshold ratio can be obtained, and then the product of the total number q of the first participants and the participation threshold ratio is calculated as the participation threshold value t. This can avoid setting the participation threshold value t to only a fixed value, thereby further improving the flexibility of the signature generation method.

[0128] In some optional implementations, “generating a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed” may include the following steps:

[0129] Generate a temporary public key;

[0130] Perform hash operation on the temporary public key, collaborative public key and the information to be signed to obtain the signature hash value;

[0131] Generates a signature shard based on the signature hash value, the private key shard, and the elliptic curve group parameters required by the EdDSA digital signature algorithm.

[0132] The temporary public key can be a random secret key value and can be generated in the following ways:

[0133] After broadcasting the obtained temporary public key fragment, obtain the temporary public key fragment broadcast by itself and the temporary public key fragments broadcast by the other participants among the t' second participants except itself, to obtain t' temporary public key fragments;

[0134] Generate a temporary public key based on t' temporary public key shards.

[0135] In a specific example, a temporary public key shard can be generated based on the information to be signed and the elliptic curve group parameters. For example, a hash operation can be performed on the secret key hash value and the information to be signed to obtain a random hash value. Then, a temporary public key shard is generated based on the random hash value and the elliptic curve group parameters. Thereafter, the temporary public key shard is broadcast, and the temporary public key shard broadcast by itself and the temporary public key shards broadcast by the other t' second participants other than itself are obtained to obtain t' temporary public key shards. Then, a temporary public key is generated based on the t' temporary public key shards.

[0136] Second participant U2 i Perform a hash operation on the secret key hash value and the information to be signed to obtain a random hash value that can be represented as:

[0137]

[0138] in, is the secret key hash value, and M is the information to be signed.

[0139] Second participant U2 i Based on the random hash value and elliptic curve group parameters, the generation of temporary public key shards can be characterized as follows:

[0140] R i =[r i ]G

[0141] Second participant U2 i Obtain the temporary public key shards broadcast by itself and the temporary public key shards broadcast by other participants except itself among the t' second participants to obtain t' temporary public key shards. Then, based on the t' temporary public key shards, generate a temporary public key which can be represented as follows:

[0142]

[0143] Among them, R i For the second participant U2 i The corresponding temporary public key shard, t' is the total number of temporary public key shards.

[0144] Please combine Figure 5 For example, t = 3, and the three first participants include first participant U11, first participant U12, and first participant U13. Assume that t' = 2, and among the three first participants, first participant U11 (for convenience of description, hereinafter referred to as second participant U21) and first participant U13 (for convenience of description, hereinafter referred to as second participant U22) serve as second participants participating in signature generation.

[0145] Then, taking the digital computer C1 used by the second participant U21 as the execution subject, when executing the above steps, the second participant U21 performs a hash operation on the secret key hash value and the information to be signed M to obtain a random hash value r1, and then generates a temporary public key shard R1 according to the random hash value r1 and the elliptic curve group parameters; taking the digital computer C3 used by the second participant U22 as the execution subject, when executing the above steps, the second participant U22 performs a hash operation on the secret key hash value and the information to be signed M to obtain a random hash value r2, and then generates a temporary public key shard R2 according to the random hash value r2 and the elliptic curve group parameters.

[0146] Finally, for the second participant U21, it can obtain the temporary public key fragment R1 broadcast by itself and the temporary public key fragment R2 broadcast by the second participant U22 to obtain 2 temporary public key fragments, and then generate the temporary public key R based on these 2 temporary public key fragments; for the second participant U22, it can obtain the temporary public key fragment R2 broadcast by itself and the temporary public key fragment R1 broadcast by the second participant U21 to obtain 2 temporary public key fragments, and then generate the temporary public key R based on these 2 temporary public key fragments.

[0147] Second participant U2 i Perform hash operation on the temporary public key, collaborative public key and the information to be signed, and obtain the signature hash value which can be represented as:

[0148] h=H(R,P,M)

[0149] Second participant U2 i Based on the signature hash value, private key shard, and the elliptic curve group parameters required by the EdDSA digital signature algorithm, the signature shard can be generated as follows:

[0150] s i =r i +h·e′ i mod n

[0151] Among them, e' i corresponds to the second participant U2 i For example, for the second participant U21, if it is actually the first participant U11, then its corresponding private key shard is e1; for another example, for the second participant U22, if it is actually the first participant U13, then its corresponding private key shard is e3.

[0152] Through the above steps of "generating signature fragments based on private key fragments, collaborative public keys and information to be signed", in the embodiment of the present disclosure, a temporary public key can be generated, and then a hash operation is performed on the temporary public key, the collaborative public key and the information to be signed to obtain a signature hash value, and based on the signature hash value, the private key fragments, and the elliptic curve group parameters required by the EdDSA digital signature algorithm, signature fragments are generated. This can ensure the richness of the parameters used in the signature fragment generation process, thereby improving the security of the signature generation method.

[0153] In addition, as mentioned above, in the embodiment of the present disclosure, “generating a temporary public key” may include the following steps:

[0154] After broadcasting the obtained temporary public key fragment, obtain the temporary public key fragment broadcast by itself and the temporary public key fragments broadcast by the other participants among the t' second participants except itself, to obtain t' temporary public key fragments;

[0155] Generate a temporary public key based on t' temporary public key shards.

[0156] Through the above steps included in "generating a temporary public key," in the disclosed embodiment, after broadcasting the acquired temporary public key fragments, the temporary public key fragments broadcast by itself and the temporary public key fragments broadcast by other participants other than itself can be obtained to obtain t' temporary public key fragments. Then, a temporary public key can be generated based on the t' temporary public key fragments. Since the generation process of the temporary public key depends on the t' second participants, it can be ensured that the temporary public key has a strong correlation with the t' second participants, thereby improving the security of the signature generation method.

[0157] After generating a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed, the signature fragment can be shared. This allows execution of step S104, which generates a digital signature based on the signature fragment generated by the party itself and the signature fragments generated by the other t' second parties, excluding the party itself.

[0158] Second participant U2 i Obtain the signature fragment generated by itself and the signature fragments generated by the other participants except itself among the t' second participants. The generated digital signature can be represented as follows:

[0159]

[0160] Among them, s i Second participant U2 i The corresponding signature shard.

[0161] Finally, the digital signature s can be output in the form of σ=(R, s).

[0162] Please combine Figure 6 For example, t = 3, and the three first participants include first participant U11, first participant U12, and first participant U13. Assume that t' = 2, and among the three first participants, first participant U11 (for convenience of description, hereinafter referred to as second participant U21) and first participant U13 (for convenience of description, hereinafter referred to as second participant U22) serve as second participants participating in signature generation.

[0163] Then, when the digital computer C1 used by the second participant U21 is used as the execution body and the above steps are executed to generate a digital signature, the second participant U21 can share the signature fragment s1 after performing a hash operation on the temporary public key R, the collaborative public key P and the information to be signed M to obtain the signature hash value h, and generating the signature fragment s1 based on the signature hash value h, the private key fragment e'1, and the elliptic curve group parameters required by the EdDSA digital signature algorithm; when the digital computer C3 used by the second participant U22 is used as the execution body and the above steps are executed to generate a digital signature, the second participant U22 can share the signature fragment s2 after performing a hash operation on the temporary public key R, the collaborative public key P and the information to be signed M to obtain the signature hash value h, and generating the signature fragment s2 based on the signature hash value h, the private key fragment e'2, and the elliptic curve group parameters required by the EdDSA digital signature algorithm.

[0164] Finally, for the second participant U21, it can obtain the signature fragment s1 generated by itself and the signature fragment s2 generated by the second participant U22, generate a digital signature s, and output it in the form of σ = (R, s); for the second participant U22, it can obtain the signature fragment s2 generated by itself and the signature fragment s1 generated by the second participant U21, generate a digital signature s, and output it in the form of σ = (R, s).

[0165] In some optional implementations, the signature generation method may further include the following steps:

[0166] Verify the digital signature and obtain the verification result;

[0167] In the case where the verification result indicates that the digital signature is a valid signature, the digital signature is sent to the intended recipient.

[0168] In the disclosed embodiment, the digital signature can be verified using the following verification logic:

[0169] [s]G=R+[H(R,P,M)]P

[0170] That is, when [S]G=R+[H(R,P,M)]P is equal, a verification result indicating that the digital signature is a usable signature is obtained, and then the digital signature is sent to the target recipient; when [S]G≠R+[H(R,P,M)]P, a verification result indicating that the digital signature is an unusable signature is obtained, and then the digital signature is sent to the target recipient.

[0171] Through the above steps included in the signature generation method, in the embodiment of the present disclosure, the digital signature can be verified to obtain a verification result, and then when the verification result indicates that the digital signature is a usable signature, the digital signature can be sent to the target recipient, thereby avoiding sending an unusable signature to the target recipient, thereby improving the reliability of the signature generation method.

[0172] In addition, it should be noted that in the embodiments of the present disclosure, the same symbol is used to represent the same object. For example, R represents a temporary public key. Therefore, to avoid redundancy, some formulas do not provide full parameter explanations.

[0173] The following will be combined Figure 7 , describes the complete process of a digital signature method provided by an embodiment of the present disclosure.

[0174] Step S701: Obtain a random secret, then generate q secret values from the random secret using a verifiable threshold secret sharing method, share the q secret values with q first parties respectively, and obtain the secret value shared by the first party and the secret values shared by the other first parties except the first party, to obtain q secret values;

[0175] Step S702: Generate private key shards and collaborative public key shards based on the q secret values, the elliptic curve group parameters, and the interpolation polynomial coefficients required by the EdDSA digital signature algorithm. The collaborative public key shards are then broadcast. The collaborative public key shards broadcast by the first party are obtained, along with the collaborative public key shards broadcast by the first party other than the first party, to obtain q collaborative public key shards. A collaborative public key is generated based on the q collaborative public key shards.

[0176] Step S703: In response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirements, after broadcasting the obtained temporary public key fragments, obtain the temporary public key fragments broadcast by itself and the temporary public key fragments broadcast by other parties among the t' second parties other than itself, to obtain t' temporary public key fragments, and generate a temporary public key based on the t' temporary public key fragments;

[0177] Step S704: Perform a hash operation on the temporary public key, the collaborative public key, and the information to be signed to obtain a signature hash value. Then, based on the signature hash value, the private key fragment, and the elliptic curve group parameters required by the EdDSA digital signature algorithm, generate a signature fragment.

[0178] Step S705: Generate a digital signature based on the signature fragments generated by itself and the signature fragments generated by the other participants among the t' second participants except itself;

[0179] Step S706: Verify the digital signature to obtain a verification result, and then send the digital signature to the target recipient if the verification result indicates that the digital signature is a valid signature.

[0180] In a specific example, "determining that t' second participants participating in signature generation among q first participants meet the signature generation requirement" may include: obtaining a participation threshold value t, where 0 < t ≤ q and is an integer; and determining that t' second participants meet the signature generation requirement when the total number of second participants t' ≥ t. For example, if the participation threshold value t = 1, then when the total number of second participants t' ≥ 1, it is determined that t' second participants meet the signature generation requirement; for another example, if the participation threshold value t = 2, then when the total number of second participants t' ≥ 2, it is determined that t' second participants meet the signature generation requirement. The participation threshold value t may be a preset fixed value or a variable value dynamically set based on the total number of first participants q. For example, a participation threshold ratio may be obtained, and then the product of the total number of first participants q and the participation threshold ratio may be calculated as the participation threshold value t. This embodiment of the present disclosure does not impose any specific limitations on this.

[0181] See also Figure 8 , which is a schematic diagram of an application scenario of a digital signature method provided in an embodiment of the present disclosure.

[0182] As previously mentioned, the digital signature method provided in the embodiments of the present disclosure is applied to electronic devices, where the electronic devices are intended to represent various forms of digital computers, such as servers, blade servers, workstations, mainframe computers, desktop computers, laptop computers, or other suitable computers.

[0183] In the embodiment of the present disclosure, the electronic device can be used to execute the digital signature method:

[0184] Obtain the secret values shared by q first parties to obtain q secret values, where q ≥ 3 and is an integer;

[0185] Based on q secret values, generate private key shards and collaborative public keys;

[0186] In response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirement, generating a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed, where 0 < t' ≤ q and is an integer;

[0187] Generate a digital signature based on the signature fragment generated by itself and the signature fragments generated by the other participants among the t' second participants except itself.

[0188] It should be noted that in the embodiment of the present disclosure, digital computers used by q first participants will serve as execution entities to execute the steps of "obtaining the secret value shared by the q first participants to obtain q secret values; generating private key shards and collaborative public keys based on the q secret values." Thereafter, among these q digital computers, t' digital computers will also serve as execution entities to execute the steps of "in response to determining that t' second participants participating in signature generation among the q first participants meet the signature generation requirements, generating signature shards based on the private key shards, the collaborative public key, and the information to be signed; and generating a digital signature based on the signature shards generated by themselves and the signature shards generated by the other participants among the t' second participants other than themselves."

[0189] Among them, the first participant who participates in key generation in the early stage and the second participant who participates in signature generation in the later stage are the same signing participant, and the digital computer used by them is the electronic device that fully executes the digital signature method.

[0190] like Figure 8 In the application scenario shown, q=3, t'=2, and the first digital computer 801 and the third digital computer 803 are electronic devices that fully execute the digital signature method, and the second digital computer 802 only executes the steps of "obtaining q secret values shared by the first participants to obtain q secret values; and generating private key fragments and collaborative public keys based on the q secret values."

[0191] In addition, it should be noted that in the embodiments of the present disclosure, Figure 8 The scene diagram shown is only for illustration and not for limitation. Those skilled in the art can Figure 8 Various obvious changes and / or substitutions may be made to the examples, and the obtained technical solutions still fall within the scope of the disclosure of the embodiments of the present disclosure.

[0192] In order to better implement the above digital signature method, the embodiment of the present disclosure also provides a digital signature device 900, which can be integrated into an electronic device. Figure 9 The structural diagram shown is used to illustrate a digital signature device 900 provided in the disclosed embodiment.

[0193] The digital signature device 900 includes:

[0194] A secret value acquisition unit 901 is configured to acquire secret values shared by q first parties to obtain q secret values, where q is an integer and is greater than or equal to 3.

[0195] A secret key generation unit 902 is used to generate a private key fragment and a collaborative public key based on q secret values;

[0196] A signature fragment generation unit 903 is configured to generate a signature fragment based on the private key fragment, the coordinated public key, and the information to be signed, in response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirements, where 0 < t' ≤ q and t' is an integer;

[0197] The digital signature generating unit 904 is configured to generate a digital signature based on the signature fragments generated by itself and the signature fragments generated by the other participants except itself among the t′ second participants.

[0198] In some optional implementations, the signature fragment generation unit 903 is configured to:

[0199] Identify the signature generation requirement and obtain an identification result;

[0200] If the identification result indicates that the signature generation requirement is the first generation requirement, determining a participation threshold value t such that t' second participants meet the first generation requirement when the total number of second participants t'≥t, where 0<t≤q is an integer;

[0201] In a case where the identification result indicates that the signature generation requirement is the second generation requirement, determining the target party, so that when the target party is included in the determination of the t' second parties, it is determined that the t' second parties meet the second generation requirement;

[0202] When the identification result indicates that the signature generation requirement is the third generation requirement, the participation threshold value t and the target participant are determined to determine that t' second participants meet the third generation requirement when the total number of second participants t'≥t and the target participant is included in the t' second participants.

[0203] In some optional implementations, the signature fragment generation unit 903 is configured to:

[0204] Obtain required characterization data;

[0205] In a case where the requirement characterization data includes a participation threshold value t but does not include a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is a first generation requirement;

[0206] In a case where the requirement characterization data does not include the participation threshold value t but includes a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is a second generation requirement;

[0207] In a case where the requirement characterization data includes the participation threshold value t and the standard identity identifier, an identification result indicating that the signature generation requirement is the third generation requirement is obtained.

[0208] In some optional implementations, the signature fragment generation unit 903 is configured to:

[0209] Obtaining t' basic identity identifiers of the second participants to obtain t' basic identity identifiers;

[0210] Get a standard identity;

[0211] In the case that the t' basic identity identifiers include the standard identity identifier, it is determined that the t' second participants include the target participant, and the second participant corresponding to the standard identity identifier is used as the target participant. In some optional implementations, the signature fragment generation unit 903 is used to:

[0212] Get participation threshold ratio;

[0213] The product of the total number q of the first participants and the participation threshold ratio is calculated as the participation threshold value t.

[0214] In some optional implementations, the signature fragment generation unit 903 is configured to:

[0215] Generate a temporary public key;

[0216] Perform hash operation on the temporary public key, collaborative public key and the information to be signed to obtain the signature hash value;

[0217] Generates a signature shard based on the signature hash value, the private key shard, and the elliptic curve group parameters required by the EdDSA digital signature algorithm.

[0218] In some optional implementations, the signature fragment generation unit 903 is configured to:

[0219] After broadcasting the obtained temporary public key fragment, obtain the temporary public key fragment broadcast by itself and the temporary public key fragments broadcast by the other participants among the t' second participants except itself, to obtain t' temporary public key fragments;

[0220] Generate a temporary public key based on t' temporary public key shards.

[0221] In some optional implementations, the secret value obtaining unit 901 is configured to:

[0222] Get a random secret;

[0223] Generate q secret values from the random secret using a verifiable threshold secret sharing method, and share the q secret values with q first parties respectively;

[0224] Obtain the secret value shared by itself and the secret values shared by the other participants except itself among the q first participants to obtain q secret values.

[0225] In some optional implementations, the key generation unit 902 is configured to:

[0226] Generate private key shards and collaborative public key shards based on q secret values, as well as the elliptic curve group parameters and interpolation polynomial coefficients required by the EdDSA digital signature algorithm;

[0227] Broadcast the collaborative public key shards;

[0228] Obtain the collaborative public key shard broadcast by itself and the collaborative public key shards broadcast by the other participants among the q first participants except itself, to obtain q collaborative public key shards;

[0229] The collaborative public key is generated based on q collaborative public key shards.

[0230] In some optional implementations, the digital signature device 900 further includes a verification unit configured to:

[0231] Verify the digital signature and obtain the verification result;

[0232] In the case where the verification result indicates that the digital signature is a valid signature, the digital signature is sent to the intended recipient.

[0233] In some optional implementations, the information to be signed includes one of the following: digital asset information, a digital file, a software installation package, and a public key certificate.

[0234] During specific implementation, the above modules can be implemented as independent entities, or can be arbitrarily combined and implemented as the same or several entities. The specific implementation of the above modules can be found in the previous digital signature method embodiment, which will not be repeated here.

[0235] The digital signature device provided by the embodiment of the present disclosure can obtain the secret value shared by q first participants to obtain q secret values, and based on the q secret values, generate a private key shard and a collaborative public key. Thereafter, in response to determining that t' second participants participating in the signature generation among the q first participants meet the signature generation requirements, a signature shard is generated based on the private key shard, the collaborative public key and the information to be signed, where 0 < t' ≤ q and is an integer. Then, based on the signature shard generated by itself and the signature shards generated by other participants among the t' second participants except itself, a digital signature is generated. That is, when a digital signature is generated by the digital signature method provided by the embodiment of the present disclosure, the total number t' of second participants participating in the signature generation can be less than or equal to the total number q of first participants participating in the key generation. Compared with the existing technology, no strict requirements are put forward in terms of the consistency of the number of participants before and after. Therefore, the flexibility of the digital signature can be improved.

[0236] In the technical solutions disclosed herein, the acquisition, storage, and application of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0237] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a storage medium, and a computer program product.

[0238] Figure 10 A schematic block diagram of an example electronic device 1000 is shown, which may be used to implement embodiments of the present disclosure.

[0239] As previously mentioned, in the embodiments of the present disclosure, electronic devices are intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0240] like Figure 10 As shown, the electronic device 1000 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1002 or a computer program loaded from a storage unit 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the electronic device 1000 can also be stored. The computing unit 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0241] Multiple components in the electronic device 1000 are connected to the I / O interface 1005, including an input unit 1006, such as a keyboard, a mouse, etc.; an output unit 1007, such as various types of displays, speakers, etc.; a storage unit 1008, such as a magnetic disk, an optical disk, etc.; and a communication unit 1009, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1009 allows the electronic device 1000 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0242] The computing unit 1001 can be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1001 performs the various methods and processes described above, for example, the digital signature method. For example, in some optional embodiments, the digital signature method can be implemented as a computer software program, which is tangibly included in a non-transient computer-readable storage medium, for example, the storage unit 1008. In some optional embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1000 via the ROM 1002 and / or the communication unit 1009. When the computer program is loaded into RAM 1003 and executed by computing unit 1001, one or more steps of the digital signature method described above may be performed. Alternatively, in other embodiments, computing unit 1001 may be configured to perform the digital signature method in any other appropriate manner (e.g., by means of firmware).

[0243] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0244] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0245] In the context of the present disclosure, a non-transient computer-readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A non-transient computer-readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A non-transient computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. More specific examples of non-transient computer-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, RAM, ROM, an erasable programmable read-only memory (EPROM) or flash memory, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0246] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) display or a liquid crystal display (LCD)) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0247] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0248] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises from computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0249] An embodiment of the present disclosure further provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the aforementioned digital signature method.

[0250] The embodiment of the present disclosure also provides a computer program product, including a computer program, which implements the aforementioned digital signature method when executed by a processor.

[0251] The electronic device, storage medium, and computer program product provided by the embodiments of the present disclosure can obtain a secret value shared by q first participants to obtain q secret values, and based on the q secret values, generate a private key shard and a collaborative public key. Thereafter, in response to determining that t' second participants participating in signature generation among the q first participants meet the signature generation requirements, a signature shard is generated based on the private key shard, the collaborative public key, and the information to be signed, where 0 < t' ≤ q and is an integer. Then, based on the signature shard generated by itself and the signature shards generated by other participants among the t' second participants other than itself, a digital signature is generated. That is, when a digital signature is generated by the digital signature method provided by the embodiments of the present disclosure, the total number t' of second participants participating in signature generation can be less than or equal to the total number q of first participants participating in key generation. Compared with the prior art, no strict requirements are put forward on the consistency of the number of participants before and after, and therefore, the flexibility of digital signatures can be improved.

[0252] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document is not limited here. In addition, in this disclosure, relational terms such as "first", "second", "third", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, "multiple" in this disclosure can be understood as at least two.

[0253] The foregoing specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A digital signature method, comprising: Obtain secret values shared by q first parties to obtain q secret values, where q ≥ 3 and is an integer; for each of the q first parties, the secret value shared by the first party is generated by the first party based on the random secret obtained by the first party, and can be specifically characterized as follows: Among them, f i (j) is used to represent the first participant U1 i Share with the first participant U1 j The secret value of ; 1≤i≤q; 1≤j≤q; α i Used to represent the first participant U1 i The random secret obtained; t is used to represent the participation threshold; γ ik Used to represent random numbers; After obtaining the q secret values, generating a private key shard and a collaborative public key based on the q secret values; In response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirements, generating a signature fragment based on the private key fragment, the collaborative public key, and the information to be signed; wherein 0 < t' ≤ q, and t' is an integer; Generate a digital signature based on the signature fragment generated by itself and the signature fragments generated by the other participants among the t' second participants except itself; The step of generating private key fragments and collaborative public keys based on the q secret values includes: Based on the q secret values and the first parameter n in the elliptic curve group parameters required by the Edwards curve digital signature algorithm, the private key score is generated, which can be specifically characterized as follows: Wherein, di is used to represent the private key score; f j (i) Used to represent the first participant U1 j Share with the first participant U1 i The secret value of ; 1≤i≤q; 1≤j≤q; After the private key score is generated, the private key shards are generated based on the private key score, the interpolation polynomial coefficients, and the first parameter n, which can be specifically characterized as follows: Among them, e i Used to represent the private key shard; di is used to represent the private key score; Used to represent the first participant U1 i Corresponding interpolation polynomial coefficients; 1≤i≤q; After generating the private key shard, generating a collaborative public key shard based on the private key shard and a second parameter G in the elliptic curve group parameters; broadcasting the collaborative public key shard; obtaining the collaborative public key shard broadcasted by itself and the collaborative public key shards broadcasted by other participants among the q first participants except itself, to obtain q collaborative public key shards; generating the collaborative public key based on the q collaborative public key shards; wherein the first parameter n is a positive integer; and the second parameter G is a base point among all points on the elliptic curve related to the elliptic curve group parameters and a point at infinity; The generating of the signature fragment based on the private key fragment, the collaborative public key and the information to be signed includes: Generate a temporary public key, which can be characterized as follows: R i =[r i ]G Among them, R is used to represent the temporary public key; R i Used to represent the second participant U2 i According to the random hash value r i and the second parameter G in the elliptic curve group parameter, the generated temporary public key fragment, and the random hash value r i The second participant U2 i Hash value of the secret key The hash operation is performed on the information to be signed M; 1≤i≤q; After generating the temporary public key, performing a hash operation on the temporary public key, the collaborative public key, and the information to be signed to obtain a signature hash value; The signature fragment is generated based on the signature hash value, the private key fragment, and the first parameter n in the elliptic curve group parameters required by the Edwards curve digital signature algorithm. Specifically, it can be characterized as follows: s i =r i +h·e′ i mod n Among them, S i Used to represent signature fragments; r i Used to represent random hash value; h is used to represent signature hash value; e' i Used to represent the second participant U2 i The private key shard.

2. The method according to claim 1, wherein The determining that t' second participants participating in signature generation among the q first participants meet the signature generation requirement includes: Identifying the signature generation requirement and obtaining an identification result; If the identification result indicates that the signature generation requirement is the first generation requirement, determining a participation threshold t, so as to determine that the t' second participants meet the first generation requirement when the total number of the second participants t'≥t; wherein 0<t≤q is an integer; In a case where the recognition result indicates that the signature generation requirement is a second generation requirement, determining a target party, so as to determine that the t' second parties meet the second generation requirement when the target party is included in the t' second parties; When the identification result indicates that the signature generation requirement is the third generation requirement, the participation threshold t and the target participant are determined to determine whether the t' second participants meet the third generation requirement when the total number of the second participants t'≥t and the target participant is included in the t' second participants.

3. The method according to claim 2, wherein: The identifying the signature generation requirement and obtaining an identification result includes: Obtain required characterization data; When the requirement characterizing data includes the participation threshold value t but does not include a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is the first generation requirement; In a case where the requirement characterization data does not include the participation threshold value t but includes the standard identity identifier, obtaining an identification result indicating that the signature generation requirement is the second generation requirement; In a case where the requirement characterization data includes the participation threshold t and the standard identity identifier, an identification result indicating that the signature generation requirement is the third generation requirement is obtained.

4. The method according to claim 3, wherein: Determining that the t' second parties include the target party comprises: Obtaining the basic identity identifiers of the t' second participants to obtain t' basic identity identifiers; Obtaining the standard identity identifier; In the case that the t' basic identity identifiers include the standard identity identifier, it is determined that the t' second participants include the target participant, and the second participant corresponding to the standard identity identifier is used as the target participant.

5. The method according to claim 2, wherein: The determining of the participation threshold value t includes: Get participation threshold ratio; The product of the total number q of the first participants and the participation threshold ratio is calculated as the participation threshold value t.

6. The method according to claim 1, wherein The generating of a temporary public key comprises: After broadcasting the obtained temporary public key fragments, obtaining the temporary public key fragments broadcasted by itself and the temporary public key fragments broadcasted by the other participants among the t' second participants except itself, to obtain t' temporary public key fragments; The temporary public key is generated according to the t' temporary public key fragments.

7. The method according to claim 1, wherein The step of obtaining the secret values shared by the q first participants to obtain the q secret values includes: Get a random secret; Generating the random secret into q secret values by a verifiable threshold secret sharing method, and sharing the q secret values with the q first parties respectively; Acquire the secret value shared by itself and the secret values shared by other participants except itself among the q first participants to obtain the q secret values.

8. The method according to claim 1, further comprising: Verifying the digital signature to obtain a verification result; In a case where the verification result indicates that the digital signature is a usable signature, the digital signature is sent to a target recipient.

9. The method according to any one of claims 1 to 8, wherein The information to be signed includes one of the following: digital asset information, digital files, software installation packages and public key certificates.

10. A digital signature device, comprising: A secret value acquisition unit is configured to acquire secret values shared by q first parties to obtain q secret values, where q ≥ 3 and is an integer. For each of the q first parties, the secret value shared by the first party is generated by the first party based on a random secret acquired by the first party, and can be specifically characterized as follows: Among them, f i (j) is used to represent the first participant U1 i Share with the first participant U1 j The secret value of ; 1≤i≤q; 1≤j≤q; α i Used to represent the first participant U1 i The random secret obtained; t is used to represent the participation threshold; γ ik Used to represent random numbers; A secret key generation unit, configured to generate a private key fragment and a collaborative public key based on the q secret values after obtaining the q secret values; a signature fragment generation unit, configured to generate a signature fragment based on the private key fragment, the collaborative public key, and the information to be signed, in response to determining that t' second parties participating in signature generation among the q first parties meet the signature generation requirement; wherein 0 < t' ≤ q, and t' is an integer; a digital signature generating unit, configured to generate a digital signature based on the signature fragments generated by itself and the signature fragments generated by the other participants among the t' second participants except itself; The key generation unit is specifically used to: Based on the q secret values and the first parameter n in the elliptic curve group parameters required by the Edwards curve digital signature algorithm, the private key score is generated, which can be specifically characterized as follows: Wherein, di is used to represent the private key score; f j (i) Used to represent the first participant U1 j Share with the first participant U1 i The secret value of ; 1≤i≤q; 1≤j≤q; After the private key score is generated, the private key shards are generated based on the private key score, the interpolation polynomial coefficients, and the first parameter n, which can be specifically characterized as follows: Among them, e i Used to represent the private key shard; di is used to represent the private key score; Used to represent the first participant U1 i Corresponding interpolation polynomial coefficients; 1≤i≤q; After generating the private key shard, generating a collaborative public key shard based on the private key shard and a second parameter G in the elliptic curve group parameters; broadcasting the collaborative public key shard; obtaining the collaborative public key shard broadcasted by itself and the collaborative public key shards broadcasted by other participants among the q first participants except itself, to obtain q collaborative public key shards; generating the collaborative public key based on the q collaborative public key shards; wherein the first parameter n is a positive integer; and the second parameter G is a base point among all points on the elliptic curve related to the elliptic curve group parameters and a point at infinity; The signature fragment generation unit is specifically used to: Generate a temporary public key, which can be characterized as follows: R i =[r i ]G Among them, R is used to represent the temporary public key; R i Used to represent the second participant U2 i According to the random hash value r i and the second parameter G in the elliptic curve group parameter, the generated temporary public key fragment, and the random hash value r i The second participant U2 i Hash value of the secret key The hash operation is performed on the information to be signed M; 1≤i≤q; After generating the temporary public key, performing a hash operation on the temporary public key, the collaborative public key, and the information to be signed to obtain a signature hash value; The signature fragment is generated based on the signature hash value, the private key fragment, and the first parameter n in the elliptic curve group parameters required by the Edwards curve digital signature algorithm. Specifically, it can be characterized as follows: s i =r i +h·e′ i mod n Among them, S i Used to represent signature fragments; r i Used to represent random hash value; h is used to represent signature hash value; e' i Used to represent the second participant U2 i The private key shard.

11. The device according to claim 10, wherein The signature fragment generation unit is used to: Identifying the signature generation requirement and obtaining an identification result; If the identification result indicates that the signature generation requirement is the first generation requirement, determining a participation threshold t, so as to determine that the t' second participants meet the first generation requirement when the total number of the second participants t'≥t; wherein 0<t≤q is an integer; In a case where the recognition result indicates that the signature generation requirement is a second generation requirement, determining a target party, so as to determine that the t' second parties meet the second generation requirement when the target party is included in the t' second parties; When the identification result indicates that the signature generation requirement is the third generation requirement, the participation threshold t and the target participant are determined to determine whether the t' second participants meet the third generation requirement when the total number of the second participants t'≥t and the target participant is included in the t' second participants.

12. The device according to claim 11, wherein The signature fragment generation unit is used to: Obtain required characterization data; In a case where the requirement characterizing data includes the participation threshold value t but does not include a standard identity identifier, obtaining an identification result indicating that the signature generation requirement is the first generation requirement; In a case where the requirement characterization data does not include the participation threshold value t but includes the standard identity identifier, obtaining an identification result indicating that the signature generation requirement is the second generation requirement; In a case where the requirement characterization data includes the participation threshold t and the standard identity identifier, an identification result indicating that the signature generation requirement is the third generation requirement is obtained.

13. The device according to claim 12, wherein The signature fragment generation unit is used to: Obtaining the basic identity identifiers of the t' second participants to obtain t' basic identity identifiers; Obtaining the standard identity identifier; In the case that the t' basic identity identifiers include the standard identity identifier, it is determined that the t' second participants include the target participant, and the second participant corresponding to the standard identity identifier is used as the target participant.

14. The device according to claim 11, wherein The signature fragment generation unit is used to: Get participation threshold ratio; The product of the total number q of the first participants and the participation threshold ratio is calculated as the participation threshold value t.

15. The device according to claim 10, wherein The signature fragment generation unit is used to: After broadcasting the obtained temporary public key fragments, obtaining the temporary public key fragments broadcasted by itself and the temporary public key fragments broadcasted by the other participants among the t' second participants except itself, to obtain t' temporary public key fragments; The temporary public key is generated according to the t' temporary public key fragments.

16. The device according to claim 10, wherein The secret value obtaining unit is used for: Get a random secret; Generating the random secret into q secret values by a verifiable threshold secret sharing method, and sharing the q secret values with the q first parties respectively; Acquire the secret value shared by itself and the secret values shared by other participants except itself among the q first participants to obtain the q secret values.

17. The apparatus according to claim 10, further comprising a verification unit configured to: Verifying the digital signature to obtain a verification result; In a case where the verification result indicates that the digital signature is a usable signature, the digital signature is sent to a target recipient.

18. The device according to any one of claims 10 to 17, wherein: The information to be signed includes one of the following: digital asset information, digital files, software installation packages and public key certificates.

19. An electronic device comprising: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 9.

21. A computer program product comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of claims 1 to 9.

Images