A multi-party signature method, system and device

Abstract

A multi-party signature method, device and system, the method comprising: each of n signers providing a signature share, wherein correct signature shares of the n signature shares corresponding to the n signers are generated by signing with a private key share of the signer based on a threshold signature algorithm, the n signers including t malicious signers; in the case of t < n / 3, at least one of the n signers calculating a complete signature corresponding to the n signature shares based on a first polynomial and the n signature shares, the first polynomial having a value of zero in the case of any signer transmitting an incorrect signature share, the n signature shares corresponding to a second polynomial, the second polynomial being a d-degree polynomial, wherein d is greater than or equal to t.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of blockchain technology, and in particular to a multi-party signature method, system, and device. Background Art

[0002] Blockchain is a novel application model for computer technologies, including distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. In a blockchain system, data blocks are linked sequentially in chronological order to form a chain-like data structure, cryptographically guaranteeing an unalterable and unforgeable distributed ledger. Due to its decentralized, tamper-proof, and autonomous nature, blockchain is gaining increasing attention and application. Summary of the Invention

[0003] The purpose of the present invention is to provide a multi-party signature scheme to save storage resources and improve system efficiency.

[0004] A first aspect of this specification provides a multi-party signature method, the method comprising:

[0005] Each of n signing parties provides a signature share, wherein the correct signature share among the n signature shares corresponding to the n signing parties is generated by the signing party based on a threshold signature algorithm, and the n signing parties include t malicious parties;

[0006] In t <n / 3的情况中,所述n个签名方中的至少一方基于第一多项式和所述n个签名份额计算所述n个签名份额对应的完整签名,所述第一多项式在任一签名方传输错误的签名份额的情况下的值为零,所述n个签名份额对应于第二多项式,所述第二多项式为d度多项式,其中d大于或者等于t。

[0007] A second aspect provides a multi-party signature method, including:

[0008] Obtaining signature shares of each of n signing parties, wherein a correct signature share among the n signature shares corresponding to the n signing parties is generated by the signing parties based on a threshold signature algorithm, and the n signing parties include t malicious parties;

[0009] In t <n / 3的情况中,基于第一多项式和所述n个签名份额计算所述n个签名份额对应的完整签名,所述第一多项式在任一签名方传输错误的签名份额的情况下的值为零,所述n个签名份额对应于第二多项式,所述第二多项式为d度多项式,其中d大于或者等于t。

[0010] A third aspect provides a multi-party signature system, the system comprising n signature devices,

[0011] Each of the n signature devices is configured to provide a signature share, wherein a correct signature share among the n signature shares corresponding to the n signature devices is generated by the signature device based on a threshold signature algorithm, and the n signature devices include t malicious devices;

[0012] In t <n / 3的情况中,所述n个签名设备中的至少一个签名设备用于基于第一多项式和所述n个签名份额计算所述n个签名份额对应的完整签名,所述第一多项式在任一签名方传输错误的签名份额的情况下的值为零,所述n个签名份额对应于第二多项式,所述第二多项式为d度多项式,其中d大于或者等于t。

[0013] A fourth aspect provides a multi-party signature device, including:

[0014] an acquiring unit, configured to acquire signature shares of each of n signing parties, wherein a correct signature share among the n signature shares corresponding to the n signing parties is generated by the signing parties based on a threshold signature algorithm, and the n signing parties include t malicious parties;

[0015] Computing unit for <n / 3的情况中,基于第一多项式和所述n个签名份额计算所述n个签名份额对应的完整签名,所述第一多项式在任一签名方传输错误的签名份额的情况下的值为零,所述n个签名份额对应于第二多项式,所述第二多项式为d度多项式,其中d大于或者等于t。

[0016] A fifth aspect provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the second aspect.

[0017] In a sixth aspect, a multi-party signature device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the second aspect is implemented.

[0018] The above solution provided by this application does not need to record the public key information of all signatories when multiple signatories perform threshold signing, which reduces the consumption of storage space, reduces the number of communication rounds, and improves system efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0020] Figure 1 A diagram of a blockchain architecture in one embodiment is shown;

[0021] Figure 2 This is a system architecture diagram in the embodiments of this specification;

[0022] Figure 3 is a flow chart of a secret sharing method in an embodiment of this specification;

[0023] Figure 4 A flowchart of the method for each signatory to generate a Schnorr signature share in the embodiments of this specification;

[0024] Figure 5 This is a flowchart of a secret reconstruction method according to an embodiment of this specification;

[0025] Figure 6 This is an architectural diagram of a multi-party signature device in an embodiment of this specification. DETAILED DESCRIPTION

[0026] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0027] Figure 1 FIG1 shows a block chain architecture diagram in an embodiment. Figure 1 In the blockchain architecture diagram shown, the blockchain includes N nodes. Figure 1 Nodes 1 through 8 are schematically shown. The lines connecting the nodes schematically represent P2P (peer-to-peer) connections, such as TCP connections, for transmitting data between nodes. These nodes can store the full ledger, i.e., the state of all blocks and all accounts. Each node in the blockchain can generate the same state by executing the same transactions, and each node in the blockchain can store the same state database.

[0028] A transaction in the blockchain field can refer to a task unit executed and recorded in the blockchain. A transaction typically includes a sender field (From), a receiver field (To), and a data field (Data). In the case of a transfer transaction, the From field indicates the address of the account initiating the transaction (i.e., initiating a transfer task to another account), the To field indicates the address of the account receiving the transaction (i.e., receiving the transfer), and the Data field includes the transfer amount.

[0029] Blockchains offer smart contract functionality. Smart contracts on blockchains are contracts that can be triggered and executed by transactions within the blockchain system. Smart contracts can be defined in code. Calling a smart contract on a blockchain involves initiating a transaction to the smart contract address, allowing each node in the blockchain to execute the smart contract code in a distributed manner.

[0030] In the scenario of deploying a contract, for example, Bob sends a transaction containing the information of creating a smart contract (ie deploying the contract) to Figure 1 In the blockchain shown, the transaction's data field contains the code (such as bytecode or machine code) for the contract to be created. The transaction's to field is empty, indicating that the transaction is for contract deployment. After the nodes reach consensus through the consensus mechanism, they determine the contract address "0x6f8ae93..." Each node adds a contract account corresponding to the smart contract's contract address to the state database, allocates state storage corresponding to the contract account, stores the contract code, and saves the hash of the contract code in the contract's state storage, successfully creating the contract.

[0031] In the scenario of calling a contract, for example, Bob sends a transaction for calling a smart contract to Figure 1 In the blockchain shown, the transaction's "from" field is the address of the transaction initiator (Bob), the "to" field is "0x6f8ae93..." (the address of the smart contract being called), and the transaction's "data" field contains the method and parameters for calling the smart contract. After consensus is reached on the blockchain, each node in the blockchain can execute the transaction, thereby executing the contract and updating the state database based on the contract's execution.

[0032] Every transaction sent to a blockchain includes a digital signature from the sender. Digital signatures are an authentication technology based on public-key cryptography. The signer encrypts a message with their private key to generate a signature, which the verifier decrypts using the signer's public key. Successful decryption validates the signature, proving the message is valid. Digital signature technology plays a crucial role in ensuring the authenticity and non-repudiation of information, and is therefore widely used in blockchain technology.

[0033] Multi-signature is an implementation of aggregate signature, which allows multiple participants to jointly perform the signature of a message m, each participant has their own private key and public key, and they can jointly construct a signature scheme to produce a single signature, which is consistent with the individual signature result of the original signature scheme, and can be verified by a consistent public key. Multi-signature based on secure multi-party computation greatly improves the efficiency of signature verification, and to some extent reduces the data storage on the blockchain.

[0034] Among them, the above signature scheme includes a threshold signature scheme, in which a total public key and n public-private key pairs are included. One public key in each public-private key pair is called a public key share, and one private key in each public-private key pair is called a private key share. Secondly, there is a corresponding recovery function for the total public key and n public-private key pairs. The recovery function can recover a complete signature from at least a threshold number of different private key shares signed by the signature shares. The generated complete signature can also be verified for correctness by the one total public key. Any less than the threshold number of signature shares cannot generate the complete signature.

[0035] The above threshold signature scheme includes, in addition to the threshold signature mechanism based on RSA, the threshold signature mechanism based on ECDSA (Elliptic Curve Digital Signature Algorithm), the threshold signature mechanism based on Schnorr (a knowledge proof mechanism based on the discrete logarithm problem), the threshold signature mechanism based on BLS (Boneh-Lynn-Shacham Signature), etc. In the embodiments of the present specification, the Schnorr threshold signature scheme will be described as an example. It can be understood that the embodiments of the present specification can also be applied to other types of threshold signature schemes.

[0036] First, introduce the Schnorr signature algorithm. Given a cyclic group G, g is a generator of the group G, and H is a hash function. First, generate a public-private key pair: (sk, pk), pk = g sk . In the signature phase, generate the signature s by formula (1):

[0037] s = r + cx (1)

[0038] Where c = H (pk, R, m). m is the message to be signed. r is a random number, R = g r , the signature output is (R, s).

[0039] In the signature verification phase, verify the signature s based on formula (2):

[0040] g s =R*pk c (2)

[0041] If the equation holds true, the signature verification is successful.

[0042] The linearity of Schnorr signatures provides excellent support for multi-party digital signatures. Multi-party digital signature schemes based on Schnorr signatures support key aggregation and can generate signatures that are consistent with the original Schnorr signatures.

[0043] Related threshold signature schemes have the following two main problems: 1) The public key of each participant is still required to recover the signature, which is not conducive to privacy protection and space storage. 2) For the distributed key generation stage, most related schemes adopt a commitment-based key distribution scheme. When the signer distributes the secret shared value to other signers, it also sends the commitment of each shared value to other signers, allowing other signers to verify that each shared value is correct based on the commitment. After the other signers verify the shared value, they need to broadcast the verification result to multiple signers. This related scheme faces the risk of tampering with the lowest bit of the key and has low communication efficiency.

[0044] The embodiments of this specification provide a Schnorr threshold signature scheme based on Shamir secret sharing, which can recover the correct aggregate signature without knowing the specific malicious party and ignoring the error messages sent by the malicious party. This means that there is no need to store the public key of each member to verify the signature share one by one, nor is there a need to store commitments to verify the shared value. Therefore, storage space can be greatly reduced and efficiency can be improved. In addition, this scheme does not require each participating party to verify each shared value, and there is no need to broadcast the verification results, thereby reducing the number of communication rounds between participating parties and improving the efficiency of key generation.

[0045] Figure 2 This is a system architecture diagram in the embodiment of this specification. Figure 2 As shown, the embodiment of this specification includes devices of n signing parties, Figure 2P1-P4 are used as examples. Each participant includes their own private key share and public key share, wherein the private key share is obtained based on the secret sharing algorithm in the example of this specification, and the secret sharing algorithm can ensure the generation of random Shamir shares. When each participant needs to sign the transaction Tx1 to be put on the chain, each signatory signs the transaction Tx1 based on their own private key share, obtains n signature shares, and can obtain the complete signature corresponding to the n signature shares and the verification data corresponding to the complete signature (such as the public key) based on the threshold signature algorithm in the embodiment of this specification. Afterwards, the n signatories can send the transaction Tx1, the above-mentioned complete signature and verification data to the blockchain for chaining. The verification data can be used in the blockchain to verify the complete signature without storing the public key shares of each signatory separately.

[0046] Figure 3 This is a flow chart of the secret sharing method in the embodiment of this specification. This method can be executed by n signatories participating in a multi-party signature. Assuming that the n signatories include at most t malicious parties, Figure 3 In, P i The range of i is from 1 to t+1, that is, the t+1 party among the n signing parties shares the secret among the n parties, thus ensuring that the shared value finally obtained by each party is a random number. In addition, P i where j ranges from 1 to n.

[0047] Specifically, Figure 3 As shown, first, at S310, each signing party P i Generate a random number z i , based on the random number z i Construct the polynomial f i , so that f i (0) = z i , generate the shared value f of each of n parties i (j) = z ij .

[0048] The signing party can construct the polynomial shown in formula (3):

[0049] f i (x) = z i +a i1 x+a i2 x 2 +…+a id x d (3)

[0050] The d-degree polynomial consists of a set of coefficients (z i , a i1 , a i2 ,…,a id) is uniquely determined, and this set of coefficients includes d+1 values. In this way, if it is known that the curve corresponding to the d-degree polynomial passes through d+1 different points on the plane, the coordinates of d+1 different points are obtained (x1, y1), (x2, y2), ..., (x d ,y d ),(x d+1 ,y d+1 ), we can get a (d+1)-variable linear equation system of d+1 equations, and from this equation system we can determine the d+1 coefficient z i , a i1 , a i2 ,…,a id The value of , and then determine the polynomial, and finally the secret data z can be obtained i The coordinates of the above d+1 different points are (x1, y1), (x2, y2),…, (x d ,y d ),(x d+1 ,y d+1 ) is the random number z i The secret shard (or secret shared value) of

[0051] Signing Party P i This allows x in the above coordinates to be i Equal to each signing party P j The corresponding label j, so that y i =f i (j) = z ij .

[0052] For example, assuming n=4, t=1, d=2, that is, there are 4 signers, including one malicious party, then any two signers can be selected from the 4 signers for secret sharing. Suppose signers P1 and P2 are selected for secret sharing respectively. Among them, signer P1 can generate a random number z1 and construct a polynomial f1(x)=z1+a based on z1. 11 x+a 12 x 2 , generate 4 shared values ​​z corresponding to P1-P4 respectively according to polynomial f1 11 、z 12 、z 13 and z 14 , where z 11 =f1(1),z 12 =f1(2),z 13 =f1(3),z 14 =f1(4).

[0053] Similarly, the signer P2 can generate a random number z2 and construct a polynomial f2(x)=z2+a based on z2. 21x+a 22 x 2 , generate 4 shared values ​​z corresponding to P1-P4 respectively according to polynomial f2 21 、z 22 、z 23 and z 24 , where z 21 =f2(1),z 22 =f2(2),z 23 =f2(3),z 24 =f2(4).

[0054] At S320, the signing party P i The shared value z of party j ij Send to party j.

[0055] Specifically, after the signing party P1 generates the above-mentioned shared value, it retains the shared value z 11 , will share the value z 12 、z 13 and z 14 After generating the above shared value, the signer P2 retains the shared value z 22 , will share the value z 21 、z 23 and z 24 Sent to signatories P1, P3 and P4 respectively.

[0056] At S330, the signing party P j Increase the shared value of t+1 signatories to get the shared value of random number Z

[0057] Specifically, by adding the above two polynomials f1(x) and f2(x), the polynomial F(x) shown in formula (4) can be obtained:

[0058] F(x)=f1(x)+f2(x)=(z1+z2)+(a 11 +a 21 )x+(a 12 +a 22 )x 2 (4)

[0059] Where, F(0)=Z=z1+z2, That is, by adding the polynomials f1(x) and f2(x), we can get the polynomial F(x) corresponding to the random number Z, whose shared value Z is j The signing party P1 and P2 can share the secret j Share value z 1j and z 2jAdded together to obtain.

[0060] Specifically, for the signer P1, the share value Z1=z 11 +z 21 ;

[0061] For the signing party P2, the share value Z2=z 12 +z 22 ;

[0062] For the signer P3, the share value Z3=z 13 +z 23 ;

[0063] For the signer P4, the share value Z4=z 14 +z 24 .

[0064] Any of the signing parties P1-P4 can recover the random number Z by obtaining other shared values ​​of Z from other parties.

[0065] In this embodiment, the random number Z is based on the random number z provided by t+1 signatories. i Since the t+1 signatories definitely include a trusted signer, the randomness of the random number Z can be guaranteed, preventing t malicious parties from knowing the random number Z, thereby ensuring the reliability of the threshold signature in the embodiment of this specification.

[0066] Figure 4 Flowchart of the method for each signatory to generate a Schnorr signature share in the embodiments of this specification. Figure 4 P in j and P k It can be any two signatories among the n signatories.

[0067] refer to Figure 4 At S401, the signing party P j Generate a random number x_sk j and x_r j .

[0068] Signing Party P j When generating random numbers x_sk j and x_r j Afterwards, the two random numbers are retained by the blockchain for subsequent calculation of the Schnorr signature share.

[0069] In S403, each signatory party Figure 3 The algorithm shown obtains the random number k_sk j Shared value and random number k_r j 's sharing value.

[0070] Random number k_sk j and random number k_r j Can be used as Figure 3 The random number Z in . Each signing party passes Figure 3 The method shown is to obtain the random number k_sk j Shared value and random number k_r j The shared value can ensure the random number k_sk j and random number k_r j randomness.

[0071] Specifically, the signatory P j Get the random number k_sk j Shared value (k_sk j ) j and random number k_r j Shared value (k_r j ) j , the signing party P k Get the random number k_sk j Shared value (k_sk j ) k and random number k_r j Share value (k_r j ) k .

[0072] At S405, the signing party P k The shared value (k_sk j ) k and shared value (k_r j ) k Sent to the signing party P j .

[0073] Among the n signing parties, except signing party P j All other signers will obtain the random number k_sk j Shared value and random number k_r j The shared value is sent to the signing party P j , so the signing party P j In S407, the random number k_sk j n shared values ​​and random number k_r j Reconstruct the n shared values ​​to get the random number k_sk j and random number k_r j .

[0074] In the embodiment of this specification, unlike the related solutions, the participants do not need to send the commitment data of each shared value to other participants, nor do they need to broadcast the verification results of the shared value based on the commitment.j n shared values ​​and random number k_r j The n shared values ​​cannot be guaranteed to be correct shared values. Therefore, in the embodiment of this specification, Figure 5 The secret reconstruction method shown is used to reconstruct the secret. Figure 5 The method shown may be executed by at least one of the n signing parties, or may be executed by a trusted third party, without limitation.

[0075] exist Figure 5 In the method shown, assume that the number of incorrect secret shares sent by the malicious party is e, e≤t, and the set of participants providing incorrect shares is E. Assume that the correct secret share is s i , the corresponding polynomial is F d (x), F d (i) = s i The secret share received during the secret reconstruction phase is s′ i , i=1,2,…,n.

[0076] refer to Figure 5 , when the number of malicious parties t is less than n / 3, an error polynomial is introduced into the method: E e (i) = 0 if and only if participant i transmits an erroneous result.

[0077]

[0078] Since when s′ i ≠s i When E e (i)=0, i=1,2,…,n, therefore, E e (x) satisfies the equation: s′ i E e (i) = E e (i)s i ,

[0079] According to this equation, the following formulas (6) and (7) can be obtained:

[0080] s′ i E e (i) = E e (i)s i =E e (i)F d (i) = Q q (i) = q q x q +q q-1 x q-1 +…+q0 (6)

[0081] s′i (e e-1 x e-1 +…+e0)-(q q x q +q q-1 x q-1 +…+q0)=-s′ i x e (7)

[0082] According to formula (6), q=e+d.

[0083] In S501, initially n secret shares s′ are i The number of incorrect secret sharing e in is set to e=t.

[0084] At S503 , a system of equations related to the error polynomials E(x) and Q(x) is solved.

[0085] Specifically, according to formula (7), n secret shares s′ i Substituting x=i, (i=1,2,…,n) into formula (7), we can obtain the equation system shown in formula (8):

[0086]

[0087] Solve the equations, that is, solve the polynomial coefficients e0, e1…e according to the equations (8) t-1 and q0, q1…q q-1 The value of .

[0088] In S505, it is determined whether the equation system in formula (8) has a solution. If there is no solution, then e=e-1, that is, e=t-1, and the n secret shares s′ are again i and x=i, (i=1,2,…,n) are substituted into formula (7) to obtain the polynomial coefficients e0, e1…e t-1 and q0, q1…q q-1 Solve. And so on, until the equation has a solution or e=0.

[0089] If the equation has a solution, execute S507 to calculate the polynomial F d (x) = Q q (x) / E e (x), then according to the polynomial F d (x) Recover the secret. In the case of e = 0, that is, n secret shares s' i Are all correct secret sharing, can be based on n secret sharing s ′ i Any d+1 secrets in the shared polynomial F can be recovered d (x).

[0090] The above calculation process can be proven to be safe.

[0091] Specifically, for t <n / 3,对于t个恶意方,Shamir秘密共享方案的多项式F d The degree of (x) is d. When d≥t, we can find a t such that d+2t <n,则可以找到一个集合 Such that |A|≥d+t+1, and there exists a polynomial f′(x) such that for all i∈A, s′ i =f′(i). The set A must exist, because at least the correct value of nt≥d+t+1 can be found to satisfy s′ i =f′(i), so the polynomial can be constructed by Lagrange interpolation. Then the secret is reconstructed: s=f′(0).

[0092] At the same time, the set |A| has at least the set (d+t+1)-t=d+1 values ​​of non-malicious parties, then the polynomials f′(x) and f(x) of degree d have at least d+1 overlapping points, so the two polynomials are consistent, and so the reconstructed secrets are also consistent.

[0093] Still refer to Figure 5 , at t <n / 2的情况下,在S509,确定根据n个秘密分享s′ i Can the corresponding polynomial be found (i.e. reconstructed)? If yes, in S511, the secret is recovered based on the reconstructed polynomial. If the result is no, the process ends and the process is repeated. Figure 4 The method shown.

[0094] This computation process can also be proven to be secure.

[0095] Specifically, for t <n / 2,对于t个恶意方,Shamir秘密共享方案的多项式度数为d,d≥t,则可以找到一个t,使得d+t<n,在能够重建多项式的情况下,至少有n-t≥d+1个非恶意方的值,则度数为d的多项式f′(x)和F d (x) If there are at least d+1 overlapping points, then the two polynomials are consistent, so the reconstructed secrets are also consistent.

[0096] Back to Figure 4 S407 in the signature party P j You can use random number k_sk j The n shared values ​​corresponding to the n signing parties are Figure 5 n secret shares s′ in the method shown i ,pass Figure 5 The method shown is to reconstruct the random number k_skj At the same time, the signing party P j You can use random number k_r j The n shared values ​​corresponding to the n signing parties are Figure 5 n secret shares s′ in the method shown i ,pass Figure 5 The method shown is used to reconstruct the random number k_r j .

[0097] At S409, the signing party P j Broadcast x_sk to all other signatories j -k_sk j and x_r j -k_r j .

[0098] Since the signer P j Broadcast the same data to other signatories, and other parties can confirm the signatory P by comparing with each other. j The consistency of data broadcast to all parties improves security.

[0099] At S411, the signing party P k According to x_sk j -k_sk j and (k_sk j ) k Calculate the signature party P k The private key share sk k In the signing party P j The corresponding private key component sk kj .

[0100] Specifically, sk kj =x_sk j -k_sk j +(k_sk j ) k (9)

[0101] In S413, according to x_r j -k_r j and (k_r j ) k Calculate the random number share and P j The random number component r corresponding to the square kj .

[0102] Specifically, r kj =x_r j -k_r j +(k_r j ) k (10)

[0103] At S415, P is generated based on the private key components of each of the n parties. k Party's private key share sk k , based on the random number components of each of the n parties, generate P k Party A's secret random number share r k .

[0104] Specifically,

[0105]

[0106]

[0107] According to formula (11), sk k is a shared value of the polynomial G(x), where the polynomial G(x) is a shared value for each (k_sk j ) k The sum F(x) of the corresponding n polynomials f(x) is In this embodiment, by (k_sk j ) k The random number x_sk provided by each signing party j Blinding is performed to improve security and ensure the randomness of each private key component. Similarly, according to formula (12), by (k_r j ) k The random number x_r provided by each signing party j Blinded treatment was performed.

[0108] At S417, the signing party P k The public key PK and random number R are reconstructed based on the public key shares and random number shares of each party, and the challenge value c is generated based on the public key PK, random number R and transaction Tx1.

[0109] Signing Party P k First, the signature square P can be generated by the following formula (13): k The public key share pk k :

[0110] pk k =sk k ·G (13)

[0111] Where G is the base point in the preset elliptic curve.

[0112] Afterwards, the signatory P k The signature P can be generated by the following formula (14): k The random number share R k :

[0113] R k =rk ·G (14)

[0114] After the n signatories have calculated their own public key shares and random number shares, they can broadcast their public key shares and random number shares to other signatories, so that each signatory can Figure 5 The method shown reconstructs the polynomial f based on n public key shares PK (x), and obtain the public key PK=f according to the polynomial PK (0), and the polynomial f can be reconstructed based on n random number shares R (x), and obtain a random number (public random number) R=f according to the polynomial R (0).

[0115] Afterwards, each participant can calculate the challenge value in the Schnorr threshold signature: c = H(PK, R, m), where m is the message to be signed, which is the transaction information to be signed together.

[0116] At S419, the signing party P k Based on the private key share sk k , secret random number share r k And the challenge value c generates the signature share.

[0117] Specifically, the signature square P can be generated based on the following formula (15): k The signature share s k :

[0118] s k = r k +c*sk k (15)

[0119] Each signatory passes Figure 4 The method shown gets its own signature share s i Then, from formula (15), we can see that due to r k and sk k are respectively a secret Shamir shared value. Due to the additive homomorphism of Shamir secret sharing, s k It is also a secret Shamir shared value, and the secret, that is, the total signature, can also be recovered through the secret reconstruction method.

[0120] Specifically, a signing party (for example, signing party P1) can be selected to perform signature reconstruction. The signing parties other than signing party P1 among the n signing parties will use their own signature shares s i Sent to the signing party P1, the signing party P1 Figure 5 The method shown recovers n signature shares s i The corresponding total signature S.

[0121] Specifically, reference Figure 5 , at t <n / 3的情况中,签名方P1基于公式(7)和所述n个签名份额计算所述n个签名份额对应的完整签名。设所述n个签名的份额中的错误签名份额的个数为e,其中e的值取值为0至t中的一个数,基于所述n个签名份额求解多项式E(x)和多项式Q(x)的系数,在求解出所述系数的情况中,基于多项式E(x)和多项式Q(x)获得多项式F d (x).

[0122] In t <n / 2的情况中,所述n个签名方中的至少一方基于所述n个签名份额确定是否能够重建与所述n个签名份额对应的多项式,在能够重建的情况中,基于该重建的多项式获得所述n个签名份额对应的完整签名。

[0123] Afterwards, the signatory P1 can send the total signature to each other signatory for verification. Each other signatory can verify the total signature S using the public key PK and the random number R according to the above formula (1). If each other signatory passes the verification, the signatory P1 can Figure 2 As shown, the transaction Tx1, signature S, public key PK and random number R are sent to the blockchain for verification of signature S.

[0124] In this way, the signer P1 does not need to store the public key shares of each other signer for verifying each signature share separately, which saves storage resources. At the same time, the signers do not need to send the verification results of the signature shares to each other, which reduces the number of communication rounds and improves efficiency.

[0125] Figure 6 This is a diagram of the architecture of a multi-party signature device in an embodiment of this specification. The multi-party signature device is used to perform the following Figure 3-Figure 5 The method shown comprises:

[0126] an acquisition unit 61 configured to acquire signature shares of n signatories, wherein a correct signature share among the n signature shares corresponding to the n signatories is generated by signing the signature share using the signer's private key share based on a threshold signature algorithm, and the n signatories include t malicious parties;

[0127] The calculation unit 62 is used to calculate the <n / 3的情况中,基于第一多项式和所述n个签名份额计算所述n个签名份额对应的完整签名,所述第一多项式在任一签名方传输错误的签名份额的情况下的值为零,所述n个签名份额对应于第二多项式,所述第二多项式为d度多项式,其中d大于或者等于t。

[0128] The embodiment of this specification also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the following Figure 3-Figure 5 The method shown.

[0129] The embodiment of this specification also provides a multi-party signature device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the following is achieved: Figure 3-Figure 5 The method shown.

[0130] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0131] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0132] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0133] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0134] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0135] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0138] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0139] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0140] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0141] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0143] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0144] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A multi-party signature method, the method comprising: Each of the n signers provides a signature share, wherein the correct signature share among the n signature shares corresponding to the n signers is generated by the signers based on a threshold signature algorithm, and the n signers include t malicious parties; In the case where t < n / 3, let the number of incorrect signature shares among the n signature shares be e, where the value of e ranges from 0 to a number among t. Based on the n signature shares, the coefficients of a first polynomial and a sixth polynomial are solved. The sixth polynomial is the product of the first polynomial and a second polynomial. In the case where the coefficients are solved, the second polynomial is obtained based on the first polynomial and the sixth polynomial. The complete signature corresponding to the n signature shares is determined based on the coefficients of the second polynomial. The value of the first polynomial is zero in the case where any signer transmits an incorrect signature share. The n signature shares correspond to n shards obtained based on the second polynomial. The second polynomial is a polynomial of degree d, where d is greater than or equal to t. The constant term of the second polynomial is the complete signature. The public key corresponding to the complete signature is calculated based on the public key shares of the n signers respectively.

2. The method according to claim 1, wherein the n signature shares are generated by each of the n signers signing a first transaction in a blockchain. At least one of the n signers calculating the complete signature corresponding to the n signature shares based on the first polynomial and the n signature shares comprises: The first signer among the n signers receives the signature shares from each of the other second signers respectively, calculates the complete signature corresponding to the n signature shares based on the first polynomial and the n signature shares, and sends the complete signature to each of the second signers; Each of the second signers respectively verifies the complete signature using the public key; The method further comprises: After each of the second signers verifies successfully, the first signer sends the first transaction, the complete signature, and the public key to the blockchain.

3. The method according to claim 2, wherein the threshold signature algorithm comprises the Schnorr threshold signature algorithm, and the method further comprises: The n signers respectively generate n first secret sharing values corresponding to a third signer, and send the n first secret sharing values to the third signer; The third signer obtains a first secret value based on the n first secret sharing values, and sends the first difference between the second secret value generated by itself and the first secret value to each of the other fourth signers among the n signers; Any one of the fourth signers calculates a private key component corresponding to the third signer based on the first difference and the first secret sharing value generated by this fourth signer; Any one of the fourth signers obtains the private key share of this fourth signer based on the private key components corresponding to the n signers respectively.

4. The method according to claim 3, wherein the third signer obtaining the first secret value based on the n first secret sharing values comprises: In the case of t < n / 3, the third signatory calculates a first secret value based on a third polynomial and the n first secret sharing values, where the value of the third polynomial is zero in the case where any signatory transmits an incorrect first secret sharing value, the n first secret sharing values correspond to a fourth polynomial, and the fourth polynomial is a polynomial of degree d, where d is greater than or equal to t; In the case of t < n / 2, the third signatory determines whether it is possible to reconstruct a fifth polynomial corresponding to the n first secret sharing values based on the n first secret sharing values, and in the case where reconstruction is possible, obtains a first secret value corresponding to the n first secret sharing values based on the fifth polynomial.

5. The method according to claim 3, further comprising: The n signatories respectively generate n second secret sharing values corresponding to the third signatory, and send the n second secret sharing values to the third signatory; The third signatory obtains a third secret value based on the n second secret sharing values, and sends a second difference between the fourth secret value generated by itself and the third secret value to each of the other fourth signatories among the n signatories; Any one of the fourth signatories calculates a secret random number component corresponding to the third signatory based on the second difference and the second secret sharing value generated by the fourth signatory; Any one of the fourth signatories obtains a secret random number share of the fourth signatory based on the secret random number components corresponding to the n signatories respectively.

6. The method according to claim 5, further comprising: Any one of the fourth signatories receives from other parties public key shares corresponding to the private key shares of each party, and public random number shares corresponding to the secret random number shares of each party; Reconstruct a public key based on the public key shares of the n signatories respectively, and reconstruct a public random number based on the public random number shares of the n signatories respectively; Calculate a signature share of the fourth signatory based on the public key, the public random number, the first transaction, and the private key share and the secret random number share of the fourth signatory.

7. The method according to claim 3, wherein the n signatories respectively generate n first secret sharing values corresponding to the third signatory includes: Each of the t + 1 parties among the n signatories randomly selects a first random number; Generates n first sharing values of the first random number according to a secret sharing algorithm, keeps one copy for itself, and sends the other n - 1 first sharing values to the other n - 1 parties respectively; Each of the n signatories calculates its own first secret sharing value based on the obtained t + 1 first sharing values, where the t + 1 first sharing values respectively correspond to the t + 1 first random numbers of the t + 1 parties.

8. The method according to claim 1, further comprising: In the case of t < n / 2, at least one of the n signatories determines whether it is possible to reconstruct a seventh polynomial corresponding to the n signature shares based on the n signature shares, and in the case where reconstruction is possible, obtains a complete signature corresponding to the n signature shares based on the seventh polynomial.

9. A multi-party signature method, comprising: Obtain the signature shares of each of the n signers, where the correct signature shares among the n signature shares corresponding to the n signers are generated by the signers based on a threshold signature algorithm, and the n signers include t malicious parties; In the case of t < n / 3, let the number of incorrect signature shares among the n signature shares be e, where the value of e ranges from 0 to a number among t. Solve the coefficients of the first polynomial and the sixth polynomial based on the n signature shares. The sixth polynomial is the product of the first polynomial and the second polynomial. In the case where the coefficients are solved, obtain the second polynomial based on the first polynomial and the sixth polynomial, determine the complete signature corresponding to the n signature shares based on the coefficients of the second polynomial. The value of the first polynomial is zero in the case where any signer transmits an incorrect signature share. The n signature shares correspond to n shards obtained based on the second polynomial. The second polynomial is a polynomial of degree d, where d is greater than or equal to t. The constant term of the second polynomial is the complete signature, and the public key corresponding to the complete signature is calculated based on the public key shares of the n signers respectively.

10. The method according to claim 9, wherein the n signature shares are generated by each signer signing a first transaction in a blockchain, and the method further comprises: Send the complete signature to each signer so that each signer respectively uses the public key to verify the complete signature, After each signer verifies and passes, send the first transaction, the complete signature, and the public key to the blockchain.

11. A multi-party signature system, the system comprising n signature devices, Each of the n signature devices is used to provide a signature share, wherein, The correct signature shares among the n signature shares corresponding to the n signature devices are generated by the signature devices based on a threshold signature algorithm, and the n signature devices include t malicious devices; In the case of t < n / 3, let the number of incorrect signature shares among the n signature shares be e, where the value of e ranges from 0 to a number among t. Solve the coefficients of the first polynomial and the sixth polynomial based on the n signature shares. The sixth polynomial is the product of the first polynomial and the second polynomial. In the case where the coefficients are solved, obtain the second polynomial based on the first polynomial and the sixth polynomial, determine the complete signature corresponding to the n signature shares based on the coefficients of the second polynomial. The value of the first polynomial is zero in the case where any signature device transmits an incorrect signature share. The n signature shares correspond to n shards obtained based on the second polynomial. The second polynomial is a polynomial of degree d, where d is greater than or equal to t. The constant term of the second polynomial is the complete signature, and the public key corresponding to the complete signature is calculated based on the public key shares of the n signature devices respectively.

12. A multi-party signature device, comprising: An acquisition unit, configured to acquire the signature shares of n signers respectively, where the correct signature shares among the n signature shares corresponding to the n signers are generated by the signers based on a threshold signature algorithm, and the n signers include t malicious parties; A calculation unit, configured to, in the case of t < n / 3, set the number of incorrect signature shares among the n signature shares as e, where the value of e ranges from 0 to a number in t, solve the coefficients of a first polynomial and a sixth polynomial based on the n signature shares, the sixth polynomial being the product of the first polynomial and a second polynomial, in the case of solving the coefficients, obtain the second polynomial based on the first polynomial and the sixth polynomial, determine the complete signature corresponding to the n signature shares based on the coefficients of the second polynomial, the value of the first polynomial being zero in the case where any signer transmits an incorrect signature share, the n signature shares corresponding to n shards obtained based on the second polynomial, the second polynomial being a polynomial of degree d, where d is greater than or equal to t, the constant term of the second polynomial being the complete signature, and the public key corresponding to the complete signature being calculated based on the public key shares of the n signers respectively.

13. A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed on a computer, the computer is made to execute the method according to claim 9 or 10.

14. A multi-party signature device, including a memory and a processor, where an executable code is stored in the memory, and when the processor executes the executable code, the method according to claim 9 or 10 is implemented.

Images