A distributed SM2 adapter signature method and system

Abstract

The present invention belongs to the field of cryptographic technology, and provides a distributed SM2 adapter signature method and system. The SM2 adapter signature method includes that in the off-chain stage, each participant generates a pre-signature value for the information to be transmitted in a distributed manner, and verifies the correctness of the pre-signature value according to the pre-signature verification algorithm, and then based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameter, and a complete signature value is adapted; in the on-chain stage, each participant publishes the complete signature value for the information to be transmitted.

Description

Technical Field

[0001] The present invention belongs to the field of cryptographic technology, and in particular relates to a distributed SM2 adapter signature method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Adapter signature, also known as scriptless script, is an important cryptographic technology to solve the problems of poor scalability and low throughput in blockchain applications. For adapter signature, the signer can use the signature private key to pre-sign the message according to the instance of the difficult relationship to generate a pre-signature value. The pre-signature value can be adapted to the complete signature value by the evidence of the difficult relationship, and the evidence of the difficult relationship can be extracted through the pre-signature value and the complete signature value.

[0004] In blockchain applications, adapter signatures can provide atomic exchange functions to achieve cross-chain fair exchange of currencies (c0 and c1) between two parties (U0 and U1), as follows: Figure 1 As shown. First, the two parties need to use a time-lock to limit the currency to be exchanged. The exchange party U0 (the party generating the difficult relationship) generates the difficult relationship GenR (1 λ )→(Y,y), generate a pre-signature for the exchange transaction tx0 (i.e., U0 to U1 to c0) based on instance Y Sent to the exchange party U1, U1 verifies After the correctness is verified, the exchange transaction tx1 (i.e., U1 to U0 to c1) is pre-signed according to instance Y, and the pre-signed value Return; U0 verification The correctness of the pre-signed value is Adapted to the complete signature value σ1, publishing σ1 on the chain can obtain the exchange currency c0; U1 is based on and σ1 can extract evidence y, and Adapting to the complete signature value σ0, announcing σ0 on the chain can obtain the exchanged currency c0, completing a fair exchange between the two parties. Compared with the atomic exchange protocol constructed based on the hash time-lock contracts technology, the generation, transmission and verification of the pre-signature of the adapter signature are all completed off-chain, avoiding the limitation of supporting the same hash preimage conditioned scripts on the chain, and reducing the storage and verification costs on the chain.

[0005] At present, adapter signatures are mainly constructed based on Schnorr signatures, ECDSA signatures, and lattice signatures. There are few studies on adapter signatures based on SM2, which limits the promotion and application of SM2 algorithm in blockchain scenarios. In addition, the inventors found that in the pre-signing stage of existing adapter signatures based on ECDSA or SM2, the signer needs to use random values ​​or signature private keys as evidence to calculate pre-signature public parameters and corresponding zero-knowledge proofs, which is difficult to expand in a distributed manner on the one hand; on the other hand, in the case of multiple participants, such as (batch) atomic swaps or multi-hop payment scenarios, the number of zero-knowledge proofs is linearly related to the number of participants, which is not efficient in specific applications. Summary of the invention

[0006] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a distributed SM2 adapter signature method and system, which can design a safe, efficient and easily distributed SM2 adapter signature based on the SM2 signature.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] A first aspect of the present invention provides a distributed SM2 adapter signing method.

[0009] A distributed SM2 adapter signing method, comprising:

[0010] In the off-chain stage, each participant will generate a pre-signature value for the information to be transmitted in a distributed manner, and verify the correctness of the pre-signature value according to the pre-signature verification algorithm. Then, based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameters, and the complete signature value is adapted;

[0011] In the on-chain stage, each participant publishes the complete signature value for the information to be transmitted.

[0012] As an implementation method, in the off-chain stage, in the process of each participant generating and verifying the pre-signature value, the SM2 adapter signature is distributedly extended based on the SM2 collaborative signature to construct a distributed SM2 adapter signature.

[0013] As an implementation, a random point in the SM2 adapter signature Among them, k is a random number, G is a group The base point, is the elliptic curve group of order n, and Z is the public parameter of the pre-signature algorithm.

[0014] As an implementation method, in the off-chain stage, the difficult relationship generator generates all pre-signed public parameters and corresponding zero-knowledge proofs in batches offline.

[0015] As an implementation method, according to the structure of the pre-signed public parameters, each participant has a signature private key to directly calculate the pre-signed public parameters.

[0016] As an implementation method, the pre-signed public parameter Z i The structure is Z i =y(X i + G) = (x i +1)Y; where x i is the signature private key, X i is the signature public key, y is the evidence, and G is the group The base point, is the elliptic curve group of order n, and Y represents a point on the elliptic curve.

[0017] As an implementation method, in a two-party SM2 adapter signature, the two parties respectively select a corresponding random value as a share of the SM2 signature private key, each selects a random value as a share of the random value in the pre-signature value, and then jointly generate the pre-signature value.

[0018] A second aspect of the present invention provides a distributed SM2 adapter signature system.

[0019] A distributed SM2 adapter signature system, comprising:

[0020] The complete signature value adaptation module is used for: each participant generates a pre-signature value for the information to be transmitted in a distributed manner, and verifies the correctness of the pre-signature value according to the pre-signature verification algorithm. Then, based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameters, and the complete signature value is adapted;

[0021] The complete signature value publishing module is used for: each participant to publish the complete signature value for the information to be transmitted.

[0022] As an implementation mode, in the complete signature value adaptation module, in the process of each participant generating and verifying the pre-signature value, the SM2 adapter signature is distributedly extended based on the SM2 collaborative signature to construct a distributed SM2 adapter signature.

[0023] As an implementation mode, in the complete signature value adaptation module, according to the structure of the pre-signature public parameters, each participant has a signature private key to directly calculate the pre-signature public parameters.

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] The distributed SM2 adapter signature method and system proposed in the present invention are more suitable for batch atomic exchange protocols, and take into account the special verification scenarios of adapter signatures, that is, the pre-signature value only needs to be verified by the protocol participants, thereby improving the signature efficiency.

[0026] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0028] Figure 1 It is an atomic swap protocol based on adapter signatures;

[0029] Figure 2 It is the SM2 adapter signature;

[0030] Figure 3(a) is a comparison of the efficiency of pre-signature algorithms;

[0031] Figure 3(b) is a comparison of the efficiency of the verification algorithms;

[0032] Figure 4 It is a batch atomic swap protocol based on SM2 adapter signatures. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0034] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0035] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0036] Based on the SM2 signature algorithm structure, the present invention uses the evidence of the difficulty relationship as the evidence to link the SM2 signature verification public key and the pre-signed public parameters, and constructs a secure and efficient adapter signature scheme (SM2-AS). The scheme can generate all pre-signed public parameters and corresponding zero-knowledge proofs in batches offline by the difficulty relationship generator. In particular, considering the specific pre-signature verification scenario, the SM2-AS proposed in the present invention can further omit the zero-knowledge proof of this part, which is more secure than the existing ECDSA adapter signature (ECDSA-AS k ) and SM2 Adapter Signature (SM-AS x ) The generation and verification of pre-signatures are more efficient, and the size of pre-signature values ​​is smaller. Thanks to the avoidance of zero-knowledge proof in the pre-signature stage, the pre-signature operation of SM2-AS is similar to the SM2 signature algorithm. SM2-AS can be distributedly extended based on the existing SM2 collaborative signature to construct a distributed SM2 adapter signature. This distributed solution can effectively avoid single point failures in the application system and improve the security of the signature private key. Finally, in view of the problem that the existing atomic exchange protocol is difficult to efficiently apply to one-to-many application scenarios, the present invention proposes a batch atomic exchange protocol and provides a safe and efficient construction based on SM2-AS.

[0037] Symbol definition:

[0038] In the present invention, represents the set of natural numbers, for any The symbol [1,n] represents the set {1,…,n}. For any finite set S, s←S means selecting an element s uniformly randomly from S.

[0039] SM2 Adapter Signature:

[0040] Let (X, x) be the SM2 signature public-private key pair, is the elliptic curve group of order n, G is the group The signing party runs the difficult relation generation algorithm to generate the difficult relations and And keep the evidence secretly, making the relationship difficult in and They represent the proof and verification algorithms in non-interactive zero-knowledge proof of knowledge (NIZKPoK) with linear evidence extraction. Y It represents a proof given using zero-knowledge proof technology. The verifier can verify the proof and believe that the prover has y such that Y=yG holds.

[0041] Difficult relationship Among them, Z is the public parameter of the pre-signature algorithm, and Respectively represent the proof and verification algorithms in non-interactive zero-knowledge proof (NIZK). Z It represents a proof given using zero-knowledge proof technology. The verifier can verify the proof and believe that the prover has y such that Y=yG and ZY=yX both hold.

[0042] The SM2 adapter signature SM2-AS is constructed as follows, see Figure 2 : The pre-signature algorithm inputs the signature private key x, the message value m and the instance Calculate the hash value of the message e = H (m), select a random number calculate r=e+r x mod n, Finally output the pre-signed value

[0043] The algorithm of this part is similar to the SM2 standard signature algorithm, where m is the message, H is the hash function, and k is Random numbers on the group, Indicates calculating the point multiplication kG and point + Z on the elliptic curve to obtain the point Points on the elliptic curve can be represented by horizontal and vertical coordinates (r x ,r y ), Indicates the selection point The horizontal coordinate of r = e + r x mod n and express Operations on groups, They are respectively the values ​​on the finite field and the pre-signed values.

[0044] · Pre-signature verification algorithm input verification public key X, message m, instance And the pre-signed value Calculate the message hash value e = H (m), If r′=r, the algorithm outputs 1 to indicate successful verification, otherwise it outputs 0 to indicate failed verification.

[0045] · Adaptation algorithm input pre-signature value and evidence y, calculate And output the signature value σ=(r,s).

[0046] · Evidence extraction algorithm input signature value σ, pre-signature value and examples calculate if and Output y, otherwise output ⊥.

[0047] Pre-signature special verification scenario:

[0048] According to the application of adapter signature on the blockchain, such as Figure 1 In the atomic exchange protocol shown in the figure, the adapter signature can be divided into two stages: on-chain and off-chain. In the off-chain stage, each participant generates and verifies the pre-signed value and adapts the complete signature value; then, the complete signature value is published on the chain. Therefore, the verification of the pre-signed value does not require verification by everyone (such as miners on the chain), but only verification by the protocol participants. For this special verification scenario, the SM2-AS proposed in the present invention can be further optimized: according to the structure Z of the pre-signed public parameters i =y(X i + G) = (x i +1)Y, each participant U i Possess the signature private key x i Z can be directly calculated i =(x i +1) Y, no additional zero-knowledge proof is required Verify Z i Therefore, SM2-AS can remove the additional difficult relationship Difficulty relationship generator uses (y,X i ) Calculate the pre-signed public parameter Z i =y(X i +G), other participants use (x i ,Y) Calculate the pre-signed public parameter Z i =(x i +1)Y.

[0049] Distributed SM2 adapter signature:

[0050] According to the structure of SM2-AS, the pre-signature operation of SM2-AS is similar to the SM2 signature operation, except for the difference in the step of calculating the random point: in SM2 signature, the random point K = kG, while in SM2 adapter signature, the random point Therefore, the distributed extension of the SM2 adapter signature algorithm is similar to the construction of the distributed SM2 signature. It only needs to transform the collaborative calculation kG in the original distributed SM2 signature into the calculation kG+Z in the process of collaboratively calculating random points. Because the difficult instance Z is publicly verifiable information, each participant can use the SM2 collaborative signature process to calculate kG and then add Z. In particular, this conversion has no structural requirements for the underlying distributed SM2 signature algorithm. Therefore, the distributed SM2 adapter signature can be constructed based on any distributed SM2 signature.

[0051] The method of constructing a distributed SM2 adapter signature based on other SM2 collaborative signatures is similar. First, consider the two-party scenario, design the two-party SM2 adapter signature based on the two-party SM2 signature, and then expand the two-party scenario to the threshold scenario based on the threshold secret sharing technology.

[0052] In the two-party SM2 adapter signature, participants U1 and U2 select random values ​​x1 and x2 as the shares of the SM2 signature private key x, select random values ​​k1 and k2 as the shares of the random value k, and then jointly generate the pre-signed value where x = x1 + x2 mod n, k = k1 + k2 mod n, r = H(m) + r x mod n,(r x ,r y )=kG+Z. The pre-signature algorithm of the adapter signature is constructed as follows:

[0053] 1. Participant U1 has share k1, and participant U2 has share k2. Both parties disclose k1G and k2G respectively, and can calculate (r x ,r y )=k1G+k2G+Z=kG+Z,r=H(m)+r x mod n;

[0054] 2. Both parties calculate the shares of (1+x) and (kr·x) respectively [(1+x)]1, [(kr·x)]1 and [(1+x)]2, [(kr·x)]2, where [(1+x)]1+[(1+x)]2=1+x, [(kr·x)]1+[(kr·x)]2=kr·x. Then, using [(1+x)]1, [(1+x)]2 as input, the collaborative inversion protocol is run to obtain (1+x) and (kr·x) respectively. -1 Share [(1+x) -1 ]1 and [(1+x) -1 ]2, that is (1+x) -1 =[(1+x) -1 ]1+[(1+x) -1 ]2.

[0055] 3.U1 input [(1+x) -1 ]1 and [(kr·x)]1, U2 input [(1+x) -1 ]2,[(kr·x)]2, run the collaborative multiplication protocol and obtain the pre-signature Share and That is, both parties publish the pre-signature to share and can collaboratively generate the pre-signature

[0056] Among them, the collaborative inversion operation and collaborative multiplication operation protocols can be referenced. According to the above construction, the difference between the construction of the two-party SM2 adapter signature and the two-party SM2 signature is only the difference in the calculation of the random point in step 1 of the pre-signature algorithm. That is, the collaborative calculation of kG is transformed into the calculation of kG+Z. Because the difficult instance Z is publicly verifiable, the transformation of this step does not affect the security and scalability of the specific protocol. Therefore, the two-party SM2 adapter signature can be based on the optimization idea and threshold expansion method of the two-party SM2 signature algorithm to give a more efficient implementation and thresholded construction.

[0057] Performance Analysis:

[0058] The present invention improves the SM2-AS scheme, ECDSA-AS scheme and the communication cost in terms of computational efficiency and communication cost. k Scheme and SM-AS x The specific results can be seen in Table 1. When comparing the computational efficiency, the complex point multiplication operation is mainly considered, and other simpler operations, such as point addition, are ignored. Moreno-Sanchez et al. proposed the first ECDSA-AS construction but did not provide a security proof. Subsequently, Aumayr et al. proposed a self-proving structure based on it. And give the provably secure ECDSA-AS k However, the above ECDSA-AS k and SM-AS x In the pre-signing process, the pre-signed public parameters and the corresponding zero-knowledge proof are generated based on the pre-signed random number / signed private key, which requires 4 point multiplication operations; the pre-signed verification also requires the verification of the zero-knowledge proof, which requires 6 point multiplication operations. In addition, the pre-signed value also needs to include the pre-signed public parameters and the corresponding zero-knowledge proof, which requires 4 Group elements and 1 group The point in .

[0059] Table 1. Comparison of communication cost and computational efficiency

[0060]

[0061] in, represents the size of a point on an elliptic curve, express The size of the group element, Exp represents the point multiplication operation on the elliptic curve, and ? represents unknown.

[0062] Experimental analysis:

[0063] In order to ensure provable security, the present invention uses a self-proving structure Construct SM2 adapter signature, combine the structure of SM2 signature, and add difficulty relationship Despite the additional difficulties It will increase the computational effort of the difficulty relationship generator, but this operation can be generated offline in batches by the difficulty relationship generator and does not affect the online pre-signature operation. SM2-AS can avoid the generation of pre-signature public parameters and corresponding zero-knowledge proofs by each participant during the pre-signature process, greatly improving the pre-signature generation, transmission and verification time. The pre-signature operation of SM2-AS is similar to the SM2 signature operation, which only requires one point multiplication operation, and the pre-signature verification only requires two point multiplication operations; the pre-signature value only contains 2 Group elements.

[0064] In order to evaluate the actual performance of the adapter signature scheme, the present invention implements SM2-AS and ECDSA-AS on the standard elliptic curve NIST curve NID.X9.62.prime256v1 based on the OpenSSL library. k and SM-AS x .The execution environment is: Intel Core i5 CPU 2.3GHz, 8GB RAM, macOS High Sierra 10.13.3system.

[0065] The present invention mainly compares the computational efficiency of the pre-signature algorithm and the pre-signature verification algorithm, as shown in Figure 3(a) and Figure 3(b). By running the program of each scheme 1000 times, it is found that ECDSA-AS k ,SM-AS x The average single-time pre-signature operation time of SM2-AS and SM2-AS is 166.54μs, 176.27μs, and 37.43μs respectively; the average single-time pre-signature verification operation time is 252.86μs, 238.46μs, and 70.76μs respectively. The pre-signature calculation time of SM2-AS is about 1.5 times that of ECDSA-AS. k and SM-AS x 1 / 4 of the time of ECDSA-AS k and SM-AS xThe experimental results are consistent with the above theoretical analysis.

[0066] Batch Atomic Swap Protocol:

[0067] The atomic swap protocol can fairly realize the exchange between different cryptocurrencies without a trusted third party, that is, users U0 and U1 can fairly exchange different cryptocurrencies c0 and c1 across chains, where fairness is reflected in whether both parties complete the exchange or both parties fail to exchange. Initially, the atomic swap protocol was designed based on hash functions and time locks, which can realize the function of extracting currency only with the preimage of the hash function, but this method has restrictions on the underlying blockchain script structure and requires that the script language of the cryptocurrency support hash preimage conditional scripts. Subsequently, Poelstra used difficult relations (embedded signature algorithms) instead of hash conditions to construct an atomic swap protocol based on adapter signatures, avoiding blockchain script restrictions and reducing on-chain storage and verification operations. The specific protocol introduction is as follows. Figure 1 shown.

[0068] At present, the atomic exchange protocol mainly focuses on the realization of the function of fair exchange between two parties. However, in application scenarios with large transaction volumes, such as exchange scenarios, it is necessary to exchange with multiple users in batches at the same time, or a single participant exchanges with multiple accounts (addresses) at the same time. The efficiency of the atomic exchange protocol between the two parties is low. Therefore, based on the one-to-one atomic exchange protocol, the present invention considers a batch atomic exchange protocol. This protocol can realize the batch atomic exchange of one party U0 to multiple parties U i , i∈[1,n] simultaneously conducts cross-chain currency exchange, that is, the initiator U0 (difficult relationship generator) sends multiple participants U i Transfer Currencyc 0i , and each participant U i Transfer currency c to U0 i0 First, U0 and U i First, use the time lock to bind the currency to be exchanged, leaving enough time to complete the exchange. U0 generates the SM2 signature public and private key pair (X0, x0), and transmits the public key X0 to U i , secretly save the signature private key x0; U i Generate SM2 signature public and private key pair (X i ,x i ), the public key X i Transmit to U0, keep signature private key x secret i The protocol is constructed as follows. Figure 4 Shown:

[0069] · Protocol establishment phase: U0 runs the difficulty relationship generation algorithm to generate two difficulty relationships and in Generate about transfer currency c 0i Give U i Transaction tx 0i Pre-signed Difficulty instance, pre-signature value and transaction information Send to U i , keep evidence y secret; U i Verifiable Examples and the pre-signed value That is, if or The transaction is rejected; otherwise, the pre-signed public parameter Z is calculated i =(x i +1)Y, and generate the transfer currency c i0 Transaction tx to U0 i0 Pre-signed The pre-signed value and transaction information Send to U0;

[0070] Exchange phase: U0 can use the evidence y of the difficult relationship and the public key X of the corresponding participant i Generate pre-signed public parameter Z i =y(X i +G), i∈[1,n], and verify the correctness of the pre-signed value if Then reject the transaction, otherwise run the adaptation algorithm based on evidence y Will U i The pre-signature of is adapted to the SM2 signature, that is, U i Transfer Currencyc i0 Give U0 the SM2 signature value σ i0 , publish σ on the chain i0 Available c i0 ; U i Get the signature value v i0 , running the extraction algorithm can calculate the evidence And through the adaptation algorithm Calculate U0 transfer currency c 0i Give U i The SM2 signature value σ 0i , publish σ on the chain 0i Get c 0i , completing a fair exchange.

[0071] Compared with ECDSA-AS k and SM-AS x, the SM2-AS proposed in this invention is more suitable for batch atomic exchange protocols. Consider the special verification scenario of the adapter signature, that is, the pre-signed value only needs to be verified by the protocol participants. Difficulty relationship generator U0 and other participants U i ,i∈[1,n] can generate the pre-signed public parameter Z i =y(X i + G) = (x i +1)Y, no need to use zero-knowledge proof for verification. Therefore, each participant U i The pre-signature generation operation is more efficient, U0 for U i The pre-signature verification is more efficient. In addition, during the pre-signature process, the same batch (same evidence y) corresponds to the same pre-signature public parameter Z0=y(X0+G) and zero-knowledge proof Therefore, Z0 and Calculate once. But for ECDSA-AS k , each pre-signature in the same batch corresponds to a different pre-signature public parameter K=k i Y, resulting in U0 giving each U i When calculating the pre-signature, you need to reselect the random number, recalculate the pre-signature public parameters and zero-knowledge proof, and transmit them to U i In general, regarding the 1-to-n batch atomic swap protocol, based on ECDSA-AS k The construction requires 2n pre-signed public parameters and 2n corresponding zero-knowledge proofs; based on SM-AS x The construction requires n+1 pre-signed public parameters and n+1 corresponding zero-knowledge proofs; the SM2-AS-based construction only requires n+1 pre-signed public parameters and 1 corresponding zero-knowledge proof.

[0072] In one or more embodiments, a distributed SM2 adapter signature system is also provided, including:

[0073] The complete signature value adaptation module is used for: each participant generates a pre-signature value for the information to be transmitted in a distributed manner, and verifies the correctness of the pre-signature value according to the pre-signature verification algorithm. Then, based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameters, and the complete signature value is adapted;

[0074] The complete signature value publishing module is used for: each participant to publish the complete signature value for the information to be transmitted.

[0075] In the complete signature value adaptation module, in the process of each participant generating and verifying the pre-signature value, the SM2 adapter signature is distributedly extended based on the SM2 collaborative signature to construct a distributed SM2 adapter signature.

[0076] In the complete signature value adaptation module, according to the structure of the pre-signed public parameters, each participant has a signature private key to directly calculate the pre-signed public parameters.

[0077] The distributed SM2 adapter signature method and system proposed in this embodiment are more suitable for batch atomic exchange protocols, and take into account the special verification scenario of adapter signatures, that is, the pre-signature value only needs to be verified by the protocol participants, which improves the signature efficiency.

[0078] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention.

[0079] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products of the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of the processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A distributed SM2 adapter signing method, characterized in that: include: In the off-chain stage, each participant will generate a pre-signature value for the information to be transmitted in a distributed manner, and verify the correctness of the pre-signature value according to the pre-signature verification algorithm. Then, based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameters, and the complete signature value is adapted; according to the structure of the pre-signature public parameters, each participant has the signature private key to directly calculate the pre-signature public parameters; The pre-signed public parameters The structure is ;in, is the signature private key, is the signature public key, For evidence, It's a group The base point, It is The elliptic curve group of Represents a point on an elliptic curve; In the on-chain stage, each participant publishes the complete signature value for the information to be transmitted.

2. The distributed SM2 adapter signing method according to claim 1, characterized in that: In the off-chain stage, in the process of each participant generating and verifying the pre-signature value, the SM2 adapter signature is distributedly extended based on the SM2 collaborative signature to construct a distributed SM2 adapter signature.

3. The distributed SM2 adapter signing method according to claim 2, characterized in that: Random dots in SM2 adapter signature ;in, is a random number, It's a group The base point, It is The elliptic curve group of It is the public parameter of the pre-signature algorithm.

4. The distributed SM2 adapter signing method according to claim 1, characterized in that: In the off-chain stage, the difficult relationship generator generates all pre-signed public parameters and corresponding zero-knowledge proofs in batches offline.

5. The distributed SM2 adapter signing method according to claim 1, characterized in that: In a two-party SM2 adapter signature, the two parties select the corresponding random value as the share of the SM2 signature private key, each selects a random value as the share of the random value in the pre-signed value, and then jointly generate the pre-signed value.

6. A distributed SM2 adapter signature system, characterized in that: include: The complete signature value adaptation module is used for: each participant generates a pre-signature value for the information to be transmitted in a distributed manner, and verifies the correctness of the pre-signature value according to the pre-signature verification algorithm. Then, based on the SM2 signature algorithm structure, the evidence of the difficult relationship is used as evidence to link the SM2 signature verification public key and the pre-signature public parameter, and the complete signature value is adapted; according to the structure of the pre-signature public parameter, each participant has the signature private key to directly calculate the pre-signature public parameter; The pre-signed public parameters The structure is ;in, is the signature private key, is the signature public key, For evidence, It's a group The base point, It is The elliptic curve group of Represents a point on an elliptic curve; The complete signature value publishing module is used for: each participant to publish the complete signature value for the information to be transmitted.

7. The distributed SM2 adapter signature system of claim 6, wherein: In the complete signature value adaptation module, in the process of each participant generating and verifying the pre-signature value, the SM2 adapter signature is distributedly extended based on the SM2 collaborative signature to construct a distributed SM2 adapter signature.

8. The distributed SM2 adapter signature system of claim 6, wherein: In the complete signature value adaptation module, according to the structure of the pre-signed public parameters, each participant has a signature private key to directly calculate the pre-signed public parameters.

Images