An SM2 threshold signature system based on dynamic secret sharing

Abstract

The present invention discloses an SM2 threshold signature system based on dynamic secret sharing, which relates to the field of information security technology. The system includes: an initialization module, a distributed key generation module, a signature module and a verification module; the initialization module is used to initialize public parameters; the distributed key generation module is connected to the initialization module, and is used to generate a secret share based on the initialized public parameters; the signature module is connected to the distributed key generation module, and is used to generate a signature pair based on the public parameters and the secret share; the verification module is connected to the signature module, and is used to verify the signature pair. In view of the fact that the existing SM2 threshold signature algorithm cannot use the original signature private key to ensure that the external signature public key remains unchanged when the number of participating users needs to change or the threshold value changes, the present invention uses a distributed key generation module to generate a secret share, which can dynamically add or delete the threshold value and the number of participating users under the premise of ensuring that the original signature private key remains unchanged.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an SM2 threshold signature system based on dynamic secret sharing. Background Art

[0002] The SM2 encryption algorithm is a public-key encryption algorithm issued by the China National Cryptography Administration. It is based on the problem of discrete logarithm decomposition on elliptic curves and performs point addition and exponentiation operations on elliptic curves over finite fields. SM2 is a commercial public-key algorithm designed to replace the Elliptic Curve Digital Signature Algorithm (ECDSA) for encryption / decryption, digital signing / verification, and key exchange.

[0003] The threshold signature algorithm was first proposed by Shamir. It is a technical means to protect the security of the original key by storing a key into multiple sub-shares. It has high practicality in actual application scenarios that require key protection.

[0004] Dynamic secret sharing is a distributed secret sharing scheme that dynamically adds and deletes participants and changes thresholds when the signature private key is fixed and there is no trusted distribution center.

[0005] However, in the existing SM2 signature method based on the threshold signature algorithm, once the signature private key is fixed, the number of participants and the threshold value remain fixed and cannot be changed. When the existing participating users change, such as when the number of participants needs to be increased, the existing SM2 threshold signature scheme cannot retain the original signature private key and must regenerate a new one. Frequent changes in the number of participants will result in frequent changes in the signature private key for the group, which not only increases communication and computing costs but also affects the public's credibility and reputation. Summary of the Invention

[0006] To solve this technical problem, the present invention provides an SM2 threshold signature system based on dynamic secret sharing.

[0007] To achieve the above object, the present invention provides the following solutions:

[0008] An SM2 threshold signature system based on dynamic secret sharing, comprising:

[0009] An initialization module, configured to initialize public parameters, including the size of the finite field, two elements of the elliptic curve equation, a base point on the elliptic curve, the number of participating users, and a threshold value;

[0010] a distributed key generation module, connected to the initialization module, for generating secret shares based on the initialized public parameters;

[0011] a signature module, connected to the distributed key generation module, for generating a signature pair based on a public parameter and the secret share;

[0012] A verification module, connected to the signature module, is used to verify the signature pair.

[0013] Optionally, it also includes:

[0014] The user adding module is connected to the initialization module and the distributed key generation module respectively, and is used to add a new participating user; when a new participating user is determined, the distributed key generation module generates a new secret share.

[0015] Optionally, it also includes:

[0016] The user deletion module is connected to the initialization module and the distributed key generation module respectively, and is used to delete the participating user; when it is determined to delete the participating user, the distributed key generation module generates a new secret share.

[0017] Optionally, it also includes:

[0018] The threshold changing module is connected to the distributed key generating module and is used to obtain a threshold increase request; the distributed key generating module generates a new secret share based on the threshold request.

[0019] Optionally, the process of the distributed key generation module generating a secret share based on the initialized public parameters includes:

[0020] Get the random number generated by the participating user i and use the random number as the private key d of the participating user i i , d i ∈F q ;

[0021] Determine the sub-public key Q based on the private key of participating user i i ;Q i =d i G, where G is the base point on the elliptic curve;

[0022] Broadcast sub-public key Q i , the participating user j receives the sub-public key Q i , and based on the sub-public key Q i Determine the public key Q, Q = ∑Q i ;

[0023] Get the coefficient a randomly selected by participating user i i,1 ,a i,2,…,a i,t-1 , and based on the randomly selected coefficient and the private key d of the participating user i i Generate a polynomial f with a maximum degree of t-1 i (x); f i (x) = d i +a i,1 x+a i,2 x 2 +…+a i,t-1 x t- 1 modq,f i (0) = x i , where x=1,2,3,…,n(x≠i), q is the size of the finite field, x i is the temporary secret share of participating user i, and n is the number of participating users;

[0024] Participating user i determines the polynomial f i The value f of (x) i (i) Send it to participant j through a secret channel and receive the polynomial f sent by participant j i The value f of (x) j (i);

[0025] According to the value f i (i) Sum value f j (i) Determine the secret share s of participating user i i ;s i =f i (i)+∑f j (i).

[0026] Optionally, the process of the signature module generating a signature pair based on the public parameter and the secret share includes:

[0027] Let message m = Hash(M); where M is the message to be signed and Hash() is the hash function for message conversion in the SM2 standard;

[0028] Determine the number of users S who participate in the signature among n participating users, and determine the coefficient λ i',s ; t≤S≤n, t is the threshold value;

[0029] Based on the coefficient λ i',s and secret share s i Determine the temporary secret share x when signing i' ;x i' =λ i,s s i ;

[0030] User i' who participates in the signature generates a random number ki' and the random number ρ i' , and the random number k i' and the random number ρ i' As an intermediate variable for random numbers and obfuscated data during signing, determine and broadcast the intermediate variable k i' G; where k i' ,ρ i' ∈q;

[0031] User i' who participates in the signature receives the intermediate variable k broadcast by user j' who participates in the signature j' G, and determine the intermediate variable R when signing; R=(r x ,r y )=k i' G+∑k j' G; where (r x ,r y ) is the coordinate of the intermediate variable R on the elliptic curve;

[0032] Determine the random number r in the signature result based on the intermediate variable R; r=(r x +m)mod q;

[0033] The user i' who participates in the signature determines the intermediate variable x when signing i' ρ i' , and the intermediate variable k i' ρ j' , obtain the intermediate variable β through Pailler homomorphic encryption j'i' and the intermediate variable ν j'i' , communicate secretly with user j' who participated in the signature and obtain the Paillier homomorphic encryption result α i'j' , and Paillier homomorphic encryption result μ i'j' ,make:

[0034] x i' ρ j' =α i'j' +β j'i' ;

[0035] k i' ρ j' =μ i'j' +v j'i' ;

[0036] User i' who participates in the signature determines the intermediate variable δ i' and the intermediate variable σ i' :

[0037] δ i' =x i' ρ i' +ρ i' +∑i'≠j' α i'j' +∑ i'≠j' β i'j' ;

[0038] σ i' =k i' ρ i' +rρ i' +∑ i'≠j' μ i'j' +∑ i'≠j' ν i'j' ;

[0039] User i' participating in the signature sends the intermediate variable δ i' and the intermediate variable σ i' To user j' who participated in the signature;

[0040] User i' who participates in the signature receives the intermediate variable δ of user j' who participates in the signature j' and the intermediate variable σ j' After that, determine the intermediate variables δ, intermediate variables σ and signature result s:

[0041] δ=∑δ i' ,i'∈{1,2,3,…,S};

[0042] σ=∑σ i' i∈{1,2,3,…,s};

[0043] s=(δ -1 σ-r)mod q;

[0044] Generate a signature pair based on the random number r and the signature result s; the signature pair is (r, s).

[0045] Optionally, the process of the verification module verifying the signature pair includes:

[0046] Determine the intermediate variable b as: b = (r + s) mod q; if b = 0, the verification fails;

[0047] When b≠0, determine (x 1, y1)=sG+bQ, and determine r'=(e+x1)mod q; (x1,y1) is a point on the elliptic curve;

[0048] If r'=r, the verification is successful; if r'≠r, the verification is unsuccessful.

[0049] Optionally, the process of adding a new participating user by the user adding module includes:

[0050] Participating user i selects an integer m i As an intermediate variable when adding users, the private key d in the distributed key generation modulei Change to the new private key d' i ;D' I =(D i -m i )mod q;m i ∈q;

[0051] Each participating user i determines a new sub-public key Q i ', and broadcast to participating user j; Q i '=d i 'G;

[0052] Participant i receives the sub-public key Q sent by participant j j ', and determine Q'=∑Q i ';

[0053] Determine whether Q' is consistent with the original public key Q; if not, the user addition fails and the user addition ends; if consistent, a new participating user c is added; among them, the participating user i will add the integer m i Sent to the newly added participating user c through a secret channel; based on the integer m i Determine the private key d of participating user c c ;d c =∑m i ; The newly added participating user c and other participating users execute the secret share generation process in the distributed key generation module to generate new secret shares.

[0054] Optionally, the process of deleting a participating user by the user deletion module includes:

[0055] Participant c communicates with other participants and determines that there are S' other participants online; S' ≥ 2;

[0056] Participating user c uses his private key d c Randomly divide it into S' parts of different sizes, and divide the integer m i As an intermediate variable when deleting a user, the integer m i Sent to participating user i through a secret channel;

[0057] Participating user i calculates the new private key d' i and the new child public key Q i ', and broadcast to participating user j; where d' i =d i +m i , Q i '=d i 'G;

[0058] Participant i receives the sub-public key Q sent by participant j j', determine the new public key Q'; Q' = Q' i +∑Q j ';

[0059] Determine whether the new public key Q' is consistent with the public key Q; if not, the user deletion fails and the user deletion ends; if consistent, delete the participating user c.

[0060] m i When participating user c voluntarily quits, m i An integer selected by participating user i;

[0061] When the participating user c does not actively exit,

[0062] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0063] In view of the fact that the existing SM2 threshold signature algorithm cannot use the original signature private key to ensure that the external signature public key remains unchanged when the number of participating users needs to change or the threshold value changes, the present invention uses a distributed key generation module to generate secret shares. It can dynamically add or delete the threshold value and the number of participating users while ensuring that the original signature private key remains unchanged. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 Schematic diagram of the implementation principle of the SM2 threshold signature system provided by the present invention;

[0066] Figure 2 Add a flow chart for users provided by the present invention;

[0067] Figure 3 This is a user deletion flow chart provided by the present invention. DETAILED DESCRIPTION

[0068] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0069] In view of the fact that the existing SM2 threshold signature algorithm cannot use the original signature private key to ensure that the external signature public key remains unchanged when the number of participating users needs to change or the threshold value changes, the present invention provides an SM2 threshold signature system based on dynamic secret sharing, which can dynamically add or delete the threshold value and the number of participating users while ensuring that the original signature private key remains unchanged.

[0070] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0071] like Figure 1 As shown, the SM2 threshold signature system based on dynamic secret sharing provided by the present invention includes: an initialization module, a distributed key generation module, a signature module, a verification module, a user addition module, a user deletion module and a threshold change module.

[0072] The initialization module is used to initialize public parameters. All participating users set the same public parameters, including: finite field F q The scale q, elliptic curve E(F q ) two elements a,b∈F q 、E(F q ) on the base point G=(x G ,y G )(G≠0), the number of participating users n and the threshold t.

[0073] The distributed key generation module is connected to the initialization module and is mainly used to generate secret shares based on the initialized public parameters. Specifically:

[0074] 1. Assume that the participating users are 1, 2, 3, ... i, ..., n, and each participating user i generates a random number d i ∈F q , as the private key of participating user i, calculate the sub-public key Q i =d i G then broadcasts the child public key Q i , after receiving it, other participating users j calculate the public key Q = ∑Q i .

[0075] 2. Each participating user i randomly selects coefficient a i,1 ,a i,2 ,…,a i,t-1 , generate a polynomial f with a maximum degree of t-1 i (x):

[0076] f i (x) = d i +a i,1 x+ai,2 x 2 +…+a i,t-1 x t-1 modq.

[0077] f i (0) = x i .

[0078] 3. When user i calculates x=1,2,3,…j,…,n(x≠i), f i (x) value and sends it to the corresponding other users 1, 2, 3, ... j, n (j ≠ i) through the secret channel, and receives f sent by other participating user j j (i), calculate the secret share s of participating user i i ,for:

[0079] s i =f i (i)+∑f j (i).

[0080] The signature module is connected to the distributed key generation module and is mainly used to generate a signature pair based on the public parameters and the secret share. The process of generating a signature pair based on the public parameters and the secret share is as follows:

[0081] 1. Let message m = Hash(M). Where M is the message to be signed and Hash() is the hash function for message conversion in the SM2 standard.

[0082] 2. Determine the number of users S who participate in the signature among n participating users, and determine the coefficient λ i',s . t≤S≤n, t is the threshold.

[0083] 3. Based on coefficient λ i',s and secret share s i Determine the temporary secret share x when signing i' .x i' =λ i,s s i .

[0084] 4. User i' who participates in the signature (i.e. signing user i') generates a random number k i' and the random number ρ i' , and the random number k i' and the random number ρ i' As an intermediate variable for random numbers and obfuscated data during signing, determine and broadcast the intermediate variable k i' G. Among them, k i' ,ρ i' ∈q.

[0085] 5. User i' who participates in the signature receives the intermediate variable k broadcast by user j' who participates in the signature j' G, and determine the intermediate variable R when signing. R=(r x ,r y )=k i' G+∑k j' G. Among them, (r x ,r y ) is the coordinate of the intermediate variable R on the elliptic curve.

[0086] 6. Determine the random number r in the signature result based on the intermediate variable R. r=(r x +m)mod q.

[0087] 7. User i' who participates in the signature determines the intermediate variable x when signing i' ρ i' , and the intermediate variable k i' ρ j' , obtain the intermediate variable β through Pailler homomorphic encryption j'i' and the intermediate variable ν j'i' , communicate secretly with user j' who participated in the signature and obtain the Paillier homomorphic encryption result α i'j' , and Paillier homomorphic encryption result μ i'j' ,make:

[0088] x i' ρ j' =α i'j' +β j'i' .

[0089] k i' ρ j' =μ i'j' +v j'i' .

[0090] 8. User i' who participates in the signature determines the intermediate variable δ i' and the intermediate variable σ i' :

[0091] δ i' =x i' ρ i' +ρ i' +∑ i'≠j' α i'j' +∑ i'≠j' β i'j' .

[0092] σ i' =k i' ρ i' +rρ i' +∑ i'≠j' μ i'j' +∑i'≠j' v i'j' .

[0093] 9. User i' participating in the signature sends the intermediate variable δ i' and the intermediate variable σ i' To user j' who participated in the signature.

[0094] 10. User i' who signed receives the intermediate variable δ of user j' who signed j' and the intermediate variable σ j' After that, determine the intermediate variables δ, intermediate variables σ and signature result s:

[0095] δ=∑δ i' ,i'∈{1,2,3,…,S}.

[0096] σ=∑σ i' i∈{1,2,3,…,S}.

[0097] s=(δ -1 σ-r)mod q.

[0098] 11. Generate a signature pair based on the random number r and the signature result s. The signature pair is (r, s).

[0099] The verification module is connected to the signature module and is mainly used to verify the signature pair. The process of verifying the signature pair includes:

[0100] 1. When calculating the verification module, the intermediate variable b = (r + s) mod q. If b = 0, the verification fails.

[0101] If b≠0, calculate the elliptic curve point (x 1, y1)=sG+bQ.

[0102] Calculate r'=(e+x1) mod q. If r'=r, the verification passes; otherwise, the verification fails.

[0103] The user addition module is connected to the initialization module and the distributed key generation module respectively for adding new participating users. When a new participating user is determined, the distributed key generation module generates a new secret share. The specific implementation process is as follows Figure 2 As shown, including:

[0104] 1. At least a threshold number t of participating users initiate user addition request communications.

[0105] 2. Each participating user i selects an integer m i (m i ∈q) as the intermediate variable when the user is added, and the private key d in the distributed key generation module is i Change to the new private key D'I =(D i -m i )mod q.

[0106] 3. Each participating user i calculates a new sub-public key Q i '=d i 'G, and broadcast it to other participating users j.

[0107] 4. Each participating user i receives Q sent by other participating user j j ', calculate Q' = ∑Q i ', determine whether Q' is consistent with the original public key Q. If not, the user addition fails and the user addition is terminated.

[0108] 5. If they are consistent, the number of users increases, and each participating user i will m i Sent to the newly added participating user c through a secret channel.

[0109] 6. New participating user c receives m sent by other participating users i , calculate the private key d of user c c =∑m i ;

[0110] 7. New participant c and other participating users execute steps 2 and 3 in the distributed key generation module to generate new secret shares.

[0111] The user deletion module is connected to the initialization module and the distributed key generation module respectively, and is used to delete participating users. When it is determined to delete a participating user, the distributed key generation module generates a new secret share. Specifically, Figure 3 As shown, the implementation process is:

[0112] If participating user c voluntarily quits, the steps are as follows:

[0113] 1. Participant c communicates with other participants and determines that there are S (S ≥ 2) other participants online.

[0114] 2. Participating user c sends his private key d c Randomly divide into S parts of different sizes m i (i∈S) is used as the intermediate variable when the user is deleted, and m i Sent to other participants i through a secret channel.

[0115] 3. Each participating user i calculates a new private key d' i =d i +m i , and calculate the new sub-public key Q i '=d i 'G, and broadcast it to other participating users j.

[0116] 4. Each participating user i receives Q sent by other participating user j j ', calculate the new public key Q'=Q' i +∑Q j ', determine whether the new Q' is consistent with the original public key Q. If not, the user deletion fails and the user deletion ends.

[0117] 5. Other participating users execute steps 2 and 3 in the distributed key generation module to generate new secret shares.

[0118] If participating user c does not actively exit, the steps are as follows:

[0119] 1. S (S ≥ t) participating users initiate a request communication to delete participating user c.

[0120] 2. Each participating user i calculates the intermediate variable when the user is deleted

[0121] 3. Each participating user i calculates a new private key d' i =d i +m i , and calculate the new sub-public key Q i '=d i 'G, and broadcast it to other participating users j.

[0122] 4. Each participating user i receives Q sent by other participating user j j ', calculate the new public key Q' = ∑Q i ', determine whether Q' is consistent with the original public key Q. If they are inconsistent, the user deletion fails and the user deletion ends.

[0123] 5. New participant c and other participating users execute steps 2 and 3 in the distributed key generation module, and each user generates a new secret share.

[0124] The threshold change module is connected to the distributed key generation module to obtain a threshold increase request. The distributed key generation module generates a new secret share based on the threshold request. Specifically:

[0125] 1. S (S ≥ t) participating users initiate a request communication to increase the threshold t'.

[0126] 2. Each participating user i randomly selects coefficient a i,1 ,a i,2 ,…,a i,t-1 , generate a polynomial f with a maximum degree of t'-1 i (x):

[0127] fi (x) = x i +a i,1 x+a i,2 x 2 +…+a i,t-1 x t’-1 mod q.

[0128] f i (0) = x i .

[0129] 3. Execute step 3 in the distributed key generation module, and each user generates a new secret share.

[0130] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0131] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. An SM2 threshold signature system based on dynamic secret sharing, characterized in that: include: Initialization module, used to initialize public parameters; The public parameters include: the size of the finite field, two elements of the elliptic curve equation, the base point on the elliptic curve, the number of participating users and the threshold value; a distributed key generation module, connected to the initialization module, for generating secret shares based on the initialized public parameters; a signature module, connected to the distributed key generation module, for generating a signature pair based on a public parameter and the secret share; a verification module, connected to the signature module, for verifying the signature pair; A user adding module, connected to the initialization module and the distributed key generation module, for adding a new participating user; when a new participating user is determined, the distributed key generation module generates a new secret share; A user deletion module, connected to the initialization module and the distributed key generation module, for deleting a participating user; when it is determined to delete a participating user, the distributed key generation module generates a new secret share; The process of adding new participating users in the user adding module includes: Participating user i selects an integer m i As an intermediate variable when adding users, the private key d in the distributed key generation module i Change to the new private key d′ i ; d′ i =(d i -m i )mod q;m i ∈q; q is the size of the finite field; Each participating user i determines a new sub-public key Q i ', and broadcast to participating user j; Q i '=d i 'G; where G is the base point on the elliptic curve; Participant i receives the sub-public key Q sent by participant j j ', and determine the new public key Q'=∑Q i '; Determine whether Q' is consistent with the original public key Q; if not, the user addition fails and the user addition ends; if consistent, a new participating user c is added; among them, the participating user i will add the integer m i Sent to the newly added participating user c through a secret channel; based on the integer m i Determine the private key d of participating user c c ;d c =∑m i ; The newly added participating user c and other participating users execute the secret share generation process in the distributed key generation module to generate new secret shares; The process of deleting participating users in the user deletion module includes: Participant c communicates with other participants and determines that there are S′ other participants online; S′≥2; Participating user c uses his private key d c Randomly divide it into S' parts of different sizes, and divide the integer m i As an intermediate variable when deleting a user, the integer m i Sent to participating user i through a secret channel; Participating user i calculates the new private key d′ i and the new child public key Q i ′, and broadcast to participating user j; where d′ i =d i +m i ; Participant i receives the sub-public key Q sent by participant k j ', determine the new public key Q'; Q' = Q' i +∑Q j '; Determine whether the new public key Q′ is consistent with the public key Q; if not, the user deletion fails and the user deletion ends; if consistent, delete the participating user c.

2. The SM2 threshold signature system based on dynamic secret sharing according to claim 1, characterized in that: Also includes: A threshold changing module, connected to the distributed key generation module, for obtaining a threshold increase request; The distributed key generation module generates a new secret share based on the threshold request.

3. The SM2 threshold signature system based on dynamic secret sharing according to claim 1, characterized in that: The process of generating a secret share based on the initialized public parameters by the distributed key generation module includes: Get the random number generated by the participating user i and use the random number as the private key d of the participating user i i , d i ∈F q ; F q is a finite field; Determine the sub-public key Q based on the private key of participating user i i ;Q i =d i G; Broadcast sub-public key Q i , the participating user j receives the sub-public key Q i , and based on the sub-public key Q i Determine the public key Q, Q = ∑Q i ; Get the coefficient a randomly selected by participating user i i,1 ,a i,2 ,…,a i,t-1 , and based on the randomly selected coefficient and the private key d of the participating user i i Generate a polynomial f with a maximum degree of t-1 i (x); f i (x) = d i +a i,1 x+a i,2 x 2 +…+a i,t-1 x t-1 modq,f i (0) = x i , where x=1,2,3,…,n, x≠i, x i is the temporary secret share of participating user i, and n is the number of participating users; Participating user i determines the polynomial f i The value of (x) f i (i) Send it to participant j through a secret channel and receive the polynomial f sent by participant j i The value of (x) f j (i); According to the value f i (i) Sum value f j (i) Determine the secret share s of participating user i i ;s i =f i (i)+∑f j (i).

4. The SM2 threshold signature system based on dynamic secret sharing according to claim 3, characterized in that: The process of the signature module generating a signature pair based on the public parameter and the secret share includes: Let message m = Hash(M); where M is the message to be signed and Hash() is the hash function for message conversion in the SM2 standard; Determine the number of users participating in the signature among n participating users, and determine the coefficient λ i′,s ; t is the threshold value; Based on the coefficient λ i′,s and secret share s i Determine the temporary secret share x when signing i ;x i =λ i,s s i ; User i' who participates in the signature generates a random number k i′ and the random number ρ i′ , and the random number k i′ and the random number ρ i′ As an intermediate variable for random numbers and obfuscated data during signing, determine and broadcast the intermediate variable k i′ G; where k i′ ,ρ i′ ∈q; User i' who participates in the signature receives the intermediate variable k broadcast by user j' who participates in the signature j′ G, and determine the intermediate variable R when signing; R=(r x ,r y )=k i′ G+∑k j′ G; where (r x ,r y ) is the coordinate of the intermediate variable R on the elliptic curve; Determine the random number r in the signature result based on the intermediate variable R; r=(r x +m)mod q; The user i' who participates in the signature determines the intermediate variable x when signing i′ ρ i′ , and the intermediate variable k i′ ρ j′ , obtain the intermediate variable β through Pailler homomorphic encryption j′i′ and the intermediate variable v j′i′ , communicate secretly with user j' who participated in the signature and obtain the Paillier homomorphic encryption result α i'j' , and Paillier homomorphic encryption result μ i'j' ,make: x i' r j' =a i'j' +b j'i' ; k i′ ρ j′ =μ i′j′ +v j′i′ ; is the temporary secret share of user i′ participating in the signature; User i' who participates in the signature determines the intermediate variable δ i′ and the intermediate variable σ i′ : d i′ =x i′ r i′ +r i′ +∑ i′≠j′ a i′j′ +∑ i′≠j′ b i′j′ ; s i′ =k i′ r i′ +rρ i′ +∑ i′≠j′ m i′j′ +∑ i′≠j′ v i′j′ ; User i′ participating in the signature sends the intermediate variable δ i′ and the intermediate variable σ i′ To user j′ who participated in the signature; The user i′ who participates in the signature receives the intermediate variable δ of the user j′ who participates in the signature j′ and the intermediate variable σ j′ After that, determine the intermediate variables δ, intermediate variables σ and signature result s: δ=∑δ i′ ,i′∈{1,2,3,…,S}; σ=∑σ i′ i∈{1,2,3,…,S}; s=(δ -1 σ-r)mod q; Generate a signature pair based on the random number r and the signature result s; the signature pair is (r, s).

5. The SM2 threshold signature system based on dynamic secret sharing according to claim 4, characterized in that: The process of the verification module verifying the signature pair includes: Determine the intermediate variable b as: b = (r + s) mod q; if b = 0, the verification fails; When b≠0, determine (x1, y1) = sG + bQ, and determine r′ = (e + x1) mod q; (x 1, y1) is a point on the elliptic curve; If r′=r, the verification succeeds; if r′≠r, the verification fails.

6. The SM2 threshold signature system based on dynamic secret sharing according to claim 3, characterized in that: When participating user c voluntarily quits, m i An integer selected by participating user i; When the participating user c does not actively exit,

Images