A (2,3) threshold SM2 signature method without a trusted center

Abstract

The application relates to a (2, 3) threshold SM2 signature method without a trusted center. d， share d +1 ‑1 , calculate partial information signature r stage, share k - rd stage, share d +1 ‑1 ( k - rd ) stage, output signature stage. Compared with the prior art, the (2, 3) threshold SM2 signature scheme without a trusted center in the technical scheme of the application not only avoids zero-knowledge proof, improves the efficiency of the whole scheme, but also successfully ensures that the threshold value in the whole signature scheme is fixed t =2, realizes a real threshold SM2 signature scheme.

Description

Technical Field

[0001] This invention relates to the field of digital signature technology in information security, and in particular to a (2,3) threshold SM2 signature method without a trusted center. Background Technology

[0002] In cryptography, keys are crucial for ensuring information security. Secure key storage is a vital guarantee of information security. If a key is leaked, attackers can easily decrypt or tamper with encrypted data, posing a significant threat to the confidentiality, integrity, and availability of information. Secret sharing is a novel cryptographic technique that offers higher security and more flexible key management compared to traditional public-key cryptography. Secret sharing divides the key into multiple parts, each held by a different holder, avoiding the risks associated with private key leakage in traditional public-key cryptography. These key parts can be distributed across different geographical locations, trust domains, or security domains, reducing the complexity of key management. Furthermore, the key parts can be recombined as needed, flexibly controlling the scope and access permissions of the key. Secret sharing offers high security; even if an attacker obtains a portion of the key, they cannot deduce the complete key, thus ensuring key confidentiality. In short, secret sharing has become an important cryptographic technique widely used in the field of information security, providing users with a more secure and flexible key management method.

[0003] Secret sharing is an important means of information security and data confidentiality. The concept was first independently proposed by Shamir and Blakley in 1979. It refers to dividing a secret *s* into several shares among a group of participants P = {P1, P2, ..., P...}. n The secret is distributed in a way that each participant receives a share of the secret, and only certain subsets of P (called qualified subsets or authorized subsets) can effectively recover s, while other subsets of P (unqualified subsets) cannot effectively recover s, or even obtain any useful information about the secret s.

[0004] The threshold signature proposed by Boyd and Desmedt is one of the most famous threshold cryptographic systems. It is a multi-party signature scheme based on secret sharing technology. During its operation, the private key information is divided into multiple parts and shared with multiple independent participants. Each time the private key is calculated, the consent of multiple participants is required to complete the calculation, thereby improving the security and robustness of the algorithm. Even if a small number of participants fail or become unavailable, the availability of the private key will not be affected.

[0005] In recent years, with the rapid development of blockchain technology, ECDSA (Elliptic Curve Digital Signature Algorithm), used in Bitcoin to ensure the security of users' private signature keys, has gradually become a research hotspot, especially threshold ECDSA. ECDSA is an elliptic curve cryptosystem. Because elliptic curve cryptosystems are superior to traditional cryptosystems (such as RSA and DSA) in terms of security and efficiency, they have gradually become the mainstream algorithm in the field of public-key algorithms.

[0006] To meet the application requirements of electronic authentication service systems, the State Cryptography Administration of China released the SM2 elliptic curve public-key cryptography algorithm on December 17, 2010. This algorithm can satisfy authentication, data integrity, and authenticity requirements in various encryption applications. As the first public-key algorithm standard released by the Chinese government, the SM2 elliptic curve public-key algorithm has played a crucial role in building China's information security system. An effective threshold SM2 elliptic curve signature scheme can replace ECDSA in most applications, especially for domestic confidential applications. However, compared to several secure threshold signature schemes for ECDSA, research on secure threshold SM2 signature schemes is still relatively limited. Therefore, proposing a secure threshold SM2 signature scheme is of great significance. Summary of the Invention

[0007] The purpose of this invention is to address the significant limitations of existing threshold SM2 signature schemes. Therefore, it provides a (2,3) threshold SM2 signature method without a trusted center, which not only avoids zero-knowledge proofs and improves the efficiency of the entire scheme, but also successfully ensures that the threshold value in the entire signature scheme is fixed at t=2.

[0008] To achieve the above objectives, the technical solution of the present invention is: a (2,3) threshold SM2 signature method without a trusted center, comprising the following steps:

[0009] Step A: System initialization phase: Based on the security parameters, run the system parameter generation algorithm and output the system's globally public parameter set SP;

[0010] Step B(2,3) Threshold key generation stage: Based on the system's global public parameter set SP, all participants randomly select their own random number r. i The shared share is then distributed to all participants using the (2,3) Shamir threshold scheme, while the commitment to the corresponding sharing polynomial is broadcast using Feldman's VSS. After verifying that the sharing by each participant is valid, each party generates its own share d of the group private key sk = d = (r1 + r2 + r3). i At the same time, each group calculates its corresponding public key pk.

[0011] Step C: Message Hash Value Calculation Phase: Based on the signed message m, each participant P... i Calculate its corresponding hash value e;

[0012] Step D: Distributed generation stage of signature random numbers: Based on the system's globally public parameter set SP, step B is called to collaboratively generate random number k, and Feldman's VSS is used to publicly disclose the corresponding commitment, while each party secretly saves the random value selected by itself.

[0013] Step E involves sharing (d+1) the private key d. -1 First, each participant generates a share of (d+1) based on their share of d. Then, a random number k' is generated using a (2,3) threshold key generation algorithm, which in turn generates a (2,3) secret share of (d+1)k'. Finally, u = (d+1)k' is recovered, and u is calculated. -1 Finally, each party calculates their share (d+1). -1 The share;

[0014] Step F, based on the results obtained in steps C and D, involves each participant P. i Calculate the first part of the signature information r;

[0015] Step G, the sharing (k-rd) phase: Based on the share information obtained in steps B and D, and the first part of the signature information r calculated in step F, each participant P... i It can calculate its own secret share of (k-rd);

[0016] Step H: Share (d+1) -1 (k-rd) phase: Based on the share information obtained in steps E and G, each participant P... i It can calculate what it owns about (d+1). -1 The secret share of (k-rd);

[0017] Step I: Output Signature Phase: Each participating party P i Output what it possesses about (d+1). -1 After obtaining the secret share information of (k-rd), the second part of the signature information s can be obtained by combining the valid secret share information output by any two participants; finally, the valid signature (r, s) for message m is output.

[0018] In one embodiment of the present invention, step A is specifically implemented as follows:

[0019] Given a security parameter λ, generate the system's globally public parameter set SP = (F p , E(F pF(p, q, H) is a large prime number with a length of not less than 160 bits. p For a finite field, E(F) p For the selection of a, b∈F p Elliptic curve as a parameter (y 2 =x 3 The points satisfying the equation of the elliptic curve (+ax+b mod p) form an abelian group G of order q, H: {0, 1}. * →{0,1} 256 It is the SM3 cryptographic hash algorithm.

[0020] In one embodiment of the present invention, step B is specifically implemented as follows:

[0021] B.1, Each participating party P i Randomly select each of the following random numbers r i Construct a random secret sharing polynomial f for each of the following. i (x)=a i,0 +a i,1 x makes a i,0 =r i , where a i,0 and a i,1 Randomly and uniformly select from the finite field Fp, calculate f i (1), f i (2), f i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for a using Feldman's VSS i,0 and a i,1 The promise [a i,0 G, [a i,1 ]G and broadcast;

[0022] B.2, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify f using Feldman's VSS. i (j)G=[a i,0 G+[a i,1 If [j]G is true, then its share is valid; otherwise, repeat step B.1.

[0023] B.3. Obtain the group private key after steps B.1 and B.2. The public key pk = [d]G = [r1]G + [r2]G + [r3]G; P1 has a secret share of the private key d as d1 = f1(1) + f2(1) + f3(1), P2 has a secret share of the private key d as d2 = f1(2) + f2(2) + f3(2), and P3 has a secret share of the private key d as d3 = f1(3) + f2(3) + f3(3).

[0024] In one embodiment of the present invention, step C is specifically implemented as follows:

[0025] After receiving the message m to be signed, each participating party P, according to the SM3 cryptographic hash algorithm H in the system's globally public parameter set SP, i Calculate the hash value of message m, e = H(m).

[0026] In one embodiment of the present invention, step D is specifically implemented as follows:

[0027] D.1, Each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial g for each of the following: i (x)=b i,0 +b i,1 x makes b i,0 =k i , where b i,0 and b i,1 Randomly and uniformly select from the finite field Fp, calculate g. i (1), g i (2), g i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculation of b using Feldman's VSS i,0 and b i,1 The promise [b i,0 G, [b i,1 ]G and broadcast;

[0028] D.2, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify g using Feldman's VSS. i (j)G=[b i,0 G+[b i,1 If [j]G is true, then its share is valid; otherwise, repeat step D.1.

[0029] D.3. Random values ​​are obtained through steps D.1 and D.2. P1 has a secret share of random number k as k1 = g1(1) + g2(1) + g3(1), P2 has a secret share of random number k as k2 = g1(2) + g2(2) + g3(2), and P3 has a secret share of random number k as k3 = g1(3) + g2(3) + g3(3).

[0030] In one embodiment of the present invention, step E is specifically implemented as follows:

[0031] E.1. During the secret sharing of (d+1), according to the various participants P in step B... i The secret share d obtained i P i Its secret share d i Incrementing by 1 yields (d) i +1), and finally P1 has a secret share of (d+1) of (d1+1), P2 has a secret share of (d+1) of (d2+1), and P3 has a secret share of (d+1) of (d3+1).

[0032] E.2. During the secret sharing of the random number k', each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial h for each of the following: i (x)=c i,0 +c i,1 x makes c i,0 =k i ', where c i,0 and c i,1 Randomly and uniformly select from the finite field Fp, calculate h i (1), h i (2), h i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for c using Feldman's VSS i,0 and c i,1 The promise [c i,0 G, [c i,1 ]G and broadcast;

[0033] E.3, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify h using Feldman's VSS. i (j)G=[c i,0 G+[c i,1 If [j]G is true, then its share is valid; otherwise, repeat step E.2.

[0034] E.4, Random Values P1 has a secret share of the random number k' as k1' = h1(1) + h2(1) + h3(1), P2 has a secret share of the random number k' as k2' = h1(2) + h2(2) + h3(2), and P3 has a secret share of the random number k' as k3' = h1(3) + h2(3) + h3(3).

[0035] E.5. During the secret sharing of (d+1)k', each participating party P i Construct a random secret sharing polynomial w for each of the following. i (x)=v i,0 +v i,1 x makes v 1,0 =3k1'(d1+1), v 2,0 =-3k2'(d2+1), v 3,0 =k3'(d3+1), where v i,0 and v i,1 Randomly and uniformly select from the finite field Fp, calculate w i (1), w i (2), w i (3) and distribute them to participants P1, P2, P3 respectively; at the same time, P i Calculate the value of v using Feldman's VSS. i,0 and v i,1 The promise [v] i,0 G, [v i,1 ]G and broadcast;

[0036] E.6, Each Recipient P j (j≠i) upon receiving from P i After receiving the message, verify w via Feldman's VSS. i (j)G=[v i,0 G+[v i,1 If [j]G is true, then its share is valid; otherwise, repeat step E.5.

[0037] E.7 P i Having a secret share of (d+1)k' That is, P1 has a secret share of (d+1)k' of v1 = w1(1) + w2(1) + w3(1), P2 has a secret share of (d+1)k' of v2 = w1(2) + w2(2) + w3(2), and P3 has a secret share of (d+1)k' of v3 = w1(3) + w2(3) + w3(3);

[0038] E.8. Any two of the participants P1, P2, and P3 can recover the secret u = (d+1)k' through cooperation by virtue of their respective secret shares regarding (d+1)k'. Then, by performing the inverse operation, u can be obtained. -1 =(d+1) -1 k' -1 ;

[0039] E.9, Each participating party P i It is possible to calculate about (d+1) -1 secret share d i That is, P1 owns information about (d+1). -1 The secret share is d1' = u -1 k1', P2 has information about (d+1) -1 The secret share is d2' = u -1 k2', P3 has information about (d+1) -1 The secret share is d3' = u -1 k3'.

[0040] In one embodiment of the present invention, step F is specifically implemented as follows:

[0041] According to the participants P in step C i The hash value e of the signed message m and the commitment [k]G = [k1]G + [k2]G + [k3]G = (x1, y1) obtained in step D regarding the random number k, where x1 and y1 are the values ​​of the elliptic curve E(F) and y1, respectively. p The x and y coordinates of the k-fold point above the base point, and the coordinates of each participating party P. i It is possible to calculate the r part of the signature (r, s), that is, r = e + x1.

[0042] In one embodiment of the present invention, step G is specifically implemented as follows:

[0043] According to the participants P in step B i Possessing a secret share d of the private key d i In step D, each participant P i Having a secret share k of the random number k i and each participant P in step F i The information in the r part of the calculated signature (r, s), and the information of each participating party P i It can be calculated that its share of the secret regarding (k-rd) is u. i =k i -rd iThat is, P1 has a secret share of (k-rd) of u1 = k1 - rd1, P2 has a secret share of (k-rd) of u2 = k2 - rd2, and P3 has a secret share of (k-rd) of u3 = k3 - rd3.

[0044] In one embodiment of the present invention, step H is specifically implemented as follows:

[0045] H.1, according to the participants P in step E i Get information about (d+1) -1 The secret share is d i 'and each participant P in step G' i The secret share of (k-rd) is obtained as u. i Each participating party P i Construct a random secret sharing polynomial l for each i (x)=t i,0 +t i,1 x makes t 1,0 =3u1d1',t 2,0 =-3u2d2',t 3,0 =u3d3', where t i,0 and t i,1 Randomly and uniformly select from the finite field Fp, calculate l i (1), l i (2), l i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculation of t using Feldman's VSS i,0 and t i,1 The promise [t] i,0 G, [t] i,1 ]G and broadcast;

[0046] H.2, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify it using Feldman's VSS. i (j)G=[t i,0 G+[t i,1 If [j]G is true, then its share is valid; otherwise, repeat step H.1.

[0047] H.3, P i Possessing information about (d+1) -1 The secret share of (k-rd) is That is, P1 possesses information about (d+1). -1The secret share of (k-rd) is s1 = l1(1) + l2(1) + l3(1), and P2 has a secret share of (d+1). -1 The secret share of (k-rd) is s2 = l1(2) + l2(2) + l3(2), and P3 has a secret share of (d+1). -1 The secret share of (k-rd) is s3 = l1(3) + l2(3) + l3(3).

[0048] In one embodiment of the present invention, step I is specifically implemented as follows:

[0049] Participant P1 outputs information about (d+1). -1 The secret share information s1 = l1(1) + l2(1) + l3(1) of (k-rd) is given, and participant P2 outputs that it possesses information about (d+1). -1 The secret share information s2 = l1(2) + l2(2) + l3(2) of (k-rd) is given, and participant P3 outputs that it possesses information about (d+1). -1 The secret share information s3 of (k-rd) is s3 = l1(3) + l2(3) + l3(3); then, by combining any two of the secret share information s1, s2, and s3 output by the three participants, the secret (d+1) can be recovered. -1 (k-rd), which is s in the signature (r, s); then according to step F, the r part of the signature (r, s) is obtained, and each participant P i This will output the complete signature (r, s) of message m, where r = e + x1 and s = (d + 1). -1 (k-rd).

[0050] Compared with the prior art, the present invention has the following advantages: the present invention not only avoids zero-knowledge proof and improves the efficiency of the whole scheme, but also successfully ensures that the threshold value in the whole signature scheme is fixed at t=2, realizing a true threshold SM2 signature scheme. Attached Figure Description

[0051] Figure 1 This is a flowchart of a (2,3) threshold SM2 signature scheme without a trusted center as described in this invention.

[0052] Figure 2 The operation flowchart of the (2,3) threshold SM2 signature scheme without a trusted center according to the present invention is shown in the figure. Detailed Implementation

[0053] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0054] See attached document Figure 1 and attached Figure 2The specific steps of the (2,3) threshold SM2 signature scheme without a trusted center described in this invention are as follows:

[0055] Step A: System initialization phase: Based on the security parameters, run the system parameter generation algorithm and output the system's globally public parameter set SP;

[0056] Step B(2,3) Threshold key generation stage: Based on the system's global public parameter set SP, all participants randomly select their own random number r. i The shared share is then distributed to all participants using a (2,3) Shamir threshold scheme, while the commitment to the corresponding sharing polynomial is broadcast using Feldman's VSS. After verifying that each participant's share is valid, each party generates its own share d of the group private key sk = d = (r1 + r2 + r3). i At the same time, each calculates its corresponding group public key pk.

[0057] Step C: Message Hash Value Calculation Phase: Based on the signed message m, each participant P... i Calculate its corresponding hash value e;

[0058] Step D: Distributed generation stage of signature random numbers: Based on the system's globally public parameter set SP, step B is called to collaboratively generate random number k, and Feldman's VSS is used to publicly disclose the corresponding commitment, while each party secretly saves the random value selected by itself.

[0059] Step E involves sharing (d+1) the private key d. -1 First, each participant generates a share of (d+1) based on their share of d. Then, a random number k' is generated using a (2,3) threshold key generation algorithm, which in turn generates a (2,3) secret share of (d+1)k'. Finally, u = (d+1)k' is recovered, and u is calculated. -1 Finally, each party calculates their share (d+1). -1 The share;

[0060] Step F, based on the results obtained in steps C and D, involves each participant P. i Calculate the first part of the signature information r;

[0061] Step G, the sharing (k-rd) phase: Based on the share information obtained in steps B and D, and the first part of the signature information r calculated in step F, each participant P... i It can calculate its own secret share of (k-rd);

[0062] Step H: Share (d+1) -1 (k-rd) phase: Based on the share information obtained in steps E and G, each participant P... iIt can perform certain operations to calculate its own value related to (d+1). -1 The secret share of (k-rd);

[0063] Step I: Output Signature Phase: Each participating party P i Output what it possesses about (d+1). -1 After obtaining the secret share information of (k-rd), the second part of the signature information s can be obtained by combining the valid secret share information output by any two participants; finally, the valid signature (r, s) for message m is output.

[0064] Furthermore, the detailed process of step A is as follows: Given a security parameter λ, generate the system's globally public parameter set SP = (F p , E(F p F(p, q, H) is a large prime number with a length of not less than 160 bits. p For a finite field, E(F) p For the choice a, b∈F p Elliptic curve as a parameter (y 2 =x 3 The points satisfying the equation of the elliptic curve (+ax+b mod p) form an abelian group G of order q, H: {0, 1}. * →{0,1} 256 It is the SM3 cryptographic hash algorithm.

[0065] Furthermore, the detailed process of step B is as follows:

[0066] B.1, Each participating party P i Randomly select each of the following random numbers r i Construct a random secret sharing polynomial f for each of the following. i (x)=a i,0 +a i,1 x makes a i,0 =r i , where a i,0 and a i,1 Randomly and uniformly select from the finite field Fp, calculate f i (1), f i (2), f i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for a using Feldman's VSS i,0 and a i,1 The promise [a i,0 G, [a i,1 ]G and broadcast;

[0067] B.2, Each receiver P j(j≠i) upon receiving from P i After receiving the message, verify f using Feldman's VSS. i (j)G=[a i,0 G+[a i,1 If [j]G is true, then its share is valid; otherwise, repeat step B.1.

[0068] B.3. The group private key for the (2,3) threshold SM2 signature scheme is obtained through the above process. The public key pk = [d]G = [r1]G + [r2]G + [r3]G; According to the information distributed above, P1 has a secret share of the private key d as d1 = f1(1) + f2(1) + f3(1), P2 has a secret share of the private key d as d2 = f1(2) + f2(2) + f3(2), and P3 has a secret share of the private key d as d3 = f1(3) + f2(3) + f3(3).

[0069] Furthermore, the detailed process of step C is as follows: After receiving the message m to be signed, according to the SM3 cryptographic hash algorithm H in the system's public parameter set SP, each participating party P... i Calculate the hash value of the message e = H(m).

[0070] Furthermore, the detailed process of step D is as follows:

[0071] D.1, Each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial g for each of the following: i (x)=b i,0 +b i,1 x makes b i,0 =k i , where b i,0 and b i,1 Randomly and uniformly select from the finite field Fp, calculate g. i (1), g i (2), g i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculation of b using Feldman's VSS i,0 and b i,1 The promise [b i,0 G, [b i,1 ]G and broadcast;

[0072] D.2, Each receiver P j (j≠i) upon receiving from P iAfter receiving the message, verify g using Feldman's VSS. i (j)G=[b i,0 G+[b i,1 If [j]G is true, then its share is valid; otherwise, repeat step D.1.

[0073] D.3. The random value of the (2,3) threshold SM2 signature scheme is obtained through the above process. Based on the information distributed above, P1 has a secret share of random number k as k1 = g1(1) + g2(1) + g3(1), P2 has a secret share of random number k as k2 = g1(2) + g2(2) + g3(2), and P3 has a secret share of random number k as k3 = g1(3) + g2(3) + g3(3).

[0074] Furthermore, the detailed process of step E is as follows:

[0075] E.1. During the secret sharing of (d+1), according to the various participants P in step B... i The secret share d obtained i P i Its secret share d i Incrementing by 1 yields (d) i +1), and finally P1 has a secret share of (d+1) of (d1+1), P2 has a secret share of (d+1) of (d2+1), and P3 has a secret share of (d+1) of (d3+1).

[0076] E.2. During the secret sharing of the random number k', each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial h for each of the following: i (x)=c i,0 +c i,1 x makes c i,0 =k i ', where c i,0 and c i,1 Randomly and uniformly select from the finite field Fp, calculate h i (1), h i (2), h i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for c using Feldman's VSS i,0 and c i,1 The promise [c i,0 G, [c i,1 ]G and broadcast;

[0077] E.3, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify h using Feldman's VSS. i (j)G=[c i,0 G+[c i,1 If [j]G is true, then its share is valid; otherwise, repeat step E.2.

[0078] E.4. Random values ​​are obtained through the above process. Based on the information distributed above, P1 has a secret share of the random number k' as k1' = h1(1) + h2(1) + h3(1), P2 has a secret share of the random number k' as k2' = h1(2) + h2(2) + h3(2), and P3 has a secret share of the random number k' as k3' = h1(3) + h2(3) + h3(3).

[0079] E.5. During the secret sharing of (d+1)k', each participating party P i Construct a random secret sharing polynomial w for each of the following. i (x)=v i,0 +v i,1 x makes v 1,0 =3k1'(d1+1), v 2,0 =-3k2'(d2+1), v 3,0 =k3'(d3+1), where v i,0 and v i,1 Randomly and uniformly select from the finite field Fp, calculate w i (1), w i (2), w i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculate the value of v using Feldman's VSS. i,0 and v i,1 The promise [v] i,0 G, [v i,1 ]G and broadcast;

[0080] E.6, Each Recipient P j (j≠i) upon receiving from P i After receiving the message, verify w via Feldman's VSS. i (j)G=[v i,0 G+[v i,1 If [j]G is true, then its share is valid; otherwise, repeat step E.5.

[0081] E.7 P i Having a secret share of (d+1)k' That is, P1 has a secret share of (d+1)k' of v1 = w1(1) + w2(1) + w3(1), P2 has a secret share of (d+1)k' of v2 = w1(2) + w2(2) + w3(2), and P3 has a secret share of (d+1)k' of v3 = w1(3) + w2(3) + w3(3);

[0082] E.8. Any two of the participants P1, P2, and P3 can recover the secret u = (d+1)k' through cooperation by virtue of their respective secret shares regarding (d+1)k'. Then, by performing the inverse operation, u can be obtained. -1 =(d+1) -1 k' -1 .

[0083] E.9. Based on the above steps, each participating party P i It is possible to calculate the value of (d+1) -1 secret share d i That is, P1 owns information about (d+1). -1 The secret share is d1' = u -1 k1', P2 has information about (d+1) -1 The secret share is d2' = u -1 k2', P3 has information about (d+1) -1 The secret share is d3' = u -1 k3'.

[0084] Furthermore, the detailed process of step F is as follows: according to the participation of each party P in step C... i The hash value e of the signed message m and the commitment [k]G = [k1]G + [k2]G + [k3]G = (x1, y1) obtained in step D regarding the random number k, where x1 and y1 are the values ​​of the elliptic curve E(F) and y1, respectively. p The x and y coordinates of the k-fold point above the base point, and the coordinates of each participating party P. i Then we can calculate the r part of the signature (r, s), that is, r = e + x1.

[0085] Furthermore, the detailed process of step G is as follows: according to the participation of each party P in step B... i Possessing a secret share d of the private key d i In step D, each participant P i Having a secret share k of the random number k i and each participant P in step F i The information in the r part of the calculated signature (r, s), and the information of each participating party Pi It can be calculated that its share of the secret regarding (k-rd) is u. i =k i -rd i That is, P1 has a secret share of (k-rd) of u1 = k1 - rd1, P2 has a secret share of (k-rd) of u2 = k2 - rd2, and P3 has a secret share of (k-rd) of u3 = k3 - rd3.

[0086] Furthermore, the detailed process of step H is as follows:

[0087] H.1, according to the participants P in step E i Get information about (d+1) -1 The secret share is d i 'and each participant P in step G' i The secret share of (k-rd) is obtained as u. i Each participating party P i Construct a random secret sharing polynomial l for each i (x)=t i,0 +t i,1 x makes t 1,0 =3u1d1',t 2,0 =-3u2d2',t 3,0 =u3d3', where t i,0 and t i,1 Randomly and uniformly select from the finite field Fp, calculate l i (1), l i (2), l i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculation of t using Feldman's VSS i,0 and t i,1 The promise [t] i,0 G, [t] i,1 ]G and broadcast;

[0088] H.2, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify it using Feldman's VSS. i (j)G=[t i,0 G+[t i,1 If [j]G is true, then its share is valid; otherwise, repeat step H.1.

[0089] H.3, P i Possessing information about (d+1) -1The secret share of (k-rd) is That is, P1 possesses information about (d+1). -1 The secret share of (k-rd) is s1 = l1(1) + l2(1) + l3(1), and P2 has a secret share of (d+1). -1 The secret share of (k-rd) is s2 = l1(2) + l2(2) + l3(2), and P3 has a secret share of (d+1). -1 The secret share of (k-rd) is s3 = l1(3) + l2(3) + l3(3).

[0090] Furthermore, the detailed process of step I is as follows: Participant P1 outputs information about (d+1) -1 The secret share information s1 = l1(1) + l2(1) + l3(1) of (k-rd) is given, and participant P2 outputs that it possesses information about (d+1). -1 The secret share information s2 = l1(2) + l2(2) + l3(2) of (k-rd) is given, and participant P3 outputs that it possesses information about (d+1). -1 The secret share information s3 of (k-rd) is s3 = l1(3) + l2(3) + l3(3); then, by combining any two of the secret share information s1, s2, and s3 output by the three participants, the secret (d+1) can be recovered. -1 (k-rd), which is s in the signature (r, s); then according to step F, the r part of the signature (r, s) is obtained, and each participant P i This will output the complete signature (r, s) of message m, where r = e + x1 and s = (d + 1). -1 (k-rd).

[0091] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.

[0092] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the protection scope of the present invention. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention fall within the protection scope of the present invention.

Claims

1. A (2,3) threshold SM2 signature method without a trusted center, characterized in that, Includes the following steps: Step A: System initialization phase: Based on the security parameters, run the system parameter generation algorithm and output the system's globally public parameter set SP; Step B (2, 3) Threshold key generation stage: Based on the system's global public parameter set SP, all participants randomly select their own random number r. i The shared share is then distributed to all participants using a (2,3) Shamir threshold scheme, while a commitment to the corresponding sharing polynomial is broadcast using Feldman's VSS. After verifying that each participant's share is valid, each party generates its own share d of the group private key sk = d = (r1 + r2 + r3). i At the same time, each group calculates its corresponding public key pk. Step C: Message Hash Calculation Phase: Based on the signed message m, each participant P... i Calculate its corresponding hash value e; Step D: Distributed generation stage of signature random numbers: Based on the system's globally public parameter set SP, call Step B to collaboratively generate random number k, use Feldman's VSS to publicly disclose the corresponding commitment, and secretly save the random values ​​selected by each party. Step E: For private key d, share (d + 1). -1 First, each participant generates a share of (d + 1) based on their share of d. Then, a random number k' is generated using a (2,3) threshold key generation algorithm, leading to a (2,3) secret share of (d + 1)k'. Finally, u = (d + 1)k' is recovered, and u is calculated. -1 Finally, each party calculates their share (d + 1). -1 The share; Step F: Based on the results obtained in Steps C and D, each participating party P... i Calculate the first part of the signature information r; Step G: Sharing (k - rd) Phase: Based on the share information obtained in Steps B and D, and the first part of the signature information r calculated in Step F, each participant P... i It can calculate its own secret share of (k - rd); Step H: Share (d + 1) -1 (k - rd) phase: Based on the share information obtained in steps E and G, each participant P i It can calculate what it owns about (d + 1). -1 The secret share of (k - rd); the specific implementation is as follows: H.1, according to the participants P in step E i Get information about (d + 1) -1 The secret share is d i 'and each participant P in step G' i The secret share of (k - rd) is obtained as u. i Each participating party P i Construct a random secret sharing polynomial l for each i (x) = t i,0 + t i,1 x makes t 1,0 = 3u1d1',t 2,0 = -3u2d2',t 3,0 = u3d3', where t i,0 and t i,1 Calculate l i (1), l i (2), l i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculate the value of t using Feldman's VSS. i,0 and t i,1 The promise [t] i,0 G, [t] i,1 ]G and broadcast; H.2, Each receiver P j , j ≠ i, upon receiving from P i After receiving the message, verify it using Feldman's VSS. i (j)G =[t i,0 ]G + [t i,1 If [j]G is valid, then its share is valid; Otherwise, repeat step H.1; H.3、(d + 1) -1 (k - rd) = ;P i Having information about (d + 1) -1 The secret share of (k - rd) is s i = That is, P1 possesses information about (d + 1). -1 The secret share of (k - rd) is s1 = l1(1) + l2(1) + l3(1), and P2 has a secret share of (d + 1). -1 The secret share of (k - rd) is s2 = l1(2) + l2(2) + l3(2), and P3 has a secret share of (d + 1). -1 The secret share of (k - rd) is s3 = l1(3) + l2(3) + l3(3); Step I: Output Signature Phase: Each participating party P i Output what it possesses about (d + 1) -1 After obtaining the secret share information of (k - rd), the second part of the signature information s can be obtained by combining the valid secret share information output by any two participants; finally, the valid signature (r, s) for message m is output.

2. The (2,3) threshold SM2 signature method without a trusted center according to claim 1, characterized in that, Step A is implemented as follows: Given a security parameter λ, generate the system's globally public parameter set SP = (F p , E(F p F(p, q, H) is a large prime number with a length of not less than 160 bits. p For a finite field, E(F) p For the selection of a, b∈F p Elliptic curve as a parameter (y 2 = x 3 The points satisfying the equation of the elliptic curve (x + b mod p) form an abelian group G of order q, H: {0, 1}. * →{0,1} 256 It is the SM3 cryptographic hash algorithm.

3. The (2,3) threshold SM2 signature method without a trusted center according to claim 1, characterized in that, Step B is implemented as follows: B.1, Each participating party P i Randomly select each of the following random numbers r i Construct a random secret sharing polynomial f for each of the following. i (x) =a i,0 + a i,1 x makes a i,0 = r i , where a i,0 and a i,1 From the finite field F p Randomly and uniformly select from the middle, calculate f i (1), f i (2), f i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for a using Feldman's VSS i,0 and a i,1 The promise [a i,0 G, [a i,1 ]G and broadcast; B.2, Each receiver P j (j ≠ i) upon receiving from P i After receiving the message, verify f using Feldman's VSS. i (j)G =[a i,0 ]G + [a i,1 If [j]G is valid, then its share is valid; Otherwise, repeat step B.1; B.

3. After steps B.1 and B.2, the group private key sk = d = is obtained. = r1 + r2 + r3, group public key pk= [d]G = [r1]G + [r2]G + [r3]G; P1 has a secret share of the group private key d as d1 = f1(1) + f2(1) + f3(1), P2 has a secret share of the group private key d as d2 = f1(2) + f2(2) + f3(2), and P3 has a secret share of the group private key d as d3 = f1(3) + f2(3) + f3(3).

4. The (2,3) threshold SM2 signature method without a trusted center according to claim 1, characterized in that, Step C is implemented as follows: After receiving the message m to be signed, each participating party P, according to the SM3 cryptographic hash algorithm H in the system's globally public parameter set SP, i Calculate the hash value of message m, e = H(m).

5. The (2,3) threshold SM2 signature method without a trusted center according to claim 1, characterized in that, Step D is implemented as follows: D.1, Each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial g for each of the following: i (x) =b i,0 + b i,1 x makes b i,0 = k i , where b i,0 and b i,1 Calculate g i (1), g i (2), g i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculation of b using Feldman's VSS i,0 and b i,1 The promise [b i,0 G, [b i,1 ]G and broadcast; D.2, Each receiver P j (j≠i) upon receiving from P i After receiving the message, verify g using Feldman's VSS. i (j)G =[b i,0 ]G + [b i,1 If [j]G is valid, then its share is valid; Otherwise, repeat step D.1; D.

3. After steps D.1 and D.2, the random value k is obtained. = k1 + k2 + k3; P1 has a secret share of random number k as k1 = g1(1) + g2(1) + g3(1), P2 has a secret share of random number k as k2 = g1(2) + g2(2) + g3(2), and P3 has a secret share of random number k as k3 = g1(3) + g2(3) + g3(3).

6. The (2,3) threshold SM2 signature method without a trusted center according to claim 1, characterized in that, Step E is implemented as follows: E.

1. During the secret sharing of (d + 1), according to the various participants P in step B... i The secret share d obtained i P i Its secret share d i Incrementing by 1 yields (d) i +1), and finally P1 has a secret share of (d+1) of (d1+1), P2 has a secret share of (d+1) of (d2+1), and P3 has a secret share of (d+1) of (d3+1). E.

2. During the secret sharing of the random number k', each participating party P i Randomly select their respective random numbers k i Construct a random secret sharing polynomial h for each of the following: i (x) = c i,0 + c i,1 x makes c i,0 = k i ', where c i,0 and c i,1 Calculate h i (1), h i (2), h i (3) and distributed to participants P1, P2, and P3 respectively; at the same time, P i Calculations for c using Feldman's VSS i,0 and c i,1 The promise [c i,0 G, [c i,1 ]G and broadcast; E.3, Each receiver P j (j ≠ i) upon receiving from P i After receiving the message, verify h using Feldman's VSS. i (j)G =[c i,0 ]G + [c i,1 If [j]G is valid, then its share is valid; Otherwise, repeat step E.2; E.4, Random value k' = = k1' + k2' + k3'; P1 has a secret share of the random number k' as k1' = h1(1) + h2(1) + h3(1), P2 has a secret share of the random number k' as k2' = h1(2) + h2(2) + h3(2), and P3 has a secret share of the random number k' as k3' = h1(3) + h2(3) + h3(3); E.

5. During the secret sharing of (d + 1)k', each participating party P i Construct a random secret sharing polynomial w for each of the following. i (x) = v i,0 + v i,1 x makes v 1,0 = 3k1'(d1 + 1), v 2,0 = -3k2'(d2+1), v 3,0 = k3'(d3 +1), where v i,0 and v i,1 Calculate w i (1), w i (2), w i (3) and distributed to participants P1 and P2 respectively. ， P3; Meanwhile, P i Calculate the value of v using Feldman's VSS. i,0 and v i,1 The promise [v] i,0 G, [v i,1 ]G and broadcast; E.6, Each Recipient P j (j ≠ i) upon receiving from P i After receiving the message, verify w via Feldman's VSS. i (j)G =[v i,0 ]G + [v i,1 If [j]G is valid, then its share is valid; Otherwise, repeat step E.5; E.7、(d + 1)k' = ;P i Having a secret share of (d + 1)k' of v i = That is, P1 has a secret share of (d + 1)k' as v1 = w1(1) + w2(1) + w3(1), P2 has a secret share of (d + 1)k' as v2 = w1(2) + w2(2) + w3(2), and P3 has a secret share of (d + 1)k' as v3 = w1(3) + w2(3) + w3(3); E.

8. Any two of the participants P1, P2, and P3 can recover the secret u = (d + 1)k' through cooperation by virtue of their respective secret shares regarding (d + 1)k'. Then, by performing the inverse operation, u can be obtained. -1 = (d + 1) -1 k' -1 ; E.9, Each participating party P i It is possible to calculate about (d + 1) -1 secret share d i That is, P1 possesses information about (d + 1). -1 The secret share is d1' = u -1 k1', P2 has information about (d + 1) -1 The secret share is d2' = u -1 k2', P3 has information about (d + 1) -1 The secret share is d3' = u -1 k3'.

7. The (2,3) threshold SM2 signature method without a trusted center according to claim 5, characterized in that, Step F is implemented as follows: According to the participants P in step C i The hash value e of the signed message m and the commitment [k]G = [k1]G + [k2]G + [k3]G = (x1, y1) obtained in step D regarding the random number k, where x1 and y1 are the elliptic curve E(F) and y1 are the hash value e of the signed message m and y1, respectively. p The x and y coordinates of the k-fold point above the base point, and the coordinates of each participating party P. i It is possible to calculate the r part of the signature (r, s), i.e., r = e + x1.

8. The (2,3) threshold SM2 signature method without a trusted center according to claim 6, characterized in that, Step G is implemented as follows: According to the participants P in step B i Possessing a secret share d of the private key d i In step D, each participant P i Having a secret share k of the random number k i and each participant P in step F i The information in the r part of the calculated signature (r, s), and the information of each participating party P i It can be calculated that its share of the secret regarding (k - rd) is u. i = k i - rd i That is, P1 has a secret share of (k - rd) of u1 = k1 - rd1, P2 has a secret share of (k - rd) of u2 = k2 - rd2, and P3 has a secret share of (k - rd) of u3 = k3 - rd3.

9. The (2,3) threshold SM2 signature method without a trusted center according to claim 8, characterized in that, Step I is implemented as follows: Participant P1 outputs information about (d + 1). -1 The secret share information s1 = l1(1) + l2(1) + l3(1) of (k - rd) is given, and participant P2 outputs information about (d + 1). -1 The secret share information s2 = l1(2) + l2(2) + l3(2) of (k - rd) is given, and participant P3 outputs information about (d + 1). -1 The secret share information s3 = l1(3) + l2(3) + l3(3) of (k - rd) can be obtained by combining any two of the secret share information s1, s2, and s3 output by the three participants. -1 (k - rd), which is s in the signature (r, s); then, according to step F, the r part of the signature (r, s) is obtained, and each participant P i This will output the complete signature (r, s) of message m, where r = e + x1 and s = (d + 1). -1 (k -rd).

Images