Threshold ecdsa signature method and system based on non-interactive distributed key

Abstract

The application discloses a threshold ECDSA signature method and system based on non-interactive distributed keys and relates to the technical field of information security. The application comprises non-interactive distributed key generation, message-independent pre-signature and online signature. The non-interactive distributed key generation is used for realizing distributed generation of public and private keys required for signature and construction of a set of honest participants in one round, thus getting rid of the requirement of interactive and multiple communication rounds. The message-independent pre-signature is used for generating pre-signature materials required for batch signature, thus reducing communication rounds and time delay from receiving a message to outputting a signature. The online signature is used for non-interactive generation of signature when a message is input. The application provides a robust threshold ECDSA signature protocol with low interaction and low time delay under a synchronous communication model, and guarantees robustness and round optimality of the protocol.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a threshold ECDSA signature method and system based on a non-interactive distributed key. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In recent years, due to the large-scale practical application of blockchain technology, research interest in threshold signatures in the cryptography community has begun to rebound. The ECDSA signature scheme is a signature scheme based on elliptic curve cryptography, consisting of a key generation phase, a signing phase, and a verification phase. Threshold ECDSA signature schemes have significant advantages in distributed security, flexibility, attack resistance, and algorithmic efficiency. They allow n participants to share the power to issue digital signatures under a single public key. The signature scheme specifies a threshold t, enabling any number of t or more participants to jointly sign, while any number of participants below the threshold t cannot generate a signature or obtain any information about the collective private key. This provides a highly reliable and robust digital signature solution for scenarios where multiple parties share private keys.

[0004] Most threshold ECDSA signature schemes require the use of two secure multi-party computation techniques: Beaver privacy inversion and multiplication-to-addition. They rely on linear homomorphic encryption algorithms. However, Paillier encryption, a previously commonly used linear homomorphic encryption algorithm, has a large communication volume and requires complex range proofs. In addition, threshold ECDSA signature schemes have never paid attention to robustness. If a malicious actor is detected, the execution of the protocol can only be terminated, which can lead to denial-of-service attacks.

[0005] As a crucial component of threshold signature schemes, distributed key generation schemes are used for key management and are responsible for generating temporary random numbers in many distributed multi-party security protocols. They are versatile and versatile building blocks that eliminate the single point of failure problem of private key storage in public-key cryptosystems, enabling a group of n participants to collectively generate a public-private key pair (pk, sk) that meets the specific requirements of a given public-key cryptosystem. In distributed key generation schemes, the key generation process does not require a trusted third party as a central node, and the generated public key pk represents the entire group, while the private key sk can be distributed and used in the form of secret shared shares, rather than being stored, computed, or reconstructed in a single location.

[0006] Research on distributed key generation mechanisms under synchronous communication models has largely followed the paradigms of Pedersen-DKG and GJKR-DKG. However, Pedersen-DKG suffers from insecurity: a Rushing Adversary exists that, in each round, can decide its message to send after receiving messages from all other parties. This Rushing Adversary can select its own random share based on the public key shares of other parties, with a certain probability making the public key pk output by the protocol satisfy its own set conditions; this means that the statistical distribution of the public key output by Pedersen-DKG cannot be guaranteed to be uniformly random. Although a simple threshold Schnorr signature protocol constructed based on Pedersen-DKG (in the absence of parallel instances) is still provably unforgeable, the existence of this key offset attack, or key influence attack, means that this scheme cannot always be securely applied to other scenarios. GJKR-DKG eliminates this problem by using the Pedersen verifiable secret-sharing protocol, which has information-theoretic hiding properties for secrets. This ensures that the public key is uniformly distributed and can be used in any discrete logarithm-based cryptosystem. However, it doubles the computation and communication overhead of polynomial commitments and requires an additional round of communication to derive the public key.

[0007] Therefore, how to overcome the shortcomings of high latency and high communication overhead in the distributed key generation mechanism of existing protocols while ensuring security has become an urgent problem to be solved by existing technologies. Summary of the Invention

[0008] To address the shortcomings of existing technologies, the present invention aims to provide a threshold ECDSA signature method and system based on non-interactive distributed keys. Utilizing the CL encryption algorithm and considering the security and performance requirements of the threshold ECDSA signature scheme, this invention provides a robust threshold ECDSA signature protocol with low interaction and low latency under a synchronous communication model, based on a non-interactive distributed key generation scheme.

[0009] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0010] The first aspect of this invention provides a threshold ECDSA signature method based on a non-interactive distributed key, comprising the following steps:

[0011] Each participant generates a share ciphertext and sends the message through a broadcast channel. The participants who receive the broadcast message are then filtered to obtain a set of honest participants. Each participant aggregates the messages of the honest participants to obtain the collective public key.

[0012] Each participant generates two random nonce secret sharing shares. Each secret sharing share is multiplied and then added to obtain the sum of the two multiplication results and checked. The validity of each participant's generated secret sharing share is checked, and the pre-signed material is obtained based on the check results.

[0013] Based on the message to be signed, each honest participant generates and broadcasts a signature share, reconstructs the signature share using pre-signed material, and uses the reconstructed signature as the final signature.

[0014] Furthermore, the specific steps for each participant to generate the share ciphertext are as follows: each participant first generates common parameters, then generates a random t-order polynomial, and generates shares based on the polynomial. The encrypted random number commitment, the share ciphertext set, the polynomial commitment, and the zero-knowledge proof are encapsulated into a message and sent through a broadcast channel.

[0015] Furthermore, each participant generates public parameters through Public Key Infrastructure (PKI).

[0016] Furthermore, the specific steps for screening the participants who receive the broadcast message are as follows:

[0017] After receiving the message broadcast by all other participants, each participant verifies the zero-knowledge proof in the message using a non-interactive zero-knowledge proof system. If the verification is successful, the participant is added to the set of honest participants, thus constructing the final set of honest participants.

[0018] Furthermore, the specific steps for each participant to aggregate the messages from honest participants to obtain the collective public key are as follows:

[0019] Each participant multiplies and aggregates the power-law commitments of the polynomial constant terms of all honest participants to obtain the collective public key. They decrypt the ciphertexts of the shares sent to them by all honest participants and add them together to obtain a Shamir secret shared share of the collective private key.

[0020] Furthermore, the steps for converting the multiplication to addition calculation for each secret shared share include:

[0021] Each ordered pair consisting of two honest participants performs two multiplication-to-addition operations to obtain an addition share of the two multiplication results. Each participant makes a power-wise commitment to each randomly generated value in the multiplication-to-addition process so that other participants can check the correctness of the multiplication-to-addition steps at the power level. If the check fails, a complaint message is broadcast to the participant who made the commitment. If other parties verify that the complaint message is valid, they remove the participant who made the commitment from the honest set.

[0022] Furthermore, the specific steps for validating the secret-sharing share generated by each participant and obtaining pre-signed materials based on the check results are as follows:

[0023] Each participant generates a secret share and uses broadcast commitments and zero-knowledge proofs of discrete logarithms to allow other participants to verify the validity of the secret share. If any check fails, the sender of the relevant message is removed from the set of honest participants.

[0024] Furthermore, based on the message to be signed, the specific steps for each honest participant to generate and broadcast a signature share are as follows:

[0025] Upon receiving a message to be signed, each honest participant generates and broadcasts a signature share. After receiving the signature share, the participants generate the sender's signature share using Lagrange interpolation and verify its validity.

[0026] Furthermore, the specific steps for reconstructing the signature share using pre-signed materials are as follows: if the size of the set of honest participants is greater than or equal to the threshold value of the threshold signature, then each honest participant reconstructs the signature share through two Lagrange interpolations and returns the final signature.

[0027] A second aspect of the present invention provides a threshold ECDSA signature system based on a non-interactive distributed key, comprising:

[0028] The non-interactive distributed key generation module is configured to generate share ciphertext for each participant through the public key infrastructure and send the message through the broadcast channel. The module also filters the participants who receive the broadcast message to obtain a set of honest participants. Each participant aggregates the messages of the honest participants to obtain the collective public key.

[0029] The message-independent pre-signature module is configured to generate two random nonce secret sharing shares for each participant. Each secret sharing share is multiplied and then added to obtain the sum of the two multiplication results and checked. The validity of the secret sharing shares generated by each participant is checked, and the pre-signature material is obtained based on the check results.

[0030] The online signature module is configured to generate and broadcast a signature share for each honest participant based on the message to be signed, reconstruct the signature share using pre-signed material, and use the reconstructed signature as the final signature.

[0031] The above one or more technical solutions have the following beneficial effects:

[0032] This invention discloses a threshold ECDSA signature method and system based on a non-interactive distributed key. Based on the CL encryption algorithm, it significantly reduces the number of communication rounds in the key generation stage and can also be used for random nonce generation, optimizing the overall communication rounds for signature generation. The threshold ECDSA signature of this application possesses self-healing and round-optimal properties. The message-independent pre-signature designed in this invention can complete the generation of pre-signature material with fewer communication rounds, thus providing a faster signature scheme.

[0033] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0034] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0035] Figure 1 This is an overall framework diagram of the threshold ECDSA signature method based on non-interactive distributed keys in Embodiment 1 of the present invention;

[0036] Figure 2 This is a schematic diagram of the non-interactive distributed key generation in Embodiment 1 of the present invention;

[0037] Figure 3 This is a schematic diagram of the pre-signature unrelated to the message in Embodiment 1 of the present invention;

[0038] Figure 4 This is a schematic diagram of the online signature in Embodiment 1 of the present invention. Detailed Implementation

[0039] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0040] It should be noted that in the embodiments of the present invention, data related to messages is involved. When the above embodiments of the present invention are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0041] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0042] The Castagnos–Laguillaumie (CL) encryption algorithm is a construct similar to the exponential ElGamal encryption algorithm. Under the subgroup membership hardness assumption, the CL encryption algorithm can be proven to be IND-CPA secure. It also satisfies the linear (addition, scalar multiplication) homomorphism of the Paillier encryption algorithm. However, in secure multi-party computation protocols, the CL encryption algorithm can avoid the use of expensive range proofs. Furthermore, under the same security parameters, the ciphertext length is only about 1 / 3 of that of Paillier, which can significantly reduce the amount of communication.

[0043] Therefore, based on the non-interactive verifiable secret sharing scheme using the CL encryption algorithm, this invention constructs a non-interactive distributed key generation protocol NI-DKG that supports proactive security under a synchronous communication model, enabling the distributed generation of public and private keys required for signature within a single round. Furthermore, based on this non-interactive distributed key generation protocol, this invention proposes a robust threshold ECDSA signature protocol that simultaneously possesses self-healing and round-optimal properties. Details are as follows.

[0044] Example 1:

[0045] Embodiment 1 of the present invention provides a threshold ECDSA signature method based on a non-interactive distributed key, such as... Figure 1 As shown, this method is based on zero-knowledge proof for malicious actor identification and robustness support. First, it generates a non-interactive distributed key using homomorphic encryption based on the CL encryption algorithm, and obtains a one-time random number suitable for threshold ECDSA signatures and a public key infrastructure suitable for threshold ECDSA signatures. Through multi-party secure modular inverse based on CL homomorphic encryption and product operation, it obtains an ECDSA signature output that is compatible with existing systems.

[0046] Specifically, this includes non-interactive distributed key generation, message-independent pre-signing, and online signing stages:

[0047] Step 1, non-interactive distributed key generation, such as Figure 2As shown, the process includes share ciphertext distribution, honest participant screening, and key aggregation. Each participant generates share ciphertext through Public Key Infrastructure (PKI) and broadcasts the message via a broadcast channel. The participant then filters the recipients of the broadcast message to obtain a set of honest participants. Each participant then aggregates the messages from the honest participants to obtain the collective public key.

[0048] Step 1.1, Share Ciphertext Distribution: Each participant first generates public parameters through the public key infrastructure, then generates a random t-order polynomial, and generates shares based on the polynomial. The encrypted random number commitment, the share ciphertext set, the polynomial commitment, and the zero-knowledge proof are encapsulated into a message and sent through the broadcast channel.

[0049] Step 1.1.1, each participant P i Generate common parameters pp = (G, q, g, pk) using PKI. i ,sk i );

[0050] Where G is the prime-order elliptic curve group, with generator g, q being a prime number, and pk... i ,sk i For a public-private key pair suitable for the CL homomorphic encryption algorithm, where the public key is known to all parties involved;

[0051] Step 1.1.2, each participant P i Each select polynomial coefficients on Constructing a stochastic t-th order polynomial And make a power-law commitment on the group for each of its coefficients.

[0052] in Denotes the group of integers of order q;

[0053] Step 1.1.3, each participant P i The function values ​​at n points on the polynomial are used as the share to be shared with other participants {s}. i,j} j ←{f i (id j )} j∈[1..n] Generate encrypted random number r j ← $ D q and its commitments and each share i,j PK using the public key of the CL algorithm of the corresponding participants. j Encrypt {E i,j} j ←{CL.Enc(pk j ,s i,j;r i )} j∈[1..n] Use the same encrypted random number to save communication overhead;

[0054] Where the symbol ← indicates assignment; the symbol ← $ D indicates that the left side represents a value randomly selected from the right side. q The set of integers within an interval generated when instantiating the group in the CL encryption algorithm based on the order q of a known-order subgroup that is easily solvable by discrete logarithms. Generate generators for unknown-order subgroups in the CL encryption algorithm;

[0055] Step 1.1.4, each participant P i Generate a proof that all the above steps have been correctly completed using a non-interactive zero-knowledge proof system.

[0056] Step 1.1.5, each participant P i Encrypt random number commitment R j Share ciphertext set {E i,j} j Polynomial commitment {A i,k} k Zero-knowledge proof It is encapsulated as a message and sent through a broadcast channel.

[0057] Step 1.2, Honest Participant Screening: After receiving messages broadcast by all other participants, each participant verifies the zero-knowledge proof in the message using a non-interactive zero-knowledge proof system. If the verification passes, the participant is added to the honest participant set, resulting in the final honest participant set. Due to the ingenious construction of the non-interactive zero-knowledge proof system, all participants obtain a consistent set of honest participants.

[0058] Step 1.3, Key Aggregation: Each participant multiplies and aggregates the power-law commitments of the polynomial constant terms of all honest participants to obtain the collective public key. They then decrypt the ciphertexts of the shares sent to them by all honest participants and aggregate them by addition to obtain a Shamir secret share of the collective private key. Furthermore, the power-law commitments of the Shamir shares of other participants' private keys and the ciphertexts of other participants' private keys can be calculated.

[0059] Step 1.3.1: Each participant performs multiplicative aggregation of the power commitments of the polynomial constant terms sent to them by all honest participants to obtain the collective public key X←∏ j∈P A j,0 Furthermore, by utilizing polynomial commitments to calculate the share at a power level and then aggregating them, we can obtain the power-law commitments of Shamir's private key share from other participants.

[0060] Step 1.3.2: Each participant decrypts the ciphertext of the shares sent to them by all honest participants and performs addition to obtain a Shamir secret shared share x of the collective private key. i ←∑ j∈P CL.Dec(sk i ,(R j E j,i Furthermore, the ciphertext of other participants' private keys can be obtained by utilizing the homomorphic addition of the CL encryption algorithm.

[0061] Step 2, message-independent pre-signature, such as Figure 3 As shown, the process includes nonce share generation, multiplication-to-addition, share disclosure, and pre-signature output. Each participant generates two random nonce secret shared shares. Each nonce secret shared share is then calculated using multiplication-to-addition to obtain the sum of the two multiplication results, which is then checked. The validity of each participant's generated nonce secret shared share is checked, and the pre-signature material is obtained based on the check results.

[0062] Step 2.1, Nonce Share Generation: Each participant first executes two instances of the non-interactive distributed key generation protocol from Step 1 in parallel to collaboratively generate two secret shared shares of random nonce k and γ, and outputs the ciphertext of the share of nonce k of other participants that needs to be used in the multiplication-to-addition step.

[0063] Step 2.2, Multiplication to Addition: Each ordered pair consisting of two honest participants performs two multiplication to addition operations to obtain the addition share of the two multiplication results; each participant makes a power-law commitment to each randomly generated value in the multiplication to addition operation so that other participants can check the correctness of the multiplication to addition step at the power level; if the check fails, a complaint message against the participant who made the commitment is broadcast, and if other parties verify that the complaint message is valid, the participant who made the commitment is removed from the honest set.

[0064] Step 2.2.1, in order to obtain k j ·γ i Addition share α j，i β j，i and k j ·x i The addition share μ j，i v j，i For all P j，j∈P\{i} Each honest participant P i from Random number β is randomly selected from the middle. j，i and v j，iIt also made an exponential commitment to each randomly generated value, generating a corresponding... and

[0065] Step 2.2.2, each honest participant P i By analyzing k j CL algorithm ciphertext Linear homomorphic operations yield share α j，i and share μ j，i ciphertext and Then the ciphertext and And the power-law commitment B of random values j，i and N j，i Broadcast transmission;

[0066] Step 2.2.3, received P i Following the broadcast message, each honest participant P j Decrypting the share ciphertext and Obtain the corresponding share and And through inspection and To check whether P is true or false i The correctness of the steps for converting multiplication to addition is ensured.

[0067] Step 2.2.3, if the check fails, then P j Broadcast a message to P i If other parties verify the validity of the complaint message, then P will... i Remove from the honest set.

[0068] Step 2.3, Share Disclosure: Each participant generates a secret shared share {δ = kγ} representing their own held shares. i，j} j It utilizes broadcast commitments and zero-knowledge proofs of discrete logarithms to allow other participants to verify the validity of the secret-shared shares. If any check fails, the sender of the relevant message is removed from the set of honest participants.

[0069] Step 2.3.1, each participant P i Generate commitments Used for verification by other participants {δ i，j} j The validity of the proof is determined by generating a non-interactive zero-knowledge proof system based on the equality of discrete logarithms. Proof that it was obtained correctly

[0070] Step 2.3.2, each participant P i Generate a secret shared share {δ = kγ} i，j} j When i ≠ j, δ i，j =α i，j +β i，j +θ i，j When i = j, δ i，j =k i γ i +θ i，i ;

[0071] Where {θ i，j} j Obtained by calling the (t, n) Shamir secret sharing with a polynomial constant term of 0, used to mask P. i Local secrets;

[0072] Step 2.3.3, each participant P i Will promise D i Zero-knowledge proof and secretly share {δ i，j} j Encapsulate it into a message and send it through a broadcast channel;

[0073] Step 2.3.4: After receiving the messages broadcast by all other participants, each participant performs a zero-knowledge proof on the messages. Through non-interactive zero-knowledge proof systems Verification is performed, and the result of the verification indicates whether D is correct or not. i If the message is generated correctly, and any check fails, the sender of the message will be removed from the set of honest participants.

[0074] Step 2.3.5, each participant P j≠i δ was obtained through Lagrange interpolation. i =∑ j L j ·δ i，j And by checking δ i +∑ j≠i L j ·(β i，j -β j，i )=∑ j≠i L j ·(α i,j +β i，j +λ i,j )+L i (k i γ i +θ i,i )=k i Whether γ is true, that is, checking To verify P, we need to determine whether it holds true. i The provided {δ i，j} j If any check fails, the sender of the relevant message will be removed from the set of honest participants.

[0075] Where k i ·γ j =α i,j +β j，i , The final set of honest participants is denoted as P. * .

[0076] Step 2.4, Pre-signed output: Returns the pre-signed material for use in the online signing stage.

[0077] Step 2.4.1, each honest participant P i {δ} is obtained through Lagrange interpolation. j} j ←{∑ l∈P L1·δ j，l} j ;

[0078] Note that due to the dynamic changes in the set of honest participants P, in step 2.3.5, during verification, the {δ} obtained using Lagrange interpolation is compared to the aggregation in step 2.4.1. j} j They may be different; if they are different, then the previously calculated {δ} cannot be used. j} j It is necessary to treat {δ} j} j Recalculate.

[0079] Step 2.4.2, P i Then, δ←∑ is obtained through Lagrange interpolation. j∈P L j ·δ j ;

[0080] Step 2.4.3, using δ, P i The R←Γ required to generate the signature can be calculated. 1 / δ And the verification process required during the online signature stage.

[0081] Step 2.4.4, P i k i Step 2.2.1 generates {v j,i} j≠i Step 2.3.1 generates {μ i，j} j≠iThe R generated in step 2.4.3 is encapsulated into Then {K j} j Step B2.1 generates {{N j,l} l≠j} j And the {R} generated in step 2.4.3 j} j Encapsulated as V i ;

[0082] in, Used to generate the signature itself, while V i =({K j} j , {R j} j , {{N j,l} l≠j} j This is used for the verification process during the online signature phase.

[0083] Step 3, online signature, such as Figure 4 As shown, this includes signature share distribution and signature reconstruction. Based on the message to be signed, each honest participant generates and broadcasts a signature share, reconstructs the signature share using pre-signed material, and uses the reconstructed signature as the final signature.

[0084] Step 3.1, Signature Share Distribution: After receiving the message to be signed, each honest participant generates and broadcasts a signature share. After receiving the signature share, the participant generates the sender's signature share through Lagrange interpolation and verifies its validity.

[0085] Step 3.1.1, each honest participant P i Generate commitments Then generated through a non-interactive zero-knowledge proof system.

[0086] proof

[0087] Step 3.1.2, P i Hash the message to get m←H(msg), and get r←R| from R. x-axis Then, the (t, n) Shamir secret share with constant term m is called to generate {m i,j} j ;

[0088] Step 3.1.3, P i Generate signature share {s i，j} j and associate it with commitment and zero-knowledge proofs Encapsulate it into a message and send it through a broadcast channel;

[0089] Where, when i≠j, s i，j =r(μ) i，j +v j,i )+k i m i,j When i = j, s i，j =rk i x i +k i m i,i ;

[0090] Step 3.1.4: After receiving the above message, the participating parties... Zero-knowledge proofs in the above message Through non-interactive zero-knowledge proof systems Zero-knowledge proofs are used for verification. If the verification passes, P1 generates a signature share using Lagrange interpolation. And through inspection Whether it is valid is used to verify the signature share s i Whether it is valid or not, if any check fails, the sender of the relevant message will be removed from the set of honest participants P. * Remove from;

[0091] Step 3.2, Signature Reconstruction: If the set P of honest participants at this time... * If the value of the signature is greater than or equal to t, then each honest participant reconstructs the signature share using two Lagrange interpolations and returns the final signature. Here, t represents the threshold value of the (t, n) threshold signature, which allows any t or more participants to sign together, while any number of participants who do not reach the threshold t cannot generate a signature or obtain any information about the collective private key; t and n are determined according to the actual wallet scheme implemented, and common ones are (3, 5), etc.

[0092] The set of honest participants P in the online signature phase of this invention * It doesn't have to be exactly the same as the set of participants p from the pre-signing phase; it only needs t or more honest participants from the pre-signing phase to continue in the online signing phase, i.e., |P * If ∩P|≥t, the signature can be output correctly.

[0093] Step 3.2.1, if the set of honest participants P * If the size is greater than or equal to t, then each honest participant... obtained through Lagrange interpolation

[0094] Step 3.2.2, P iThen obtain it through Lagrange interpolation. Then, s and r generated in step C1.2 are returned together as the final signature (r, s).

[0095] This invention discloses a robust threshold ECDSA signature protocol based on a non-interactive distributed key generation scheme, including non-interactive distributed key generation, message-independent pre-signature, and online signature. The non-interactive distributed key generation is used to distribute the generation of the public and private keys required for signing and construct the set of honest participants within a single round, eliminating the need for interactive and multiple communication rounds. The message-independent pre-signature is used to generate the pre-signature materials required for signing in batches, reducing the number of communication rounds and the latency from receiving a message to outputting a signature. The online signature is used to generate the signature non-interactively upon receiving the message. The novel protocol provided by this invention not only achieves robustness and round-optimization but also represents a substantial improvement over current state-of-the-art research. In the absence of a trusted central node, the non-interactive distributed key generation scheme and robust threshold ECDSA signature protocol proposed in this invention are of great significance.

[0096] Specifically, this invention provides robustness or self-healing: after detecting a malicious actor, honest participants can eliminate the influence of the malicious actor and continue the current protocol operation. The non-interactive distributed key generation scheme proposed in this invention is built on a non-interactive verifiable secret sharing scheme under a synchronous model. It can achieve distributed generation of the public and private keys required for signing within one round, eliminating the need for interactive operations and multiple communication rounds. It also reduces the overall communication rounds required for ECDSA signing, achieving a one-round key generation phase and a three-round signing phase. The set of participants P in the online signing phase of this invention... * It is not necessary for the participants p to be exactly the same as those in the pre-signing phase; only t or more honest participants from the pre-signing phase need to continue to participate in the online signing phase. It can correctly output the signature; this invention can provide users with a fast and secure threshold ECDSA signature protocol in more fields such as blockchain.

[0097] Example 2:

[0098] Embodiment 2 of the present invention provides a threshold ECDSA signature system based on a non-interactive distributed key, comprising:

[0099] The non-interactive distributed key generation module is configured to generate share ciphertext for each participant through the public key infrastructure and send the message through the broadcast channel. The module also filters the participants who receive the broadcast message to obtain a set of honest participants. Each participant aggregates the messages of the honest participants to obtain the collective public key.

[0100] The message-independent pre-signature module is configured to generate two random nonce secret sharing shares for each participant. Each nonce secret sharing share is multiplied and then added to obtain the sum of the two multiplication results and checked. The validity of the nonce secret sharing shares generated by each participant is checked, and the pre-signature material is obtained based on the check results.

[0101] The online signature module is configured to generate and broadcast a signature share for each honest participant based on the message to be signed, reconstruct the signature share using pre-signed material, and use the reconstructed signature as the final signature.

[0102] The steps and methods involved in the above embodiment two correspond to those in embodiment one. For specific implementation details, please refer to the relevant description section of embodiment one.

[0103] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0104] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A threshold ECDSA signature method based on a non-interactive distributed key, characterized in that, Includes the following steps: Each participant generates a share ciphertext and sends the message through a broadcast channel. The participants who receive the broadcast message are then filtered to obtain a set of honest participants. Each participant aggregates the messages of the honest participants to obtain the collective public key. Each participant generates two random nonce secret sharing shares. Each secret sharing share is multiplied and then added to obtain the sum of the two multiplication results and checked. The validity of each participant's generated secret sharing share is checked, and the pre-signed material is obtained based on the check results. According to the message to be signed, each honest participant generates and broadcasts a signature share, reconstructs the signature share using pre-signed materials, and uses the reconstructed signature as the final signature. The specific steps for each honest participant to generate and broadcast a signature share according to the message to be signed are as follows: after receiving the message to be signed, each honest participant generates and broadcasts a signature share. After receiving the signature share, the participant generates the sender's signature share through Lagrange interpolation and verifies its validity. The specific steps for reconstructing the signature share using pre-signed materials are as follows: if the size of the set of honest participants is greater than or equal to the threshold value of the threshold signature, then each honest participant reconstructs the signature share through two Lagrange interpolations and returns the final signature.

2. The threshold ECDSA signature method based on non-interactive distributed keys as described in claim 1, characterized in that, The specific steps for each participant to generate the share ciphertext are as follows: Each participant first generates common parameters, then generates a random t-order polynomial, and generates shares based on the polynomial. The encrypted random number commitment, the share ciphertext set, the polynomial commitment, and the zero-knowledge proof are encapsulated into a message and sent through a broadcast channel.

3. The threshold ECDSA signature method based on non-interactive distributed keys as described in claim 2, characterized in that, Each participant generates public parameters through the public key infrastructure.

4. The threshold ECDSA signature method based on non-interactive distributed keys as described in claim 2, characterized in that, The specific steps for screening the participants who received the broadcast message are as follows: After receiving the message broadcast by all other participants, each participant verifies the zero-knowledge proof in the message using a non-interactive zero-knowledge proof system. If the verification is successful, the participant is added to the set of honest participants, thus constructing the final set of honest participants.

5. The threshold ECDSA signature method based on a non-interactive distributed key as described in claim 4, characterized in that, The specific steps for each participant to aggregate the messages from honest participants to obtain the collective public key are as follows: Each participant multiplies and aggregates the power-law commitments of the polynomial constant terms of all honest participants to obtain the collective public key. They decrypt the ciphertexts of the shares sent to them by all honest participants and add them together to obtain a Shamir secret shared share of the collective private key.

6. The threshold ECDSA signature method based on non-interactive distributed keys as described in claim 1, characterized in that, The steps for performing a multiplication-to-addition calculation for each secret shared share include: Each ordered pair consisting of two honest participants performs two multiplication-to-addition operations to obtain an addition share of the two multiplication results. Each participant makes a power-wise commitment to each randomly generated value in the multiplication-to-addition process so that other participants can check the correctness of the multiplication-to-addition steps at the power level. If the check fails, a complaint message is broadcast to the participant who made the commitment. If other parties verify that the complaint message is valid, they remove the participant who made the commitment from the honest set.

7. The threshold ECDSA signature method based on a non-interactive distributed key as described in claim 6, characterized in that, The specific steps for validating the secret-sharing share generated by each participant and obtaining pre-signed materials based on the check results are as follows: Each participant generates a secret share and uses broadcast commitments and zero-knowledge proofs of discrete logarithms to allow other participants to verify the validity of the secret share. If any check fails, the sender of the relevant message is removed from the set of honest participants.

8. A threshold ECDSA signature system based on a non-interactive distributed key, characterized in that, include: The non-interactive distributed key generation module is configured to generate share ciphertext for each participant through the public key infrastructure and send the message through the broadcast channel. The module also filters the participants who receive the broadcast message to obtain a set of honest participants. Each participant aggregates the messages of the honest participants to obtain the collective public key. The message-independent pre-signature module is configured to generate two random nonce secret sharing shares for each participant. Each secret sharing share is subjected to multiplication-to-addition calculation to obtain the sum of the two multiplication results and is checked. The validity of the secret sharing shares generated by each participant is checked, and the pre-signature material is obtained based on the check results. The online signature module is configured to generate and broadcast a signature share based on the message to be signed by each honest participant, reconstruct the signature share using pre-signed materials, and use the reconstructed signature as the final signature. The specific steps for each honest participant to generate and broadcast a signature share based on the message to be signed are as follows: after receiving the message to be signed, each honest participant generates and broadcasts a signature share; after receiving the signature share, the participant generates the sender's signature share through Lagrange interpolation and verifies its validity. The specific steps for reconstructing the signature share using pre-signed materials are as follows: if the size of the set of honest participants is greater than or equal to the threshold value of the threshold signature, then each honest participant reconstructs the signature share through two Lagrange interpolations and returns the final signature.

Images