Threshold ecsga signature method and system based on pseudo-random number generator

Abstract

This invention discloses a threshold ECDSA signature method and system based on a pseudo-random number generator, including distributed key generation, pre-signing, online signing, and signature verification. Distributed key generation is used to distribute the generation of the public and private keys required for signing and to construct the pseudo-random number generator seed; pre-signing is used to quickly generate the pre-signature material required for signing; online signing is used to quickly generate a signature pair based on public parameters and the pre-signature material when the signature message arrives; and signature verification is used to verify the signature pair. This invention uses a pseudo-random number generator to solve the multi-party multiplication problem in the pre-signing stage, securely generating the material in the form of additive shares required for signing. Compared with the expensive and complex multi-party multiplication-to-addition operations commonly used in existing protocols, this achieves optimized communication rounds and a significant reduction in communication overhead.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a threshold ECDSA signature method and system based on a pseudo-random number generator. Background Technology

[0002] The statements in this section merely refer to the background art related to this invention and do not necessarily constitute prior art.

[0003] With the popularization and development of digital assets, the Elliptic Curve Digital Signature Algorithm (ECDSA) signature scheme is becoming increasingly valuable. ECDSA is a signature scheme based on elliptic curve cryptography, consisting of a key generation phase, a signing phase, and a verification phase. The (t,n) threshold ECDSA signature scheme is based on secure multi-party computation. It divides a private key into multiple shares and distributes them to n different participants. Then, any number of more than t participants are allowed to generate a valid signature through collaboration, without any single party possessing the complete private key. This improves the security of the private key, preventing its theft or loss, and also enables multi-party consensus and authorization. It is used in various scenarios, including blockchain.

[0004] A key step in threshold ECDSA signature schemes is to perform the multiplication of two secrets without revealing the secret shares, with these two secrets distributed among different participants in the form of shares. The common approach in existing schemes is the secure multi-party computation technique of multiplicative-to-additive (MtA). However, the implementation of this scheme is quite complex, especially when multiple parties are involved, requiring multiple rounds of interaction, which accounts for the majority of the computation and communication overhead of the overall scheme. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a threshold ECDSA signature method and system based on a pseudo-random number generator, which has the advantages of low interaction and low latency.

[0006] On the one hand, a threshold ECDSA signature method based on a pseudo-random number generator is provided;

[0007] Threshold ECDSA signature methods based on pseudo-random number generators include:

[0008] Each participant generates a seed share and a polynomial share for a pseudo-random number generator, distributes the generated data to other participants, and broadcasts polynomial coefficient commitments.

[0009] Each participant uses a multinomial coefficient commitment to verify the validity of the received multinomial share. If valid, a public key is generated based on the multinomial coefficient commitment, and a private key share is generated based on the multinomial shares of all participants. At the same time, a shared pseudo-random number generator seed is generated for itself and other participants.

[0010] Each participant converts its (t,n) secret shared key share into a (t,t+1) secret shared key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share;

[0011] After obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature.

[0012] Verify the message signature and return the verification result.

[0013] On the other hand, a threshold ECDSA signature system based on a pseudo-random number generator is provided;

[0014] Threshold ECDSA signature systems based on pseudo-random number generators include:

[0015] The distributed key generation module is configured as follows: each participant generates a pseudo-random number generator seed share and a multinomial share, distributes the generated data to other participants, and broadcasts a multinomial coefficient commitment; each participant uses the multinomial coefficient commitment to verify whether the received multinomial share is valid, and if valid, generates a public key based on the multinomial coefficient commitment, and generates its own private key share based on the multinomial shares of all participants; at the same time, it generates a shared pseudo-random number generator seed for itself and other participants.

[0016] The pre-signature module is configured as follows: each participant converts its (t,n) secret shared key share into a (t,t+1) secret shared key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share.

[0017] The online signature module is configured as follows: after obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature.

[0018] The signature verification module is configured to verify the signature of a message and return the verification result.

[0019] The above technical solution has the following advantages or beneficial effects:

[0020] (1) This invention provides a novel lightweight threshold ECDSA signature protocol. Based on this design, the communication overhead and computational complexity of threshold ECDSA signature are effectively reduced.

[0021] (2) The pre-signature module based on the pseudo-random number generator designed in this invention can efficiently generate some of the materials required for signing without encryption operations and with simple data interaction. This solves the problem of high overhead of multi-party multiplication schemes in existing threshold ECDSA signature schemes, greatly reduces the number of communication rounds to generate pre-signature materials, and thus provides a faster threshold signature scheme.

[0022] (3) The pre-signature module and online signature module designed in this invention cleverly transform the multi-party multiplication and modular inverse operation in the threshold ECDSA signature protocol into simple operations performed locally by each participant. At the same time, under the semi-honest adversary model, the pseudo-random number generator and simple addition secret sharing share can enable multiple participants to efficiently complete the signature operation without revealing their secret share by using a pseudo-random number generator and simple addition secret sharing share. Only one communication is required between each of the other designated participants in the pre-signature module and the signature module, which satisfies the requirements of correctness and efficiency. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0024] Figure 1 This is an overall framework diagram of an embodiment of the present invention. Detailed Implementation

[0025] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0026] A pseudo-random number generator (PRG) is an algorithm that can generate a long sequence of numbers from a short random seed. This sequence has statistical properties that approximate true random numbers. PRGs are widely used in cryptography because they are faster and more reproducible than true random number generators. Reproducibility is reflected in the fact that a PRG can generate the same sequence of numbers based on the same random seed. Applying a PRG to threshold signature schemes can reduce the communication overhead required for share transmission. This scheme builds a lightweight threshold ECDSA signature protocol based on a PRG. In the pre-signature stage, the PRG can solve the multiplication problem of multiplying two secret shares with only a small amount of communication, quickly and securely generating the additive share form of the material required for the signature, thus optimizing the number of communication rounds and significantly reducing communication overhead.

[0027] Example 1

[0028] This embodiment provides a threshold ECDSA signature method based on a pseudo-random number generator;

[0029] like Figure 1 As shown, the threshold ECDSA signature method based on a pseudo-random number generator includes:

[0030] S101: Each participant generates a seed share and a polynomial share for a pseudo-random number generator, distributes the generated data to other participants, and broadcasts the polynomial coefficient commitments.

[0031] Each participant uses a multinomial coefficient commitment to verify the validity of the received multinomial share. If valid, a public key is generated based on the multinomial coefficient commitment, and a private key share is generated based on the multinomial shares of all participants. At the same time, a shared pseudo-random number generator seed is generated for itself and other participants.

[0032] S102: Each participant converts its (t,n) secret shared key share into a (t,t+1) secret shared key share and generates a random number share; it uses the shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to the designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share;

[0033] S103: After obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature.

[0034] S104: Verify the message signature and return the verification result.

[0035] It should be understood that the participants can be terminals or servers.

[0036] Further, in S101: each participant generates a seed share and a polynomial share for the pseudo-random number generator, distributes the generated data to other participants, and broadcasts the polynomial coefficient commitment, specifically including:

[0037] S101-11: Each participant {P i} i∈{1,…,n} The system public parameters pp = (G, q, g) are generated using the security parameter λ through Public Key Infrastructure (PKI).

[0038] Where G is the prime-order elliptic curve group, g is the generator, and q is a prime number;

[0039] S101-12: Each participant P i Each in Generate a random polynomial of order t, where the polynomial coefficients {a} ik} k∈[0..t] By each participant P i exist The threshold is randomly selected above, where t is the threshold size.

[0040] f i (x)=a i0 +a i1 x + … + a it x t ,

[0041] For all j = 1, ..., n, participant P i Calculate the generator polynomial share f i (j) Simultaneously, the polynomial coefficients are committed to a power on the group: for all k = 0, ..., t, the polynomial coefficients are used as exponents to generate polynomial coefficient commitments. Use u i a represents the constant term of the polynomial i0 , use y i X represents i0 ;

[0042] in This represents the cyclic group of integers of order q, and by default all operations are performed within it. On;

[0043] S101-13: Each participant P i Seed share of a pseudo-random number generator that randomly generates λ bits.

[0044] S101-14: Each participant P i Seed share of the pseudo-random number generator and polynomial share f i (j) Distributed to participant P j and broadcast the polynomial coefficient commitment X ik .

[0045] It should be understood that each participant first generates common parameters through PKI, then generates a pseudo-random number generator seed share and a random t-order polynomial, generates a polynomial share based on the polynomial, distributes the pseudo-random number generator seed share and polynomial share to other participants, and broadcasts polynomial coefficient commitments.

[0046] Further, in S101: Each participant uses a polynomial coefficient commitment to verify the validity of the received polynomial share. If valid, a public key is generated based on the polynomial coefficient commitment, and a private key share is generated based on the polynomial shares of all participants. Simultaneously, a shared pseudo-random number generator seed is generated for itself and other participants, specifically including:

[0047] S101-21: Received from other participating parties P j Seed share of the pseudo-random number generator sent Polynomial share f j (i) and polynomial coefficient commitment X jk Then, for all j = 1, ..., n, participant P i Check the equation:

[0048]

[0049] Whether it is true or false; where j represents the index value of the participant; t is the threshold size;

[0050] If the complaint is not valid, a complaint will be broadcast and the agreement will be terminated.

[0051] If true, then participant P i Use your own polynomial share f i (i) and the received polynomial share f j (i) Perform additive aggregation to define your own private key share. n represents the number of participants;

[0052] The public key is committed to y by broadcasting the polynomial constant term in S101-14. i =X i0 Perform multiplication aggregation to obtain Where y represents the public key;

[0053] S101-22: Participant P i The received participants {P j} j≠i Seed share sent to oneself by the pseudo-random number generator With its own pseudo-random number generator seed share Add them together to form a shared pseudo-random number generator seed for both parties. e ij With participant P j generated Equal, for use in the pre-signature stage;

[0054] Among them, the shared seed e ij The index ij represents that it is a participant P. i and P j The shared seed is provided by participant P. i Owned, and with participant P j The shared seed e ji same.

[0055] It should be understood that the private key should be noted. And P i Private key share x i It is the (t,n) Shamir secret share of x, that is, the private key x can be reconstructed from any number of more than t private key shares. It is also publicly available and computable.

[0056] Understandably, each participant uses the polynomial coefficient commitment to verify the validity of the received polynomial share. If valid, the participant multiplies and aggregates the polynomial constant term power commitments of all participants to obtain the collective public key, and adds and aggregates the polynomial shares of all participants to obtain their own private key share. At the same time, the participant uses the pseudo-random number generator seed share sent to them by other participants and their own pseudo-random number generator seed share to generate a shared pseudo-random number generator seed for both parties.

[0057] Further, in S102: each participant converts its (t,n) secret shared key share into a (t,t+1) secret shared key share and generates a random number share; using a shared pseudo-random number generator seed, the pseudo-random number generator is invoked to generate relevant random numbers, and the key share and random number share are blinded; the blinded key share and random number share are distributed to designated participants, specifically including:

[0058] S102-11: Order Let P be the set of all parties participating in the signing, assuming |S| = t+1. iThe index is relabeled from 1 to t + 1 in ascending order of the original index value i. In the signature protocol, let the party with the lowest original index be relabeled as P1, and the party with the highest original index be relabeled as P t+1 ;

[0059] S102-12: The parties {P i} i∈S Use the set Lagrange coefficient λ i,S , and locally convert the (t, n) share x of the key x they own into the (t, t + 1) share of the key x i Let Let such that Each party P i Calculates its own relevant random number by accumulating the output of the pseudo-random number generator PRG (Pseudo Random Generator, PRG). For all j ∈ S, j ≠ i, the party P i Subtracts the output of all pseudo-random number generators with i < j in the index {PRG(e ij )} i＜j , and adds the output of all pseudo-random number generators with i > j in the index {PRG(e ij )}[[ID=Z]] i＞j , and the relevant random number is calculated as Σ j＜i PRG(e ij ) - Σ j＞i PRG(e ij );

[0060] S102-13: Each party {P i} i∈S Randomly selects a random number share from Z q Let ← $ denote random uniform sampling. For all j ∈ S, j ≠ i, use the pseudo-random number generator to construct relevant random numbers to blind the random number share and the key share Calculate in sequence:

[0061]

[0062]

[0063]

[0064] where denotes the random number share, and the random number share is also called the nonce share; denotes the random number share; is the seed of the pseudo-random number generator;

[0065] Then calculate Where e ij The superscript is only used for distinction and is different from e. ij No difference;

[0066] S102-14: If t is even, then each participant {P} i} i∈S k i w i and φ i Secretly sent to the participating party {P j} j∈{i+1,…,i+t / 2} and broadcast

[0067] If t is odd, each participant k i w i and φ i Secretly sent to the participating party {P j} j∈{i+1,…,i+(t+1) / 2} and broadcast Each participant k i w i and φ i Secretly sent to the participating party {P j} j∈{i+1,…,i+(t-1) / 2} and broadcast

[0068] It should be understood that in the calculation of index values, S102-11 stipulates that if the index value is greater than t+1, it is modulo t+1; if the index value is less than or equal to 0, it is added to t+1. For example, P t+2 =P1, P 1-1 =P t+1 P 1-2 =P t .

[0069] It should be understood that the S102-12 pseudo-random number generator PRG can output a pseudo-random number sequence. Therefore, after using a certain seed to call the PRG to generate a pseudo-random number sequence, the pseudo-random number sequence can be saved. Whenever the same seed needs to be used to call the PRG, the output can be directly obtained from the pseudo-random number sequence in sequence.

[0070] Understandably, each party participating in the signing process first converts its own key share into the key share required for pre-signing using Lagrange coefficients locally. Then, they randomly generate two shares, noncek and φ, and use a pseudo-random number generator with a shared seed to generate relevant random numbers to blind their key share and random number share. The blinded key share and random number share are then distributed to designated participants, and the power-law commitment R of the blinded noncek share is broadcast. i .

[0071] Further, in S102: Each participant generates first signature material based on the random number share sent by other participants and its own blinded random number share, specifically including:

[0072] S102-21: Each participant {P i} i∈S Locally using broadcast R i Calculate R = π i∈S R i Let r be the x-coordinate of R, and let r = R| x-axis ;

[0073] S102-22: If t is even, then each participant {P} i} i∈S Calculate the additive share of x·φ locally:

[0074] u i =w i φ i +Σ j∈{i-t / 2,…,i-1} (w i φ j +w j φ i );

[0075] Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size;

[0076] And the additive share of k·φ:

[0077] v i =k i φ i +Σ j∈{i-t / 2,…,i-1} (k i φ j +k j φ i );

[0078] Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The locally generated k·φ addition share, where t is the threshold size;

[0079] If t is odd, then each participant Calculate the additive share of x·φ locally:

[0080] u i =w i φ i +Σ j∈{i-(t-1) / 2,…,i-1} (w i φ j +w j φ i );

[0081] Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size;

[0082] And the additive share of k·φ:

[0083] v i =k i φ i +Σ j∈{i-(t-1) / 2,…,i-1} (k i φ j +k j φ i );

[0084] Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The locally generated k·φ addition share, where t is the threshold size;

[0085] Each participant Calculate the additive share of x·φ locally:

[0086] u i =w i φ i +Σ j∈{i-(t+1) / 2,…,i-1} (w i φ j +w j φi );

[0087] Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size;

[0088] And the additive share of k·φ:

[0089] v i =k i φ i +Σ j∈{i-(t+1) / 2,…,i-1} (k i φ j +k j φ i );

[0090] Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The additive share of k·φ generated locally, and t is the threshold size.

[0091] It should be understood that each party will perform local multiplication and addition operations on the blinded random number share sent by other participants and its own blinded random number share, while simultaneously calculating R. i The multiplicative aggregation generates the partial material needed for the signature, which is then used in the online signing stage.

[0092] Further, in S103: after obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants, specifically including:

[0093] S103-11: After receiving the message M to be signed, for all i∈S, each participant P i Hash message M to generate a hash value m = Hash(M), and then use the hash value m of the message with r and u generated in the pre-signature stage. i The second signature material δ in additive share form required to generate the signature i =m·φ i +r·u i The left arrow (←) indicates assignment.

[0094] S103-12: Each participant P i The second signature material δ i With the first signature material vi Send to all other participants {P j} j∈S,j≠i ;

[0095] Where v i It is generated in steps S102-22.

[0096] It should be understood that after receiving the message to sign, each participant generates the remaining materials required for the signature and then sends all the materials required for the signature to all other participants.

[0097] Further, S103: After receiving the first and second signature materials, each participating party completes and outputs the signature, specifically including:

[0098] Upon receiving all the necessary materials for signature {δ j} j∈s,j≠i and {v j} j∈S,j≠i After that, each participant {P i} i∈S Calculated locally The r and s generated in S102-22 are then output together as a signature pair (r, s).

[0099] It should be understood that, in the signature reconstruction, after receiving all the materials required for the signature, each participant generates and outputs a signature.

[0100] Further, S104: verifying the message signature and returning the verification result, specifically includes:

[0101] Any party calculates the hash value m = Hash(M) of message M, and uses the hash value m and common parameters to verify the signature (r,s), generating... And check R′| x-axis If the value is r, the verification passes and the signature (r,s) is the correct signature of m; otherwise, the verification fails.

[0102] It should be understood that the signature of the message is verified using public parameters and the message itself, and the verification result is returned.

[0103] This invention discloses a lightweight threshold ECDSA signature protocol based on a pseudo-random number generator, including distributed key generation, pre-signing, online signing, and signature verification. Distributed key generation is used to distribute the generation of the public and private keys required for signing and to construct the pseudo-random number generator seed; pre-signing is used to quickly generate the pre-signature material required for signing, reducing communication rounds; online signing is used to quickly generate a signature pair based on public parameters and pre-signature material when the signing message arrives; and signature verification is used to verify the signature pair.

[0104] This invention addresses the major obstacle of threshold ECDSA signature protocols, which lack an efficient and secure protocol to perform the multiplication of two secret shares. It employs a pseudo-random number generator to solve the multi-party multiplication problem during the pre-signature stage, securely generating the material in the form of additive shares required for signature. Compared with the expensive and complex multi-party multiplication-to-addition operations commonly used in existing protocols, this invention optimizes communication rounds and significantly reduces communication overhead.

[0105] This invention can provide:

[0106] 1. Semi-Honest Security: The interaction process of this protocol will not reveal any confidential information beyond the result;

[0107] 2. Fewer communication rounds: The pre-signature module based on a pseudo-random number generator proposed in this protocol can efficiently generate some of the materials required for signing without encryption operations. The data interaction is simple, which greatly reduces the number of communication rounds for generating signature materials, thus providing a faster threshold signature scheme.

[0108] 3. More flexible multiplication-to-addition share scheme: The pre-signature module based on the pseudo-random number generator proposed in this protocol cleverly transforms the multi-party multiplication-to-addition operation commonly used in the threshold ECDSA signature protocol into a simpler operation, requiring only one transmission operation to the specified participant;

[0109] This invention can provide users with a fast and lightweight threshold ECDSA signature solution in more fields such as hardware wallets.

[0110] Example 2

[0111] This embodiment provides a threshold ECDSA signature system based on a pseudo-random number generator;

[0112] Threshold ECDSA signature systems based on pseudo-random number generators include:

[0113] The distributed key generation module is configured as follows: each participant generates a pseudo-random number generator seed share and a multinomial share, distributes the generated data to other participants, and broadcasts a multinomial coefficient commitment; each participant uses the multinomial coefficient commitment to verify whether the received multinomial share is valid, and if valid, generates a public key based on the multinomial coefficient commitment, and generates its own private key share based on the multinomial shares of all participants; at the same time, it generates a shared pseudo-random number generator seed for itself and other participants.

[0114] The pre-signature module is configured as follows: each participant converts its private key share into a key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share.

[0115] The online signature module is configured as follows: after obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature.

[0116] The signature verification module is configured to verify the signature of a message and return the verification result.

[0117] It should be noted that the distributed key generation module, pre-signature module, online signature module, and signature verification module described above correspond to steps S101 to S104 in Embodiment 1. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these modules, as part of the system, can be executed in a computer system, such as a set of computer-executable instructions.

[0118] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A threshold ECDSA signature method based on a pseudo-random number generator, characterized in that... include: Each participant generates a seed share and a polynomial share for a pseudo-random number generator, distributes the generated data to other participants, and broadcasts polynomial coefficient commitments. Each participant uses a multinomial coefficient commitment to verify the validity of the received multinomial share. If valid, a public key is generated based on the multinomial coefficient commitment, and a private key share is generated based on the multinomial shares of all participants. At the same time, a shared pseudo-random number generator seed is generated for itself and other participants. Each participant converts its (t, n) secret shared key share into a (t, t+1) secret shared key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share; After obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature. Verify the message signature and return the verification result.

2. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, Each participant generates a seed share and a polynomial share for the pseudo-random number generator, distributes the generated data to other participants, and broadcasts polynomial coefficient commitments, specifically including: Each participant {P i } i∈{1，…，n} The system public parameter pp = (G, q, g) is generated using the security parameter λ through the public key infrastructure; where G is a prime-order elliptic curve group, g is the generator, and q is a prime number. Each participant P i Each in Generate a random polynomial of order t, where the polynomial coefficients {a} ik } k∈[0..t] By each participant P i exist The threshold is randomly selected above, where t is the threshold size. f i (x)=a i0 +a i1 x+…+a it x t , For all j = 1, ..., n, participant P i Calculate the generator polynomial share f i (j) Simultaneously, the polynomial coefficients are given a power commitment on the group: for all k = 0, ..., t, the polynomial coefficients are used as exponents to generate polynomial coefficient commitments. Use u i a represents the constant term of the polynomial i0 , use y i X represents i0 ;in, This represents the cyclic group of integers of order q, and by default all operations are performed within it. On; Each participant P i Seed share of a pseudo-random number generator that randomly generates λ bits. Each participant P i Seed share of the pseudo-random number generator and polynomial share f i (j) Distribute to participant P j and broadcast the polynomial coefficient commitment X ik .

3. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, Each participant uses a multinomial coefficient commitment to verify the validity of the received multinomial share. If valid, it generates a public key based on the multinomial coefficient commitment and its own private key share based on the multinomial shares of all participants. Simultaneously, it generates a shared pseudo-random number generator seed for itself and other participants, specifically including: Received from other participants P j Seed share of the pseudo-random number generator sent Polynomial share f j (i) and polynomial coefficient commitment X jk Then, for all j = 1, ..., n, participant P i Check the equation: Whether it is true or false; where j represents the index value of the participant; t is the threshold size; If the complaint is not valid, a complaint will be broadcast and the agreement will be terminated. If true, then participant P i Use your own polynomial share f i (i) and the received polynomial share f j (i) Perform additive aggregation to define your own private key share. n represents the number of participants; The public key is then committed to y by broadcasting the polynomial constant term. i =X i0 Perform multiplication aggregation to obtain Where y represents the public key; Participant P i The received participants {P j } j≠i Seed share sent to oneself by the pseudo-random number generator With its own pseudo-random number generator seed share Add them together to form a shared pseudo-random number generator seed for both parties. e ij With participant P j generated Equal, for use in the pre-signature stage; Among them, the shared seed e ij The index ij represents that it is a participant P. i and P j The shared seed is provided by participant P. i Owned, and with participant P j The shared seed e ji same.

4. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, Each participant converts its (t, n) secret shared key share into a (t, t+1) secret shared key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; The blinded key share and random number share are distributed to designated participants, specifically including: make Let P be the set of all parties participating in the signing, assuming |S| = t+1. i The indexes are re-marked from 1 to t+1 in ascending order of the original index values ​​i. In the signature protocol, the participant with the lowest original index is re-marked as P1, and the participant with the highest original index is re-marked as P. t+1 ; Participant {P i } i∈S Using the set Lagrange coefficient λ i，S Locally, allocate (t, n) shares of the key x to yourself. i Convert to (t, t+1) shares of key x make Make Each participant P i By accumulating the output of the pseudo-random number generator, relevant random numbers are calculated for the participant P. For all j∈S, j≠i, the participant P... i Subtract the outputs of all pseudo-random number generators whose index i < j {PRG(e ij )} i＜j And sum up the outputs of all pseudo-random number generators with index i > j {PRG(e ij )} i＞j The relevant random number is calculated as ∑ j＜i PRG(e ij )-∑ j＞i PRG(e ij ); Each participant {P i } i∈S From Z q Randomly select random number share This represents random uniform sampling. For all j∈S, j≠i, a pseudo-random number generator is used to construct relevant random numbers to blind the random number share. and key share Calculate sequentially: in, This represents the random number share, also known as the nonce share. Indicates the random number share; Use this as the seed for the pseudo-random number generator; then calculate... Where e ij The superscript is only used for distinction and is different from e. jj No difference; If t is even, then each participant {P} i } i∈S k i w i and φ i Secretly sent to the participating party {P j } j∈{i+1，…，i+t / 2} and broadcast If t is odd, each participant k i w i and φ i Secretly sent to the participating party {P j } j∈{i+1，…，i+(t+1) / 2} and broadcast Each participant k i w i and φ i Secretly sent to the participating party {P j } j∈{i+1，…，i+(t-1) / 2} and broadcast 5. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, Each participant generates the first signature material based on the random number share sent by other participants and their own blinded random number share, specifically including: Each participant {P i } i∈S Locally using broadcast R i Calculate R = π i∈S R i Let r be the x-coordinate of R, and let r = R| x-axis ; If t is even, then each participant {P} i } i∈S Calculate the additive share of x·φ locally: you i =w i f i +S j∈{i-t / 2，…，i-1} (w i f j +w j f i ); Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size; And the additive share of k·φ: v i =k i f i +∑ j∈{i-t / 2，...，i-1} (k i f j +k j f i ); Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The locally generated k·φ addition share, where t is the threshold size; If t is odd, then each participant Calculate the additive share of x·φ locally: you i =w i f i +∑ j∈{i-(t-1) / 2，...，i-1} (w i f j +w j f i ); Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size; And the additive share of k·φ: v i =k i f i +∑ j∈{i-(t-1) / 2，...，i-1} (k i f j +k j f i ); Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The locally generated k·φ addition share, where t is the threshold size; Each participant Calculate the additive share of x·φ locally: you i =w i f i +∑ j∈{i-(t+1) / 2，...，i-1} (w i f j +w j f i ); Where, φ i , φ j w i w j To blind the random number share and key share, j is the index value of other participants, u i The additive share of x·φ generated locally, where t is the threshold size; And the additive share of k·φ: v i =k i f i +∑ j∈{i-(t+1) / 2，...，i-1} (k i f j +k j f i ); Where, φ i , φ j k i k j To blind the random number share, j is the index value of other participants, v i The additive share of k·φ generated locally, and t is the threshold size.

6. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, After obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants, specifically including: After receiving the message M to be signed, for all i∈S, each participant P i Hash message M to generate a hash value m = Hash(M), and then use the hash value m of the message with r and u generated in the pre-signature stage. i The second signature material δ in additive share form required to generate the signature i =m·φ i +r·u i The left arrow (←) indicates assignment. Each participant P i The second signature material δ i With the first signature material v i Send to all other participants {P j } j∈S，j≠i .

7. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, After receiving the first and second signature materials, each participant completes and outputs their signature, specifically including: Upon receiving all the necessary materials for signature {δ j } j∈S，j≠i and {v j } j∈S，j≠i After that, each participant {P i } i∈S Calculated locally Then output r and s together as a signature pair (r, s).

8. The threshold ECDSA signature method based on a pseudo-random number generator as described in claim 1, characterized in that, Verify the message signature and return the verification result, which includes: Any party calculates the hash value m = Hash(M) of message M, and uses the hash value m and common parameters to verify the signature (r, s), generating... And check R′| x-axis If the value is r, the verification passes and the signature (r, s) is the correct signature of m; otherwise, the verification fails.

9. A threshold ECDSA signature system based on a pseudo-random number generator, characterized in that: include: The distributed key generation module is configured as follows: each participant generates a pseudo-random number generator seed share and a multinomial share, distributes the generated data to other participants, and broadcasts a multinomial coefficient commitment; each participant uses the multinomial coefficient commitment to verify whether the received multinomial share is valid, and if valid, generates a public key based on the multinomial coefficient commitment, and generates its own private key share based on the multinomial shares of all participants; at the same time, it generates a shared pseudo-random number generator seed for itself and other participants. The pre-signature module is configured as follows: each participant converts its (t, n) secret shared key share into a (t, t+1) secret shared key share and generates a random number share; it uses a shared pseudo-random number generator seed to call the pseudo-random number generator to generate relevant random numbers, and performs blinding processing on the key share and random number share; it distributes the blinded key share and random number share to designated participants; each participant generates the first signature material based on the random number share sent by other participants and its own blinded random number share. The online signature module is configured as follows: after obtaining the message to be signed, each participant generates a second signature material and sends the first and second signature materials to all other participants; after receiving the first and second signature materials, each participant completes and outputs the signature. The signature verification module is configured to verify the signature of a message and return the verification result.

10. The threshold ECDSA signature system based on a pseudo-random number generator as described in claim 9, characterized in that, Each participant generates a seed share and a polynomial share for the pseudo-random number generator, distributes the generated data to other participants, and broadcasts polynomial coefficient commitments, specifically including: Each participant {P i } i∈{1，...，n} The system public parameters pp = (G, q, g) are generated using the security parameter λ through public key infrastructure. Where G is the prime-order elliptic curve group, g is the generator, and q is a prime number; Each participant P i Each in Generate a random polynomial of order t, where the polynomial coefficients {a} ik } k∈[0..t] By each participant P i exist The threshold is randomly selected above, where t is the threshold size. f i (x)=a i0 +a i1 x+…+a it x t , For all j = 1, ..., n, participant P i Calculate the generator polynomial share f i (j) Simultaneously, the polynomial coefficients are given a power commitment on the group: for all k = 0, ..., t, the polynomial coefficients are used as exponents to generate polynomial coefficient commitments. Use u i a represents the constant term of the polynomial i0 , use y i X represents i0 ; in This represents the cyclic group of integers of order q, and by default all operations are performed within it. Upward: Each participant P i Seed share of a pseudo-random number generator that randomly generates λ bits. Each participant P i Seed share of the pseudo-random number generator and polynomial share f i (j) Distribute to participant P j and broadcast the polynomial coefficient commitment X ik .

Images