Distributed multi-party digital signature method suitable for block chain

Abstract

The invention relates to the technical field of block chains, in particular to a distributed multi-party digital signature method suitable for a block chain, which comprises the following steps: a signature node applies for a signature parameter Token from an intelligent contract, calculates a public and private key pair of the signature node according to the Token, and generates a corresponding zero-knowledge proof; the signature node generates a signature private key and a signature public key of the signature according to the node list in which the signature process participates and the to-be-signed message; the signature node calculates a partial signature held by the signature node according to the signature public and private key pair obtained by the KeyExtract and the message to be signed, and the smart contract aggregates all the partial signatures to obtain a final signature; performing verification; and after the new signature node is added into the signature node set, additional signature is carried out on the signed message, and the new signature node single machine generates a part of signature of the new signature node single machine and combines the part of signature with the original signature. According to the method, the dynamic change of the signature node set can be processed under the condition that the operation of the existing nodes is not influenced.

Description

Technical Field

[0001] The present invention relates to the technical field of blockchain, and in particular to a distributed multi-party digital signature method applicable to blockchain. Background Art

[0002] Blockchain technology usually uses digital signature technology to ensure the authenticity of stored digital records. In practical applications, engineers usually choose distributed multi-party digital signature algorithms to implement digital signature functions. In 2008, German cryptographer Claus Schnorr proposed the Schnorr signature algorithm based on the discrete logarithm difficulty problem. The algorithm is known for its simplicity and efficiency and is widely used in the task of numerical signature of digital files. The Schnorr signature algorithm has always attracted the attention of blockchain technology researchers due to its simplicity and efficiency. Blockchain technology researchers continue to propose new distributed multi-party Schnorr signature algorithms to build more efficient and more private blockchain systems. In 2019, Gregory Maxwell and others proposed a distributed multi-party Schnorr signature algorithm MuSig suitable for Bitcoin; in 2021, the digital currency BitcoinCash changed the digital signature algorithm from the original multi-party ECDSA signature algorithm to the multi-party Schnorr signature algorithm in the Taproot upgrade. The distributed multi-party Schnorr algorithm is generally divided into two stages: private key generation and signature generation. In the private key generation stage, all signers will jointly generate a signature private key; in the signature generation stage, each signer selects a random number, and then runs the Schnorr algorithm in MPC mode to generate the final signature. However, the distributed multi-party Schnorr algorithm needs to prevent rogue-key attacks in the private key generation stage, that is, attackers can forge the private key they need by selecting a specific public key. In the existing technology, the rogue-key attack problem is often solved by introducing a central server.

[0003] For example, the document "Lv Xin, Wang Zhijian, Xu Feng. A new forward-secure threshold digital signature scheme [J]." proposed a method of using the Joint-Shamir-RSS secret sharing scheme to share random numbers, and implemented a threshold Schnorr signature scheme that meets forward security. This scheme selects signature random numbers and private keys through a key management center. The document "Liu Wei, Guo Lingbei, Xia Yujie, et al. Blockchain oracle data transmission model based on threshold aggregate signature [J]" solves the rogue-key attack problem by introducing oracles and smart contracts, and implements a distributed multi-party Schnorr signature scheme on the blockchain. However, in the signing process, the oracle actually plays the role of a central server, so this scheme still requires the assistance of a central server.

[0004] Due to the introduction of central servers, the existing protocols are difficult to achieve complete decentralization and cannot meet the needs of blockchain applications. Therefore, it is necessary to propose improvements to the existing distributed multi-party Schnorr algorithm.

[0005] In the prior art, a Chinese invention patent document with publication number CN116318708A and publication date June 23, 2023 is proposed. The patent document discloses an ECDSA threshold optimal signature scheme using zero-knowledge proof and Joint-Shamir-RSS secret sharing algorithm. However, this technical solution does not support dynamic adjustment of the signature node set. Whenever a new node joins the blockchain or the threshold value t changes, all nodes in this technical solution need to re-execute the preprocessing phase algorithm. Since each node in the preprocessing phase of this technical solution needs to execute 3 zero-knowledge proofs and 2n homomorphic encryption algorithms, this will seriously affect the normal operation of the signature node.

[0006] In the prior art, a Chinese invention patent document with a publication number of CN117394992A and a publication date of January 12, 2024, and a Chinese invention patent document with a publication number of CN115865341A and a publication date of March 28, 2023 were proposed. The above two technical solutions propose two solutions for using a verifiable Joint-Shamir-RSS secret sharing algorithm to collaboratively calculate the signature private key, but the above two technical solutions also face the problem of not supporting dynamic adjustment. When a new node is added, both solutions require all nodes to execute the secret sharing algorithm again, which will bring great additional overhead.

[0007] Therefore, the current existing technology generally uses the Joint-Shamir-RSS secret sharing algorithm to collaboratively generate private keys, but this method is only applicable to scenarios where the signature node set remains stable, and is not applicable to blockchain scenarios. Summary of the invention

[0008] In order to solve the above technical problems, the present invention proposes a distributed multi-party digital signature method suitable for blockchain, which can handle the dynamic changes of the signature node set without affecting the operation of existing nodes.

[0009] The present invention is achieved by adopting the following technical solutions:

[0010] A distributed multi-party digital signature method applicable to blockchain, comprising the following steps:

[0011] Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof;

[0012] Step S2. Extraction of signature private key KeyExtract: The signing node generates the signature private key and signature public key for this signature according to the list of nodes participating in the signing process and the message to be signed;

[0013] Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature.

[0014] Step S4. Verify: verify the validity of the final signature;

[0015] Step S5. Extend: After the new signature node is added to the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature on its own and merge the partial signature with the original signature.

[0016] The step S1 specifically includes the following steps:

[0017] Step S 11 Each signing node sends a request to join the smart contract and constructs its own private key generation polynomial to generate a private key and the corresponding public key;

[0018] Step S 12 The signing node generates a zero-knowledge proof to prove the validity of the public / private key, and sends the proof and the public key to the smart contract; the smart contract verifies the zero-knowledge proof, and if the verification is successful, the signing node public key is recorded in the blockchain;

[0019] Step S 13 .Signature nodes choose to join or create a new signature node collection.

[0020] The step S 11 Specifically include: Each signature node u i Randomly select n random numbers Constructing polynomials Then u i Send a private key request to the smart contract, and the smart contract will select a random number t i And calculate u i Private key parameter Token i =HashFunc(u i ||t i ||timestamp), where timestamp is the current timestamp, and then the smart contract will use the private key parameter Token i Return to the signing node; at this time, u i Calculate the private key SecKey you holdi =f i (Token i ) and the corresponding public key PubKey i =SecKey i ·Gen1.

[0021] The step S 12 The specific steps include: The signing node will call the zero-knowledge proof: Generate Proof i (1) ; The signature node will (Token, L, PubKey i ,Proof i (1) ) is stored in the blockchain node.

[0022] The newly created signature node set specifically means that the signature node selects m-1 existing nodes to form a signature node set; wherein m is the number of nodes participating in the signature in each signature process.

[0023] The step S2 specifically includes the following steps: Assuming a signature node u s If the message Msg needs to be signed, the smart contract will s Select m-1 nodes from the signature node set to participate in this signing process; let the signature node list for this signature be L(u1,...,u s ,...,u m ); For each signature node u i ∈L,u i Select a random number rs i , and calculate the private key rsk for this signature i =rs i +HashFunc(L||Msg),SignSecKey i =rsk i +SecKey i ; During this signing process, u i The signature public key is SignPublicKey i =(PubKey i ,rsk i Gen1, SignSecKey i ·Gen2).

[0024] The step S3 specifically comprises the following steps:

[0025] Step S 31 The signing node selects a random number and security parameters, and shares the random number with other signers in Shamirr-ss mode;

[0026] Step S 32 The signature node aggregates all random number shared values ​​to obtain its own random number shard;

[0027] Step S 33 The signing node uses oblivious transmission technology to securely exchange signature private keys and security parameter information;

[0028] Step S 34 .Each signer randomly selects a random number and shares it with other signers in Shamirr-ss mode;

[0029] Step S 35 The signing node calculates its own partial signature and sends it to the smart contract;

[0030] Step S 36 The smart contract combines all partial signatures to obtain a complete signature and stores the public information of this signature in the blockchain.

[0031] The step S3 specifically comprises the following steps:

[0032] Step S 31 For each signature node u i ∈L,u i Select m+1 random numbers And construct the polynomial Then u i PubRandom will be calculated i =RandomSub i Gen2 and call zero-knowledge proof NIZK ((PubRandom i ,Gen),(Random i ),PubRandom i =RandomSub i Gen2) Proof i (2) ; then u i Send to all signing nodes (PubRandom i ,Proof i (2) );

[0033] Step S 32 .when u i Receive other signature nodes u j.j≠i Sent Time verification If the verification fails, the smart contract is notified to terminate the signature; when u i Receive and verify through m-1 (PubRandomi ,Proof i (2) ) and then we get u i Calculate z i (u j ),1≤j≤m, and (u j ,z i (u j ))Sent secretly to signing node u j,j≠i ; when u i Received from other m-1 signing nodes (u i ,z j (u i )), after j≠i, calculate the random number shard you hold

[0034]

[0035] Step S 33 .u i and other u j,j≠i Joint Implementation of F OT (SignSecKey i ,Mask i ,SignSecKey j ,Mask j ) and get

[0036] Step S 34 .u i Calculate your own signature fragment

[0037] Then u i Sign i ,SignPublicKey i ,Mask i Gen1) is sent to the smart contract;

[0038] Step S 35 .When the smart contract receives m signature fragments, it can aggregate the final signature

[0039]

[0040] The step S5 specifically includes: when each new node u e A signature node set is added, and the signature node set becomes L'(u1,...,u m ,u e ), if the new node u e When the message Msg that has been signed by the set needs to be signed again, the new node ue Additional signatures are performed, and other nodes do not need to respond.

[0041] The additional signature specifically includes the following steps:

[0042] Step S 51 .u e Read the last signature FinalSign:

[0043]

[0044] Step S 52 .u e Select a random number rs e , and calculate the private key rsk for this signature e =rs e +HashFunc(L'||Msg),SignSecKey e =rsk e +SecKey e ; During this signing process, u e The signature public key is SignPublicKey e =(PubKey e ,rsk e Gen2, SignSecKey e Gen2);

[0045] Step S 53 .u e Select a random number RandomSub e ,Mask e And calculate PubRandom e =RandomSub e Gen2; at this time u e The signature of the message is calculated as

[0046]

[0047] Step S 54 .u e Update signature

[0048]

[0049] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0050] 1. The signature method of the present invention inherits the advantages of the existing distributed multi-party Schnorr signature algorithm, and introduces the Joint-Shamir-RSS secret sharing algorithm, zero-knowledge proof technology and oblivious transmission technology, realizing completely decentralized distributed private key generation and distributed signature generation processes, and the method can resist rogue-key attacks. Zero-knowledge proof solves the problem of the private key generation stage being vulnerable to rogue-key attacks; the Joint-Shamir-RSS secret sharing algorithm and oblivious transmission technology are introduced into the standard Schnorr signature algorithm, which provides anti-tampering and anti-repudiation functions while reducing the user's computing time in the system.

[0051] Furthermore, the present invention not only realizes effective anti-tampering and anti-repudiation functions, but also solves the problem that the previous multi-party Schnorr signature algorithm requires the participation of a central server in order to defend against rogue-key attacks. At the same time, in the operation of the blockchain system, new nodes may join the signature node set, and the newly added nodes may need to sign previously signed messages. This method allows the signature node set to be dynamically adjusted, has flexibility, and is suitable for application in the blockchain system, solving the problem of handling dynamic changes in the signature node set without affecting the operation of existing nodes.

[0052] 2. In the present invention, the central server does not need to be involved in the private key generation and signature generation stages.

[0053] 3. In the present invention, during the private key generation phase, each signer independently constructs a polynomial to generate his or her own public-private key pair locally, and provides a zero-knowledge proof that can prove the validity of the polynomial and the public key, so as to defend against rogue-key attacks.

[0054] 4. In the present invention, in the signature private key extraction stage, in order to ensure security, each signature node generates an additional signature public and private key pair based on the public and private key pair it holds according to the current signature situation.

[0055] 5. In the present invention, in the signature generation stage, each participant uses the Joint-Shamir-RSS secret sharing algorithm and zero-knowledge proof to collaboratively generate random numbers, and uses oblivious transfer technology to securely exchange data and generate the final signature.

[0056] 6. In the present invention, changes in the signature node set will not interfere with the normal operation of existing nodes, and newly added nodes are supported to independently add signatures to past messages. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, wherein:

[0058] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0059] Example 1

[0060] As a basic implementation mode of the present invention, the present invention includes a distributed multi-party digital signature method applicable to blockchain, in which the public-private key pair of each signature node is generated locally by the node. When joining the blockchain, the signature node needs to provide its own public key and a zero-knowledge proof that can prove the validity of the public key to the smart contract. If the proof fails to pass the verification, the smart contract will prevent the node from joining the blockchain. After successful verification, the signature node can select a specified number of nodes to form its own signature node set or join an existing signature node set. In the signature generation stage, all signature nodes first use the Joint-Shamir-RSS secret sharing algorithm to collaboratively generate the random number used for this signature, then use the oblivious transfer technology to complete the operation of converting the shard multiplication into addition, and finally generate their own partial signatures using the Schnorr signature algorithm, and finally aggregate the final signature. After obtaining the approval of most nodes in the node set, the new node can become a member of the signature node set. When the new node wants to append its own signature to a message that has been signed by the set, it only needs to generate its own partial signature on a single machine and merge it with the original signature. By optimizing the Schnorr signature algorithm process and designing a suitable final signature structure, the present invention allows other nodes in the set to not respond to the signing process.

[0061] More specifically, the method comprises the following steps:

[0062] Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof.

[0063] Step S2. Extraction of signature private key KeyExtract: The signing node generates the signature private key and signature public key for this signature based on the list of nodes participating in the signing process and the message to be signed.

[0064] Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature.

[0065] Step S4. Verify: verify the validity of the final signature.

[0066] Step S5. Extend: After the new signature node is added to the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature on its own and merge the partial signature with the original signature.

[0067] Example 2

[0068] As a preferred embodiment of the present invention, the present invention includes a distributed multi-party digital signature method applicable to blockchain, comprising the following steps:

[0069] Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof. More specifically, it includes the following steps:

[0070] Step S 11 Each signing node sends a request to join the smart contract and constructs its own private key generation polynomial to generate a private key and the corresponding public key;

[0071] Step S 12 The signing node generates a zero-knowledge proof to prove the validity of the public / private key, and sends the proof and the public key to the smart contract; the smart contract verifies the zero-knowledge proof, and if the verification is successful, the signing node public key is recorded in the blockchain;

[0072] Step S 13 .Signature nodes choose to join or create a new signature node collection.

[0073] Step S2. Extraction of signature private key KeyExtract: The signing node generates the signature private key and signature public key for this signature according to the list of nodes participating in the signing process and the message to be signed;

[0074] Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature.

[0075] Step S4. Verify: verify the validity of the final signature;

[0076] Step S5. Extend: After the new signature node is added to the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature on its own and merge the partial signature with the original signature.

[0077] Example 3

[0078] As another preferred embodiment of the present invention, the present invention includes a distributed multi-party digital signature method applicable to blockchain, comprising the following steps:

[0079] Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof.

[0080] Step S2. Extraction of signature private key KeyExtract: The signing node generates the signature private key and signature public key for this signature according to the list of nodes participating in the signing process and the message to be signed;

[0081] Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature. Specifically, it includes the following steps:

[0082] Step S 31 The signing node selects a random number and security parameters, and shares the random number with other signers in Shamirr-ss mode;

[0083] Step S 32 The signature node aggregates all random number shared values ​​to obtain its own random number shard;

[0084] Step S 33 The signing node uses oblivious transmission technology to securely exchange signature private keys and security parameter information;

[0085] Step S 34 .Each signer randomly selects a random number and shares it with other signers in Shamirr-ss mode;

[0086] Step S 35 The signing node calculates its own partial signature and sends it to the smart contract;

[0087] Step S 36 The smart contract combines all partial signatures to obtain a complete signature and stores the public information of this signature in the blockchain.

[0088] Step S4. Verify: verify the validity of the final signature;

[0089] Step S5. Extend: After the new signature node is added to the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature on its own and merge the partial signature with the original signature.

[0090] Example 4

[0091] As the best embodiment of the present invention, the present invention includes a distributed multi-party digital signature method suitable for blockchain, which integrates the Schnorr signature algorithm, the Joint-Shamir-RSS secret sharing algorithm, the zero-knowledge proof technology and the oblivious transfer technology. For the convenience of description, we define the parameters of the Schnorr signature algorithm as: three cyclic groups of prime number p Where Gen1 is the generator of G1, and Gen2 is the generator of G2; a bilinear pairing function E(Gen1, Gen2); the message Msg to be signed; the maximum number of nodes allowed to participate in the signature is n, and the minimum number of nodes is t; the number of nodes participating in the signature in each signing process is m, where n≥m≥t; hash function HashFunc; zero-knowledge proof in is a list of public parameters, is a list of private data, R is a relational expression that needs to be proved, and Proof is the generated zero-knowledge proof; the oblivious transfer function The input parameters a1 and b1 are provided by user 1, while a2 and b2 are provided by user 2. The output value satisfies After the function is executed, user 1 holds User 2 will hold During function execution, a user cannot know the information about input parameters held by another user.

[0092] For details, please refer to the attached manual. Figure 1 , the method comprises the following steps:

[0093] Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof. Specifically, it includes the following steps:

[0094] Step S 11 .Each signature node sends a request to join the smart contract and constructs its own private key generation polynomial to generate a private key and the corresponding public key. That is, each signature node u i Randomly select n random numbers Constructing polynomials Then u i Send a private key request to the smart contract, and the smart contract will select a random number t i And calculate u i Private key parameter Token i =HashFunc(u i ||t i||timestamp), where timestamp is the current timestamp, and then the smart contract will use the private key parameter Token i Return to the signing node; at this time, u i Calculate the private key SecKey you hold i =f i (Token i ) and the corresponding public key PubKey i =SecKey i ·Gen1.

[0095] Step S 12 The signing node generates a zero-knowledge proof to prove the validity of the public / private key, and sends the proof and the public key to the smart contract; the smart contract verifies the zero-knowledge proof, and if the verification is successful, the signing node public key is recorded in the blockchain. That is, the signing node will call the zero-knowledge proof: Generate Proof i (1) ; The signature node will (Token, L, PubKey i ,Proof i (1) ) is stored in the blockchain node.

[0096] Step S 13 .Signature nodes choose to join or create a new signature node set, that is, after verification, u i You can select m-1 existing nodes to form a signature node set or join an existing signature node set.

[0097] Step S2. Extraction of signature private key KeyExtract: The signature node generates the signature private key and signature public key for this signature based on the list of nodes participating in the signature process and the message to be signed. Specifically, assuming that a signature node u s If the message Msg needs to be signed, the smart contract will s Select m-1 nodes from the signature node set to participate in this signing process; let the signature node list for this signature be L(u1,...,u s ,...,u m ); For each signature node u i ∈L,u i Select a random number rs i , and calculate the private key rsk for this signature i =rs i +HashFunc(L||Msg),SignSecKey i =rsk i +SecKey i; The signature public key of ui in this signing process is SignPublicKey i =(PubKey i ,rsk i Gen1, SignSecKey i ·Gen2).

[0098] Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature. Specifically, it includes the following steps:

[0099] Step S 31 The signing node selects a random number and security parameters, and shares the random number with other signers in Shamirr-ss mode. That is, for each signing node u i ∈L,u i Select m+1 random numbers And construct the polynomial Then u i PubRandom will be calculated i =RandomSub i Gen2 and call zero-knowledge proof NIZK ((PubRandom i ,Gen),(Random i ),PubRandom i =RandomSub i Gen2) Proof i (2) ; then u i Send to all signing nodes (PubRandom i ,Proof i (2) ).

[0100] Step S 32 .The signature node aggregates all random number shared values ​​to obtain its own random number shard. That is, when u i Receive other signature nodes u j.j≠i Sent Time verification If the verification fails, the smart contract is notified to terminate the signature; when u i Receive and verify through m-1 (PubRandom i ,Proof i (2) ) and then we get ui calculation z i (u j),1≤j≤m, and (u j ,z i (u j ))Sent secretly to signing node u j,j≠i ; when u i Received from other m-1 signing nodes (u i ,z j (u i )), after j≠i, calculate the random number shard you hold

[0101] Step S 33 .The signing node uses oblivious transmission technology to securely exchange signature private keys and security parameter information. i and other u j,j≠i Joint Implementation of F OT (SignSecKey i ,Mask i ,SignSecKey j ,Mask j ) and get

[0102] Step S 34 .Each signer randomly selects a random number and shares it with other signers in Shamirr-ss mode. i Calculate your own signature fragment

[0103] Then u i Sign i ,SignPublicKey i ,Mask i Gen1) is sent to the smart contract.

[0104] Step S 35 .The signing node calculates its own partial signature and sends it to the smart contract. That is, when the smart contract receives m signature fragments, it can aggregate the final signature.

[0105]

[0106] Step S 36 The smart contract combines all partial signatures to obtain a complete signature and stores the public information of this signature in the blockchain.

[0107] Step S4. Verify: The third party verifies the validity of the final signature based on the final signature, the signature public key, and the message to be signed.

[0108] Step S5. Extend: After the new signature node joins the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature and merge the partial signature with the original signature. e A signature node set is added, and the signature node set becomes L'(u1,...,u m ,u e ), if the new node u e When the message Msg that has been signed by the set needs to be signed again, the new node u e Additional signatures are performed, and other nodes do not need to respond.

[0109] The additional signature specifically includes the following steps:

[0110] Step S 51 .u e Read the last signature FinalSign:

[0111]

[0112] Step S 52 .u e Select a random number rs e , and calculate the private key rsk for this signature e =rs e +HashFunc(L'||Msg),SignSecKey e =rsk e +SecKey e ; During this signing process, u e The signature public key is SignPublicKey e =(PubKey e ,rsk e Gen2, SignSecKey e Gen2);

[0113] Step S 53 .u e Select a random number RandomSub e ,Mask e And calculate PubRandom e =RandomSub e Gen2; at this time u e The signature of the message is calculated as

[0114]

[0115] Step S 54 .ue Update signature

[0116]

[0117] In summary, after reading the present invention document, ordinary technicians in this field can make various other corresponding transformation schemes based on the technical scheme and technical concept of the present invention without creative mental labor, which all fall within the scope of protection of the present invention.

Claims

1. A distributed multi-party digital signature method applicable to blockchain, characterized in that: The following steps are involved: Step S1. Private key generation KeyGen: The signing node applies for the signature parameter Token from the smart contract, calculates its own public and private key pair based on the Token and generates the corresponding zero-knowledge proof; Step S2. Extraction of signature private key KeyExtract: The signing node generates the signature private key and signature public key for this signature according to the list of nodes participating in the signing process and the message to be signed; Step S3. Signature generation SignGen: The signing node calculates the partial signature it holds based on the signature public and private key pair obtained by KeyExtract and the message to be signed. The smart contract aggregates all partial signatures to obtain the final signature. Step S4. Verify: verify the validity of the final signature; Step S5. Extend: After the new signature node is added to the signature node set, it will add a signature to the signed message. The new signature node will generate its own partial signature on its own and merge the partial signature with the original signature.

2. A distributed multi-party digital signature method applicable to blockchain according to claim 1, characterized in that: The step S1 specifically includes the following steps: Step S 11 Each signing node sends a request to join the smart contract and constructs its own private key generation polynomial to generate a private key and the corresponding public key; Step S 12 The signing node generates a zero-knowledge proof to prove the validity of the public / private key, and sends the proof and the public key to the smart contract; the smart contract verifies the zero-knowledge proof, and if the verification is successful, the signing node public key is recorded in the blockchain; Step S 13 .Signature nodes choose to join or create a new signature node collection.

3. A distributed multi-party digital signature method applicable to blockchain according to claim 2, characterized in that: The step S 11 Specifically include: Each signature node u i Randomly select n random numbers Constructing polynomials Then u i Send a private key request to the smart contract, and the smart contract will select a random number t i And calculate u i Private key parameter Token i =HashFunc(u i ||t i ||timestamp), where timestamp is the current timestamp, and then the smart contract uses the private key parameter Token i Return to the signing node; at this time, u i Calculate the private key SecKey you hold i =f i (Token i ) and the corresponding public key PubKey i =SecKey i ·Gen1.

4. A distributed multi-party digital signature method applicable to blockchain according to claim 3, characterized in that: The step S 12 The specific steps include: The signing node will call the zero-knowledge proof: PubKey i =f i (Token) Gen) Proof of Generation The signing node will Stored in blockchain nodes.

5. A distributed multi-party digital signature method applicable to blockchain according to any one of claims 2 to 4, characterized in that: The newly created signature node set specifically means that the signature node selects m-1 existing nodes to form a signature node set; wherein m is the number of nodes participating in the signature in each signature process.

6. A distributed multi-party digital signature method applicable to blockchain according to claim 5, characterized in that: The step S2 specifically includes the following steps: Assuming a signature node u s If the message Msg needs to be signed, the smart contract will s Select m-1 nodes from the signature node set to participate in this signing process; let the signature node list for this signature be L(u1,…,u s ,…,u m ); For each signature node u i ∈L,u i Select a random number rs i , and calculate the private key rsk for this signature i =rs i +HashFunc(L||Msg),SignSecKey i =rsk i +SecKey i ; During this signing process, u i The signature public key is SignPublicKey i =(PubKey i ,rsk i Gen1, SignSecKey i ·Gen2).

7. A distributed multi-party digital signature method applicable to blockchain according to any one of claims 1 to 4, characterized in that: The step S3 specifically comprises the following steps: Step S 31 The signing node selects a random number and security parameters, and shares the random number with other signers in Shamirr-ss mode; Step S 32 The signature node aggregates all random number shared values ​​to obtain its own random number shard; Step S 33 The signing node uses oblivious transmission technology to securely exchange signature private keys and security parameter information; Step S 34 .Each signer randomly selects a random number and shares it with other signers in Shamirr-ss mode; Step S 35 The signing node calculates its own partial signature and sends it to the smart contract; Step S 36 The smart contract combines all partial signatures to obtain a complete signature and stores the public information of this signature in the blockchain.

8. A distributed multi-party digital signature method applicable to blockchain according to claim 7, characterized in that: The step S3 specifically comprises the following steps: Step S 31 For each signature node u i ∈L,u i Select m+1 random numbers And construct the polynomial Then u i PubRandom will be calculated i =RandomSub i Gen2 and call zero-knowledge proof NIZK ((PubRandom i ,Gen),(Random i ),PubRandom i =RandomSub i Gen2) Proof of Generation Then u i Send to all signing nodes Step S 32 .when u i Receive other signature nodes u j.j≠i Sent Time verification If the verification fails, the smart contract is notified to terminate the signature; when u i Received and verified by m-1 Then you get u i Calculate z i (u j ),1≤j≤m, and (u j ,z i (u j ))Sent secretly to signing node u j,j≠i ; when u i Received from other m-1 signing nodes (u i ,z j (u i )), after j≠i, calculate the random number shard you hold Step S 33 .u i and other u j,j≠i Joint Implementation of F OT (SignSecKey i ,Mask i ,SignSecKey j ,Mask j ) and get Step S 34 .u i Calculate your own signature fragment Then u i Sign i ,SignPublicKey i ,Mask i Gen1) is sent to the smart contract; Step S 35 .When the smart contract receives m signature fragments, it can aggregate the final signature 9. A distributed multi-party digital signature method applicable to blockchain according to any one of claims 1 to 4, characterized in that: The step S5 specifically includes: when each new node u e A signature node set is added, and the signature node set becomes L'(u1,...,u m ,u e ), if the new node u e When the message Msg that has been signed by the set needs to be signed again, the new node u e Additional signatures are performed, and other nodes do not need to respond.

10. A distributed multi-party digital signature method applicable to blockchain according to claim 9, characterized in that: The additional signature specifically includes the following steps: Step S 51 .u e Read the last signature FinalSign: Step S 52 .u e Select a random number rs e , and calculate the private key rsk for this signature e =rs e +HashFunc(L'||Msg),SignSecKey e =rsk e +SecKey e ; During this signing process, u e The signature public key is SignPublicKey e =(PubKey e ,rsk e Gen2, SignSecKey e Gen2); Step S 53 .u e Select a random number RandomSub e ,Mask e And calculate PubRandom e =RandomSub e Gen2; at this time u e The signature of the message is calculated as Step S 54 .u e Update signature

Images