Distributed signature method, system, device, medium and program product

Abstract

The embodiment of the invention provides a distributed signature method, system and device, a medium and a program product, and relates to the technical field of distributed signature. The method comprises the following steps: a main signature party generates a Hash commitment, calculates a key share of each distributed signature party and sends the key share to the corresponding distributed signature party; each distributed signer calculates a public key corresponding to the respective secret key share, and generates a corresponding sub-signature for broadcasting; the main signature party verifies the sub-signatures, generates a complete signature and sends the complete signature to the data receiving party; and the data receiver verifies the complete signature and receives the message to be transmitted after the verification is passed. According to the embodiment of the invention, a distributed privacy signature scheme is constructed by using secure multi-party computing, Hash commitment and a randomization function, so that the data privacy can be protected, the randomness of the signature can be enhanced, and meanwhile, the signature verification process is simplified, thereby effectively improving the efficiency and security of the distributed signature.

Description

Technical Field

[0001] The present application relates to the field of distributed signature technology, and more specifically, to a distributed signature method, system, device, medium and program product. Background Art

[0002] In order to improve the credibility of signatures and the security of the signing process, distributed signature technology is a common practice.

[0003] At present, there are still some defects in distributed signature schemes that have not yet been overcome. For example, some distributed signature schemes have low efficiency in the signing process due to the high complexity of the encryption and decryption algorithms or the verification interaction process; some schemes improve the signing efficiency by simplifying the algorithm or the verification interaction process, but this often reduces the credibility and security of the signature, and also increases the risk of privacy data leakage. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a distributed signature method, system, device, medium and program product to improve the efficiency and security of distributed signature.

[0005] In a first aspect, an embodiment of the present application provides a distributed signature method, including:

[0006] The master signer generates a hash commitment for the message to be transmitted based on the pre-negotiated hash function, calculates the key share corresponding to each distributed signer based on its own private key and the currently selected first privacy information, and sends the hash commitment and the key share to the corresponding distributed signer respectively;

[0007] Each distributed signatory calculates a public key corresponding to its own key share based on a pre-selected elliptic curve base point, generates a corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information, and broadcasts the public key and the sub-signature;

[0008] The main signer verifies the sub-signatures of each distributed signer, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signer to the data recipient;

[0009] The data recipient generates a verification hash commitment corresponding to the message to be transmitted based on the hash function, verifies the complete signature based on the verification hash commitment and the public key, and receives the message to be transmitted after the verification passes.

[0010] In an embodiment of the present application, a distributed privacy signature scheme is constructed by using secure multi-party computation, hash commitment and randomization function, which can protect data privacy and enhance the randomness of the signature. At the same time, it also simplifies the signature verification process, thereby effectively improving the efficiency and security of distributed signatures.

[0011] In some possible embodiments, the main signer verifies the sub-signatures of each distributed signer, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signer to the data recipient, including:

[0012] The master signer authenticates each distributed signer based on the public key corresponding to each key share, and verifies the sub-signature of each distributed signer;

[0013] If the identity authentication passes and the sub-signature verification passes, a complete signature is generated based on the key share and each sub-signature, and the complete signature and the number of each distributed signatory are sent to the data recipient;

[0014] In the event that the identity authentication fails or the sub-signature verification fails, the sub-signature of the corresponding distributed signatory is rejected.

[0015] In the embodiment of the present application, the identity of each distributed signatory is verified by the public key corresponding to the key share, which can prevent the identity of the signatory from being misused and further improve the security of the distributed signature.

[0016] In some possible embodiments, the master signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculates the key share corresponding to each distributed signer in combination with its own private key and the currently selected first privacy information, and sends the hash commitment and the key share to the corresponding distributed signer, including:

[0017] The primary signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function;

[0018] Constructing a polynomial function by combining its own private key and a pre-selected first random number set, and calculating the key share corresponding to each distributed signatory based on the polynomial function and the currently selected second random number set;

[0019] The hash commitment and the key share are respectively sent to corresponding distributed signing parties.

[0020] In the embodiment of the present application, by constructing a secret polynomial and calculating the key shares of different signatories respectively, the randomness of the signing process is further improved, thereby improving the security of the distributed signature.

[0021] In some possible embodiments, the primary signer verifies the sub-signatures of each distributed signer, further comprising:

[0022] The main signer calculates the share verification information corresponding to each distributed signer based on each sub-signature and the hash commitment, and performs interpolation operation using the share verification information corresponding to each distributed signer to restore the verification polynomial function;

[0023] Based on the verification polynomial function, a constant term comparison is performed with the polynomial function to verify the sub-signature of each distributed signatory.

[0024] In an embodiment of the present application, the security of the distributed signature is further improved by restoring the share verification information corresponding to each sub-signature and using interpolation operations to restore the verification polynomial function, and then verifying each sub-signature based on the comparison of the polynomial function.

[0025] In some possible embodiments, generating a corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment, and the currently selected second private information includes:

[0026] Generate a first sub-signature parameter based on the key share and the hash commitment, generate a second sub-signature parameter based on the elliptic curve base point, the key share, the hash commitment, the currently selected second private information, and a randomization function synchronized by the primary signer, and generate a third sub-signature parameter based on the hash commitment and the second sub-signature parameter;

[0027] The sub-signature corresponding to the distributed signatory is obtained based on the combination of the first sub-signature parameter, the second sub-signature parameter and the third sub-signature parameter.

[0028] In an embodiment of the present application, three signature parameters corresponding to the sub-signature are generated based on the key share, elliptic curve base point, hash commitment and the currently selected second private information, so that the main signer can verify the legitimacy of each sub-signature, thereby further improving the security of the distributed signature.

[0029] In some possible embodiments, both the first private information and the second private information are random numbers selected based on a preset prime domain.

[0030] In the embodiment of the present application, random numbers selected based on a preset prime field are used as the first private information and the second private information, thereby improving the uniformity of obtaining private information and further improving the efficiency of distributed signatures.

[0031] In a second aspect, an embodiment of the present application provides a distributed signature system, including a primary signatory, a data receiver, and a plurality of distributed signatories, wherein:

[0032] The master signer is used to generate a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculate the key share corresponding to each of the distributed signers respectively based on its own private key and the currently selected first privacy information, and send the hash commitment and the key share to the corresponding distributed signer respectively;

[0033] The distributed signer is used to calculate the public key corresponding to the respective key share based on the pre-selected elliptic curve base point, generate the corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information, and broadcast the public key and the sub-signature;

[0034] The master signer is further used to verify the sub-signatures of each distributed signer, generate a complete signature based on the key share and each sub-signature after each sub-signature is verified, and send the complete signature and the number of each distributed signer to the data recipient;

[0035] The data receiver is used to generate a verification hash commitment corresponding to the message to be transmitted based on the hash function, verify the complete signature based on the verification hash commitment and the public key, and receive the message to be transmitted after the verification is passed.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0038] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a distributed signature method provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0043] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0044] It should be noted that the existing distributed signature schemes have at least the following defects:

[0045] 1. The public and private key pairs used for signing are generated by each node itself, and the public keys of each participant are not verified during the signing process, resulting in the identity of the signer being impersonated or the signature information being stolen;

[0046] 2. If the sub-signature needs to be verified, multiple rounds of communication are required. In addition, since complex calculations such as Lagrange interpolation are required in the signature verification process, the efficiency of distributed signature and verification is not high.

[0047] 3. The signature contains the original message, which allows attackers to forge a synthetic signature, resulting in low security and reliability of distributed signatures.

[0048] In view of the problems existing in the above-mentioned prior art, the embodiments of the present application provide a distributed signature method, which solves the problem of verifiability of distributed signature identity to prevent the identity of the signer from being impersonated; solves the problems of high computational complexity and communication complexity in the distributed signature process to improve the efficiency of distributed signature; in addition, the distributed signer assists in generating a complete signature, thereby effectively improving the security and reliability of the distributed signature.

[0049] like Figure 1As shown, the embodiment of the present application provides a distributed signature method, which may include the following steps:

[0050] S1. The main signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculates the key share corresponding to each distributed signer based on its own private key and the currently selected first privacy information, and sends the hash commitment and key share to the corresponding distributed signer.

[0051] It should be noted that in the embodiment of the present application, the distributed signature scheme includes multiple participants: the data sender (main signer), n distributed signers, and the data receiver. The main signer generates an unforgeable complete signature with the assistance of each distributed signer; the data receiver receives the data transmitted by the data sender after verifying the validity of the complete signature; each distributed signer is responsible for generating its own corresponding sub-signature to assist the main signer in completing the signing process, but cannot obtain sensitive information (original data) during the generation of the sub-signature.

[0052] Specifically, each participant first selects an elliptic curve E defined on a finite field and determines the base point G on the elliptic curve E, and then the participants negotiate an ideal hash function.

[0053] When starting a distributed signature, the main signer first generates a hash commitment for the data to be transmitted using a pre-negotiated hash function; then, the first private information is selected to calculate the key share corresponding to each distributed signer. For example, the first private information can be a random number selected based on a preset range. Finally, the generated hash commitment and key share are sent to the corresponding distributed signer (different distributed signers correspond to different key shares).

[0054] S2. Each distributed signatory calculates the public key corresponding to its own key share based on the pre-selected elliptic curve base point, and generates a corresponding sub-signature based on the key share, elliptic curve base point, hash commitment and the currently selected second private information, and broadcasts the public key and sub-signature.

[0055] Furthermore, both the first private information and the second private information are random numbers selected based on a preset prime domain.

[0056] Specifically, after receiving the hash commitment and key share, each distributed signatory generates a sub-signature. On the one hand, the corresponding public key is generated according to the key share it receives (different distributed signatories correspond to different public keys); on the other hand, the corresponding sub-signature is generated according to the key share, elliptic curve base point, hash commitment and the currently selected second private information. Finally, the generated public key and sub-signature are broadcasted, and the broadcasted information can be obtained by other participants for verification, etc.

[0057] It should be noted that both the first private information and the second private information are random numbers or a set of random numbers selected based on a preset prime domain.

[0058] S3. The main signer verifies the sub-signatures of each distributed signer, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signer to the data recipient.

[0059] After obtaining the sub-signatures broadcast by each distributed signatory, the main signatory first needs to verify these sub-signatures. After all sub-signatures are verified, a complete signature is generated based on the information of these sub-signatures and the key shares calculated above, and then the complete signature and the number of each distributed signatory are sent to the data recipient. If the sub-signature verification fails, the signature of the distributed signatory is rejected (the sub-signatures of other distributed signatories are used instead, and a complete signature can be generated by collecting no less than a preset number of sub-signatures) or the signing process is terminated.

[0060] S4. The data recipient generates a verification hash commitment corresponding to the message to be transmitted based on the hash function, verifies the complete signature based on the verification hash commitment and the public key, and receives the message to be transmitted after the verification is passed.

[0061] Specifically, after receiving the complete signature sent by the main signer and the numbers of each distributed signer, the data recipient first uses the hash function agreed upon by all parties to calculate the corresponding verification hash commitment based on the message to be received (message to be transmitted), and then verifies the complete signature based on the verification hash commitment and the public key. After both verifications are passed, the message is received.

[0062] Based on this, by using secure multi-party computing, hash commitment and randomization functions to build a distributed privacy signature scheme, it is possible to protect data privacy and enhance the randomness of the signature, while also simplifying the signature verification process, thereby effectively improving the efficiency and security of distributed signatures.

[0063] In some possible embodiments, step S3, the main signer verifies the sub-signatures of each distributed signer, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signer to the data recipient, which may include:

[0064] The main signer authenticates each distributed signer based on the public key corresponding to each key share, and verifies the sub-signature of each distributed signer;

[0065] When the identity authentication and sub-signature verification are passed, a complete signature is generated based on the key share and each sub-signature, and the complete signature and the number of each distributed signatory are sent to the data recipient;

[0066] In the event that identity authentication fails or sub-signature verification fails, the sub-signature of the corresponding distributed signatory party will be rejected.

[0067] It should be noted that in addition to verifying the sub-signatures of each distributed signatory, the main signatory can also authenticate each distributed signatory based on the public key broadcast by the distributed signatory. Only when the identity authentication and sub-signature verification are passed, a complete signature is generated based on the key share and each sub-signature and sent to the data recipient. Otherwise, the sub-signature of the corresponding distributed signatory is rejected, or the distributed signature process is terminated.

[0068] Based on this, by verifying the identity of each distributed signatory based on the public key corresponding to the key share, it is possible to prevent the identity of the signatory from being misused, further improving the security of the distributed signature.

[0069] In some possible embodiments, step S1, the primary signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculates the key share corresponding to each distributed signer respectively in combination with its own private key and the currently selected first privacy information, and sends the hash commitment and the key share to the corresponding distributed signer respectively, which may include:

[0070] The primary signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function;

[0071] Constructing a polynomial function by combining its own private key and a pre-selected first random number set, and calculating the key share corresponding to each distributed signatory based on the polynomial function and the currently selected second random number set;

[0072] Send the hash commitment and key share to the corresponding distributed signing parties respectively.

[0073] It should be noted that each time the master signer generates a key share, it first constructs a polynomial function based on its own private key and the currently selected first random number set (the number of random numbers contained in this set is determined based on the threshold value of the pre-negotiated threshold signature), and then selects a second random number set (the number of random numbers in this set is consistent with the number of distributed signers) and substitutes it into the polynomial function for calculation to obtain the key share corresponding to each distributed signer.

[0074] Based on this, by constructing a secret polynomial and calculating the key shares of different signatories respectively, the randomness of the signing process is further improved, thereby improving the security of the distributed signature.

[0075] In some possible embodiments, in step S3, the primary signer verifies the sub-signatures of each distributed signer, which may also include:

[0076] The main signer calculates the share verification information corresponding to each distributed signer based on each sub-signature and hash commitment, and uses the share verification information corresponding to each distributed signer to perform interpolation operations to restore the verification polynomial function;

[0077] Based on the verification polynomial function, the constant term is compared with the polynomial function to verify the sub-signature of each distributed signature party.

[0078] It should be noted that in the process of the main signer verifying the sub-signatures of each distributed signer, a verification step can be further added: first, the corresponding share verification information is calculated based on the hash commitment and the parameters of the sub-signature, and then an interpolation operation is performed using no less than a preset number (the threshold value of the preset threshold signature) of share verification information to restore a polynomial (verification polynomial function), and then it is verified whether the constant term of the polynomial is consistent with the constant term of the polynomial function constructed in the previous steps. If they are consistent, the verification process of the sub-signature is passed.

[0079] Based on this, by restoring and calculating the share verification information corresponding to each sub-signature, and using interpolation operations to restore the verification polynomial function, each sub-signature is verified based on the comparison of the polynomial function, thereby further improving the security of the distributed signature.

[0080] In some possible embodiments, in step S2, generating a corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment, and the currently selected second private information may include:

[0081] Generate a first sub-signature parameter based on the key share and the hash commitment, generate a second sub-signature parameter based on the elliptic curve base point, the key share, the hash commitment, the currently selected second private information, and the randomization function synchronized by the primary signer, and generate a third sub-signature parameter based on the hash commitment and the second sub-signature parameter;

[0082] Based on the combination of the first sub-signature parameter, the second sub-signature parameter and the third sub-signature parameter, the sub-signature corresponding to the distributed signing party is obtained.

[0083] Exemplarily, in the process of generating a sub-signature, each distributed signatory may first generate a first sub-signature parameter based on its own key share and hash commitment; then select a random number, and combine the key share, hash commitment and elliptic curve base point G, and use a randomization function synchronized by the main signatory to generate a second sub-signature parameter; finally, the product of the hash commitment and the second sub-signature parameter is used as the third sub-signature parameter, and the first sub-signature parameter, the second sub-signature parameter and the third sub-signature parameter are combined as the sub-signature corresponding to the current distributed signatory.

[0084] Based on this, by generating three signature parameters corresponding to the sub-signature based on the key share, elliptic curve base point, hash commitment and the currently selected second private information, the signing process of the hash commitment by the distributed signer is realized, thereby improving the security of the distributed signature.

[0085] As an example, the distributed signature method of this application is described below with reference to a specific example:

[0086] The parties involved in the distributed signature scheme include: the data sender (the main signer, hereinafter referred to as Alice), n distributed signers {P1, P2, ..., P n}、Data receiver (signature verifier, hereinafter referred to as Bob).

[0087] First, each participant selects an elliptic curve E defined on a finite field, and G is the base point on E (in the elliptic curve cryptography encryption algorithm, the base point is the basis for generating the public key). Each participant negotiates an ideal hash function p is a sufficiently large prime number (the size of the prime number is determined by the message sequence to be converted), and the threshold value t of the threshold signature is negotiated. The main signer Alice synchronizes a randomization function R(·) to each distributed signer.

[0088] The distributed signature process is as follows:

[0089] 1. Alice requests a signature:

[0090] Assume that the data that Alice wants to transmit to Bob is m;

[0091] (1) To protect data privacy, the distributed signer only signs the summary information of the data. To this end, Alice calculates the hash commitment about the message m to be signed: h = H(m).

[0092] (2) Alice selects t (threshold value of threshold signature) random numbers (first random number set): And use these random numbers and your own private key to construct a t-1 degree polynomial (polynomial function): f(x) = (sk A+a0)+a1x+...+a t-1 x t-1 , where sk A is Alice's private key, which will not be leaked because it is obfuscated with the random number a0. Then, Alice reselects n random numbers (the second random number set): And use the polynomial function to calculate the key share corresponding to each distributed signature party: f i =f(b i )(i∈[n]).

[0093] (3) Alice sends the key share f i And the hash commitment h is sent to the corresponding distributed signing party P through a secure channel i (i∈[n]) to request each distributed signing party to perform a distributed signature on the hash commitment value to obtain the corresponding sub-signature.

[0094] 2. Sub-signature generation process:

[0095] Each distributed signing party P i (i∈[n]) receives <f i ,h>, generate their own sub-signatures, the process is as follows:

[0096] (1) Calculate the first sub-signature parameter: τ i =f i ·h;

[0097] (2) Calculation and f i Corresponding public key: PK i =f i G, and broadcast PK i .

[0098] The primary signer can use PK i Authentication of each distributed signatory is performed to prevent the signatory from being impersonated, because according to the properties of the elliptic curve, only f i The signing party can generate the corresponding PK i .

[0099] (3) Select a random number (second private information): And use the randomization function R(·) to calculate two randomization parameters: (u i ,v i )←R(G,f i ,h,x i ), where the second sub-signature parameters include: u i =(x i +h)·G,v i =f i (xi +h)·G;

[0100] (4) Based on the hash commitment and the v in the second sub-signature parameter i , the third sub-signature parameter is further calculated by the following formula: T i =h·v i ;

[0101] (5) Based on the first sub-signature parameter and the second sub-signature parameter (using u i ) and the third sub-signature parameter to generate the sub-signature: σ i =(τ i ,u i ,T i ), and broadcast σ i .

[0102] 3. Complete signature generation process:

[0103] Alice collects no less than t sub-signatures σ sent by each distributed signature party i After that, each sub-signature is verified using the hash commitment h. The verification method is:

[0104] (1) Verify T i =u i ·h·f i =τ' i ·u i Is it true, where τ' i =f i h is calculated by the primary signer;

[0105] (2) Verify whether τ·G=h·PK holds, where PK' i =f i G is calculated by the primary signer;

[0106] If both equations above hold, then t sub-signatures pass verification. This is because Alice can calculate τ' locally i and PK' i , and PK' i If the above two equations are both true, Alice can be sure that the sub-signature generated by the distributed signing party is indeed honestly generated in accordance with the pre-negotiated signature protocol.

[0107] Optionally, in addition to the above verification steps (1) and (2), a verification step (3) can be added: Alice calculates f' i =τ i / h, then use no less than t (i,f' i) to perform interpolation operations, restore the polynomial (verify the polynomial function), and then verify whether the constant term of the polynomial is equal to (sk A +a0).

[0108] After Alice receives no less than t sub-signatures and each sub-signature passes verification, the process of Alice generating a complete signature is: Calculation Thus, a complete signature is generated: σ = (U, T, F), and the complete signature σ and the numbers of the t distributed signatories are sent to Bob.

[0109] 4. Complete signature verification and data receiving process:

[0110] After Bob receives the message m' and the complete signature σ sent by Alice, he verifies the validity of the signature as follows:

[0111] Calculate h'=H(m'), where τ i and PK i It is based on the message acquisition broadcast by each distributed signing party;

[0112] Then verify whether τ·G=h'·PK and verify whether T=h'·U·Fmodp. If both are true, it means that there is no problem with the message m' to be received and the complete signature σ, and the message m' is received; otherwise, the verification fails and the message m' is rejected.

[0113] It should be noted that the embodiments of the present application have the following beneficial effects:

[0114] 1. The distributed signer uses the signature key share generated by the data sender to generate the corresponding public key. The data sender can also calculate the public key information. Therefore, the data sender can verify the identity of each distributed signer and solve the problem of verifiability of distributed signature identity to prevent the identity of the signer from being impersonated.

[0115] 2. Use secure multi-party computing, hash commitment, and randomization function to build a distributed privacy signature scheme, where hash commitment is used to protect data privacy, and randomization function is used to enhance the randomness of the signature scheme. At the same time, the local operation of the distributed signer is combined to generate the signature, thereby improving the security and reliability of the signature scheme.

[0116] 3. In the process of generating a complete signature, only one round of communication is required between the data sender and the distributed signer, and the complexity of the algorithm is relatively low, thus solving the problem of high computational complexity and communication complexity in the distributed signature process and reducing computational and communication overheads.

[0117] 4. Use a polynomial function to distribute the signature key share used to generate the sub-signature. The signature key share is also used by the main signer to confirm the identity of each distributed signer. However, during the signing and verification process, there is no need to recover the secret information hidden by the polynomial, thereby reducing the amount of calculation to improve the efficiency of distributed signatures. In addition, even if the distributed signers collude with each other, they cannot obtain valid information about the private key of the data sender, thereby improving the privacy protection capability of the signature scheme.

[0118] 5. Use distributed signatories to assist in generating complete signatures, thereby significantly reducing the risk of signature forgery and improving the security and reliability of the signature scheme.

[0119] The embodiment of the present application also provides a distributed signature system, including a primary signatory, a data receiver, and a plurality of distributed signatories, wherein:

[0120] The master signer is used to generate a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculate the key share corresponding to each distributed signer respectively based on its own private key and the currently selected first privacy information, and send the hash commitment and key share to the corresponding distributed signer respectively;

[0121] The distributed signer is used to calculate the public key corresponding to the respective key share based on the pre-selected elliptic curve base point, generate the corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information, and broadcast the public key and the sub-signature;

[0122] The main signer is also used to verify the sub-signatures of each distributed signer, generate a complete signature based on the key share and each sub-signature after each sub-signature is verified, and send the complete signature and the number of each distributed signer to the data recipient;

[0123] The data receiver is used to generate a verification hash commitment corresponding to the message to be transmitted based on a hash function, verify the complete signature based on the verification hash commitment and the public key, and receive the message to be transmitted after the verification is passed.

[0124] It can be understood that the above-mentioned system item embodiment corresponds to the method item embodiment of the present invention. A distributed signature system provided by the embodiment of the present invention can implement the distributed signature method provided by any method item embodiment of the present invention.

[0125] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method, and will not be elaborated here.

[0126] like Figure 2As shown, some embodiments of the present application provide an electronic device 200, which includes: a memory 210, a processor 220, and a computer program stored in the memory 210 and executable on the processor 220, wherein the processor 220 reads the program from the memory 210 through the bus 230 and executes the program to implement a method of any embodiment included in the above-mentioned distributed signature method.

[0127] Processor 220 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 220 can be a microprocessor.

[0128] The memory 210 may be used to store instructions executed by the processor 220 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 220 of the disclosed embodiment may be used to execute instructions in the memory 210 to implement the method shown above. The memory 210 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0129] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0130] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0131] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0133] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0134] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0135] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0136] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0137] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A distributed signature method, characterized in that: include: The master signer generates a hash commitment for the message to be transmitted based on the pre-negotiated hash function, calculates the key share corresponding to each distributed signer based on its own private key and the currently selected first privacy information, and sends the hash commitment and the key share to the corresponding distributed signer respectively; Each distributed signatory calculates a public key corresponding to its own key share based on a pre-selected elliptic curve base point, generates a corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information, and broadcasts the public key and the sub-signature; The main signer verifies the sub-signatures of each distributed signer, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signer to the data recipient; The data recipient generates a verification hash commitment corresponding to the message to be transmitted based on the hash function, verifies the complete signature based on the verification hash commitment and the public key, and receives the message to be transmitted after the verification passes.

2. The distributed signature method according to claim 1, characterized in that: The main signatory verifies the sub-signatures of each distributed signatory, generates a complete signature based on the key share and each sub-signature after each sub-signature is verified, and sends the complete signature and the number of each distributed signatory to the data recipient, including: The master signer authenticates each distributed signer based on the public key corresponding to each key share, and verifies the sub-signature of each distributed signer; If the identity authentication passes and the sub-signature verification passes, a complete signature is generated based on the key share and each sub-signature, and the complete signature and the number of each distributed signatory are sent to the data recipient; In the event that the identity authentication fails or the sub-signature verification fails, the sub-signature of the corresponding distributed signatory is rejected.

3. The distributed signature method according to claim 1, characterized in that: The master signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculates the key share corresponding to each distributed signer in combination with its own private key and the currently selected first privacy information, and sends the hash commitment and the key share to the corresponding distributed signer, including: The primary signer generates a hash commitment for the message to be transmitted based on a pre-negotiated hash function; Constructing a polynomial function by combining its own private key and a pre-selected first random number set, and calculating the key share corresponding to each distributed signatory based on the polynomial function and the currently selected second random number set; The hash commitment and the key share are respectively sent to corresponding distributed signing parties.

4. The distributed signature method according to claim 3, characterized in that: The main signing party verifies the sub-signatures of each distributed signing party, further comprising: The main signer calculates the share verification information corresponding to each distributed signer based on each sub-signature and the hash commitment, and performs interpolation operation using the share verification information corresponding to each distributed signer to restore the verification polynomial function; Based on the verification polynomial function, a constant term comparison is performed with the polynomial function to verify the sub-signature of each distributed signatory.

5. The distributed signature method according to claim 1, characterized in that: The generating a corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information includes: Generate a first sub-signature parameter based on the key share and the hash commitment, generate a second sub-signature parameter based on the elliptic curve base point, the key share, the hash commitment, the currently selected second private information, and a randomization function synchronized by the primary signer, and generate a third sub-signature parameter based on the hash commitment and the second sub-signature parameter; The sub-signature corresponding to the distributed signatory is obtained based on the combination of the first sub-signature parameter, the second sub-signature parameter and the third sub-signature parameter.

6. The distributed signature method according to claim 1, characterized in that: The first private information and the second private information are both random numbers selected based on a preset prime domain.

7. A distributed signature system, characterized in that: It includes the main signer, the data receiver and several distributed signers, among which: The master signer is used to generate a hash commitment for the message to be transmitted based on a pre-negotiated hash function, calculate the key share corresponding to each of the distributed signers respectively based on its own private key and the currently selected first privacy information, and send the hash commitment and the key share to the corresponding distributed signer respectively; The distributed signer is used to calculate the public key corresponding to the respective key share based on the pre-selected elliptic curve base point, generate the corresponding sub-signature based on the key share, the elliptic curve base point, the hash commitment and the currently selected second private information, and broadcast the public key and the sub-signature; The master signer is further used to verify the sub-signatures of each distributed signer, generate a complete signature based on the key share and each sub-signature after each sub-signature is verified, and send the complete signature and the number of each distributed signer to the data recipient; The data receiver is used to generate a verification hash commitment corresponding to the message to be transmitted based on the hash function, verify the complete signature based on the verification hash commitment and the public key, and receive the message to be transmitted after the verification is passed.

8. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor can implement the distributed signature method described in any one of claims 1 to 6 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the distributed signature method according to any one of claims 1 to 6 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the distributed signature method according to any one of claims 1 to 6 is implemented.

Images