High-robustness dynamic threshold signature scheme technology in alliance chain

Abstract

The threshold signature technology can allow a plurality of participants to jointly generate an effective signature in the block chain, so that the security is enhanced, and the decentration capability is also provided. In the alliance chain with frequent node change, the current threshold signature scheme has many defects including insufficient robustness and fault tolerance in the signature process, difficulty in supporting dynamic joining and quitting of signature nodes, difficulty in adapting to an asynchronous alliance chain network environment and the like. In order to overcome the defects, the invention designs a high-robustness dynamic threshold signature scheme in an alliance chain, specifically, aiming at the problems of robustness and fault tolerance, a method of converting signature shares into shares in a threshold form is adopted, and aiming at the problems of dynamics and asynchronism, secret sharing and private key refreshing are adopted, so that the signature sharing efficiency is improved. The technology in the scheme can effectively solve the defects in a threshold signature scheme in a current alliance chain, so that the alliance chain has robustness and fault tolerance, meets dynamic nature and adapts to an asynchronous network environment.

Description

Technical Field

[0001] The technologies used in this application mainly include blockchain and threshold signature technology, which mainly involves the design of a highly robust dynamic threshold signature scheme in an asynchronous BFT consensus blockchain scenario. Background Art

[0002] The current blockchain is mainly divided into permissioned blockchain (such as consortium blockchain, etc.) and unpermitted blockchain (such as Bitcoin, Ethereum, etc.). In mainstream blockchains, digital signature technology is widely used to verify transactions. The ability to generate signatures is equivalent to the ability to spend money. Whenever a transaction is signed, a certain "gas fee" needs to be paid. When many members sign the same transaction separately, the fees generated will increase in proportion to the number of users, and the communication cost consumed will also increase accordingly. In order to reduce the cost of signatures, when multiple users sign the same transaction, we can use threshold signature technology, and a group of members will only generate one signature for the same transaction information. The so-called threshold signature technology refers to allowing n members to distribute digital signatures under a shared single public key, specifying a threshold value t, so that any subset of t+1 members can generate a public signature, but a smaller subset cannot generate a public signature. In the blockchain, the control of cryptocurrency is distributed among n servers (or members), and confidential currency transactions are authorized by digital signatures. By using the (t,n) threshold signature scheme, any number of servers exceeding t can generate a public signature. Even if as many as t of the n servers are attacked, no valid signature can be generated, and the cryptocurrency remains secure.

[0003] However, the existing threshold signature schemes have the following three problems: First, the threshold scheme can achieve the condition of (t,n), but the signature process in the scheme is usually generated by (t′,t′) (where t<t′<n), and once a member fails to sign during the signature process, the signature process needs to be restarted, which is not robust and fault-tolerant. Secondly, in the environment of asynchronous BFT blockchain, the communication process is often asynchronous. When the communication delay is too large, it is basically difficult for the threshold signature to generate a valid public signature. Finally, in the signing process, there is often a process of signing members joining and leaving. The current threshold signature schemes rarely support dynamic joining and leaving of members and are not dynamic. To this end, we propose a dynamic threshold signature scheme that can support robustness and high fault tolerance in an asynchronous environment.

[0004] To implement the dynamic threshold signature scheme, the digital signature technology we use is the Elliptic Curve Digital Signature Scheme (ECDSA). The work we do is to expand and improve ECDSA. By adding the dynamic member joining and exiting process and designing the share conversion on the basis of ECDSA, we have completed the scheme design of this application. Summary of the invention

[0005] The present application provides an ECDSA dynamic threshold signature scheme that can support dynamic joining and exit of signature members in an asynchronous network, which is used to solve the problems of insufficient robustness and fault tolerance of threshold signature technology in current asynchronous blockchain scenarios and inability to support dynamic joining and exit of signature members.

[0006] The present application provides a complete ECDSA dynamic threshold scheme with high robustness in an asynchronous network environment in an embodiment, including the following steps: 1) Distributed key generation stage: the shares are distributed in the signature member set through polynomials, and all signature members calculate their own signature shard private keys after receiving all the share secrets from other members; 2) Pre-signature stage: Each member in the signature member set calculates the pre-signature additive share with other members in the signature member set through the signature shard private key obtained from the distributed key generation stage and the random number generated by itself, and converts it into a threshold share through the scheme of converting the additive share of the present application to obtain the pre-signature threshold share; 3) Signature stage: By introducing an honest coordinator, when verifying the interactive information, Signature members are divided into honest node sets and dishonest node sets. When the honest node set meets a specific number, the honest node set is started to complete the signature; 4) Joining and exiting phase: When a member joins, the joining member selects a random polynomial with a constant term of 0 as the polynomial for share distribution in the distributed key generation phase, and then performs distributed key generation to obtain its own signature shard private key. Other signature members also update their signature private keys through calculation. When a member exits, the remaining signature member sets all select a random polynomial with a constant term of 0 to update their signature private keys; 5) Additive share conversion to threshold share phase: Signature members use their additive shares as the constant terms of the polynomial and use the polynomial to distribute shares to obtain their own threshold shares.

[0007] In one embodiment of the present application, the distributed key generation stage further includes: the signing member generates a random number as its own secret private key, and uses the secret private key as a constant term to generate a polynomial, calculates the public key of its own secret private key and the commitment of the public key, broadcasts its own public key commitment, calculates the polynomial shares and verification tuples of other members through the polynomial, sends the polynomial shares to other signing members and broadcasts the verification tuple, and after receiving the polynomial shares and broadcast verification tuples sent by other members, the signing member accumulates and calculates its own signature shard private key and calculates its own signature shard public key.

[0008] In one embodiment of the present application, the pre-signature stage further includes: the signing member locally generates its own random number and the signature shard private key obtained in the distributed key generation stage, keeps the random number and the signature shard private key as a secret, and multiplies them with other signing members in an encrypted manner to obtain a parameter share for calculating the common point of the elliptic curve, and a parameter share for calculating the signature. Since the parameter share obtained in this stage is an additive share, it is converted into a threshold share using the method of converting an additive share into a threshold share, and the final pre-signature share is a threshold share.

[0009] In one embodiment of the present application, the signing stage further includes: the signing member sends the pre-signature threshold share obtained from the pre-signature stage to the coordinator in a confidential manner using zero-knowledge proof; the coordinator adds the signing member to the honest node set after verification, otherwise it adds the dishonest node set; when the threshold value t is met in the honest node set, the complete pre-signature is obtained by Lagrange interpolation calculation, and the obtained pre-signature is calculated with the transaction message to obtain the signature of the transaction message; if a signing member fails to receive a response for a long time, the coordinator may add it to the dishonest node set.

[0010] In one embodiment of the present application, the joining and exiting stages further include: the newly joined signature member selects a random polynomial with a constant term of 0, calculates the polynomial shares and verification tuples of other members, obtains its own signature shard private key and signature shard public key through share distribution, and other members also update their signature shard private keys and signature shard public keys accordingly; when the signature member exits, the signature member in the signature member set after the exit selects a new random polynomial with a constant term of 0, distributes shares with the remaining members, calculates the polynomial shares and verification tuples, and adds them to the original signature shard private key to obtain a new signature shard private key and signature shard public key.

[0011] In one embodiment of the present application, the stage of converting the additive share into the threshold share further includes: the signature member distributes the shares with other signature members by using the additive share as the constant term of the polynomial, calculates the polynomial shares and the check tuple, and obtains the threshold share by calculating the polynomial shares and the check tuple from other members.

[0012] Therefore, the embodiments of the present application have the following beneficial effects:

[0013] Through the scheme of converting the threshold share stage from additive shares, in the set of signature members, it is not necessary to collect all additive pre-signatures to complete the signing of the transaction, because by converting the additive share into the threshold share, as long as there is a threshold number of pre-signature shares, the pre-signature value accumulated by the original additive share can be restored through Lagrange interpolation, and there is a set of dishonest nodes, and the erroneous nodes can be tolerated, that is, when the signature verification of a signature member fails, the subsequent signing process can still be carried out, so that the robustness of the entire signature process is improved and the threshold optimality is achieved. This application can identify honest nodes and dishonest nodes by designing a coordinator to coordinate the entire signature, and can adapt to an asynchronous network environment by judging the response time of the members, that is, in an asynchronous network environment, the signature can still be completed. In addition, this application designs the joining and exiting stages, and updates the signature private key, which can resist the attacks of active adversaries, and can adapt to the asynchronous BFT blockchain scenario where the signature members frequently flow, solving the problem that digital signatures are difficult to complete when members change in asynchronous BFT blockchains.

[0014] The present application further explains the present solution and its beneficial effects in detail in the accompanying drawings and specific implementation methods, so that the present application can be more obvious and easy to understand. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 In the figure, DKG is the distributed key generation stage, PreSign is the pre-signing stage, and Sign is the signing stage. In the DKG stage, the signing member C i Send the polynomial share to other members in the signature set to generate their own signature shard private key sk i And the shard public key pk i ; In the PreSign phase, the signature member C i Generate two random numbers k i and γ i , and use the two random numbers and the signature shard private key to perform multiplication-to-addition (MtA) protocol calculation and additive share-to-threshold share protocol (AtT) calculation to obtain the signature threshold share Finally, in the Sign phase, t honest members are satisfied, (k,δ,σ) is restored and the signature information (r,s) is calculated with the message m.

[0016] Figure 2 .This figure shows the scenario when a signing member joins. By selecting a random polynomial with a constant term of 0, the share is calculated and sent to other members in the signature set. After receiving the shares sent by other signing members, the signature shard private key is calculated to obtain its own signature.

[0017] Figure 3 The figure shows a schematic diagram of the time threshold signature scheme. A public signature can be generated when there are more than or equal to t honest signing members.

[0018] Specific example demonstration

[0019] The embodiments of the present application will be described in detail below. The examples are marked in the accompanying drawings, wherein the same or similar symbols and numbers throughout represent the same or similar meanings. The drawings of the present application are used to explain the present application and cannot be understood as limiting the present application.

[0020] For ease of explanation, this application assumes that the initial signature member set is S, whose number is n, the set of signature members after the change is S′, whose number is n′, the threshold value of the signature is t, and the number of signature members that the active adversary can control cannot reach the threshold value t.

[0021] The meanings of the parameters involved in the embodiments of the present application are shown in Table 1. For the incomplete parameters shown in Table 1, specific explanations will be given in the following embodiments.

[0022] Table 1 Parameter types and meanings involved in this application

[0023]

[0024] It should be noted that, unless otherwise specified in the entire stage of this application, the perspective used is to calculate the entire solution from the perspective of a certain signature member in the signature member set.

[0025] Let (G,G,q) be a tuple of elliptic curve group G, generator G, and group order q, where q is a prime number. Each element b∈G in the elliptic curve group is represented as a pair (b x ,b y ), where b x is the projection of b on the x-axis, b y is the projection of b on the y axis, let π:G→F q Represented as mapping point b∈G to b x modq function, let H:{0,1} * →F q is a hash function.

[0026] Specifically, the specific process of the distributed key generation phase is as follows:

[0027] S1-1 Each signature member C in the signature member set S i Choose a random number μ i ∈Z q , calculate C i The child public key U i =μ i G, and calculate the child public key U i Commitment and Opening Commitment[C DKG ,DC DKG ] i =Com(U i ), and broadcasts the commitment C DKG .

[0028] S1-2 Each signing member C i Open commitment DC via broadcast DKG For your own child public key U i Verify that your sub-public key U i Can only be opened by yourself and calculate the common public key of the signature members

[0029] S1-3 Each signing member C i Set your own random number μ i As a constant term of the t-1 degree polynomial, generate your own polynomial f i (x) = μ i +a i1 x+a i2 x 2 +...+a i(t-1) x t-1 , where a i1 ,a i2 ,...,a i(t-1) ∈Z q .

[0030] S1-4 Each signing member C i The identity information ID of other signing members j Substitute as a variable into the polynomial to calculate the polynomial fraction f i (ID j ) sends it to the signing member ID j , and calculate the check tuple {A i1 ,A i1 ,...,A i(t-1)}, where A ij =a ij G(j∈[1,t-1]), broadcasts the verification tuple to facilitate the subsequent verification of the polynomial shares.

[0031] S1-5 Each signing member C i Upon receiving a signature from other member C j The polynomial share and the check tuple are then checked and calculated. If the If yes, the share is accepted, otherwise it is discarded.

[0032] S1-6 Each signing member C i After receiving the polynomial shares sent by all other signing members, calculate your own signature shard private key and shard public key, that is, the shard private key and shard public key pk i =sk i ·G.

[0033] So far, each signature member contains the sub-public key set {U1,U2,...,U n}, common public key PK, shard public key set {pk1,pk2,...,pk n}, and its own confidential data, including the random number μ i (can be discarded) and the shard private key sk i . And the relationship between the shard public key set and the common public key PK satisfies where λ i are the Lagrange interpolation coefficients.

[0034] Specifically, the specific process of the pre-signature stage is as follows:

[0035] S2-1 Each signing member C i Generate a random number (k i ,γ i )∈Z q , calculate the random point F of the elliptic curve i =γ i G, and for a random point F on the elliptic curve i Calculate Commitment and Open Commitment [C PreSign ,DC PreSign ] i =Com(F i ), and broadcasts the commitment C PreSign .

[0036] S2-2 Each signing member C i The random number (k i ,γ i ) and other signing members C j (j∈S) performs MtA protocol (multiplication to addition) calculation:

[0037]

[0038] C iThe results obtained by the MtA protocol are calculated to obtain δ i As input, the additive share δ is converted into the threshold share process. i Convert to threshold share

[0039] S2-3 Each signing member C i The random number k i And your own shard private key sk i With other signature members C j (j∈S) performs MtA protocol (multiplication to addition) calculation:

[0040]

[0041] C i The results obtained by the MtA protocol are calculated σ i As input, the additive share σ is converted into the threshold share process. i Convert to threshold share

[0042] S2-4 Each signing member C i K i As input, the additive share k is converted into the threshold share process. i Convert to threshold share Finally, we get the pre-signed tuple

[0043] In the above process, the random number (k i ,γ i ,sk i ) is encrypted using the Paillier homomorphic encryption method, and i and sk i Generate zero-knowledge proof zk to prove C i Know your random number i and the shard private key sk i , preparing for the subsequent signing phase.

[0044] Specifically, the specific process of the signature phase is as follows:

[0045] S3-1 Each signing member C i Extract from the pre-signed tuple And Make a commitment to calculate commitment And broadcast the commitment RC i .

[0046] S3-2 Coordinator C cUpon receipt of the commitment RC i After that, use open commitment for verification. If the verification succeeds, it will be added to the honest node set H, otherwise it will be added to the dishonest node DH.

[0047] S3-3 C i Extract from the pre-signed tuple And Encrypt it and send it to the coordinator C using zero-knowledge proof c .

[0048] S3-4 Coordinator C c On receiving the After the proof is obtained, it is verified. If the verification is correct, it is added to the honest node set H, otherwise it is added to the dishonest node set DH. If a signature member does not respond for a certain period of time, the signature member can be included in the dishonest node DH.

[0049] S3-5 When the number of honest nodes is greater than or equal to t, the signature calculation is started. The honest node set jointly calculates R. The honest node set calculates δ through Lagrange interpolation. The random point F of the elliptic curve is verified by opening the commitment i , calculated Let the horizontal coordinate of R be r.

[0050] The S3-6 honest node set restores k and σ through Lagrange interpolation calculation, and performs hash calculation on the message M to obtain m=H(M), and then calculates the signature s=mk+rσ to verify the validity of (r,s).

[0051] In the above process And the public key used for verification is And the verification process of (r,s) is as follows:

[0052]

[0053] That is, π(R′)=π(R)=r, where the consistency of R is verified as follows:

[0054]

[0055] What needs to be explained in the above signing process is that we have taken into account the asynchronous network scenario, and some signing members may not get a response for a long time. In order to meet the asynchronous environment, we will classify the signing members who have not received a response for a long time into the dishonest node set. Even if the signing member can never respond, it will not hinder the subsequent signing process because there are enough signing members to complete the entire signature.

[0056] Specifically, the specific process of converting the additive share into the threshold share is as follows:

[0057] The additive shares we describe satisfy where a i That is, additive shares, which need to be accumulated to calculate a. Converting them into threshold shares means that a can be calculated when the threshold value of t shares is met.

[0058] S4-1 Each signing member will take his share a i As input, the share a i As a constant term of a t-1 degree polynomial, calculate the public key U required for verification i ′=a i G, generate a polynomial f i (x) = a i +a i1 x+a i2 x 2 +...+a i(t-1) x t-1 , where a i1 ,a i2 ,...,a i(t-1) ∈Z q , for U i 'Calculate commitment and open commitment [C AtoT ,DC AtoT ] i =Com(U i ′), broadcast commitment C AtoT .

[0059] S4-2 Each signing member C i The identity information ID of other signing members j Substitute as a variable into the polynomial to calculate the polynomial fraction f i (ID j ) sends it to the signing member ID j , and calculate the check tuple {A i1 ,A i1 ,...,A i(t-1)}, where A ij =a ij G(j∈[1,t-1]), broadcast checksum tuple.

[0060] S4-3 Each signing member C i Upon receiving a signature from other member C j The polynomial share and the check tuple are then checked and calculated. If the If yes, the share is accepted, otherwise it is discarded.

[0061] S4-4 Each signing member C i Calculate its own threshold share after receiving the polynomial shares sent by all other signing members

[0062] It should be noted that the above share conversion process converts the data that needs to be restored by accumulating shares into shares that can be restored as long as t shares are satisfied. Its robustness naturally meets the requirements and has good fault tolerance. In the pre-signing stage, this method can be used to restore the additive pre-signed shares (k i ,δ i ,σ i ) Pre-signed share of conversion threshold This allows the signing process to be both robust and fault-tolerant.

[0063] Specifically, the joining and exiting stages are as follows:

[0064] Joining process:

[0065] Initialization: Assume C i is the signature member to be added, and the number of signature members after joining is n′.

[0066] S5-1-1 Signature Member C i Generate a t-1 degree polynomial f with a constant term of 0 i (x) = a i1 x+a i2 x 2 +...+a i(t-1) x t -1 The coefficient (a i1 ,a i2 ,...,a i(t-1) )∈Z q .

[0067] S5-1-2 Signature Member C i Calculate the share f i (ID j ) to send it to other members of the committee, C i Calculate the checksum tuple {A i1 ,A i2 ,...,A i(t-1)}, where A ij =a ij G(j∈[1,t-1]), broadcast the check tuple.

[0068] S5-1-3 Node C i After receiving the share and verification tuple from other members, if If the verification is successful, the verification will fail. i Calculate its shard private key and its shard public key pki =sk i G. The shard private keys of other members are and shard public key pk j ′=sk j ′·G.

[0069] Exit process:

[0070] Initialization: Assume C d is the signing member who has withdrawn, and the number of signing member sets S′ after withdrawal is n′.

[0071] S5-2-1 Node C in the committee member set S′ i Generate a t-1 random polynomial f with a constant term of 0 i (x) = a i1 x+a i2 x 2 +...+a i(t-1) x t-1 The coefficient (a i1 ,a i2 ,...,a i(t-1) )∈Z q .

[0072] S5-2-2 Node C i Calculate the share f i (ID j ) to send it to other members of the committee, ID j is the identity information of the members in the committee member set S′, C i Calculate the checksum tuple {A i1 ,A i2 ,...,A i(t-1)}, where A ij =a ij G(j∈[1,t-1]), broadcast the check tuple.

[0073] S5-2-3 Node C i After receiving the share and verification tuple from other members, if Where j∈[S′], the verification is passed, otherwise it fails. The signature member C in the signature member set after exit i Calculate its shard private key and its shard public key pk i ′=sk i ′·G.

[0074] The above joining and exiting processes are all carried out in the distributed key generation stage, because when a member joins or exits the signature set, it is necessary to ensure that the joining member has his or her own signature private key, and the signature private key and polynomial share of the exiting member must be invalid. Moreover, when a member joins, it is necessary to ensure that the common private key of the signature member restored by all shard private keys before and after this signature must remain unchanged. Therefore, a polynomial with a constant term of 0 is introduced. When a member joins or exits, the signature private keys of all signature members are updated once, which ensures security during the member change process and meets the requirements of forward security.

Claims

1. A highly robust dynamic threshold signature scheme technology in a consortium chain, characterized by the following Basic process: Distributed key generation phase: The signing members select random numbers to forward shares through polynomials, and each signing member calculates the shard private key for signing based on the received shares; Pre-signature phase: Each signing member selects a random number and their own shard private key to calculate the pre-signature additive share used to generate the signature with other signing members, and then converts it into a threshold share through calculation with other signing members; Signature phase: The trusted coordinator verifies whether the pre-signature threshold shares of the signing member are valid. When there are enough valid pre-signature threshold shares, a valid signature is calculated. Joining and exiting stage: After a signing member joins or exits, the signing member set needs to update its shares once using a polynomial. The process of converting additive shares into threshold shares: In the pre-signing stage, the additive shares are converted into threshold shares.

2. The method according to claim 1, characterized in that The distributed key generation stage further includes: The signing member forwards its own random number using a univariate polynomial, calculates the share verification tuple, and sends it to other signing members; After receiving the polynomial shares and share verification tuples sent by other signing members, the signing member calculates the shard private key used for signing and the shard public key used to verify whether the signature is valid.

3. The method according to claim 2, characterized in that The pre-signing phase further includes: The signing member generates two random numbers, wherein the signing member calculates the two random numbers with other signing members to obtain a pre-signed additive share for calculating the common point of the elliptic curve, and the signing member calculates one of the two random numbers and its own shard public key with other signing members to obtain a pre-signed additive share for calculating the signature; Among all the signing members, the additive pre-signed shares are forwarded using a polynomial to convert them into threshold shares.

4. The method according to claim 3, characterized in that: The signing phase further includes: A coordinator is selected to verify the pre-signature threshold share of each signature member to determine whether the signature member set is honest. If honest, it is added to the honest node set; if dishonest, it is added to the dishonest node set. The coordinator verifies the response time of each signing member. If it exceeds the predetermined delay, it will be added to the dishonest node set. When the number of honest nodes reaches the threshold, the honest node set will use Lagrange interpolation to calculate the pre-signed threshold share to obtain the signature. When the number of dishonest nodes reaches a certain value, it does not meet the conditions for generating a signature and restarts the entire signature scheme.

5. The method according to claim 4, characterized in that The entry and exit phases further include: When a signing member joins, the signing member selects a random polynomial without constant terms, forwards the shares to the members in the signature set, and calculates the shard private key and shard public key for signing. When a signing member withdraws, the signing members in the signing member set after the member withdraws select a univariate polynomial without a constant term to forward shares, and sum the calculated result with the original shard private key to obtain the updated shard private key and shard public key.

6. The method according to any one of claims 1 to 5, characterized in that: The process of converting the additive share into the threshold share further includes: The signing member uses its own pre-signed additive share as the constant term of the univariate polynomial, forwards the share with other signing members, and calculates a new pre-signed threshold share.

Images