Multi-signature method with aggregable and traceable public keys

Abstract

The invention relates to a multi-signature method with aggregable and responsibility-traceable public keys, relates to the technical field of block chains, and is used for solving the problems that in a privacy protection block chain system, user identity tracking is difficult, the privacy of signers cannot be guaranteed, and privacy protection and effective supervision cannot be balanced. The multi-signature method comprises the following steps: generating a public and private key pair and public parameters; generating a user key; key distribution; user signature; the combiner aggregates and outputs the signature; verifying signature validity; the tracker tracks the signer. According to the method, the roles of the combiner and the tracker are set, the work of aggregating the signature share is completed by the combiner, and only the signature signed and output by the combiner is recognized as an effective signature. And meanwhile, when some illegal behaviors occur, a participant signer is tracked through a tracker, so that identity tracking of the block chain is effectively realized, and meanwhile, privacy of legal users is ensured.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a multi-signature method in which public keys can be aggregated and traced. Background Art

[0002] As digital cryptocurrencies have become more popular, blockchain technology has attracted widespread attention from governments, regulators, and financial institutions. To ensure the security and traceability of transactions, blockchain uses a variety of technologies. For example, digital currency transactions are authorized and verified through digital signatures. When a coin holder intends to use a coin with a specified public key (pk) for a transaction, they, as the payer, must initiate a new spending transaction. The transaction involves allocating coins to the recipient and verifying it using their signing key (sk).

[0003] By introducing digital signatures, the public can be assured that these transactions are legitimate and authenticated, thus ensuring their authorization. To manage public and private keys, Liu et al. have proposed deterministic wallets using threshold (multiple) signatures. However, there are some vulnerabilities in deterministic wallet algorithms. Not only do they face risks such as weak privacy protection and data leakage, but they also lack accountability mechanisms. This results in the final signature being universal and unable to be traced back to the signer who agreed to the transaction when problems occur.

[0004] Baek and Zheng proposed the identity-based threshold signature (IDTHS) scheme, which allows a threshold number of signers to collaboratively generate signatures. Compared with the identity-based signature (IBS) scheme proposed by Shamir, the IDTHS scheme not only disperses the authority of the signer, but also prevents single point failure, thus potentially enhancing the security of deterministic wallets. The coin holder distributes the private key to multiple participants, allowing multiple participants holding a share of the private key to generate signatures and decide whether the transaction is confirmed.

[0005] However, in the IDTHS scheme, all parties publicly share their signature shares, and anyone can aggregate signatures. Therefore, the privacy of the signer cannot be guaranteed. In addition, when there is a problem with the transaction, the corresponding signer cannot be traced back through the IDTHS scheme. Therefore, it is urgent to develop a signature method that meets the identity-based threshold (multiple) and can also meet the accountability and privacy of blockchain wallets.

[0006] In other words, the signature method in the prior art has the problems of difficulty in tracking user identity, failure to guarantee the privacy of the signer, and failure to balance privacy protection and effective supervision. Summary of the invention

[0007] The present invention provides a multi-signature method with aggregated and traceable public keys, which is used to solve the problem that user identity tracking is difficult and the privacy of signers cannot be guaranteed in a privacy-protected blockchain system.

[0008] The present invention provides a multi-signature method with aggregated and traceable public keys, comprising the following steps:

[0009] Step S100, generating a public-private key pair and public parameters;

[0010] Step S200, user public keys are aggregated and keys are generated;

[0011] Step S300, distributing keys;

[0012] Step S400, generate signature share σ i ;

[0013] Step S500, the combiner outputs the final signature σ;

[0014] Step S600, verifying whether the signature is valid;

[0015] Step S700: The tracker tracks and obtains a set of signers.

[0016] In one implementation method, step 100 specifically includes the following steps:

[0017] Step S101, the private key generator PKG selects a group G with a prime order of q, and independent generators g and h. Define a bilinear map: Select a master key And calculate the public key P pub =g s ; Choose two hash functions H1: and

[0018] Step S102, the combiner selects a private key in group G Calculate the public key

[0019] Step S103, the tracker generates a public-private key pair: Randomly select generators Random Selection calculate and Then, select And calculate Where i = 0,…,5. The tracker public key is: The tracker private key is:

[0020] Step S104, let s, sk c ,skt Confidential, public parameters

[0021] In one implementation method, step 200 specifically includes the following steps:

[0022] Step S201: The user aggregates the identities of n signers, that is Send the aggregated public key to PKG;

[0023] Step S202, PKG calculates Q ID =H1(ID), get the key sk ID =(Q ID ) s .

[0024] In one implementation method, step 300 specifically includes the following steps:

[0025] Step S301: Run the computationally secure verifiable secret sharing scheme based on bilinear mapping - CVSSBM, and n signers obtain corresponding private key shares.

[0026] In one implementation method, step 400 specifically includes the following steps:

[0027] Step S401, run the distributed key generation protocol based on bilinear mapping - DKPBM, take (G, g, t, n) as input, generate a secret value K and a public value

[0028] Step S402, calculate

[0029] Step S403, each signer signs the message M and broadcasts it:

[0030] Among them, the i-th signer gets share K i , where i=1,...n.

[0031] In one embodiment, step 500 specifically includes the following steps:

[0032] Step S501: The combiner calculates the cumulative sum of signature shares in set C. Where |C|=t;

[0033] Step S502, use Algorithm encryption Z: Random Selection Calculate the following formula:

[0034]

[0035] Where w0=g, ciphertext ct=(w1,w2,w3,c,v);

[0036] Step S503: if and only if i∈C, b i =1, get the string (b1,...b n )∈{0,1} n , and calculate

[0037] Step S504, generate the following relationship R S Zero-knowledge proof of π:

[0038]

[0039] Step S505, BLS signature of the above parameters:

[0040] Step S506: The combiner outputs a valid signature σ←(v,ct,π,tg).

[0041] In one embodiment, step 600 specifically includes the following steps:

[0042] Step S601, check whether the signature is output by the combiner,

[0043] Step S602, check whether π is a relation R S Valid proof of

[0044] Step S603: When all the above checks are passed, the message signature pair (M, σ) is considered valid.

[0045] In one embodiment, step 700 specifically includes the following steps:

[0046] Step S701, if the signature verification fails, that is, Verify(cp,ID,M,σ)=0, the tracker will not proceed to the next step;

[0047] Step S702: for signature σ=(v,ct,π,tg), analyze

[0048] Step S703: The tracker decrypts and obtains Analyze ct = (w1, w2, w3, c, v) and check whether the following equation is true. The specific equation is as follows:

[0049]

[0050] Among them, w0=g, when the equation is established, the calculation is

[0051] Find a collection where |C|=t and

[0052] Step S704, if the set If it exists, the tracking is successful.

[0053] Compared with the prior art, the advantage of the present invention is that it proposes a threshold (multi) signature method based on identity that can be held accountable, called AIDTHS, which ensures the privacy of blockchain wallet signing members while providing full accountability. This signature method effectively guarantees user privacy and user identity tracking by setting the roles of combiner and tracker. During the operation of the method, firstly, the public-private key pair and public parameter cp of the scheme PKG, combiner and tracker are generated; secondly, PKG generates the corresponding key for the identity ID submitted by the user; secondly, the account holder or trusted user distributes the key to n users; secondly, the signer signs the message M to generate a signature share; after that, the user interacts with the combiner, the combiner aggregates the signature shares and outputs the final signature. We believe that a valid signature contains the signature part of the combiner. In this process, the combiner first aggregates the signature shares in the set C and encrypts them with the tracker public key to generate a zero-knowledge proof and signs the parameters, so that a complete signature can be formed. This protects user privacy while providing a method for trackers to track user identities; when certain illegal behaviors occur, the tracking agency decrypts the private key to track the user's identity, effectively tracking the identity of privacy-protected blockchain transactions while ensuring the privacy of other legitimate users. This solves the problem of difficulty in tracking user identities in privacy-protected blockchain transactions, the inability to guarantee user privacy, and the inability to balance privacy protection and effective supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Hereinafter, the present invention will be described in more detail based on embodiments and with reference to the accompanying drawings.

[0055] Figure 1 It is a model diagram of a multi-signature method in which public keys can be aggregated and traced in an embodiment of the present invention.

[0056] Figure 2 It is a method flow chart of a multi-signature method in which public keys can be aggregated and traced in an embodiment of the present invention; DETAILED DESCRIPTION

[0057] The present invention will be further described below in conjunction with the accompanying drawings.

[0058] It should be noted that digital signature technology is one of the important research directions in the field of cryptography today, and its core goal is to ensure the integrity of data and the legitimacy of the signer's identity. With the continuous development of network security and digital signature technology, specific application scenarios have put forward higher requirements for digital signature technology, and people use threshold (multiple) signatures to share the power of signing. The idea of ​​identity (ID)-based signature proposed by Shamir is to create a signature on a message so that any user can verify the signature using the signer's identifier information (such as an email address) instead of the public key embedded in the digital certificate. Baek and Zheng combined these two concepts to realize "ID-based threshold signature". The application scenarios of the ID-based threshold signature method are wide. For example, Alice, as the holder of an account in the blockchain, can delegate this power to multiple signers, so that the signature on a given message is jointly generated by these signers, and the transaction can be executed only when the signer broadcasts a certain number of partial signatures. Although identity-based threshold signatures can be widely used in multiple scenarios, they cannot protect the privacy of the signer, nor can they track the identity of the signer when necessary.

[0059] In recent years, researchers have conducted a lot of research on the accountability function of threshold signatures. Boneh et al. proposed a new type of threshold signature, called TAPS, which is a hybrid of privacy and accountability. From the public perspective, TAPS signatures are completely private. However, an entity with a secret tracking key can track a signature to the set of signers that generated it. TAPS enables organizations to keep their internal operations private while ensuring that signers are accountable for their actions. However, TAPS cannot adapt to identity-based scenarios and has certain limitations.

[0060] It should be noted that the public key aggregable and accountable multi-signature method in the present invention is mainly used for privacy-protected blockchain transactions in blockchain technology. In addition to being applicable to privacy-protected blockchain transactions, this method also has a wide range of application scenarios. For example, in voting, when faced with the need to hide the identity of the voter to protect the voter's privacy, but at the same time prevent the voter's dishonest behavior, the voting system should be able to supervise the voter's malicious behavior while ensuring the voter's privacy. Through the public key aggregable and accountable multi-signature method, it can be ensured that the voting system supervises the voter's malicious behavior and revokes the voter's voting qualification in a timely manner while ensuring the voter's anonymity.

[0061] like Figure 1 As shown, the present invention provides a model of multi-signature with public key aggregation and accountability. The present invention includes six different roles, including private key generator (PKG), distributor, combiner, verifier, tracker and user. Among them, the one-way arrow represents the action of the subject on the object.

[0062] First, the coin holder initiates a private key extraction request and sends its identity ID to the private key generator (PKG). After receiving the ID, PKG uses its own private key to generate a key corresponding to the ID and returns it to the user. After the coin holder obtains the private key, he sets the key sharing rules, calculates and sends each key share to the corresponding signer. The signer can verify the validity of the key share using the public verification parameters. When signing a blockchain transaction, each participant signs the message M with its corresponding key share to generate a signature share. A trusted third-party combiner interacts with each participant, collects the signature shares from the previous step, aggregates and encrypts the signature shares of the quorum C, and generates the corresponding zero-knowledge proof. After signing with the combined key, the final signature is generated.

[0063] For a message-signature pair, any verifier can use the public parameters to confirm that the signature output by the combiner and the zero-knowledge proof therein are valid, thereby verifying the validity of the signature generated by the combiner. Once the signature is confirmed to be valid, the trusted third-party tracker uses the tracking key to decrypt the signature generated by the combiner and trace it back to the quorum C.

[0064] like Figure 2 As shown, the present invention provides a multi-signature method with public key aggregation and accountability, comprising the following steps:

[0065] Step S100, generating a public-private key pair and public parameters;

[0066] Step S200, user public keys are aggregated and keys are generated;

[0067] Step S300, distributing keys;

[0068] Step S400, generate signature share σ i ;

[0069] Step S500, the combiner outputs the final signature σ;

[0070] Step S600, verifying whether the signature is valid;

[0071] Step S700: The tracker tracks and obtains a set of signers.

[0072] According to the above steps, by setting the roles of combiner and tracker, effective guarantee of user privacy and user identity tracking is achieved. During the operation of the method, the public-private key pair and public parameter cp of the scheme PKG, combiner and tracker are first generated; secondly, PKG generates the corresponding key for the identity ID submitted by the user; secondly, the account holder or trusted user distributes the key to n users; secondly, the signer signs the message M to generate a signature share; then, the user interacts with the combiner, the combiner aggregates the signature share and outputs the final signature. We believe that a valid signature contains the signature part of the combiner. In this process, the combiner first aggregates the signature shares in the set C and encrypts them with the tracker public key, generates a zero-knowledge proof, and signs the parameters, so that a complete signature can be formed. This provides a method for the tracker to track the user's identity while protecting the user's privacy; when certain illegal behaviors occur, the tracking agency decrypts the private key to realize the function of tracking the user's identity, effectively realizing the identity tracking of privacy-protected blockchain transactions, while ensuring the privacy of other legitimate users. It solves the problems of difficulty in tracking user identities in privacy-preserving blockchain transactions, the inability to guarantee user (signatory) privacy, and the inability to balance privacy protection and effective supervision.

[0073] Specifically, in one embodiment, step 100 initializes the algorithm and generates a public key and a private key pair and public parameters for the PKG, the combiner and the tracker. Specifically, the following steps are included:

[0074] Step S101, the private key generator PKG selects a group G with a prime order of q, and independent generators g and h. Define a bilinear map: Select a master key And calculate the public key P pub =g s . Choose two hash functions and

[0075] Step S102, the combiner selects a private key in group G Calculate the public key

[0076] Step S103, the tracker generates a public-private key pair: Randomly select generators Random Selection calculate and Then, select And calculate Where i = 0,…,5. The tracker public key is: The tracker private key is:

[0077] Step S104, let s, sk c ,sk t Confidential, public parameters

[0078] Specifically, in one embodiment, step 200 generates a user's key, and PKG generates a key when the ID submitted by the user. Specifically, the following steps are included:

[0079] Step S201: The user aggregates the identities of n signers, that is Send the aggregated public key to PKG;

[0080] Step S202, PKG calculates Q ID =H1(ID), get the key sk ID =(Q ID ) s .

[0081] Specifically, in one embodiment, step 300 distributes keys to n signers, which is implemented by a trusted user associated with an identity or PKG running a CVSSBM algorithm. Specifically, the following steps are included:

[0082] Step S301: Run the computationally secure verifiable secret sharing scheme based on bilinear mapping - CVSSBM, and n signers obtain corresponding private key shares.

[0083] Specifically, in one embodiment, step 400 signs the message M, and each signer generates a signature share on the message M and broadcasts it. Specifically, the following steps are included:

[0084] Step S401, run the distributed key generation protocol based on bilinear mapping - DKPBM, take (G, g, t, n) as input, generate a secret value K and a public value Finally, the i-th signer gets share K i , where i = 1, ... n;

[0085] Step S402, calculate

[0086] Step S403, each signer signs the message M and broadcasts it:

[0087] Specifically, in one embodiment, step 500 generates a valid signature. The combiner aggregates the signature shares and outputs a valid AIDTHS signature. Specifically, the following steps are included:

[0088] Step S501, the combiner calculates the cumulative sum of signature shares in set C Z = Σ i∈C U i, where |C|=t;

[0089] Step S502, use Algorithm encryption Z: Random Selection Calculate the following formula:

[0090]

[0091] Where w0=g, ciphertext ct=(w1,w2,w3,c,v);

[0092] Step S503: if and only if i∈C, b i =1, get the string (b1,...b n )∈{0,1} n , and calculate

[0093] Step S504, generate the following relationship R S Zero-knowledge proof of π:

[0094]

[0095] Step S505, BLS signature of the above parameters:

[0096] Step S506: The combiner outputs a valid signature σ←(v,ct,π,tg).

[0097] Specifically, in one embodiment, step 600 verifies the validity of the signature. Specifically, it includes the following steps:

[0098] Step S601, check whether the signature is output by the combiner,

[0099] Step S602, check whether π is a relation R S Valid proof.

[0100] Step S603: When all the above checks are passed, the message signature pair (M, σ) is considered valid.

[0101] Specifically, in one embodiment, step 700 implements the tracking function. The tracker decrypts to obtain the signer set to implement tracking. Specifically, the following steps are included:

[0102] Step S701, if the signature verification fails, that is, Verify(cp,ID,M,σ)=0, the tracker will not proceed to the next step;

[0103] Step S702: for signature σ=(v,ct,π,tg), analyze

[0104] Step S703: The tracker decrypts and obtains Analyze ct = (w1, w2, w3, c, v) and check whether the following equation holds:

[0105]

[0106] Among them, w0=g, when the equation is established, the calculation is

[0107] Find a collection where |C|=t and

[0108] Step S704, if the set If it exists, the tracking is successful.

[0109] From the description of the above specific implementation method, it can be seen that by setting the roles of the combiner and the tracker, effective guarantees for user privacy and user identity tracking are achieved. During the operation of the method, firstly, the public-private key pair and public parameter cp of the scheme PKG, the combiner and the tracker are generated; secondly, PKG generates the corresponding key for the identity ID submitted by the user; secondly, the account holder or the trusted user distributes the key to n users; secondly, the signer signs the message M to generate a signature share; after that, the user interacts with the combiner, the combiner aggregates the signature share and outputs the final signature. We believe that a valid signature contains the signature part of the combiner. In this process, the combiner first aggregates the signature shares in the set C and encrypts them with the public key of the tracker, generates a zero-knowledge proof, and signs the parameters, so that a complete signature can be formed. This provides a method for the tracker to track the user identity while protecting the user's privacy; when certain illegal behaviors occur, the tracking agency decrypts the private key to realize the function of tracking the user's identity, effectively realizing the identity tracking of the privacy-protected blockchain transaction, while ensuring the privacy of other legitimate users. It solves the problems of difficulty in tracking user identities in privacy-preserving blockchain transactions, the inability to guarantee user privacy, and the inability to balance privacy protection and effective supervision.

[0110] Although the present invention has been described with reference to preferred embodiments, various modifications may be made thereto and parts thereof may be replaced by equivalents without departing from the scope of the present invention. In particular, the various technical features mentioned in the various embodiments may be combined in any manner as long as there are no structural conflicts. The present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

[0111] Obviously, the above described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0112] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0113] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A multi-signature method with aggregated and traceable public keys, characterized in that: It includes the following steps: Step S100, generating a public-private key pair and public parameters; Step S200, user public keys are aggregated and keys are generated; Step S300, distributing keys; Step S400, generate signature share σ i ; Step S500, the combiner outputs the final signature σ; Step S600, verifying whether the signature is valid; Step S700: The tracker tracks and obtains a set of signers.

2. The multi-signature method according to claim 1, characterized in that: The step 100 specifically includes the following steps: Step S101, the private key generator PKG selects a group G with a prime order of q, and independent generators g and h, and defines a bilinear map: Select a master key And calculate the public key P pub =g s , choose two hash functions and Step S102, the combiner selects a private key in group G Calculate the public key Step S103, the tracker generates a public-private key pair: Randomly select generators Random Selection calculate and Then, select And calculate Where i = 0,…,5, and the tracker public key is: The tracker private key is: Step S104, let s, sk c ,sk t Confidential, public parameters 3. The multi-signature method according to claim 1, characterized in that: The step 200 specifically includes the following steps: Step S201: The user aggregates the identities of n signers, that is Send the aggregated public key to PKG; Step S202, PKG calculates Q ID =H1(ID), get the key sk ID =(Q ID ) s .

4. The multi-signature method according to claim 1, characterized in that: The step 300 specifically includes the following steps: Step S301, running a computationally secure verifiable secret sharing scheme based on bilinear mapping - CVSSBM, and n signers obtain corresponding private key shares 5. The multi-signature method according to claim 1, characterized in that: The step 400 specifically includes the following steps: Step S401, run the distributed key generation protocol based on bilinear mapping - DKPBM, take (G, g, t, n) as input, generate a secret value K and a public value Step S402, calculate Step S403, each signer signs the message M and broadcasts it: Among them, the i-th signer gets share K i , i=1,...n.

6. The multi-signature method according to claim 1, characterized in that: The step 500 specifically includes the following steps: Step S501, the combiner calculates the cumulative sum of signature shares in set C Z = Σ i∈C U i , where |C|=t; Step S502, use Algorithm encryption Random Selection Calculate the following formula: Where w0=g, ciphertext ct=(w1,w2,w3,c,v); Step S503: if and only if i∈C, b i =1, get the string (b1,...b n )∈{0,1} n , and calculate Step S504, generate the following relationship R S Zero-knowledge proof of π: Step S505, BLS signature of the above parameters: Step S506: The combiner outputs a valid signature σ←(v,ct,π,tg).

7. The multi-signature method according to claim 1, characterized in that: The step 600 specifically includes the following steps: Step S601, check whether the signature is output by the combiner, Step S602, check whether π is a relation R S Valid proof of Step S603: When all the above checks are passed, the message signature pair (M, σ) is considered valid.

8. The multi-signature method according to claim 1, characterized in that: The step 700 specifically includes the following steps: Step S701, if the signature verification fails, that is, Verify(cp, ID, M, σ) = 0, the tracker will not proceed to the next step; Step S702: for signature σ=(v,ct,π,tg), analyze Step S703: The tracker decrypts and obtains Analyze ct = (w1, w2, w3, c, v) and check whether the following equation holds: Among them, w0=g, when the equation is established, the calculation is Find a collection where |C|=t and Step S704, if the set If it exists, the tracking is successful.

Images