Deterministic threshold elliptic curve digital signature generation method and participant

Abstract

The application discloses a kind of certainty threshold elliptic curve digital signature generation method and participant, the method includes: two participants are based on pseudo-random function and the point multiplication operation on elliptic curve, according to the message to be signed, each signature key generates respective signature share parameter and related proof;Each according to the verification key of oneself verifies the signature share parameter and related proof of the other party;If verification is passed, each calculates the common signature parameter according to the signature share parameter of oneself and the other party;According to the message to be signed, common signature parameter and joint public key and each signature private key generates respective signature share;Finally, each generates the overall digital signature according to the signature share of oneself and the other party.The application can improve the generation efficiency of digital signature.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of encryption technology, and particularly relates to a deterministic threshold elliptic curve digital signature generation method and a participant. BACKGROUND

[0002] With the rapid development of the Internet, digitalization has penetrated into all aspects of social life, giving people more convenient ways of communication, entertainment and business activities. However, this has also led to many information security problems, such as privacy leakage, network attacks, data tampering and identity impersonation. These problems make it particularly important to ensure the confidentiality, integrity and authenticity of information.

[0003] In this context, cryptography research has become the key to ensuring information security. It provides technical support for confidentiality, integrity, authentication and non-repudiation through encryption, decryption, digital signature and hash function technologies. Encryption ensures that only authorized parties can access information and prevents unauthorized theft; identity authentication ensures the authenticity of information sources. Digital signature plays a crucial role in modern cryptography and is widely used in military, e-commerce and e-government fields.

[0004] In cryptography, the security of a key system is attributed to the difficulty of calculating a certain mathematical problem. The three major public key cryptosystems: Rivest-Shamir-Adleman (RSA), ElGamal based on Diffie-Hellman key exchange, and Elliptic Curve Cryptography (ECC), are based on three major difficult problems: integer factorization, discrete logarithm computation, and elliptic curve discrete logarithm computation.

[0005] Schnorr digital signature (Schnorr) is a variant of ElGamal, whose security is based on the discrete logarithm problem. Due to its simplicity, provable security and linear structure, it is widely used in various applications today. A deterministic variant of Schnorr signature (called stateless signature) uses a message and a long-term secret Pseudorandom Function (PRF) to derive random parameters in a stateless manner. Because it reduces the risk of errors or poor randomness selection when using a random generator directly, it has attracted attention.

[0006] In recent years, with the wide application of Schnorr signature, people try to use threshold signature to strengthen the key protection mechanism of Schnorr signature, in order to alleviate the single point failure problem when storing and using such keys. Threshold signature allows its key to be secretly shared among multiple devices, and a set of devices meeting the threshold number uses the key to perform a signature operation in an interactive manner. However, the threshold protocol of the Schnorr deterministic variant is very inefficient so far, because they use a nonlinear PRF function to calculate the random parameter used in the signature.

[0007] Therefore, the current digital signature generation method is relatively inefficient. SUMMARY

[0008] The embodiments of the present application provide a deterministic threshold elliptic curve digital signature generation method and a participant, which can solve the problem that the current digital signature generation method is relatively inefficient.

[0009] In a first aspect, the embodiments of the present application provide a deterministic threshold elliptic curve digital signature generation method, which comprises:

[0010] Based on the pseudo-random function and the point multiplication operation on the elliptic curve, the signature share parameter and the related proof of the participant are generated according to the signature key of the participant and the message to be signed, and the signature share parameter and the related proof of the participant are sent to another participant;

[0011] The signature share parameter and the related proof of another participant are verified according to the verification key of the participant;

[0012] If the verification is passed, the signature parameter is calculated according to the signature share parameter of the participant and another participant;

[0013] The signature share of the participant is generated according to the signature parameter, the message to be signed, the joint public key and the signature private key of the participant, and the signature share of the participant is sent to another participant;

[0014] The digital signature of the message to be signed is generated according to the signature share of the participant and another participant.

[0015] In a second aspect, the embodiments of the present application provide a deterministic threshold elliptic curve digital signature generation participant, which comprises a signature module, a communication module and a verification module.

[0016] The signature module is used to generate the signature share parameter and the related proof of the participant according to the signature key of the participant and the message to be signed based on the pseudo-random function and the point multiplication operation on the elliptic curve;

[0017] The communication module is configured to send the signature share parameter and the related proof of the participant to another participant, and receive the signature share parameter and the related proof of another participant;

[0018] The verification module is configured to verify the signature share parameter and the related proof of another participant according to the verification key of the participant;

[0019] If the verification is passed, the signature module is further configured to calculate a signature parameter according to the signature share parameter of the participant and another participant, generate the signature share of the participant according to the signature parameter, the message to be signed, the joint public key, and the signature private key of the participant;

[0020] The communication module is further configured to send the signature share of the participant to another participant, and receive the signature share of another participant;

[0021] The signature module is further configured to generate the digital signature of the message to be signed according to the signature share of the participant and another participant.

[0022] Compared with the prior art, the beneficial effects of the embodiments of the present application are as follows: according to the signature method provided by the present application, two participants generate their own random parameters based on point multiplication operation on an elliptic curve and a pseudo-random function respectively, and then generate respective signature shares, and the digital signature is obtained after the signature shares are combined; under the consideration of the same security level, the point multiplication operation on the elliptic curve is used to replace the power operation on a large integer domain when a nonlinear pseudo-random function is used in the traditional Schnorr signature, and a smaller key size is provided; thus, the distributed deterministic threshold signature scheme based on the Schnorr signature and the elliptic curve cryptosystem are combined, and a more efficient and more compact signature method is obtained. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 FIG. 1 is a structural schematic diagram of a deterministic threshold elliptic curve digital signature generation system according to an embodiment of the present application;

[0024] Figure 2 FIG. 4 is an implementation flowchart of a system initialization method according to an embodiment of the present application;

[0025] Figure 3 FIG. 5 is an implementation flowchart of a deterministic threshold elliptic curve digital signature generation method according to an embodiment of the present application;

[0026] Figure 4 FIG. 6 is a structural schematic diagram of a participant of a deterministic threshold elliptic curve digital signature generation system according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] The present application will be further described in detail below in combination with specific embodiments, but the embodiments of the present application are not limited thereto.

[0028] Figure 1 Fig. 1 shows a structure diagram of a deterministic threshold elliptic curve digital signature generation system according to an embodiment of the present application. As an example but not limitation, the system 100 can include at least a pair of participants, i.e. a participant 110 and a participant 120.

[0029] For example, the participant 110 or the participant 120 can generate a signature share parameter and a related proof according to a message to be signed, a respective signature key based on a pseudo-random function and a point multiplication operation on an elliptic curve, and send the signature share parameter and the related proof to the other participant. Then each participant can verify the signature share parameter and the related proof of the other participant according to a respective verification key. If the verification is passed, each participant can calculate a common signature parameter according to the signature share parameter of itself and the other participant, generate a respective signature share according to the message to be signed, the common signature parameter, a joint public key and a respective signature private key, and send the signature share to the other participant. Finally, each participant can generate a whole digital signature according to the signature share of itself and the other participant.

[0030] Optionally, the system 100 can further include at least one verifier 130, which can verify whether the digital signature generated by the participants is correct. If correct, the verifier 130 can accept and save the digital signature corresponding to the message to be signed. If incorrect, the verifier 130 can return an error message.

[0031] According to the system provided by the present application, by using a point multiplication operation on an elliptic curve instead of a power operation on a large integer field in a traditional Schnorr signature, a smaller key size can be provided, thereby reducing the amount of calculation and improving efficiency.

[0032] Figure 2 Fig. 2 shows a flow chart of a system initialization method according to an embodiment of the present application. The method 200 can be applied to the system 100 described above to generate corresponding preparation parameters as an initialization method of the system 100. As an example but not limitation, the method 200 can include steps S201-S204, which will be described below.

[0033] S201, generating a public parameter.

[0034] For example, the public parameter can be generated by the participants in the system 100.

[0035] Specifically, the participants can generate a basic public parameter , a secure collision-resistant hash function H , and a verifier secret parameter with a desirable number . Wherein, is an elliptic curve group, is a generator of the group , and is a group the order of the group.

[0036] An exemplary group satisfies: , is a security parameter. And the group has an order satisfying to guarantee the security of digital signature, where denotes the key length required when the security parameter is .

[0037] An exemplary hash function can satisfy: where, denotes a non-zero, , denotes a polynomial with as a parameter.

[0038] An exemplary is an integer, and, , , is coprime with . Where, , is an error function, which denotes the degree of error or unreliability allowed by the system under a given security parameter.

[0039] S202, generating initial signature parameters and secret parameters.

[0040] An exemplary initial signature parameter can include: a first elliptic curve point, a second elliptic curve point, a modulus.

[0041] In one example, the participants , may generate a first initial random number and a second initial random number ; calculate the points corresponding to the first and second initial random numbers on the elliptic curve, i.e., the first elliptic curve point , the second elliptic curve point . Then, according to , generate a signature key for generating random parameters and a verification key for verifying whether the random parameters of another participant are correct.

[0042] An exemplary first elliptic curve point and second elliptic curve point may satisfy the following formula:

[0043]

[0044] The points of the first elliptic curve can also be represented in coordinate form as follows: The points of the second elliptic curve can be represented as .

[0045] For example, the participating parties A smaller modulus can be set based on the coordinates of the points on the second elliptic curve. .

[0046] In one example, another participant It can be a participant Randomly select secret parameters.

[0047] For example, the secret parameters of the participants It can satisfy: .

[0048] S203, Generate a signing key and a verification key based on the initial signature parameters and the secret parameters.

[0049] In one example, the participants It can generate its own signature key and verification key based on its first and second elliptic curve points, modulus, and secret parameters.

[0050] For example, signing key It can satisfy: Verify key It can satisfy: Among them , It can be based on the key generation algorithm in the pseudo-random function: Generated, Indicates a stop symbol.

[0051] S204 generates a signing private key and a joint public key.

[0052] In one example, the participants Choose random number As the private key for signing, where: It is a field modulo q or a finite field. Then, based on the signing private key... Calculate your own signature public key Upon receiving another participant's... Sending the signing public key Afterwards, the two participating parties Jointly generate a public key .

[0053] Figure 3The diagram illustrates an implementation flowchart of a deterministic threshold elliptic curve digital signature generation method provided by an embodiment of the present invention. As an example and not a limitation, method 300 may include steps S301-S307, and method 300 can be applied to any participant in the system 100 described above. Method 300 can be used for entity authentication and message authentication in a communication network.

[0054] S301, based on pseudo-random functions and dot product operations on elliptic curves, generates the sign share parameters and related proofs of the participants based on the participants' signature keys and the messages to be signed.

[0055] In one possible implementation, the participants can generate their first and second random parameters based on a pseudo-random function, using their signature key and the message to be signed, and then search for a parameter set that satisfies preset conditions. Then, based on dot product operations on an elliptic curve, they generate their first and second signature parameters according to their parameter set and second random parameters. Finally, they generate the relevant proof based on their parameter set, first signature parameters, second signature parameters, and a third random number. Simultaneously, they generate the participant's signature share parameter based on their first random parameter.

[0056] In one example, participants can base their decisions on an evaluation function within a pseudo-random function: Generate the first and second random parameters for the participants.

[0057] For example, the first and second random parameters of the participants can satisfy the following formula:

[0058]

[0059] in, The first random parameter for the participants. The second random parameter for the participants. The message is pending signature. These are parameters in the signature key.

[0060] In one example, the parameter group The preset conditions that are met can be expressed as:

[0061]

[0062]

[0063] in, As a participant The first parameter in the parameter group. As a participant The second parameter in the parameter group, For the modulus of the participants, The first random parameter of the participants.

[0064] In one example, the first signature parameter and the second signature parameter can satisfy the following formula:

[0065]

[0066]

[0067] in, As a participant The first signature parameter, This is the second parameter in the parameter group of the participating party. is a generator of the elliptic curve group; As a participant The second signature parameter, This is the second random parameter.

[0068] In one example, the relevant proofs from the participants satisfy: .

[0069] In one example, the signature share parameter used by the participants to generate the signature share. The following formula can be satisfied:

[0070]

[0071] in , Let be the order of the elliptic curve group.

[0072] S302, send the participant's signature share parameters and related proof to the other participant.

[0073] Accordingly, the signature share parameters and related proofs of the other participant are received.

[0074] S303, verify the signature share parameters and related proof of another participant based on the verification key of the participant.

[0075] In one possible implementation, a participant can generate verification parameters for another participant based on a pseudo-random function and its own verification key. Then, the participant's relevant proof is decomposed to obtain the parameters within that proof, such as the other participant's parameter set and the first, second, and third signature parameters. The verification parameters are then calibrated based on the other participant's parameter set to obtain calibration values. Finally, the verification model verifies whether the other participant's signature share parameter, the parameters within its relevant proof, and the calibration values ​​satisfy the conditions in the verification model. If satisfied, it indicates that the other participant's generated relevant proof and signature share parameter have passed the Vector Oblivious Linear Evaluation (VOLE) correlation test, and step S304 can be performed to continue generating the digital signature. If not satisfied, the process can be stopped and the signing process interrupted.

[0076] In one example, the verification parameters of another participant It can satisfy: ,in Verify the parameters in the key for the participating parties.

[0077] In one example, the calibration value of the verification parameter by another participant can satisfy the following formula:

[0078]

[0079] in, To verify the calibration values ​​of the parameters for another participant, For the modulus of the other participant, This is the first parameter in the parameter group of another participant. The secret parameter for another parameter group is generated by the participants.

[0080] In one example, the validation model can satisfy the following formula:

[0081]

[0082]

[0083]

[0084] in, As another participant The first parameter in the parameter group. For the first elliptic curve point of the other participant, For the modulus of the other participant, For the calibration values ​​of the verification parameters of another participant, Let be a generator of the elliptic curve group. For the second signature parameter of another participant, For the secret parameters of another participating party, For the first signature parameter of another participant, For the third signature parameter of another participant, The signature share parameter for the other participant.

[0085] For example, the third signature parameter of another participant It can be the product of the second random parameter of another participant and the generator G.

[0086] S304, Calculate the signature parameters based on the signature share parameters of the participating party and the other participating party.

[0087] For example, signature parameters It can satisfy: .

[0088] S305 generates the signature share of the participants based on the signature parameters, the message to be signed, the joint public key, and the signing private key.

[0089] For example, the signature share of a participant can satisfy the following formula:

[0090]

[0091] in, The share of signatures by the participating parties.

[0092] S306, Send the participant's signed share to another participant.

[0093] Accordingly, the signature share of the other participant is received.

[0094] S307, Generate a digital signature for the message to be signed based on the signature shares of one participant and another participant.

[0095] For example, a digital signature may include ,in .

[0096] Optionally, method 300 may also include step S308.

[0097] S308 sends a digital signature and a message to be signed to the verifier so that the verifier can verify the validity of the digital signature based on the message to be signed.

[0098] For example, any participating party can send a digital signature to the verifier. Message awaiting signature The verifier can first calculate information about the message. hash value Then, the verifier parameter of the verifier is calculated according to the joint public key Finally, it is judged whether the verifier parameter of the verifier is equal to the signature parameter generated by the participant If they are equal, it indicates that the digital signature is legal, otherwise, the verifier can refuse to believe the authenticity of the signature source and the signature content.

[0099] Since the present application generates the digital signature based on the elliptic curve cryptosystem, its security can be embodied by the difficulty of the discrete logarithm problem on the elliptic curve. If an attacker wants to solve the signature private key of a participant through the joint public key, he needs to solve the discrete logarithm problem on the elliptic curve, which is theoretically infeasible. Similarly, even if the attacker obtains the signature parameter in the digital signature, he also needs to solve the discrete logarithm problem on the elliptic curve in order to crack any message about the random parameter of the participant according to the signature parameter. Therefore, the signature method provided by the present application can have security.

[0100] Further, since only the participant holding the signature private key can generate a valid digital signature, and the verifier can only verify the validity of the signature through the joint public key, the present application also has authentication. Through the signature process and the verification process in the method 300, the signature receiver can ensure that the message has not been tampered or modified in the transmission process. If an attacker tries to forge the message, he must guess a linear function value related to the secret parameter, and the probability that the forged value can satisfy the verification condition is low, so the signature method provided by the present application also has integrity. Since the participant cannot deny the fact that he has signed a specific message, and the verifier can verify the validity of the signature using the joint public key, the present application also has non-repudiation.

[0101] Therefore, according to the signature method provided by the present application, two participants generate their own random parameters based on the point multiplication operation on the elliptic curve and the pseudo-random function respectively, and then generate their respective signature shares to obtain the digital signature after merging; under the consideration of the same security level, the point multiplication operation on the elliptic curve is used to replace the power operation on the large integer domain when the nonlinear pseudo-random function is used in the traditional Schnorr signature, thereby providing a smaller key size; thereby the distributed deterministic threshold signature scheme based on the Schnorr signature and the elliptic curve cryptosystem can be combined, and a more efficient and more compact signature method can be obtained.

[0102] Figure 4 Fig. 1 shows a structure schematic diagram of a participant for generating a deterministic threshold elliptic curve digital signature according to an embodiment of the present application. As an example but not limitation, Figure 4 The participant shown in Fig. 1 can be the participant 110 or the participant 120 in the system 100.

[0103] In some embodiments, the participants may include a signature module 11, a communication module 12, and a verification module 13.

[0104] For example, the signature module is used to generate the signature share parameters and related proofs of the participants based on the signature key of the participants and the message to be signed, using a pseudo-random function and dot product operation on an elliptic curve; the communication module is used to send the signature share parameters and related proofs of the participants to another participant and receive the signature share parameters and related proofs of the other participant; the verification module is used to verify the signature share parameters and related proofs of the other participant based on the verification key of the participants; if the verification is successful, the signature module is also used to calculate the signature parameters based on the signature share parameters of the participants and the other participant, and generate the signature share of the participants based on the signature parameters, the message to be signed, the joint public key, and the signature private key of the participants; the communication module is also used to send the signature share of the participants to another participant and receive the signature share of the other participant; the signature module is also used to generate a digital signature of the message to be signed based on the signature shares of the participants and the other participant.

[0105] In one possible implementation, the signature module can specifically be used to: generate a first random parameter and a second random parameter for the participant based on the participant's signature key and the message to be signed, using a pseudo-random function; find a parameter set for the participant that meets preset conditions; generate a first signature parameter and a second signature parameter for the participant based on the dot product operation on an elliptic curve, using the participant's parameter set and the participant's second random parameter, respectively; generate relevant proofs for the participant based on the participant's parameter set, the participant's first signature parameter, the participant's second signature parameter, and the participant's second random number; and generate a signature share parameter for the participant based on the participant's first random parameter.

[0106] For example, the first signature parameter can satisfy the following formula:

[0107]

[0108] in, As a participant The first signature parameter, i =0,1; This is the second parameter in the parameter group of the participating party. is a generator of the elliptic curve group.

[0109] For example, the second signature parameter can satisfy the following formula:

[0110]

[0111] in, As a participant The second signature parameter, This is the second random parameter.

[0112] In one possible implementation, the verification module can specifically be used to: generate verification parameters for another participant based on the verification key of the participant using a pseudo-random function; decompose the relevant proof of the other participant to obtain the parameter set, first signature parameter, second signature parameter, and third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated based on the second random number of the other participant; calibrate the verification parameters of the other participant based on the parameter set of the other participant to obtain the calibration value of the verification parameters of the other participant; and verify the parameter set, the calibration value of the verification parameters of the other participant, the first signature parameter, the second signature parameter, the third signature parameter, and the signature share parameter of the other participant based on the verification model.

[0113] For example, the verification model can satisfy the following formula:

[0114]

[0115]

[0116]

[0117] in, As another participant The first parameter in the parameter group. For the first elliptic curve point of the other participant, For the modulus of the other participant, For the calibration values ​​of the verification parameters of another participant, Let be a generator of the elliptic curve group. For the second signature parameter of another participant, For the secret parameters of another participant, For the first signature parameter of another participant, For the third signature parameter of another participant, The signature share parameter for the other participant.

[0118] According to the participants provided by this invention, two participants generate their own random parameters based on dot product operations on elliptic curves and pseudo-random functions, respectively. Then, their respective signature shares are generated and merged to obtain a digital signature. Under the same security level, dot product operations on elliptic curves can replace the power multiplication operations on large integer fields used in traditional Schnorr signatures when using nonlinear pseudo-random functions, providing a smaller key size. Thus, it is possible to combine the distributed deterministic threshold signature scheme based on Schnorr signatures with elliptic curve cryptography to obtain a more efficient and compact signature method.

[0119] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0120] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software mode depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

Claims

1. A deterministic threshold elliptic curve digital signature generation method, characterized in that, Applicable to participants in deterministic threshold elliptic curve digital signature generation, including: Based on pseudo-random functions and dot product operations on elliptic curves, the signature share parameters and related proofs of the participating party are generated according to the signing key of the participating party and the message to be signed; and the signature share parameters and related proofs of the participating party are sent to another participating party. Verify the signature share parameters and related proof of the other participant based on the verification key of the participating party; If the verification passes, the signature parameters are calculated based on the signature share parameters of the participating party and the other participating party. The signature share of the participant is generated based on the signature parameters, the message to be signed, the joint public key, and the signature private key of the participant, and then sent to the other participant. A digital signature of the message to be signed is generated based on the signature shares of the participating party and the other participating party; The step of generating the signature share parameters and related proofs of the participants based on the pseudo-random function and dot product operation on elliptic curves, according to the participants' signature keys and the message to be signed, includes: Based on the pseudo-random function, the first random parameter and the second random parameter of the participant are generated according to the participant's signature key and the message to be signed; Find the parameter set of the participants that meets the preset conditions; Based on the dot product operation on the elliptic curve, the first signature parameter and the second signature parameter of the participant are generated according to the parameter group of the participant and the second random parameter of the participant, respectively. The relevant proof of the participant is generated based on the participant's parameter group, the participant's first signature parameter, the participant's second signature parameter, and the participant's second random number; The signature share parameter of the participant is generated based on the first random parameter of the participant.

2. The method according to claim 1, characterized in that, The first signature parameter satisfies the following formula: in, For the participating parties The first signature parameter, i =0,1; This is the second parameter in the parameter group of the participating party. is a generator of the elliptic curve group; The second signature parameter satisfies the following formula: in, For the participating parties The second signature parameter, This is the second random parameter.

3. The method according to claim 1, characterized in that, The step of verifying the signature share parameter and related proof of the other participant based on the verification key of the participating party includes: Based on the pseudo-random function, the verification parameters of the other participant are generated according to the verification key of the participant. By disassembling the relevant proof of the other participant, we obtain the parameter group, first signature parameter, second signature parameter and third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated based on the second random number of the other participant; The calibration value of the verification parameters of the other participant is obtained by calibrating the verification parameters of the other participant according to the parameter set of the other participant; Based on the verification model, the parameter set of the other participant, the verification parameter calibration value of the other participant, the first signature parameter of the other participant, the second signature parameter of the other participant, the third signature parameter of the other participant, and the signature share parameter of the other participant are verified.

4. The method according to claim 3, characterized in that, The verification model satisfies the following formula: in, For the other participating party The first parameter in the parameter group. For the first elliptic curve point of the other participant, The modulus of the other participant. The calibration value for the verification parameters of the other participant. Let be a generator of the elliptic curve group. The second signature parameter of the other participating party. This is a secret parameter for the other participating party. The first signature parameter of the other participating party. The third signature parameter of the other participating party. The signature share parameter for the other participant.

5. A deterministic threshold elliptic curve digital signature generation participant, characterized in that, Includes a signature module, a communication module, and a verification module; The signature module is used to generate the signature share parameters and related proofs of the participating party based on the signature key of the participating party and the message to be signed, using a pseudo-random function and dot product operation on an elliptic curve. The communication module is used to send the signature share parameters and related proof of the other participant to the other participant, and to receive the signature share parameters and related proof of the other participant. The verification module is used to verify the signature share parameters and related proofs of the other participant based on the verification key of the participant. If the verification is successful, the signature module is further configured to calculate signature parameters based on the signature share parameters of the participating party and the other participating party, and generate the signature share of the participating party based on the signature parameters, the message to be signed, the joint public key, and the signature private key of the participating party; The communication module is also used to send the signature share of the other participant to the other participant and to receive the signature share of the other participant; The signature module is also used to generate a digital signature of the message to be signed based on the signature shares of the participating party and the other participating party; Specifically, the signature module is used for: Based on the pseudo-random function, the first random parameter and the second random parameter of the participant are generated according to the participant's signature key and the message to be signed; Find the parameter set of the participants that meets the preset conditions; Based on the dot product operation on the elliptic curve, the first signature parameter and the second signature parameter of the participant are generated according to the parameter group of the participant and the second random parameter of the participant, respectively. The relevant proof of the participant is generated based on the participant's parameter group, the participant's first signature parameter, the participant's second signature parameter, and the participant's second random number; The signature share parameter of the participant is generated based on the first random parameter of the participant.

6. The participating party according to claim 5, characterized in that, The first signature parameter satisfies the following formula: in, For the participating parties The first signature parameter, i =0,1; This is the second parameter in the parameter group of the participating party. is a generator of the elliptic curve group; The second signature parameter satisfies the following formula: in, For the participating parties The second signature parameter, This is the second random parameter.

7. The participating party according to claim 5, characterized in that, The verification module is specifically used for: Based on the pseudo-random function, the verification parameters of the other participant are generated according to the verification key of the participant. By disassembling the relevant proof of the other participant, we obtain the parameter group, first signature parameter, second signature parameter and third signature parameter of the other participant, wherein the third signature parameter of the other participant is generated based on the second random number of the other participant; The calibration value of the verification parameters of the other participant is obtained by calibrating the verification parameters of the other participant according to the parameter set of the other participant; Based on the verification model, the parameter set of the other participant, the verification parameter calibration value of the other participant, the first signature parameter of the other participant, the second signature parameter of the other participant, the third signature parameter of the other participant, and the signature share parameter of the other participant are verified.

8. The participating party according to claim 7, characterized in that, The verification model satisfies the following formula: in, For the other participating party The first parameter in the parameter group. For the first elliptic curve point of the other participant, The modulus of the other participant. The calibration value for the verification parameters of the other participant. Let be a generator of the elliptic curve group. The second signature parameter of the other participating party. This is a secret parameter for the other participating party. The first signature parameter of the other participating party. The third signature parameter of the other participating party. The signature share parameter for the other participant.

Images