A two-wheel threshold ECDSA signature method and system

Abstract

The application discloses a two-round threshold ECDSA signature method and system, and relates to the technical field of cryptography and information security, and comprises the following steps: each participating node adopts non-interactive multiplication to encode a private key share of each node to obtain an encoded value; each signature node generates a signature random number, a blind random number and a corresponding commitment value, adopts non-interactive multiplication to encode the two random numbers to obtain an encoded value, generates a pre-signature result containing the commitment value, the encoded value and zero-knowledge proof, and after determining a to-be-signed message, each signature node combines the pre-signature result, adopts non-interactive multiplication to decode, calculates a signature share of each node through a random re-randomization mechanism, combines all the signature shares into a complete ECDSA signature and verifies the signature. In the case that only two rounds of interaction are needed, the threshold signature is efficient and safe, the communication overhead and the calculation overhead are considered, balance between efficiency and safety is achieved, and the problem of security degradation of the pre-signature is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cryptography and information security technology, in particular to a two-round threshold ECDSA signature method and system. BACKGROUND

[0002] The Elliptic Curve Digital Signature Algorithm (ECDSA) has been widely used in blockchain, cryptocurrency wallet and distributed key management scenarios. In practical applications, a single private key holder is vulnerable to attacks, and once the key is compromised, it may cause serious security incidents. In order to enhance security, threshold signature (Threshold Signature) is proposed, the core idea of which is to divide the signature private key into multiple shares and distribute them to different participants. Only when at least t participants cooperate together can an effective signature be generated, so that even if some participants are attacked, the overall key will not be compromised.

[0003] However, the existing threshold ECDSA protocol has significant deficiencies in interaction efficiency. Under general threshold settings (i.e. t takes any value between 2 and n), early threshold ECDSA schemes require more than 8 rounds of interaction, resulting in high latency. Although subsequent research has optimized the number of interaction rounds to 4 or even 3, compared with the two-round interaction of threshold Schnorr signature (Schnorr signature is a digital signature scheme based on elliptic curve cryptography), there is still a gap. This becomes an obstacle to practical deployment in applications that require low latency and high throughput, such as blockchain payment systems.

[0004] In addition, in order to reduce online signature latency, many schemes introduce a presigning mechanism, i.e. performing partial calculations in advance before the message to be signed is determined, so that only a small amount of computation is required in the online phase to complete the signature. However, some related research shows that when the presigned result is too much, an attacker can use the ratio relationship of specific hash messages to forge a signature, resulting in a security lower than that of single ECDSA. This defect means that the existing threshold ECDSA protocol poses a risk in practical applications, especially when both presigning and hashing of the original message are supported, the attack surface is particularly serious.

[0005] In summary, the existing threshold ECDSA protocol has at least the following problems:

[0006] (1) The number of interaction rounds is large, the communication latency is high, and it is not suitable for efficient application scenarios.

[0007] (2) The presigning mechanism has a security drop, resulting in a security lower than that of single ECDSA.

[0008] (3) The existing improvement scheme often makes a trade-off between efficiency and security, and fails to achieve a balance. SUMMARY

[0009] To solve the above problems, the present application provides a two-round threshold ECDSA signature method and system, which realizes two-round threshold ECDSA for the first time, realizes efficient and secure threshold signature in the case of only two-round interaction, balances communication overhead and calculation overhead, balances efficiency and security, avoids the problem of security degradation of pre-signature, and is suitable for multi-party secure computing scenarios such as blockchains, distributed identity authentication, and financial transactions.

[0010] To achieve the above purpose, the present application adopts the following technical solutions:

[0011] In a first aspect, the present application provides a two-round threshold ECDSA signature method, comprising:

[0012] Each participating node encodes its private key share using non-interactive multiplication to obtain a public encoded value and a secret state value of the private key share;

[0013] Each signature node generates a signature random number and a blinded random number and their corresponding commitment values, encodes the two random numbers using non-interactive multiplication to obtain the public encoded values and secret state values of the random numbers, and generates zero-knowledge proof for proving that the public encoded values and commitment values are consistent with respect to the same random number, and the pre-signature result is composed of the commitment values and public encoded values of the random numbers and the zero-knowledge proof;

[0014] When the zero-knowledge proof is verified, signature node i uses the random number generated by signature node j and the public encoded value of the private key share, and uses the secret state value of the private key share and the random number generated by signature node i to perform a decoding operation of non-interactive multiplication, thereby calculating the product additive share between the two random numbers and between the private key share and the blinded random number, and calculating the product of the signature random number commitment values in all pre-signature results to obtain a partial signature result;

[0015] Each signature node obtains a signature point after re-randomization processing of the partial signature result, combines the product additive share to calculate its own signature share, merges all signature shares into a complete ECDSA signature, and verifies the signature, and outputs the ECDSA signature after verification.

[0016] As an optional implementation, after encoding the private key share, each participating node also generates and publishes zero-knowledge proof for proving that the public encoded value of the held private key share is consistent with the held public key share with respect to the same held private key share.

[0017] As an optional implementation, the process of calculating the product additive share comprises:

[0018] signature node generated signature random number and blinded random number the commitment value of , the public encoding value and secret state value of , the public encoding value and secret state value of signature node private key share the public encoding value and secret state value of ;

[0019] signature node generated signature random number and blinded random number the commitment value of , the public encoding value and secret state value of , the public encoding value and secret state value of signature node private key share the public encoding value and secret state value of ; , denotes the new signature node set after removing signature node from the signature node set P;

[0020] decode operation is performed on using to obtain ; wherein is the additive share of , satisfying ; and are the respective sums of the two random numbers selected by all signature nodes; is a public reference string of non-interactive multiplication; is the decoding function of NIM role B;

[0021] decode operation is performed on using to obtain ; wherein is the additive share of , satisfying ; is the decoding function of NIM role A;

[0022] decode operation is performed on using performing a decoding operation and multiplying by corresponding Lagrange coefficient obtained ; wherein, is an additive share of satisfying ; is a signature private key;

[0023] for using performing a decoding operation and multiplying by corresponding Lagrange coefficient obtained ; wherein, is an additive share of satisfying .

[0024] As an optional implementation, the process of the re-randomization processing includes:

[0025] after determining the to-be-signed message , each signature node calculates three hash values according to three hash functions ;

[0026] calculates the signature point , i.e., re-randomizes the partial signature result to ;

[0027] wherein, and are intermediate calculation results; is the sum of the signature random numbers selected by the signature nodes; is a set of signature nodes; X is a signature public key; is a pre-signature result of the signature node .

[0028] As an optional implementation, the process in which each signature node calculates its own signature share includes:

[0029] ;

[0030] ;

[0031] wherein, , are the signature random number and the blinded random number selected by the signature node , respectively; is the abscissa of the signature point; represents that the signature node a new set of signature nodes in the signature node set ; for the signature node a private key share in the signature node set a corresponding Lagrange coefficient ; , , and a product-addition share

[0032] a signature share of the signature node is determined .

[0033] As an optional implementation, the process of merging all signature shares into a complete ECDSA signature and verifying the signature includes: the signature share of the signature node is , an aggregation result is calculated, a signature result is obtained and verified; wherein ; P is a set of signature nodes; is an order of an elliptic curve group , which is a prime number; is an abscissa of a signature point.

[0034] In a second aspect, the present application provides a two-round threshold ECDSA signature system, comprising:

[0035] A key encoding module is configured to encode the private key share of each participating node by using non-interactive multiplication, to obtain a public encoding value and a secret state value of the private key share;

[0036] A pre-signature module is configured to generate a signature random number and a blinded random number and a corresponding commitment value of each signature node, encode the two random numbers by using non-interactive multiplication to obtain a public encoding value and a secret state value corresponding to each random number, and generate zero-knowledge proof for proving that the public encoding value and the commitment value are consistent with respect to the same random number, and the pre-signature result is composed of the commitment value and the public encoding value of each random number and the zero-knowledge proof;

[0037] A decoding module is configured to, when the zero-knowledge proof is verified, the signature node i uses the random number and the secret state value of the private key share generated by the signature node j to perform a decoding operation of non-interactive multiplication, thereby calculating the product-addition share between the two random numbers and between the private key share and the blinded random number, and calculating the product of the signature random number commitment values in all pre-signature results to obtain a partial signature result;

[0038] The signature module is configured to each signature node to obtain a signature point after re-randomization processing of the partial signature result, to calculate a respective signature share in combination with the product addition share, to combine all the signature shares into a complete ECDSA signature and to verify, and to output the ECDSA signature after verification.

[0039] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, and computer instructions stored in the memory and running on the processor, when the computer instructions are run by the processor, the method of the first aspect is completed.

[0040] In a fourth aspect, the present application provides a computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method of the first aspect is completed.

[0041] In a fifth aspect, the present application provides a computer program product comprising a computer program, when the computer program is executed by the processor, the method of the first aspect is completed.

[0042] Compared with the prior art, the present application has the following beneficial effects:

[0043] The present application proposes a two-round threshold ECDSA signature method and system based on non-interactive multiplication (NIM), which optimizes the threshold ECDSA interaction to two rounds and avoids the problem of security degradation of pre-signature. The method initializes the elliptic curve parameters and the non-interactive multiplication public reference string, generates and divides the private key into multiple shares by secret sharing or distributed key generation, and holds the shares by the participating nodes. The protocol includes two rounds of interaction: in the first round, each signature node generates a random number and performs commitment and zero-knowledge proof; in the second round, each signature node combines the to-be-signed message and the pre-signature result to generate a signature share through non-interactive multiplication solution and re-randomization mechanism. Finally, the aggregator combines the signature shares into a complete ECDSA signature and performs verification. Through the above design, the present application method realizes two-round threshold ECDSA for the first time, realizes efficient and secure threshold signature in only two rounds of interaction, balances the communication overhead and the calculation overhead, balances the efficiency and the security, and is suitable for multi-party secure computing scenarios such as blockchains, distributed identity authentication and financial transactions.

[0044] The main innovation points of the present application include:

[0045] 1. Two-round interaction design: The present application realizes two-round threshold ECDSA signature for the first time in the threshold optimal scenario. By introducing a non-interactive multiplication mechanism in the pre-signature stage, the multiplication sharing required for one interaction is realized, avoiding the overhead of multiple interactions in traditional schemes, thereby compressing the total number of signature rounds to two, significantly reducing communication delay.

[0046] 2. Pre-signature security improvement: The present application introduces a random re-randomization mechanism in the signature stage, i.e. a hash-driven random disturbance on the pre-signature result when generating the final signature. This mechanism can eliminate the possibility of attackers using pre-signature results for forgery, restoring the overall security to the level consistent with single-party ECDSA, solving the problem of pre-signature security degradation.

[0047] 3. Bandwidth and performance optimization: Under the condition of meeting 128-bit computational security and 40-bit statistical security, the communication volume, bandwidth overhead and online signature calculation amount are significantly reduced, suitable for high-frequency signature scenarios.

[0048] 4. Generality and practicality: The present application supports arbitrary (t, n) threshold settings, has high flexibility, and relies on fewer system assumptions, only requiring standard elliptic curve groups and hash functions, without relying on complex trusted settings.

[0049] The advantages of the additional aspects of the present application will be partially given in the following description, partially will become obvious from the following description, or will be understood through the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description only the embodiments of the present application, and for those skilled in the art, without creative labor, can also obtain other drawings according to the provided drawings.

[0051] Figure 1 The two-round threshold ECDSA signature method flowchart provided for embodiment 1 of the present application;

[0052] Figure 2 The implementation flowchart of non-interactive multiplication provided for embodiment 1 of the present application;

[0053] Figure 3 The message interaction process diagram of the signature node provided for embodiment 1 of the present application. DETAILED DESCRIPTION

[0054] The present application will be further described below in combination with the drawings and embodiments.

[0055] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0056] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. Furthermore, it should be understood that the terms “comprising” and “including”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0057] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0058] Example 1

[0059] This embodiment provides a two-round threshold ECDSA signature method, such as... Figure 1 As shown, it includes:

[0060] Each participating node encodes its own private key share using non-interactive multiplication to obtain the public encoded value and secret state value of the private key share;

[0061] Each signature node generates a signature random number and a blinded random number, along with their respective commitment values. The two random numbers are encoded using non-interactive multiplication to obtain the public encoded value and secret state value corresponding to each random number. A zero-knowledge proof is generated to demonstrate that the public encoded value and the commitment value are consistent with the same random number. The commitment value, public encoded value, and zero-knowledge proof of each random number constitute the pre-signature result.

[0062] Once the zero-knowledge proof verification is successful, signing node i uses the public encoded value of the random number and private key share generated by signing node j, and the secret state value of the random number and private key share generated by signing node i, to perform a non-interactive multiplication decoding operation. This calculates the product addition share between the two random numbers and between the private key share and the blinded random number, and calculates the product of the signature random number commitment value in all pre-signed results to obtain a partial signature result.

[0063] Each signature node re-randomizes a portion of the signature results to obtain a signature point. It then calculates its own signature share by combining the product-addition share with the signature points. All signature shares are then merged into a complete ECDSA signature for verification. Once verified, the ECDSA signature is output.

[0064] The method of the embodiment mainly includes the following stages:

[0065] S1: In the system initialization stage, determine the set of system participant nodes, set the elliptic curve parameters, the hash function required for signature, and the public reference string required for non-interactive multiplication, and provide a global environment for the subsequent signature protocol.

[0066] The system is composed of n participant nodes, and the set of participant nodes Each participant node holds a key share allocated by a key generation center. When performing threshold signature, at least signature nodes cooperate to complete the signature protocol, and the set of signature nodes to generate the final complete signature.

[0067] Among them, the participant node (Participant Node) refers to an entity designated and holding a key share in the system initialization stage. The system includes several participant nodes, each of which saves a corresponding private key share allocated by the key generation center for subsequent threshold signature execution. Use to represent the set of participant nodes.

[0068] Among them, the signing node (Signing Node) refers to a subset of participant nodes that actually participate in and execute the signature protocol in a specific signature operation. Use to represent the set of signing nodes. The number of signing nodes is not less than the preset threshold , and the threshold signature result is generated through interactive calculation. The participant nodes that do not participate in this signature operation are not considered as signing nodes.

[0069] Specifically, the system initialization stage specifically includes the following steps:

[0070] Step S101: Set the order of the elliptic curve group as a prime number , and the generator.

[0071] Step S102: Select a hash function .

[0072] Among them, in specific implementation, a secure hash function with fixed length such as SHA-2 can be used, and its output is mapped to the integer set mod .

[0073] Step S103: Set the order of the finite Abelian group as a prime number , and the cyclic subgroup The order is a prime number The discrete logarithm problem in It is difficult to go up, in The above is easy. Define the NIM common reference string. .

[0074] NIM has two encoding / decoding roles: A and B. For example... Figure 2 As shown, the implementation process of non-interactive multiplication includes:

[0075] In the NIM role A encoding operation, an encoding function is used. According to public reference strings Treatment of encoded data Perform the encoding operation to obtain the encoded value. and send the public encoded value For role B; in the NIM role A decoding operation, the decoding function is used. According to public reference strings and secret state value For public coded values Perform the decoding operation to obtain the decoded value. .

[0076] In the NIM role B encoding operation, an encoding function is used. According to public reference strings Treatment of encoded data Perform the encoding operation to obtain the encoded value. and send the public encoded value For role A; in the NIM role B decoding operation, the decoding function is used. According to public reference strings and secret state value For public coded values Perform the decoding operation to obtain the decoded value. .

[0077] Step S104: Bind the session identifier sid to each signed session, and use an authenticated channel for all broadcast messages (such as each message having a digital signature bound to the session identifier sid) to prevent replay and cross-session mixing.

[0078] Step S105: Output common parameters .

[0079] S2: During the key generation phase, two operations need to be completed:

[0080] (1) Through a distributed key generation protocol or a trusted party using secret sharing, private key shares are generated and distributed, and held by the participating nodes respectively, ensuring that each participating node only holds a portion of the private key information;

[0081] (2) Each participant node calls a non-interactive multiplication module, encodes the private key share thereof, and exchanges necessary information and zero-knowledge proof to support subsequent secure calculation.

[0082] Specifically, the key generation phase specifically includes the following steps:

[0083] Step S201: The trusted distribution party selects a random polynomial to generate the private key share of the participant node, let the signature public key be , the signature private key be . The private key share of each participant node is , and the corresponding public key share is . The is privately distributed to the participant node , and the is publicly distributed to the participant node corresponding to the public key share .

[0084] Alternatively, the above operation can be replaced by the operation of DKG (Distributed Key Generation).

[0085] Step S202: Each participant node performs the NIM role B encoding operation on the private key share held by the participant node , to obtain an encoded value ; wherein is the encoding function of the NIM role B; is the public encoded value of ; and is the secret state value of .

[0086] Step S203: Each participant node generates and publishes zero-knowledge proof to prove the consistency of the private key share held by the participant node and the public key share ; that is, each participant node generates proof that the same private key share is consistent.

[0087] Step S204: Each participant node broadcasts , and locally saves ; if the proof verification of any participant node fails, the process is aborted. After completion, the system state is: the ECDSA public key , and the public key of each party is , private key .

[0088] S3: The protocol enters two rounds of interaction:

[0089] (1) In the first round of pre-signature stage, each signature node generates a random number required for signature and makes commitment, and at the same time, calls a non-interactive multiplication module to encode the random number, all signature nodes exchange necessary information and attach zero-knowledge proof to ensure correctness and security; by introducing a non-interactive multiplication mechanism in the pre-signature stage, the multiplication sharing required for one interaction is realized.

[0090] (2) In the second round of signature stage, when the message to be signed is known, each signature node uses the pre-signature result of the first round, and again calls the non-interactive multiplication module to decode the random number and the private key share, combines the random re-randomization mechanism, calculates the respective signature share and broadcasts, and restores the required multiplication result without exposing the private key; wherein, the random re-randomization mechanism introduced, that is, the pre-signature result is subjected to hash-driven random disturbance when generating the final signature.

[0091] Specifically, as shown in Figure 3 , the first round of pre-signature stage specifically includes the following steps:

[0092] Step S3-101: Each signature node samples a random scalar ; wherein, is a signature random number; is a blinding random number.

[0093] Step S3-102: Each signature node calculates the commitment value of the random scalar .

[0094] Step S3-103: Each signature node performs NIM role B encoding operation and role A encoding operation on respectively, to obtain the encoding value of the random number and the encoding value of the random number ; wherein, is the encoding function of NIM role A, is the public encoding value of ; is the secret state value of ; is the public encoding value of ; is the secret state value of .

[0095] Step S3-104: Each signature node generate prove Regarding the same Consistent, and Regarding the same Consistent.

[0096] In this step, zero-knowledge proof This is used to prove that the commitment value submitted by each signing node is consistent with the corresponding random number.

[0097] Step S3-105: Each signature node Broadcast round one message That is, the pre-signed result of the first round, and the local state Store securely and use only once. This is to generate the first round of pre-signature results. The pre-signed secret state value is generated at the time; and all messages are bound to the session identifier sid and sent through the authentication channel to avoid confusion between different sessions.

[0098] The second round of signing includes the following steps:

[0099] Step S3-201: Each signature node Based on the received With local state For each Calculate the share of product addition to be used in the online phase using the following steps; where, For the j-th signature node, This means removing a signature node from the signature node set P. The set of new signature nodes.

[0100] It should be noted that although the following steps are described in the signing stage, they can also be completed offline if the message to be signed is unknown.

[0101] Step S3-201-1: Verification If the verification of any signature node fails, the process will be terminated.

[0102] Step S3-201-2: Calculate the signature node Regarding the set of signature nodes Lagrange coefficient .

[0103] Step S3-201-3:

[0104] right use Perform NIM role B decoding operation to obtain ;in, is an additive share of , satisfying ; is a private key share of the signing node selected in step S3-102, is the sum of the random scalar selected in step S3-102.

[0105] For , the NIM role A decoding operation is performed using to obtain ; wherein is an additive share of , satisfying ; is a private key share of the signing node selected in step S3-102, is the sum of the random scalar selected in step S3-102.

[0106] For , the NIM role B decoding operation is performed using and multiplied by the private key share of the signing node corresponding Lagrange coefficient to obtain ; wherein is an additive share of , satisfying ; is the signing private key in step S201, is the private key share obtained by the participating node in step S201, is the sum of the random scalar selected by the signing node in step S3-102, is the decoding function of the NIM role B.

[0107] For , the NIM role A decoding operation is performed using and multiplied by the private key share of the signing node corresponding Lagrange coefficient to obtain ; wherein is an additive share of , satisfying ; is the signing private key in step S201,​​​​ the private key share acquired by the participating node in step S201, the random scalar selected by the signing node in step S3-102 . the decoding function of the NIM role A.

[0108] Step S3-201-4: calculate the product of all in the first round of pre-signature result broadcasted by the signing nodes; ; wherein let be the partial signature result, wherein is the sum of the random scalars selected by all signing nodes in step S3-102; is the commitment value of the signing node to calculated in step S3-102.

[0109] In the second round of the signature phase, the random re-randomization mechanism includes: deriving a random factor through a hash function according to the session identifier, the message, the signing node commitment value, etc., and using it to re-randomize the pre-signature result.

[0110] Step S3-202: after the to-be-signed message is determined, each signing node calculates three hash values according to three hash functions .

[0111] Step S3-203: each signing node calculates the signature point , i.e. re-randomizes the partial signature result of step S3-201-4 from to , let denote the abscissa of the signature point R; wherein and are intermediate calculation results; is the sum of the random scalars selected by the signing node in step S3-102.

[0112] Step S3-204: each signing node calculates its own signature share:

[0113] ;

[0114] .

[0115] Step S3-205: each signing node broadcasts the signature share , and then erasing the current session (including , and related states).

[0116] S4: The signature aggregation and verification phase is executed by a signature aggregator, which can be any participating node or other trusted third party, which is referred to as an aggregator below.

[0117] The aggregator collects the signature shares submitted by each signature node, combines to obtain a complete ECDSA signature, and verifies it through the public key; if the verification is passed, the ECDSA signature is output; otherwise, it is considered invalid.

[0118] Specifically, the following steps are included:

[0119] Step S401: The aggregator collects all signature shares , executes steps S3-201-3, S3-202, and S3-203 in sequence to obtain , and then calculates .

[0120] Step S402: Calculate the aggregation result .

[0121] Step S403: Call the ECDSA signature verification algorithm to verify the signature result using the system public key, and if the verification is passed, output the final signature result , otherwise discard it.

[0122] In this step, when the number of signature shares is less than the threshold, the signature process is terminated; when the number of signature shares meets the threshold, the final signature result is aggregated according to the Lagrange interpolation coefficient.

[0123] In this step, the abscissa of the signature point is calculated and compared with the aggregation result to determine whether the signature result is valid.

[0124] In the above process, all messages are bound to the session identifier and transmitted through the authentication channel to prevent replay attacks and cross-session misuse.

[0125] Under the 128-bit security level, the communication volume of the above-mentioned method of the embodiment is about 1.9 KB (pre-signature stage) + 64B (online stage), which is only about 4% of the existing three-round protocol, greatly reducing the bandwidth overhead. Although the pre-signature calculation is slightly heavy, the online signature calculation takes less than 1 millisecond, and the overall performance is still better than most existing schemes, especially suitable for high-frequency signature scenarios. Thus, under the conditions of meeting the 128-bit computational security and 40-bit statistical security, the communication volume and computational volume are significantly reduced. Through the above-mentioned method, the number of interaction rounds is reduced to two rounds, and the security of the pre-signature mechanism is ensured, so that the threshold signature scheme considers both efficiency and security.

[0126] Embodiment 2

[0127] The embodiment provides a two-round threshold ECDSA signature system, comprising:

[0128] A key encoding module configured to encode the private key share of each participating node by using non-interactive multiplication, to obtain a public encoding value and a secret state value of the private key share;

[0129] A pre-signature module configured to generate a signature random number and a blinded random number and a corresponding commitment value of each signature node, encode the two random numbers by using non-interactive multiplication to obtain a public encoding value and a secret state value corresponding to each random number, and generate zero-knowledge proof for proving that the public encoding value and the commitment value are consistent with respect to the same random number, and the pre-signature result is composed of the commitment value and the public encoding value of each random number and the zero-knowledge proof;

[0130] A decoding module configured to, when the zero-knowledge proof is verified, the signature node i uses the random number generated by the signature node j and the public encoding value of the private key share, uses the random number generated by the signature node i and the secret state value of the private key share, and performs a decoding operation of non-interactive multiplication, thereby calculating the product-addition share between the two random numbers and between the private key share and the blinded random number, and calculating the product of the signature random number commitment value in all pre-signature results to obtain a partial signature result;

[0131] A signature module configured to obtain a signature point after the signature node performs re-randomization processing on the partial signature result, calculate the signature share of each signature node in combination with the product-addition share, combine all signature shares into a complete ECDSA signature, and verify the signature, and output the ECDSA signature after the verification is passed.

[0132] It should be noted that the above-mentioned modules correspond to the steps described in Embodiment 1, and the above-mentioned modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above-mentioned modules as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0133] In more embodiments, there are also provided:

[0134] An electronic device comprising a memory and a processor and computer instructions stored on the memory and running on the processor, when the computer instructions are run by the processor, the method described in embodiment 1 is completed. For brevity, it will not be repeated here.

[0135] It should be understood that in the embodiments, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, ready-to-program gate arrays FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0136] The memory can include read-only memory and random access memory, and provide instructions and data to the processor, and a portion of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0137] A computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method described in embodiment 1 is completed.

[0138] The method in embodiment 1 can be directly embodied as hardware processor execution is completed, or executed by a combination of hardware and software modules in the processor. The software module can be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. The storage medium is mature in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method. To avoid repetition, it will not be described in detail here.

[0139] A computer program product comprising a computer program, when the computer program is executed by the processor, the method described in embodiment 1 is realized and completed.

[0140] The present application also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, for example, instructions embodied in program modules, executed by devices at the target real or virtual processor to perform the processes / methods as described above. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The functionality of the program modules can be combined or split between program modules as desired in various embodiments. Machine executable instructions for program modules can be executed within a local or distributed device. In a distributed device, program modules can be located in local and remote memory storage devices.

[0141] Computer program code for carrying out operations of the present application can be written in one or more programming languages. These computer program codes can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program codes, when executed by the computer or other programmable data processing apparatus, cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program codes can be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0142] In the context of the present application, computer program code or related data can be carried by any suitable carrier to enable the device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media, and the like. Examples of signals can include electrical, optical, radio, sound or other forms of propagated signals, such as carrier waves, infrared signals, and the like.

[0143] Those skilled in the art can realize that the units and algorithm steps of the examples described in conjunction with the present embodiments can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0144] The above describes the specific embodiments of the present application in conjunction with the accompanying drawings, but is not a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications or variations made by those skilled in the art on the basis of the technical solutions of the present application without inventive labor are still within the scope of protection of the present application.

Claims

1. A two-wheel threshold ECDSA signature method, characterized in that, The method comprises the following steps: Each participant node encodes the private key share by using non-interactive multiplication to obtain a public encoded value and a secret state value of the private key share; Each signing node generates a signing random number and a blinded random number and a corresponding commitment value, encodes the two random numbers by using non-interactive multiplication to obtain a public encoded value and a secret state value corresponding to each random number, and generates zero-knowledge proof for proving that the public encoded value and the commitment value are consistent with respect to the same random number, and the pre-signature result is composed of the commitment value and the public encoded value of each random number and the zero-knowledge proof; When the zero-knowledge proof is verified, the signing node i uses the random number generated by the signing node j and the public encoded value of the private key share, uses the random number generated by the signing node i and the secret state value of the private key share to perform a decoding operation of non-interactive multiplication, thereby calculating the product additive share between the two random numbers and between the private key share and the blinded random number, and calculating the product of the signing random number commitment values in all pre-signature results to obtain a partial signature result; Each signing node obtains a signature point after re-randomization processing of the partial signature result, combines the product additive share, calculates the signature share of each signing node, merges all the signature shares into a complete ECDSA signature, and verifies the complete ECDSA signature, and outputs the ECDSA signature after verification.

2. A two-wheel threshold ECDSA signature method as claimed in claim 1, characterized in that, After each participant node encodes the private key share, a zero-knowledge proof for proving that the public encoded value of the held private key share is consistent with the held public key share with respect to the same held private key share is generated and published.

3. A two-wheel threshold ECDSA signature method as claimed in claim 1, wherein, The process of calculating the product additive share comprises: Signature node Generated signature random number And the commitment value of the blinded random number The public encoding value and secret state value of , The public encoding value and secret state value of , The public encoding value and secret state value of The private key share of the signature node The public encoding value and secret state value of ;​ signature node generated signature random number and blinded random number the commitment value of , the public encoding value and secret state value of , the public encoding value and secret state value of ; the private key share of signature node the public encoding value and secret state value of ; , denotes the new signature node set after removing signature node from the signature node set P.​ To Using Performing the decoding operation results in ; wherein, is the additive share, satisfying ; and are the respective sums of two random numbers selected by all signing nodes, respectively; is a public reference string for non-interactive multiplication; is a decoding function for NIM role B; To use perform a decoding operation to obtain ; wherein is an additive share of , satisfying ; is a decoding function of the NIM role A; To Using Performing a decoding operation and multiplying by Corresponding Lagrange coefficients Obtaining ; wherein is an additive share, satisfying ; is a signature private key; To Using Performing a decoding operation and multiplying by Corresponding Lagrange coefficients Obtaining ; wherein is an additive share, satisfying .

4. The two-round threshold ECDSA signature method of claim 1, wherein, The process of re-randomization processing comprises: Message to be signed After the determination, each signing node , three hash values , according to three hash functions ; Computing the signature point The partial signature result is re-randomized as ; wherein, and is an intermediate calculation result; is the sum of the signature random numbers selected by the signature nodes; is a set of signature nodes; X is a signature public key; is a pre-signature result of the signature node .

5. A two-wheel threshold ECDSA signature method as claimed in claim 4, characterized in that, the respective signing nodes The process of computing the respective signing shares comprises: ； ； wherein, , are the selected signature random number and the blinded random number of the signing node ; is the horizontal coordinate of the signing node ; denotes the signing node in the new set of signing nodes after removing the signing node from the set of signing nodes P ; is the private key share of the signing node ; is the Lagrange coefficient corresponding to the signing node , , and are the product-addition shares; Thereby determining the signature share of the signing node .​ 6. A two-wheel threshold ECDSA signature method as claimed in claim 1, wherein, The process of merging all the signature shares into a complete ECDSA signature and verifying the complete ECDSA signature comprises: Signature node The signature share of the signature node is The aggregation result is calculated by The signature result is obtained by and verification is performed; wherein, P is a set of signature nodes; is an elliptic curve group , which is a prime number; is the abscissa of the signature point.

7. A two-wheel threshold ECDSA signature system, characterized by, The method comprises the following steps: The key encoding module is configured to encode the private key share of each participant node by using non-interactive multiplication to obtain a public encoded value and a secret state value of the private key share; The pre-signature module is configured to generate a signing random number and a blinded random number and a corresponding commitment value by each signing node, encode the two random numbers by using non-interactive multiplication to obtain a public encoded value and a secret state value corresponding to each random number, and generate zero-knowledge proof for proving that the public encoded value and the commitment value are consistent with respect to the same random number, and the pre-signature result is composed of the commitment value and the public encoded value of each random number and the zero-knowledge proof; The decoding module is configured to, when the zero-knowledge proof is verified, use the random number generated by the signing node j and the public encoded value of the private key share, use the random number generated by the signing node i and the secret state value of the private key share to perform a decoding operation of non-interactive multiplication, thereby calculating the product additive share between the two random numbers and between the private key share and the blinded random number, and calculating the product of the signing random number commitment values in all pre-signature results to obtain a partial signature result; The signature module is configured to obtain a signature point after re-randomization processing of the partial signature result by each signing node, combine the product additive share, calculate the signature share of each signing node, merge all the signature shares into a complete ECDSA signature, and verify the complete ECDSA signature, and output the ECDSA signature after verification.

8. An electronic device, comprising: A computer program product comprising a memory and a processor, and computer instructions stored on the memory and running on the processor, which, when run by the processor, complete the method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, A computer program product for storing computer instructions, which, when executed by a processor, complete the method of any one of claims 1-6.

10. A computer program product, characterised in that, A computer program product comprising a computer program, which, when executed by a processor, implements the method of any one of claims 1-6.

Images