A general two-party oblivious signature method and system

Abstract

This invention discloses a general two-party unintentional signature method and system, belonging to the field of cryptographic protocol technology. The method includes: participants P1 and P2 jointly generating a signature public key; participants P1 and P2 jointly calculating a signature of the message, wherein the signature is known only to participant P1, and participant P1 uses the signature public key to verify the signature. This invention can both distribute key storage to avoid the risk of key leakage and prevent additional participants from obtaining the final signature content.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic protocol technology, and in particular relates to a general method and system for two-party unintentional signatures. Background Technology

[0002] Driven by informatization and globalization, digital communication and electronic transactions have become core components of modern society. With the increase in electronic contracts, online financial transactions, and transnational cooperation, ensuring the security and authenticity of data transmission has become a crucial issue. Digital signature technology, as an important means of guaranteeing information authenticity and preventing tampering, has been widely used. The core concept of digital signatures is that users use their private keys to sign, thereby achieving functions such as identity authentication, and the foundation of digital signature algorithms lies in the security of the private key.

[0003] Traditional digital signatures are typically generated by a single entity using its private key and attached to an electronic document or message. The recipient verifies the signature to ensure the authenticity of the information's origin and the integrity of its content. This unilateral signing mechanism is effective enough for most simple applications. However, in more complex scenarios, especially those involving multiple independent entities that need to jointly sign or confirm, traditional unilateral signatures fall short.

[0004] To address the signature problem in multi-party collaborations, threshold signature technology emerged. Threshold signatures allow t out of n participants to jointly generate a signature, without requiring the participation of all parties, thus improving the system's fault tolerance and flexibility. It is particularly prominent in scenarios such as blockchain and multi-party contract signing, effectively improving efficiency and security by allowing only some participants to generate signatures. Within the threshold signature framework, two-party signatures can be considered a special case, specifically when n=2 and t=2. In this scenario, signature generation requires the joint participation of both parties, ensuring that no single party can generate or tamper with the signature. By evenly distributing the authority for signature generation, two-party signature technology enhances the security and fairness of the signing process, making it widely applicable in scenarios requiring joint confirmation and accountability from both parties.

[0005] However, in certain sensitive application scenarios, although the signature is jointly generated by both parties, strict restrictions may be needed on the acquisition and use of the signature content for reasons such as security, access control, and compliance. In this case, the system can be designed so that only one party (e.g., P1) can acquire and use the final generated signature content, while the other party (P2), although involved in the signature generation process, cannot directly access the specific content of the signature.

[0006] This restrictive design has many practical applications. For example, in financial transactions, P1 might be a financial institution or bank, while P2 is a client or partner. Both parties need to jointly generate a signature to confirm the legality and validity of a transaction. However, to protect client privacy or meet regulatory requirements, only P1 can hold and manipulate the final signature content to execute the transaction. This not only prevents the leakage of client information but also ensures the compliance and security of the transaction. Similar situations frequently occur in corporate collaborations. For instance, when two companies jointly sign an important business contract, due to the need to protect trade secrets or internal management, only one party (e.g., P1) can store and use the final signature, while the other party (P2), although involved in signature generation, has no right to obtain the specific content of the signature. This mechanism ensures both parties' participation and confirmation during the signing process while effectively protecting each party's sensitive information from being obtained by the other. Furthermore, in the government or military fields, sensitive documents involving national security often require joint authentication from multiple departments or agencies. At this point, although these departments (such as P1 and P2) need to jointly generate a signature to verify the authenticity of the document, for security reasons, only one core department (P1) can ultimately hold and use the signature. This design prevents the unnecessary dissemination of sensitive information between different organizations while ensuring the confidentiality and integrity of the information. However, existing technologies lack good solutions for such sensitive application scenarios. Summary of the Invention

[0007] This invention discloses a universal two-party unintentional signature method and system that can both distribute the key storage to avoid the risk of key leakage and prevent additional parties from obtaining the final signature content.

[0008] To achieve the above objectives, the technical solution of the present invention includes the following:

[0009] A general method for two-party unintentional signatures, applied to participant P1, the method comprising:

[0010] Together with participant P2, a signature public key Q is generated;

[0011] Together with participant P2, the ECDSA signature of message m is calculated, and the ECDSA signature is verified using the signature public key Q; wherein, the ECDSA signature is known only to participant P1.

[0012] Furthermore, the step of jointly generating the signature public key Q with participant P2 includes:

[0013] Initiate a registration request to participant P2 so that participant P2 can register in the finite domain. A random value is selected as the private key share x2 of participant P2, and the public key Q2 and proof π are calculated based on the private key share x2; wherein, the proof π is used to prove that participant P2 knows the private key share x2 corresponding to the public key Q2, and q is a finite field. The model;

[0014] Obtain the public key Q2 and the proof π, and verify the proof π;

[0015] If the proof of π passes, in a finite field A random value is selected as the private key share x1 of participant P1, and the signature public key Q is calculated based on the private key share x1.

[0016] Furthermore, together with participant P2, the ECDSA signature of message m is calculated, including:

[0017] In a finite field A random value is selected as the temporary private key share k1 of participant P1. After calculating the public key R1 and the proof π1 based on the private key share k1, a commitment is made to the public key R1 and the proof π1 to obtain the commitment value π. ′ ; wherein, the proof π1 is used to prove that participant P1 knows the temporary private key share k1 corresponding to the public key R1;

[0018] The system receives the public key R2 and proof π2 sent by participant P2, and verifies the proof π2; wherein the public key R2 is generated based on participant P2's temporary private key share k2, and the temporary private key share k2 is a finite field. A random value in the public key R2, wherein the proof π2 is used to prove that participant P2 knows the temporary private key share k2 corresponding to the public key R2;

[0019] If the proof π2 verification passes, a public-private key pair (pk, sk) is generated, and the private key share x1 is encrypted using the public key pk to generate ciphertext c. key And calculate the hash value m of message m. ′ ;

[0020] The ciphertext c key The hash value m ′ and the commitment value π ′ Send it to participant P2 so that participant P2 can combine the private key share x2 and the temporary private key share k2 to generate ciphertext c3;

[0021] Receive the ciphertext c3, and combine it with the temporary private key share k1, the public key R2, and the private key sk to generate an ECDSA signature for message m.

[0022] Further, participant P2 combines the private key share x2 and the temporary private key share k2 to generate ciphertext c3, including:

[0023] Verify the commitment value π ′ And in the promised value π ′ If the verification is successful, obtain the public key R1 and the proof π1;

[0024] Verify the proof π1, and if the proof π1 passes verification, calculate the point R = (r on the elliptic curve based on the temporary private key share k2 and the public key R1. x ,r y ); where r x Let r be the x-coordinate of point R. y Let R be the ordinate of point R;

[0025] Based on the x-coordinate r x Generate the first half r of the ECDSA signature;

[0026] From model q 2 Integer ring Select a random number ρ, and from the integer multiplication group modulo N Select random number in,

[0027] Calculate ciphertext

[0028] Calculate the intermediate value And for the intermediate value v and the ciphertext c key Perform an XOR operation to obtain the ciphertext c2;

[0029] The ciphertext c1 and the ciphertext c2 are XORed to obtain the ciphertext c3.

[0030] Further, by combining the temporary private key share k1, the public key R2, and the private key sk, an ECDSA signature for message m is generated, including:

[0031] Based on the temporary private key share k1 and the public key R2, the first half r of the ECDSA signature is obtained;

[0032] Decrypt the ciphertext c3 using the private key sk to obtain the decryption result s. ′ ;

[0033] Based on the decryption result s ′ And the temporary private key share k1, to obtain the intermediate value s ″ ;

[0034] Calculate the modulus q and the intermediate value s ″The difference;

[0035] In the intermediate value s ″ and the modulus q and the intermediate value s ″ The smaller value is selected from the differences and used as the second half of the ECDSA signature.

[0036] A general method for two-party unintentional signatures, applied to participant P2, the method comprising:

[0037] Together with participant P1, a signature public key Q is generated;

[0038] Together with participant P1, calculate the ECDSA signature of message m; wherein, the ECDSA signature is known only to participant P1, and participant P1 uses the signature public key Q to verify the ECDSA signature.

[0039] Furthermore, the step of jointly generating the signature public key Q with participant P1 includes:

[0040] Receive the registration request from participant P1;

[0041] In a finite field A random value is selected as the private key share x2 of participant P2, and the public key Q2 and proof π are calculated based on the private key share x2; wherein, the proof π is used to prove that participant P2 knows the private key share x2 corresponding to the public key Q2, and q is a finite field. The model;

[0042] The public key Q2 and proof π are sent to participant P1 so that participant P1 can verify the proof π. If the proof π is verified successfully, the proof can be applied in a finite field. After selecting a random value as the private key share x1 of participant P1, the signature public key Q is calculated based on the private key share x1.

[0043] Furthermore, together with participant P1, the ECDSA signature of message m is calculated, including:

[0044] In a finite field Choose a random value as the temporary private key share k2 of participant P2, and calculate the public key 2 and proof π2 based on the private key share k2; wherein, the proof π2 is used to prove that participant P2 knows the temporary private key share k2 corresponding to the public key R2;

[0045] The public key R2 and proof π2 are sent to participant P1, so that participant P1, upon successful verification of proof π2, generates a public-private key pair (pk, sk) and uses the public key pk to encrypt the private key share x1 to generate ciphertext c. key And calculate the hash value m of message m.′ ;

[0046] The ciphertext c sent by participant P1 key The hash value m ′ and commitment value π ′ Wherein, the commitment value π ′ It is a commitment by the participants to the public key R1 and the proof π1, wherein the public key R1 is generated based on the temporary private key share k1 of participant P1, and the temporary private key share k1 is a finite field. A random value in the public key R1, wherein the proof π1 is used to prove that participant P1 knows the temporary private key share k1 corresponding to the public key R1;

[0047] Based on the ciphertext c key The hash value m ′ The commitment value π ′ The private key share x2 and the temporary private key share k2 are used to generate ciphertext c3;

[0048] The ciphertext c3 is sent to the receiving participant P1, so that participant P1 generates an ECDSA signature for message m based on the ciphertext c3, the temporary private key share k1, the public key R2, and the private key sk.

[0049] A general two-party unintentional signature system is provided, comprising: participant P1 and participant P2; participant P1 and participant P2 jointly generate a signature public key Q and jointly calculate an ECDSA signature of message m, wherein the ECDSA signature is known only to participant P1, and participant P1 uses the signature public key Q to verify the ECDSA signature.

[0050] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the general two-party unintentional signature method described above.

[0051] Compared to existing technologies, the unintentional two-party signature scheme proposed in this invention is a special type of two-party signature scheme in which two parties, P1 and P2, collaborate to generate a signature, but with an additional property: P2 does not obtain the final signature value. In this protocol, P1 is responsible for generating partial signature information, while P2, although participating in the signing process, does not obtain the complete signature data. P2's role is limited to assisting P1 in completing the signature generation, and the final signature is only held by P1. This mechanism enhances security, avoiding the risk that P2 could use the signature for malicious purposes or forge it, while ensuring that the signature generation depends on the collaboration of both parties rather than independent operation. In terms of security, the unintentional two-party signature scheme, in addition to satisfying the unforgeability for both parties, also possesses the property of indistinguishability:

[0052] 1. Unforgeability of P1. This property requires that a malicious P1 cannot independently generate a valid signature without a share of P2's private key.

[0053] 2. P2 Unforgeability. This property requires that a malicious P2 cannot independently generate a valid signature without a share of P1's private key.

[0054] 3. P2 is indistinguishable. An honest P1 can choose to register with P2 multiple times, and this property ensures that a malicious P2 cannot determine which registration key P1 used. Attached Figure Description

[0055] Figure 1 This is a flowchart of a general two-party unintentional signature method.

[0056] Figure 2 This refers to the distributed key generation phase of an ECDSA instance that uses an unintentional two-party signature scheme.

[0057] Figure 3 This refers to the distributed signature phase of an ECDSA instance that uses an unintentional two-party signature scheme. Detailed Implementation

[0058] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the implementation of the present invention will be further described in detail below using ECDSA as an example.

[0059] The general two-party unintentional signature method of this invention is based on the ideal commitment scheme, the ideal zero-knowledge scheme, the non-interactive zero-knowledge commitment scheme, and Paillier encryption. It involves two parties and possesses the unintentional property, meaning only the initiator of the signature can obtain the final signature value. This signature scheme has wide applications. By introducing a second party, it can securely store the key to prevent key leakage while preventing the newly introduced party from obtaining the final signature value. Furthermore, the two-party unintentional signature scheme of this invention is highly efficient; the execution time for key generation, signing, and verification stages is all in the millisecond range.

[0060] Ideal Commitment Scheme: The ideal commitment scheme is used in the non-interactive zero-knowledge commitment scheme. Static safety in the random oracle model This can be easily implemented using a hash function, Com(x) = H(x,r), where r ← {0,1} n It is random. The outcome is between participants P1 and P2. The working mode is as follows:

[0061] -when Received from participant P i The message (commit,sid,x) for (i∈{1,2}) records (sid,i,x) and sends the message (receipt,sid) to participant P. 3-i If the message (commit, sid, *) has been stored before, then ignore this message.

[0062] -when Received from participant P i If the (decommit, sid) message has been recorded before, then (decommit, sid, x) will be sent to participant P. 3-i .

[0063] Ideal zero-knowledge scheme: The standard ideal zero-knowledge scheme is represented by ((x,w),λ)→(λ,(x,R(x,w))), where λ represents an empty string. The ideal zero-knowledge scheme for relation R is... This indicates that zero-knowledge proofs for any knowledge satisfy the following condition. The non-interactive version of the relation can be implemented using the Fiat-Shamir paradigm under the random oracle model, which is safe under sequential combinatorial conditions. The working mode is as follows:

[0064] - If a message (prove,sid,x,w) is received from participant Pi (i∈{1,2}), then... If SID has previously provided proof, no response is needed; otherwise, the message (proof, SID, x) is sent to participant P. 3-i .

[0065] Non-interactive zero-knowledge commitment scheme: In signature schemes, there is a step where participants send non-interactive zero-knowledge proofs. This step is characterized using a commitment-zero-knowledge proof approach. This indicates that if a non-interactive zero-knowledge proof has been provided, then the scheme is based on an ideal commitment scheme. To achieve:

[0066] -When received from participant P i For the message (com-prove,sid,x,w) for (i∈{1,2}), if sid has been queried, ignore this message; otherwise, store (sid,i,x,w) and send (proof-receipt,sid) to P. 3-i .

[0067] -When received from participant P iThe (decom-proof,sid) message for (i∈{1,2}) is in (sid,i,x,w) If (x,w)∈R, then send (decom-proof,sid,x,1) to P if it has been stored before. 3-i Otherwise, send (decom-proof,sid,x,0) to P. 3-i .

[0068] Paillier encryption: Paillier is a homomorphic encryption algorithm. (pk, sk) represents the public-private key pair of Paillier, and Enc... pk (·) and Dec sk (·) represent the encryption algorithm and the decryption algorithm, respectively. Let a⊙c represent the addition of plaintext in c1 and c2, and let a⊙c represent the multiplication of plaintext in c by the scalar a.

[0069] The following uses ECDSA as an example to further illustrate the implementation of this invention. The steps for ECDSA signing are as follows: It is an elliptic curve group of order q, with generator G. The private key is a random value. The corresponding public key is Q = x·G. The message to be signed is m∈{0,1} * .

[0070] 1. Calculate the hash value of message m using the SHA256 algorithm, where q is the length of the SHA256 output.

[0071] 2. Randomly select from the ring of integers modulo q.

[0072] 3. Calculate R←k·G, and calculate the point R = (r) on the elliptic curve corresponding to R. x ,r y ).

[0073] 4. Based on r x Calculate r, r = r x Mod q. If the result of the calculation is 0, return to step two.

[0074] 5. Calculate s←k -1 ·(m′+r·x)mod q.

[0075] 6. Output (r,s) as an ECDSA signature.

[0076] A flowchart of the general two-party unintentional signature method of the present invention, as shown below. Figure 1 As shown, it includes the following steps.

[0077] Step 1: Participant P1 and Participant P2 jointly generate a signature public key.

[0078] like Figure 2 The diagram shows the distributed key generation phase of an ECDSA instance. P1 and P2 generate their respective keys, and the specific steps are as follows:

[0079] The first stage is the distributed key generation stage. The goal of this stage is for both parties to jointly run the key generation protocol and jointly generate a random group element Q as the signature PK. There is only one round of interaction in this stage.

[0080] 1. P1 initiates a registration request to P2, and P2 then... Randomly select x2 as your private key share and calculate the corresponding public key Q2←x2·G (if x2 already exists, reuse the value). At the same time, provide a proof π to prove that you know the private key x2 corresponding to Q2.

[0081] 2. P2 sends Q2 and π to P1. After receiving P2's message, P1 first verifies π. If the verification is successful, P1 then... In the process, x1 is randomly selected as the private key share of P1, and the public key Q←x1·Q2 is calculated based on Q2 given by P2.

[0082] Step 2: Participant P1 and Participant P2 jointly generate a signature public key Q and jointly calculate the signature of message m. This signature is known only to Participant P1, and Participant P1 uses the signature public key Q to verify the signature.

[0083] like Figure 3 As shown, after the key generation phase is completed, P1 and P2 interact for multiple rounds and jointly calculate an ECDSA signature. However, only P1 can obtain this signature, and P2 will only know that P1 signed a message during this process.

[0084] 1. Before the protocol begins, P1 has a signing public key Q, a message m to be signed, and a private key share x1 generated by P1 during the distributed key generation phase; P2 has a private key share x2 generated during the distributed key generation phase.

[0085] 2. P1 in Randomly select k1 as the temporary private key share, calculate the corresponding public key R1←k1·G, and provide a proof π1 for R1 to prove that you know the k1 corresponding to R1. At the same time, make a commitment to R1 and π1 to obtain the commitment value π. ′ , will π ′ Send to P2.

[0086] 3. P2 in Randomly select k2 as a temporary private key share, calculate the corresponding public key R2←k2·G, and provide a proof for R2 π2 to prove that you know the k2 corresponding to R2.

[0087] 4. P2 sends R2 and π2 to P1. After receiving P2's message, P1 first verifies π2. If the verification is successful, it generates a Paillier-encrypted public-private key pair (pk, sk) and uses pk to encrypt P1's private key share x1, ciphertext c. key =Enc pk (x1), and simultaneously calculate the hash value m of the message to be signed locally. ′ ←H(m).

[0088] 5. P1 will c key m ′ and the commitment value π ′ The opened π is sent to P2, and P2 first verifies π. ′ Then verify that π1 is simultaneously calculated based on R1, and R←k2·R1 can be used as a point on the elliptic curve (r x ,r y Let r = r x mod q. P2 starts modulo q. 2 Integer ring Select a random number ρ from the integer multiplication group modulo N. Select random number in, N is a group The modulus is then used to calculate the ciphertext. Ciphertext c2=v⊙c key ciphertext Where gcd(a,b) represents the greatest common divisor of a and b.

[0089] 6. P2 sends c3 to P1. P1 calculates the same R←k1·R2 as P2, and then calculates the first half of the signature r in the same way as P2. P1 decrypts c3 with sk to obtain s′, and then multiplies the inverse of its own temporary private key share with the decryption result to obtain... Choose the smaller of s″ and qs″ as the second half s of the signature, thereby generating the signature (r,s), and use the signature public key Q to verify the signature (r,s) to ensure its correctness.

[0090] The following is a specific experiment illustrating the universal two-party unintentional signature method provided by this invention.

[0091] According to the method of this invention, a prototype of the protocol was implemented and its performance was tested. Specifically, secp256k1 was used as the underlying elliptic curve for ECDSA signatures, and the SHA-256 hash function was selected. SHA3-256 was used as the commitment in the ECDSA signature generation stage. The distributed key generation stage and distributed signature stage of this scheme were implemented using the Golang libraries tronch0 / curv3 and tronch0 / crypt0. Performance testing was conducted on a 14-inch Apple MacBook Pro laptop equipped with an Apple M1 Pro (3.2GHz), 10 cores, and 16GB of memory. The runtime is shown in Table 1, where the time unit is milliseconds.

[0092] Table 1

[0093]

[0094]

[0095] This invention can be used in identity authentication scenarios. For example, the FIDO authentication scheme requires users to securely store their private keys in hardware. Using the signature scheme of this invention, the key can be stored in a distributed manner, and the parties involved in storing the key do not obtain the user's final signature. This ensures the security of the user's private key; even if an adversary obtains a share of the private key stored locally on P1, they cannot impersonate the user to complete the authentication. Furthermore, even a malicious P2 cannot independently generate a signature, nor can it obtain a signature from its interaction with P1. This ensures both key security and eliminates the risk of signature forgery.

[0096] Furthermore, through fine-grained control over access to signed content, this two-party signature scheme not only meets the fairness and security requirements of the participating parties but also flexibly adapts to various special application scenarios. In the modern information security environment, this mechanism provides a reliable and efficient solution for complex and sensitive collaborations, demonstrating significant advantages, especially when facing potential security threats or stringent compliance requirements.

[0097] Based on the same concept, this invention also discloses a general unintentional two-party signature system. This system has two participants, P1 and P2, and the protocol is divided into two phases: a distributed key generation phase and a distributed signature phase. In the distributed key generation phase, P1 and P2 interact and generate their respective signature keys, without knowing each other's keys. The signature verification key is unique and publicly available. In the distributed signature phase, P1 outputs a signature, while P2 outputs a stop signal.

[0098] First, let's look at the algorithm components of an unintentional two-party signature: (key generation, signing, verification).

[0099] - Key Generation: Distributed key generation involves two parties, P1 and P2, who respectively input the common parameter PP and the security parameter 1. λ If P1 and P2 have previously performed a key generation phase, then P2 needs to reuse the private key share SK generated in the previous key generation phase. p2 Otherwise, P2 generates a new private key share SK. p2 P1 needs to select different private key shares SK at different key generation stages. P1 At the same time, P1 will also output the signature public key PK for this key generation phase. S .

[0100] - Signature: In the distributed signature phase, P1 and P2 respectively input their outputs from the key generation phase, i.e., P1 inputs SK. P1 PK S And the message to be signed, m, P2 input SK p2 When the signature ends, P1 outputs signature σ, and P2 does not output.

[0101] -Verification: Anyone can perform this step by inputting the signature message 'm' and the public key 'PK'. S And the signature σ, output whether the signature verification passes {0,1}.

[0102] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A universal method for accidental signatures between two parties, characterized in that, Applied to participant P1, the method includes: Together with participant P2, a signature public key Q is generated; Together with participant P2, the signature of message m is calculated, and the signature is verified using the public key Q; wherein, the signature is known only to participant P1.

2. The method according to claim 1, characterized in that, The step of jointly generating the signature public key Q with participant P2 includes: Initiate a registration request to participant P2 so that participant P2 can register in the finite domain. A random value is selected as the private key share x2 of participant P2, and the public key Q2 and proof π are calculated based on the private key share x2; wherein, the proof π is used to prove that participant P2 knows the private key share x2 corresponding to the public key Q2, and q is a finite field. The model; Obtain the public key Q2 and the proof π, and verify the proof π; If the proof of π passes, in a finite field A random value is selected as the private key share x1 of participant P1, and the signature public key Q is calculated based on the private key share x1.

3. The method according to claim 2, characterized in that, Together with participant P2, the signature of message m is calculated, including: In a finite field A random value is selected as the temporary private key share k1 of participant P1. After calculating the public key R1 and the proof π1 based on the private key share k1, a commitment is made to the public key R1 and the proof π1 to obtain the commitment value π. ′ ; wherein, the proof π1 is used to prove that participant P1 knows the temporary private key share k1 corresponding to the public key R1; The system receives the public key R2 and proof π2 sent by participant P2, and verifies the proof π2; wherein the public key R2 is generated based on participant P2's temporary private key share k2, and the temporary private key share k2 is a finite field. A random value in the public key R2, wherein the proof π2 is used to prove that participant P2 knows the temporary private key share k2 corresponding to the public key R2; If the proof π2 verification passes, a public-private key pair (pk, sk) is generated, and the private key share x1 is encrypted using the public key pk to generate ciphertext c. key And calculate the hash value m′ of message m; The ciphertext c key The hash value m′ and the commitment value π′ are sent to participant P2 so that participant P2 can combine the private key share x2 and the temporary private key share k2 to generate ciphertext c3; Receive the ciphertext c3, and combine it with the temporary private key share k1, the public key R2, and the private key sk to generate a signature for message m.

4. The method according to claim 3, characterized in that, The participant P2 combines the private key share x2 and the temporary private key share k2 to generate ciphertext c3, including: Verify the commitment value π ′ And in the promised value π ′ If the verification is successful, obtain the public key R1 and the proof π1; Verify the proof π1, and if the proof π1 passes verification, calculate the point R = (r on the elliptic curve based on the temporary private key share k2 and the public key R1. x ,r y ); where r x Let r be the x-coordinate of point R. y Let R be the ordinate of point R; Based on the x-coordinate r x Generate the first half r of the signature; From model q 2 Integer ring Select a random number ρ, and from the integer multiplication group modulo N Select random number in, Calculate ciphertext Calculate the intermediate value And for the intermediate value v and the ciphertext c key Perform an XOR operation to obtain the ciphertext c2; The ciphertext c1 and the ciphertext c2 are XORed to obtain the ciphertext c3.

5. The method according to claim 3, characterized in that, By combining the temporary private key share k1, the public key R2, and the private key sk, a signature for message m is generated, including: Based on the temporary private key share k1 and the public key R2, the first half r of the signature is obtained; Decrypt the ciphertext c3 using the private key sk to obtain the decryption result s′; Based on the decryption result s′ and the temporary private key share k1, the intermediate value s″ is obtained; Calculate the modulus q and the intermediate value s ″ The difference; In the intermediate value s ″ and the modulus q and the intermediate value s ″ Choose the smaller value from the differences and use that smaller value as the second half of the signature, s.

6. A universal method for accidental signatures between two parties, characterized in that, Applied to participant P2, the method includes: Together with participant P1, a signature public key Q is generated; Together with participant P1, a signature of message m is calculated; wherein, the signature is known only to participant P1, and participant P1 uses the signature public key Q to verify the signature.

7. The method according to claim 6, characterized in that, The step of jointly generating the signature public key Q with participant P1 includes: Receive the registration request from participant P1; In a finite field A random value is selected as the private key share x2 of participant P2, and the public key Q2 and proof π are calculated based on the private key share x2; wherein, the proof π is used to prove that participant P2 knows the private key share x2 corresponding to the public key Q2, and q is a finite field. The model; The public key Q2 and proof π are sent to participant P1 so that participant P1 can verify the proof π. If the proof π is verified successfully, the proof can be applied in a finite field. After selecting a random value as the private key share x1 of participant P1, the signature public key Q is calculated based on the private key share x1.

8. The method according to claim 7, characterized in that, Together with participant P1, the signature of message m is calculated, including: In a finite field Choose a random value as the temporary private key share k2 of participant P2, and calculate the public key 2 and proof π2 based on the private key share k2; wherein, the proof π2 is used to prove that participant P2 knows the temporary private key share k2 corresponding to the public key R2; The public key R2 and proof π2 are sent to participant P1, so that participant P1, upon successful verification of proof π2, generates a public-private key pair (pk, sk) and uses the public key pk to encrypt the private key share x1 to generate ciphertext c. key And calculate the hash value m of message m. ′ ; The ciphertext c sent by participant P1 key The hash value m′ and the commitment value π′; wherein, the commitment value π′ is the commitment of the participant to the public key R1 and the proof π1, the public key R1 is generated based on the temporary private key share k1 of the participant P1, and the temporary private key share k1 is a finite field. A random value in the public key R1, wherein the proof π1 is used to prove that participant P1 knows the temporary private key share k1 corresponding to the public key R1; Based on the ciphertext c key The hash value m′, the commitment value π′, the private key share x2, and the temporary private key share k2 are used to generate ciphertext c3; The ciphertext c3 is sent to the receiving participant P1, so that participant P1 generates a signature of message m based on the ciphertext c3, the temporary private key share k1, the public key R2, and the private key sk.

9. A universal two-party unintentional signature system, characterized in that, The system includes: participant P1 and participant P2; participant P1 and participant P2 jointly generate a signature public key Q and jointly calculate the signature of message m, wherein the signature is only known to participant P1, and participant P1 uses the signature public key Q to verify the signature.

10. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the general two-party unintentional signature method as described in any one of claims 1-8.

Images