Adaptive secure two-round threshold signature method and system with full tight security

Abstract

This invention relates to the field of threshold signature technology, and provides an adaptive secure two-round threshold signature method and system with fully compact security. The method includes: based on public and private keys, each participant performs a first round of offline signing, generating a first-round signature message and a phase state; in the first round of offline signing, each participant splits its secret share into two hidden branches, generating corresponding random values, public elements, and commitment information for each hidden branch, overlaying a dynamic mask on the commitment information, and offline outputting the first-round signature message and phase state; upon receiving the message to be signed, the participants call a second-round online signature algorithm, generating a partial signature response based on the phase state and secret share generated in the first round of offline signing; and call an aggregation algorithm to aggregate all partial signature responses to generate a complete threshold signature. Because attackers cannot distinguish the true purpose of the two branches, they can flexibly switch the branch roles in subsequent security proofs.

Description

Technical Field

[0001] This invention belongs to the field of threshold signature technology, and particularly relates to an adaptive secure two-round threshold signature method and system with fully compact security. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of technologies such as distributed systems, cloud computing, and blockchain, the demand for multi-party collaborative digital signature generation is increasing. Traditional single-key signature mechanisms have significant limitations in terms of security and reliability, such as single point of failure and key leakage risks. Therefore, threshold signature technology is gradually becoming an important means to ensure key security in distributed environments.

[0004] Threshold signature technology is typically based on a secret-sharing mechanism, where private keys are distributed and stored among multiple participants. A valid signature can only be generated when at least a threshold number of participants collaborate. This mechanism is widely used in scenarios such as blockchain consensus, distributed key management, and secure multi-party computation.

[0005] Among existing technologies, threshold signature schemes based on Schnorr Signature have attracted widespread attention due to their simple structure and high efficiency. However, existing schemes still face the following key technical challenges in practical applications: Traditional threshold signature schemes mostly guarantee security only under a static corruption model, where the attacker chooses the participant to be corrupted before protocol execution. However, in practical applications, attackers can often dynamically select targets during protocol execution, a technique known as adaptive corruption. Under this attack model, attackers can obtain not only the participant's private key but also their internal state information during the signing process, significantly increasing security risks.

[0006] Many existing threshold signature schemes based on the Schnorr architecture rely on the Forking Lemma for their security proofs. However, this type of proof often results in loose security bounds, meaning there is a significant trade-off between the probability of a successful attack and the underlying difficulty. This "non-tight security" leads to the need for larger parameter sizes in practical deployments, thus reducing system efficiency.

[0007] Furthermore, some existing threshold signature schemes require three or more rounds of interaction to generate a signature, which significantly increases communication overhead and impacts system performance in high-latency network environments (such as cross-regional distributed systems or blockchain networks). Therefore, how to reduce the number of interaction rounds while ensuring security is an important direction for current research.

[0008] To achieve compact security, some studies have introduced bimodal commitment techniques, such as the Groth-Sahai Commitment-based construction method. This type of commitment scheme allows simulators to extract or simulate information during security proofs by switching between a "binding mode" and a "hidden mode," thus avoiding the use of fork lemmas. However, effectively applying this technique to threshold signatures while simultaneously supporting adaptive security remains a significant challenge. Summary of the Invention

[0009] To address the technical problems mentioned above, this invention provides an adaptive secure two-round threshold signature method and system with fully compact security. It employs a dual-branch hiding mechanism, where one branch is used for adaptive secure simulation and the other branch is used for final secure extraction. Since attackers cannot distinguish the true purpose of the two branches, they can flexibly switch the roles of the branches in subsequent security proofs and ultimately restore one of the branches to a strictly bound structure, thereby completing the reduction proof of the underlying difficult problem.

[0010] To achieve the above objectives, the present invention adopts the following technical solution: A first aspect of the present invention provides an adaptive secure two-round threshold signature method with fully compact security, comprising: Generate a public key and private keys held by each participant, wherein the private keys contain a secret share and a mask seed; Based on the public and private keys, each participant performs the first round of offline signing, generating the first round of signature messages and stage status. In the first round of offline signing, each participant splits its own secret share into two hidden branches, generates corresponding random values, public elements and commitment information for the two hidden branches respectively, overlays a dynamic mask on the commitment information, and outputs the first round of signature messages and stage status offline. Upon receiving the message to be signed, the participants invoke the second-round online signature algorithm, relying on the stage state and secret share generated offline in the first round, to generate a partial signature response; The aggregation algorithm is invoked to aggregate all local signature responses and generate a complete threshold signature.

[0011] Furthermore, it also includes: the verifier first recalculates the challenge value based on the public key, and then verifies the Schnorr relationship and commitment open relationship corresponding to the two hidden branches respectively. Only when all verifications pass is the complete threshold signature accepted.

[0012] Furthermore, the sum of the two hidden branches obtained from the split is equal to the original secret share.

[0013] Furthermore, the second round of online signature algorithm aggregates the commitments from the two hidden branches to compute the unified challenge.

[0014] Furthermore, the aggregation algorithm employs Lagrange interpolation.

[0015] Furthermore, the method for generating the public key is as follows: input the number of users and the threshold value, randomly generate a global master secret, and generate a public key based on the global master secret; The secret share is obtained by splitting the global master secret.

[0016] Furthermore, the dynamic mask is jointly generated by a random seed shared among the participants, and the masks of each participant satisfy an overall cancellation relationship.

[0017] A second aspect of the invention provides an adaptive secure two-round threshold signature system with fully compact security, comprising: A key generation module is configured to generate a public key and a private key held by each participant, wherein the private key contains a secret share and a mask seed; The offline signature module is configured as follows: based on the public key and private key, each participant performs the first round of offline signature, generating the first round of signature message and stage status; in the first round of offline signature, each participant splits its own secret share into two hidden branches, generates corresponding random values, public elements and commitment information for the two hidden branches respectively, overlays a dynamic mask on the commitment information, and outputs the first round of signature message and stage status offline; The online signature module is configured to: upon receiving a message to be signed, the participating party calls the second-round online signature algorithm to generate a partial signature response based on the stage state and secret share generated offline in the first round; The aggregation module is configured to call the aggregation algorithm to aggregate all local signature responses and generate a complete threshold signature.

[0018] A third aspect of the invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the adaptive secure two-round threshold signature method with fully compact security as described above.

[0019] A fourth aspect of the present invention provides a computer device including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein the processor, when executing the program, implements the steps of the adaptive secure two-round threshold signature method with fully compact security as described above.

[0020] Compared with the prior art, the beneficial effects of the present invention are: This invention employs a dual-branch hiding mechanism, with one branch used for adaptive security simulation and the other for final security extraction. Since attackers cannot distinguish the true purpose of the two branches, the system can flexibly switch the roles of the branches in subsequent security proofs and eventually restore one of the branches to a strictly bound structure, thereby completing the reduction proof of the underlying difficult problem.

[0021] This invention dynamically observes attacker behavior during protocol execution and only determines the remaining secret structure when a threshold number is reached. Since multiple legitimate hidden states are always retained, the remaining internal states can be dynamically completed without changing any publicly available information, thereby avoiding the guessing losses in traditional solutions and achieving a fully compact security specification. Attached Figure Description

[0022] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0023] Figure 1 This is a flowchart of an adaptive secure two-wheel threshold signature method with fully compact security according to Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the structure of a computer device according to Embodiment 4 of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0025] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0026] Example 1 Threshold signatures are a core technology in distributed escrow and consensus mechanisms. However, achieving all of the following properties simultaneously under standard assumptions has remained an unsolved problem: a two-round protocol, offline execution of the first round, adaptive corruption security, and fully tight security reduction. Existing methods either sacrifice tightness, rely on stronger proof heuristics, or cannot handle the local signature randomness leaked during adaptive corruption.

[0027] Addressing the issues of existing threshold signature schemes, such as difficulty in achieving compact security under adaptive corruption models, excessive number of interaction rounds, and low efficiency due to security proofs relying on bifurcation lemmas, this embodiment provides an adaptive secure two-round threshold signature method with complete compact security.

[0028] The adaptive secure two-round threshold signature method with fully compact security provided in this embodiment is partially non-interactive, pairing-free, and can be instantiated based on the Matrix Decisional Diffie-Hellman (MDDH) assumption under a random oracle model; furthermore, its security reduction remains fully compact even in a multi-instance environment.

[0029] 1. Dual-mode commitment.

[0030] In existing two-round threshold signature schemes based on the Schnorr architecture, linear homomorphic bimodal commitments are typically used as the core component to avoid the random oracle query loss caused by forking Lemma. Bimodal commitments refer to a commitment mechanism that simultaneously possesses two computationally indistinguishable working states: Hiding Mode and Binding Mode. In Hiding Mode, the simulator can simulate the signing process and answer signature queries without possessing the real master private key; while in Binding Mode, the security reduction can extract the solution to the underlying hard problem from the final forged signature, thus completing the security reduction. In traditional schemes, bimodal commitments usually act directly on the first round of random group elements, i.e., committing to the random commitment value in the Schnorr protocol, and its basic form can be expressed as: ; Where C represents the commitment to R, R represents the elements of the first round of random group, U represents the commitment opening information, and A is the public commitment matrix.

[0031] However, this invention finds that in an adaptive corruption environment, the traditional bimodal commitment mechanism cannot meet true security requirements. This is because an adaptive attacker can not only observe the publicly available transcript but also corrupt the participants after protocol execution and obtain their internal states, including the random numbers used to generate commitment openings. Once the attacker obtains the opening information, the security requirements necessitate that the simulator not only ensure the publicly available commitment itself is indistinguishable from the actual execution but also guarantee that the conditional probability distribution of the commitment opening information remains consistent with the real system under known publicly available transcript conditions. Traditional bimodal commitments only guarantee the binding of commitments but cannot guarantee the consistency of the probability distribution of openings.

[0032] Specifically, in traditional bimodal commitments, the opening distribution differs fundamentally between hidden and bound modes. In bound mode, given a commitment, its opening is essentially uniquely determined; however, in hidden mode, the simulator typically relies on trapdoor information to randomly sample from multiple openings that meet the conditions. Therefore, even if the commitments generated in the two modes are computationally indistinguishable, an attacker, after obtaining the opening information through subsequent corruption, can still differentiate between real and simulated execution based on the difference in the conditional distribution of the openings. This means that traditional bimodal commitments are not suitable for truly adaptive corruption security scenarios.

[0033] To address the aforementioned problems, this invention proposes a novel bimodal commitment structure that supports opening simulation. The core idea is to shift the application of the bimodal structure from directly applying it to the first-round group elements to their opening information itself. Specifically, the following two-layer commitment structure is adopted: ; The commitment consists of two parts: the first part, commitment C, is used to fix the first round group element R; the second part, commitment S, further commits to the opening information U and V themselves. The commitment key ck is ( , ); , and The elements are the commitment keys. Through this design, the present invention shifts the simulation from "group element commitment" to "opening information," enabling the simulator to not only simulate public transcripts but also generate an opening conditional distribution that is completely consistent with the real protocol after subsequent corruption occurs.

[0034] Furthermore, this invention leverages the property that opening information only affects the attacker's view through specific affine combinations, ensuring that the opening distribution in real and simulated executions remains consistent in a conditional probability sense. In other words, even if the attacker subsequently obtains an internal random state, the observed opening distribution remains identical to that of the real system, thus making it impossible to distinguish between the real and simulated worlds using corruption operations. This mechanism fundamentally solves the problem that traditional bimodal commitments cannot support adaptive corruption and forms the core foundation for this invention to achieve fully compact adaptive secure threshold signatures.

[0035] 2. Masking mechanism.

[0036] This invention further introduces a masking technique for adaptive corruption security into the threshold signature protocol to address the problem that long-term secret shares are easily correlated and analyzed in traditional threshold signatures under multi-round sessions and gradual disclosure of random states. In traditional threshold signature schemes, each participant typically uses local response values ​​that are linearly related to the long-term secret share when generating local signature shares. Although a single signature does not directly reveal the private key, in an adaptive corruption environment, attackers can gradually obtain the internal random states, historical responses, and some hidden variables of different participants across multiple sessions, thereby creating cumulative constraints on the long-term secret share, ultimately compromising simulation consistency and affecting the tightness of the security protocol.

[0037] To address the aforementioned issues, in this invention, each participant's local signature value is first superimposed with a local mask random variable before being included in the public transcript, thereby re-randomizing the actual witness. The masks between different participants are generated correlatedly through pairwise negotiation or random oracle derivation, satisfying an overall weighted zero-sum relationship. Therefore, when finally aggregating using Lagrange coefficients, the local masks automatically cancel each other out, ensuring that the final aggregated signature still satisfies the original Schnorr verification equation and does not affect the protocol's correctness.

[0038] 3. Delay the release of the key.

[0039] Traditional threshold signature schemes, when proving security, typically require pre-guessing a key participant. This might involve assuming which user will ultimately be immune to attacker corruption, or predicting which signature request an attacker will ultimately use for forgery. If the guess is incorrect, the entire security protocol fails. This approach suffers significant security degradation as the number of participants and signatures increases, making it difficult to achieve truly high-strength security.

[0040] To address this issue, this invention proposes a delayed determination method. Instead of determining the complete signature information of all participants at the start of the protocol, this invention only fixes the information actually obtained by the attacker, temporarily reserving information not yet exposed and not generating it immediately. This allows the system to maintain flexibility for subsequent adjustments. As the attacker gradually obtains the signature data or internal states of some participants, this invention dynamically generates new partial signature data based on the currently disclosed information, ensuring that this data remains consistent with previously disclosed communication records. Since the attacker cannot uniquely determine the overall secret until a threshold number is reached, the system can retain this "on-demand generation" capability. Only when the attacker has access to a sufficient number of participants, leading to the imminent unique determination of the entire signature relationship, does this invention finally complete the generation of the final part of the data. Thus, the system does not need to predict in advance which participant will ultimately become the key participant, but rather naturally completes the entire signature structure based on the attacker's actual attack process.

[0041] By employing the above method, this invention avoids the security risks associated with traditional solutions that heavily rely on "pre-guessing," thus achieving a fully compact security specification. Simultaneously, this invention retains the advantages of two-round signatures and offline preprocessing of the first round, making it suitable for practical applications such as blockchain, multi-party escrow, and distributed identity authentication.

[0042] 4. Two branches.

[0043] This invention associates each signature session with two independent branches. Externally, both branches appear identical, making it impossible for attackers to distinguish which branch is used for simulation and which for final extraction. The first branch primarily handles protocol simulation. In this branch, the simulator can flexibly generate signature responses, commitment opening information, and corrupted internal states, ensuring that this data remains consistent with previously published communication records. Therefore, even if an attacker continuously initiates signature queries or dynamically corrupts participants during protocol execution, the system can still maintain consistent and secure simulation. This branch essentially acts as an "adapter to attacker behavior," addressing the signature simulation problem in an adaptive corruption environment. The second branch is used for final secure extraction. When the attacker outputs the final forged signature, this invention utilizes the other branch to reconstruct a strongly bound structure, enabling the system to extract solutions to underlying mathematical problems from the attacker-generated forged information, thereby completing the secure specification.

[0044] The key point of this invention is that the attacker never knows which branch is actually used for simulation internally, nor which branch is ultimately used for extraction. The two branches are generated symmetrically during protocol execution, and the externally observed data distribution is completely identical. Therefore, even if the attacker can adaptively choose the corruption object and query method, they cannot attack a specific branch. This avoids the problem of relying heavily on advance guessing in traditional schemes, and ensures that the entire security proof process incurs only constant-order losses, thus achieving a fully compact security reduction.

[0045] The adaptive secure two-round threshold signature method with fully compact security provided in this embodiment is as follows: Figure 1 As shown, it includes six stages: system initialization, key generation, first round of offline signing, second round of online signing, signature aggregation and signature verification.

[0046] Step 1, System Initialization: ; During the system initialization phase, output common parameters. This provides a common foundational environment for subsequent signatures and security proofs. The system first selects a prime-order cyclic group. Its order is and determine the group generator. Let the safety parameter be... The matrix dimension parameter is Then, several secret parameters are randomly generated: and output common parameters. .

[0047] Step 2, Key Generation: ; in, Indicates the key generation algorithm, Indicates the number of users. Indicates the threshold value. Represents the public key matrix. This represents the private key.

[0048] During the key generation phase, the number of users N and the threshold value t are input, and a global master secret is randomly generated. ,matrix Let be the MDDH correlation matrix, which is a block diagonal matrix, the first... Only the first column , The row is non-zero, corresponding to Define a linear function: ,in Further expand the matrix ,in For a randomly selected supplementary matrix, such that Satisfying the corresponding full-rank condition, for any Define its extended representation Then there is Therefore, the public key matrix is... .

[0049] The system uses the Shamir secret sharing method to share the master private key. Distribute to There are several participants. Therefore, each signatory... Private key share In addition, the system also provides for each pair of different participants Generate mask seed Participants Local masked seed Therefore, participants private key .

[0050] The specific steps are as follows: The master secret x is sampled, and the aggregated verification public key matrix is ​​obtained through this linear function. ; enter Number of users N, threshold value t, through Generate N user local mask seeds ; Perform Shamir threshold secret sharing on the master secret x, splitting it into N secrets ( , ,…, ); The complete private key for each user i is: ; Output the global aggregate public key and all N user private keys: .

[0051] Step 3, First round of offline signing: ; in, This represents the first round of signature algorithm. Indicates the first Each participating party Indicates the address of the participant. Indicates the first The private key of each participant Represents the set of signers. Indicates the first The first round of signature messages from each participating party Indicates the stage state.

[0052] One of the core innovations of this invention lies in the first-round signature stage. In traditional Schnorr threshold signatures, participants typically generate only a random value and its commitment. In this invention, each participant further splits its private key share into two hidden branches. In bimodal commitment signature schemes, the commitment key exists in two modes. Direct proof and reduction typically require guessing in advance which random oracle queries will be used for signing and which query will correspond to the final forgery, thus incurring a loss linearly related to the number of signature queries. Therefore, our invention does not directly use the private key share of each participant, but instead randomly splits it into two branches: a random value generated... , is the key share of one branch, and the key share of the other branch is The sum of the two branches equals the original secret share, but it is impossible for outsiders to determine which branch will be used in subsequent security proofs. Both branches will use their key shares for signing, and ultimately each signer's signature contains both Schnorr relations.

[0053] For each branch, the participants generate corresponding random values, public elements, and commitment information. These commitments are not ordinary commitments, but rather employ a special bimodal commitment structure. For the... Each signer, ignoring their subscript. Randomly generated , Select random value and To commit to open information, commit key Randomly generated For the commitment For this dual-mode commitment, there are two modes: In actual protocol execution, the commitment key will only be generated in one statistical binding method, i.e., randomly selected. , ,at this time ,matrix If the rank is full, then it is uniquely determined. , This makes it uniquely determined; in the simulation of signature lookup, the commitment key is switched to statistical hiding mode and randomly selected. ,at this time , emulator save Representative element , making ,then , So what is fixed is actually and In hidden mode, the emulator wants to... Open ,in The response generated by the simulator in the second round. The challenge is generated for the second round, so that the signature generated by the simulator can pass verification; and in the final forged extraction, it switches to binding mode.

[0054] This commitment not only hides internal information but also allows the system to dynamically generate valid open results in subsequent security proofs. In other words, even if an attacker corrupts the participants and obtains the internal state after signature execution, the system can still ensure that the previously disclosed commitment remains consistent with the subsequently exposed information, thus supporting adaptive corruption security.

[0055] Furthermore, this invention incorporates a dynamic mask into the commitment result. The mask is jointly generated by the participants using a shared random seed, and the masks of each participant satisfy an overall cancellation relationship. That is, all masks automatically cancel each other out after aggregation, thus not affecting the correctness of the final signature. Even if an attacker obtains a partial signature result, they cannot directly recover the true signature structure, thereby effectively reducing the risk of cross-session information leakage.

[0056] Since the first round of signatures is unrelated to the specific message, all participants can generate the first round of data offline in advance, completing preprocessing without waiting for the actual message to arrive, thus significantly reducing communication latency in the online signature phase. Therefore, the first round of messages includes the first... Each signer separately shares the public key for their two branches. and The promised value.

[0057] The specific steps are as follows: Get the Each participant's private key Randomly generated For one branch key share, the other branch key share is... ; Two sets of committed random numbers were sampled. and Intermediate random value ; : By calculating the key share of the two branches The corresponding public key share is obtained from the linear function. Calculate the intermediate random value between the two branches. The linear function is obtained ; Public key shares for the two branches respectively. Make a commitment, commitment key ,in Randomly generated and The opening information is a random value. ; Random values ​​for the two branches respectively Make a commitment, commitment key ,in Randomly generated and The opening information is a random value. ; The commitment of each participant is ; : To and The promise of open information; ; the commitment value Add the corresponding mask This refers to the first round of messages sent. ; Output the first The first round of signatures from each participating party Stage state .

[0058] Finally, the first round of signature messages is output.

[0059] Step 4, Second round of online signature: ; in, This indicates the second-round signature algorithm. Indicates the first One signatory, Indicates the signer's address. Indicates the first The status information of each signer. Signatory The first round of messages sent out, Represents the set of signers. The message indicates that you need to sign. Indicates the first Each signer signs the message.

[0060] In the second round of online signature phase, upon arrival of the message to be signed, each participant generates a partial signature response based on the first round's state, the aggregated challenge value, and their local secret share. Because the system had previously incorporated a dynamic mask, the publicly available partial signature response does not directly reveal the true secret structure. For the... Each signer, ignoring their subscript. Aggregate the commitments from the two branches respectively, and The pledges of the signatories will be aggregated separately, The commitments of the signers are aggregated individually, and a unified challenge is computed using a random oracle. Then generate a response. Then the responses will be... Public key shares First round of random values , promise to open information Add dynamic masking for transmission, where bits .

[0061] The specific steps are as follows: Input: The stage state of the first round of offline signature output Signatory The first round of messages ; definition Used to generate a mask; Regarding the first round of messages Using Lagrange coefficients Weighted aggregation is obtained ; Aggregate commitment This can be resolved to a share of the public key. and the first round of random values Aggregation of commitments; Hash to generate global challenge value: Generate the Fiat-Shamir challenge; the challenge value will be shared with the public key. The two branches respectively and The aggregate commitment, signer address ID, signer set S, and message m to be signed are bound together, so an attacker cannot directly swap the same response to another message or another signer set after receiving the response; ; : Separate public key shares and the first round of random values Add the corresponding mask and get and ; Calculate the signature response This is very similar to the Schnorr response, and with the corresponding mask, we get... ; Add a corresponding mask to the promised opening information. get ; Output the first The message is signed by a signer. The public key share after adding the mask First round of random values ,response , promise to open information and aggregation commitment This was sent as the second round of signature messages.

[0062] Step 5: Signature aggregation and signature verification.

[0063] Step 501, signature aggregation.

[0064] ; in, This indicates an aggregate signature algorithm. Indicates the signer's address. Represents the set of signers. The message indicates that you need to sign. Indicates the first The second message sent by the signer, that is, the first... The signatures of each signer, including the response. Public key shares First round of random values , promise to open information , of which bits Aggregation can be performed using Lagrange interpolation, for example, aggregating responses: , For aggregation response, The response after adding a mask to the signer. Similarly, by aggregating other information, the aggregated public key is obtained. ,polymerization Aggregate commitment opening information Aggregate commitment Full threshold signature .

[0065] The specific steps are as follows: Enter the first The message is signed by a signer.

[0066] Verify that the committed random numbers of all fragment signatures are consistent: ; For the The aggregate commitment sent by each signer in the second round of signing Define aggregate commitment ; ; ; ; : Public key shares for each signer First round of random values , promise to open information Signature response Using Lagrange coefficients The aggregate public key is obtained by weighted aggregation. ,polymerization Aggregate commitment opening information Aggregated signature response ; Obtain the aggregated public key ,polymerization Aggregated signature response Aggregate commitment opening information Aggregate commitment Full threshold signature .

[0067] Step 502: Signature verification.

[0068] ; in, This indicates the signature verification algorithm. Indicates the signer's address. Represents the set of signers. The message indicates that you need to sign. This indicates an aggregate signature.

[0069] During the signature verification phase, the verifier first recalculates the challenge value based on the public information, and then verifies the Schnorr relationship corresponding to the two hidden branches respectively. (A zero-knowledge proof mechanism based on the discrete logarithm problem) and a commitment-open relationship. The final threshold signature is only accepted when all verifications pass.

[0070] The specific steps are as follows: Input threshold signature The verifier receives the complete threshold signature, including the aggregate public key. ,polymerization Aggregated signature response Aggregate commitment opening information Aggregate commitment ; enter ; Aggregate commitment This can be resolved to a share of the public key. and the first round of random values The aggregation of commitments It can be interpreted as a pair and The promise of open information; Recalculate the commitment key using a random oracle. and ; Recalculate the unified challenge value from both commitment branches. ; : Check the aggregate public key of the two branches and Does it form a public key? ; Check whether the response relationship between the two branches holds true; Check public key shares Is the aggregation commitment correctly opened? : Check the random number Is the aggregation commitment correctly opened? Output 1.

[0071] The key innovation of this invention lies in its "delayed determination" mechanism. Traditional threshold signature security proofs typically require pre-guessing which participant will ultimately become the key target of an attack, leading to security losses. This invention does not pre-determine the target participant; instead, it dynamically observes the attacker's behavior during protocol execution, only determining the remaining secret structure when a threshold number is reached. Because the system always retains multiple legitimate hidden states, it can dynamically complete the remaining internal states without changing any publicly available information, thus avoiding the guessing losses of traditional solutions and achieving a fully compact security specification.

[0072] Furthermore, this invention employs a dual-branch hiding mechanism. The system internally maintains two symmetrical branches: one for adaptive security simulation and the other for final secure extraction. Since attackers cannot distinguish the true purpose of the two branches, the system can flexibly switch branch roles in subsequent security proofs and ultimately restore one branch to a strictly bound structure, thereby completing the reduction proof of the underlying difficult problem.

[0073] Example 2 The adaptive secure two-round threshold signature system with fully compact security provided in this embodiment includes: A key generation module is configured to generate a public key and a private key held by each participant, wherein the private key contains a secret share and a mask seed; The offline signature module is configured as follows: based on the public key and private key, each participant performs the first round of offline signature, generating the first round of signature message and stage status; in the first round of offline signature, each participant splits its own secret share into two hidden branches, generates corresponding random values, public elements and commitment information for the two hidden branches respectively, overlays a dynamic mask on the commitment information, and outputs the first round of signature message and stage status offline; The online signature module is configured to: upon receiving a message to be signed, the participating party calls the second-round online signature algorithm to generate a partial signature response based on the stage state and secret share generated offline in the first round; The aggregation module is configured to call the aggregation algorithm to aggregate all local signature responses and generate a complete threshold signature.

[0074] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.

[0075] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the adaptive secure two-round threshold signature method with fully compact security as described in Embodiment 1 above.

[0076] Example 4 This embodiment provides a computer device, such as... Figure 2 As shown, the system includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001. The processor 1001, communication interface 1002, and computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and send data. When the processor 1001 executes the program, it implements the steps in the adaptive secure two-round threshold signature method with fully compact security as described in Embodiment 1 above.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An adaptive secure two-round threshold signature method with fully compact security, characterized in that, include: Generate a public key and private keys held by each participant, wherein the private keys contain a secret share and a mask seed; Based on the public and private keys, each participant performs the first round of offline signing, generating the first round of signature messages and stage status. In the first round of offline signing, each participant splits its own secret share into two hidden branches, generates corresponding random values, public elements and commitment information for the two hidden branches respectively, overlays a dynamic mask on the commitment information, and outputs the first round of signature messages and stage status offline. Upon receiving the message to be signed, the participants invoke the second-round online signature algorithm, relying on the stage state and secret share generated offline in the first round, to generate a partial signature response; The aggregation algorithm is invoked to aggregate all local signature responses and generate a complete threshold signature.

2. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, Also includes: The verifier first recalculates the challenge value based on the public key, and then verifies the Schnorr relationship and commitment open relationship corresponding to the two hidden branches respectively. Only when all verifications pass is the complete threshold signature accepted.

3. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, The sum of the two hidden branches obtained from the split is equal to the original secret share.

4. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, The second round of online signature algorithm aggregates the commitments from the two hidden branches to compute the unified challenge.

5. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, The aggregation algorithm uses Lagrange interpolation.

6. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, The method for generating a public key is as follows: input the number of users and a threshold value, randomly generate a global master secret, and generate a public key based on the global master secret; The secret share is obtained by splitting the global master secret.

7. The adaptive secure two-round threshold signature method with fully compact security as described in claim 1, characterized in that, The dynamic mask is generated jointly by the participants using a random seed shared among them, and the masks of each participant satisfy an overall cancellation relationship.

8. An adaptive secure two-wheeled threshold signature system with fully compact security, characterized in that, include: A key generation module is configured to generate a public key and a private key held by each participant, wherein the private key contains a secret share and a mask seed; The offline signature module is configured as follows: based on the public key and private key, each participant performs the first round of offline signature, generating the first round of signature message and stage status; in the first round of offline signature, each participant splits its own secret share into two hidden branches, generates corresponding random values, public elements and commitment information for the two hidden branches respectively, overlays a dynamic mask on the commitment information, and outputs the first round of signature message and stage status offline; The online signature module is configured to: upon receiving a message to be signed, the participating party calls the second-round online signature algorithm to generate a partial signature response based on the stage state and secret share generated offline in the first round; The aggregation module is configured to call the aggregation algorithm to aggregate all local signature responses and generate a complete threshold signature.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the adaptive secure two-round threshold signature method with full compact security as described in any one of claims 1-7.

10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the adaptive secure two-round threshold signature method with full compact security as described in any one of claims 1-7.

Images