Threshold signature methods

Abstract

Each signer generates masks for each signer in a signing set, wherein the sum of the masks is equal to a predetermined number. The masks for each signer are summed with the random value to generate an

Description

Technical Field The present invention relates to threshold signature methods and one or more information processing apparatus for applying such methods. Background Recently there has been a National Institute of Standards and Technology (NIST) call for threshold schemes including signatures and encryption schemes. A threshold signature scheme is a special type of multiparty computation that aims to generate a digital signature. A threshold signature assumes that there are N signers, and that any threshold T of the N signers can sign a message but T - 1 cannot. In a world without quantum computers there are threshold signature solutions that are both practical and secure in highly adversarial environments. Examples of pre-quantum threshold signature schemes include implementations of e.g. the Schnorr, ECDSA, RSA, or BLS signature schemes. These signature schemes are well developed and include security features such as robustness, identifiable aborts, small round complexity, and backward compatibility with existing applications. In a world with sufficiently powerful quantum computers, cryptographic techniques need to be modified because the problems on which pre-quantum cryptographic algorithms are based will become solvable. There is a need for improved techniques for generating threshold signatures, which techniques may be applicable to both post-quantum and classical signature schemes. Summary According to a first aspect of the present invention, there is provided a threshold signature method performed by an information processing apparatus associated with a signer that has a secret share for generating a threshold signature, the method comprising: sampling a random value; generating masks corresponding to each signer in a signing set including the current signer, wherein the sum of the masks is equal to a predetermined number; summing the sampled random value and the mask for the current signer to generate a masked random value; deleting the random value and the share for the current signer; sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signer in the signing set; generating an overall random value by summing the masked random value and the received masks; using the overall random value to generate an individual contribution that is contribution to a threshold signature generated based on the signer’s secret share masked by the overall random value; wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated. In some implementations the predetermined number is zero. In such implementations, when the individual contributions are summed, the contribution of the overall random values formed by the masks is zero. In other implementations, the predetermined number is not zero. In such implementations, when the individual contributions are summed, the predetermined number is subtracted to remove the contribution to the overall random value formed by the masks. Sending a respective generated mask to each other signer using a secure channel may comprise communicating using an out-of-band communication channel. In some embodiments, sending a respective generated mask to each other signer using a secure channel comprises encrypting each mask for a destination signer in the signing set using a public key of a public key encryption mechanism. The mask may be encrypted by: sampling a nonce; extending the nonce to generate an extended nonce; encrypting the mask by XOR with the extended nonce to generate an encrypted mask; and encrypting the nonce with a public key of the destination signer. Generating masks by a signer may comprise randomly sampling masks for each other signer and setting the negative of the total of the randomly sampled masks to be sent to other signers as the value of the share for the signer. In such cases, the sum of the shares for the signer and each other signer is zero. Generating masks by a signer may comprise generating random seeds associated with each other signer, generating masks from the seeds using a pseudorandom number generator, and setting the negative of the total of the masks to be sent to each other signer as the value of the mask for the signer. In such implementations, the sum of the masks for the signer and each other signer is zero. The seeds may be strings having a length that is shorter than the length of each of the masks. The individual contribution may take the form of sum of the overall random value and a product of the Lagrange coefficient, the secret share, and a challenge that is generated based on a hash of the message. The method may further comprise sending a commitment that commits the signer to the sampled random value. The commitment may be formed by hashing a string that depends upon the sampled random value. The method may be performed by each of a threshold number of signers in a signing set. The signing set may comprise at least a threshold number of signers required to generate a threshold signature. The method may further comprise combining the individual contributions of a threshold number of signers to generate an overall contribution. The overall contribution may form part of the threshold signature. Sampling the random value, generating the masks, summing the sampled random value and the mask for the current signer, deleting the random value and the share for the current signer, and sending a respective generated mask to each other signer may happen in a first round or pre-processing stage of the method. Receiving masks from each other signer in the signing set, generating an overall random value, and using the overall random value to generate an individual contribution may occur in a subsequent round of the method. In addition to deleting the random value and the share for the current signer, the signer may delete the masks for all other signers after they have been sent using the secure channel. According to a second aspect of the invention there may be provided information processing apparatus comprising a processor and a memory, wherein the memory stores instructions that, when executed by the information processing apparatus, cause the information processing apparatus to perform a method comprising: sampling a random value from a distribution; generating masks corresponding to each signer in a signer set including the current signer, wherein the sum of the masks is equal to a predetermined number; summing the sampled random value and the mask for the current signer to generate a masked random value; deleting the random value and the share for the current signer; sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signers in the signing set; generating an overall random value by summing the masked random value and the received masks; using the overall random value to generate an individual contribution that is contribution to the signature generated based on the signer’s secret share masked by the overall random value; wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated. According to a third aspect of the invention there may be provided, a program that, when executed on an information processing apparatus, cause the information processing apparatus to perform a method according to the first aspect of the invention. Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 is a schematic diagram of components of an information processing apparatus; Figure 2 is a figure illustrating steps of a three-round post-quantum threshold signature scheme; Figure 3 is a figure illustrating a further step of the three-round post-quantum threshold signature scheme; Figure 4 is a figure illustrating steps of a three-round classical threshold signature scheme; Figures 5 is a figure illustrating generation of the signature generated by the three-round classical threshold signature scheme of Figure 4; Figure 6 is a figure illustrating verification of the signature shown in figure 5; and Figures 7 and 8 are figures showing steps of a two-round post-quantum threshold signature scheme. Detailed Description Digital signatures are a method of ensuring the authenticity and non-repudiation of electronic documents and messages. They are an important component of secure electronic communication and are widely used in applications such as electronic contracts, financial transactions, and email communication. The use of digital signatures offers several advantages over traditional paperbased signatures. First, they provide a higher level of security, as it is much more difficult to forge a digital signature than a handwritten signature. Second, they provide a greater level of assurance regarding the authenticity and integrity of the signed document or message, as any changes made to the original document will result in a different signature and thus an invalid signature. Typically, digital signatures may be verified by anyone with access to the signer's public key, the message to which the signature was applied, and the signature. Threshold signature schemes based on lattice assumptions and classical signature assumptions will be described below. The post-quantum threshold signature schemes assume that the Module Learning with Errors (MLWE) problem, the Module Short Integer Solution (MSIS) problem, and variants thereof are hard to solve. Preliminaries The signature schemes and encryption / decryption scheme described below may be performed on one or more information processing apparatus such as a server, computer, and / or mobile device. A central actor will be described below. The central actor may be a separate information processing apparatus, such as a server or cloud service, and other steps of the signature scheme may be performed on user devices associated with different signers in the signature scheme. In one example a group of signers in a group may wish to be able to sign a message as long as a threshold number T of the signers in the group contribute to the signature process. The signers may participate in the signature scheme using separate user devices. This applies similarly to a threshold decryption scheme, where each decrypting party may use a separate user device. In other implementations all the processing may be performed on a single information processing apparatus and there may be a single user. For example, a user may have a signing key associated with a cryptographic asset, such as an asset on a blockchain. The user may wish to keep the signing key secure and resistant to loss. Accordingly, the user may generate shares of the signing key and store them on different storage devices. In this case, the user may sign a document using the storage devices as long as the user has access to at least a threshold number of the devices. Similarly, a malicious actor would need access to a threshold number of the storage devices to apply the signature. In some implementations the storage devices may be drives, such as solidstate drives or the like. All steps of the method in this case could be performed on a single information processing apparatus based on information relating to the key shares stored on the storage devices. The description below will describe potential signers. However, the term ‘potential signer’ or ‘signer’ may be used interchangeably with the term ‘secret share’ because as just described, the method could be performed by a single user in respect of each secret share. Accordingly, the term ‘signer’ should not be interpreted as requiring a separate user or a separate information processing apparatus. Figure 1 is a schematic diagram of components of an example information processing apparatus 1 suitable for use in the embodiments described below. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 10, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processing apparatus 1 comprises a processor 11, a storage in the form of memory 12, a network module 13, a display 14, and a user interface 15. The network module may allow the information processing apparatus 1 to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 16. Further components may be provided but are not shown or described. The information processing apparatus may take the form of, among other things, a cloud infrastructure, a server, and loT device, or a portable or wearable computer. Any of the steps of the subsequently described methods may be performed by computer-readable instructions of one or more programs stored in a non-transitory storage and executed by a processor on one or more information processing apparatuses. First embodiment Figure 2 illustrates steps of a threshold signature method. The method is performed by a set of N signers, T of which are required to complete a threshold signature. Before the signature method begins, each of the N signers is provided with a secret key, ski. In some implementations, the secret keys may be generated by a central actor (e.g. an application on a server or cloud) and the keys are distributed to the N users. In other implementations, the secret keys may be distributed on a peer-to-peer basis with one of the group of Ausers generating the secret keys and distributing them. In this case, the member of the group of users may be referred to as the central actor. In more complicated implementations, the keys may be generated and distributed using multi-party computation techniques. For the purposes of this description, we assume that there is a central actor which may be a central server / cloud or one or more of the N signers. The central actor generates a uniform matrix, A, over a ring of polynomials, Rq. Rq is a ring of polynomials modulo q. The Ring, R, is defined for n and q as Z / (X” + 1) and Rqis defined as: The matrix, A, has dimensions of k by I and each entry in the matrix is a polynomial of The central actor generates a secret, s, from a distribution D. D is a distribution over Rq. The central actor uses Linear Shamir Secret Sharing to generate A secret shares, Si. In accordance with this method, a polynomial, P, with degree T-l, is generated over Rq. Tis the threshold number of shares required to perform the signature. The threshold number of shares, T, may be considered, in some examples, to be the number of active signers required to generate the signature. The polynomial at zero is equal to the selected secret s i.e. P(0) = s. The Shamir Secret sharing generates N secret shares from the polynomial, P. The value N is the number of secret shares to be generated where N is greater than or equal to T the threshold number of secret shares required to complete the signature process. The N secret shares are provided to a signing set of potential signers. Reconstruction of the polynomial P will be performed later. The reconstruction is performed using Lagrange polynomials. For i e SS, we define: n i~j jess / {i} where Ls; is a Lagrange coefficient. A set of evaluation points, E, is defined each having coordinates x,, s, for each of N different values of i (corresponding to the A secret shares). Si = P(xj) In this case: Accordingly, during the key generation process, each potential signer receives a respective secret share ski = Si. The lattice, A, is made available as a public parameter. The preliminaries just described are shown at the top of Figure 2 in a first portion 201. The following three sections illustrate steps of a three-round threshold signature scheme. In some implementations each round will be time limited such that each of a threshold number of active signers (hereinafter ‘signers’) of the N potential signers should complete the specified steps within the time limit. If the threshold number of signers do not complete the required steps for a round within the time limit, the signature method may be aborted. In a first round, each signer generates and makes available a commitment, cmti, and a mask, In a second round, each signer makes available an LWE commitment, Wi. In a third round, each signer makes available a response zi. The central actor can then generate a signed message based on the available information. At the end of each round the signers may check that the round has been completed before initiating steps in the subsequent round. In the first round, shown in portion 202 of Figure 2, each signer samples a small ephemeral randomness n and a small noise (or error), e-. Each sample is taken from a distribution across Rq. A Learning with Errors (LWE) commitment, wi, is generated based on the lattice A generated in the previously described key generation phase and the generated small ephemeral randomness, n, and small noise (error), e / , generated by the signer. The LWE commitment, Wi, is the sum of the small noise (error), e' and a product of the uniform matrix, A, and the generated small ephemeral randomness, n. A hash commitment, cmti, is generated. Each signer generates a hash using a function HCOm based on the identifiers of members of the signing set, SS, a message to be signed, M, and the generated LWE commitment, wi. The Hash function H is labelled ‘com’ to distinguish from other hash functions. The Hash function may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. Next a mask is generated from a function ‘ZeroShare()’. ZeroShare is applied to members of a signing set, SS, which may be any subset of the N signers that are involved in generating a threshold signature. The function ZeroShare is configured such that on summation of masks generated by the function ZeroShare for the subset, SS, formed of N or fewer signers, the sum outputs 0. As will be apparent from its construction below, all the generated masks (shares of zero) need to be summed for the sum to be equal to zero. 2>=° Jess In other words, ZeroShare outputs an additive sharing of the value 0. One way to generate such a share is to randomly sample (&j)jess / {i} and set = — Sjess / [i) where the notation) c SS / { i} indicates that j is an element of the signing set excluding the signer, i, who is generating the ZeroShare. To express this another way, each signer generates random values for the mask for every other user and then sets the negative sum of those values as their own mask. When all the masks (zero shares) over the signing set (including the signer who is generating the zero shares) are summed the value will by construction be zero. A more memory efficient method could be to sample random seeds (randy), generate A£ = PRG (randj) through a pseudorandom number generator PRG (e.g. SHA) and to set A£ = — S / ess / pyAy. Here, if each seed, rand, (a binary string), is shorter than Ay G Pg there may be an overall memory saving depending on the implementation. Following the generation of the masks, a masked ephemeral randomness, is generated as a sum of the ephemeral randomness n and the mask Af t that is the mask value that the signer generated for itself. The commitment, cmti, and mask, A^y, of each signer are made available. The commitments are made publicly available (i.e. available to all members of the signing set SS) whereas the masks are sent by a secure channel to each other party. Accordingly, each signer only receives the masks that were generated for it. The manner by which the mask is sent securely to each other party may vary from implementation-to-implementation but could include use of an out-of-band communication channel, encryption using the receiving parties public key in a public key infrastructure, or any other known mechanism for securely transmitting to a particular signer. In one efficient implementation, the signers in the signing set are part of a public key infrastructure and the signer sending the mask may sample a random nonce and encrypt it using a destination signer’s public key to generate a nonce ciphertext. ct <- PKE.Enc(pkj,nonce) The nonce is then extended to have the same length as the mask A£ y using a pseudo-random number generator, G. The mask can then be encrypted by XOR with the extended nonce to generate a mask ciphertext ctotp (one-time pad): ctotp = A£ y © G (nonce, i,j) G can be instantiated using standard cryptographic hash functions such as SHA. The signer i sends the nonce ciphertext and the mask ciphertext (ct, ctotp) to the destination signer. The destination signer can decrypt the nonce ciphertext using its private key, extend the nonce using the same pseudo-random number generator G, and recover the mask by XOR between the extended nonce and the encrypted mask. Each signer also receives from other signers in the signing set, SS, corresponding mask values that were generated in a similar way. In other words, each signer generates masks using the ZeroShare function and each signer receives a mask from each other signer. Each signer deletes their ephemeral randomness, n, and the masks that they generated once they have been sent. This is referred to as deleting the values from the signer’s state in Figure 2. In a second round of the three-round signature scheme, shown in the third portion 203 of Figure 2, each signer has securely received masks from each other signer in the signing set as noted above. Each signer generates an overall randomness, rt, by adding the masked ephemeral randomness, r^, to the sum of the received mask values. This step is illustrated in the second round in the implementation of the first embodiment. In other implementations, this step may be performed in the third round. A further check is made to ensure that the contributions from the first round are complete. If the commitments from the first round are complete, each signer shares their LWE commitment, wi, generated in the first round in a second contribution, contrib2. This may be shared generally (i.e. made public to the signing set) and does not need to be sent using a secure channel to each device separately. Of course, the communication may be secure within the group of signers. The bottom portion 204 of Figure 2 shows the third round of the signature method. Initially it is checked that the first and second rounds were successfully completed with contributions received from each of the signers. Each signer calculates an aggregated commitment, w, which is obtained by summing, across the signers in the signing set, the LWE commitments, wi, made available at the end of the second round. The aggregated commitment, w, may be subjected to bit dropping in accordance with the techniques described in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pino et al, 7th Feb 2024, EUROCRYPT 2024. The bit dropping is optional and may serve several purposes. The dropping of bits serves to make the commitment shorter and thus the resulting signature shorter and also serves to improve the resistance of the scheme from direct forgery attacks by hiding the ephemeral randomness in the aggregated commitment, w. The bit dropping is similar to the bit dropping technique that is used in connection with CRYSTALS-Dilithium and is not described here in detail. Each signer calculates a global challenge, c, that is a hash of the public key, vk, the message, M, and the aggregated commitment, w. Although not shown, the hash function used is Hraccoon. The Hash function H is labelled ‘raccoon’ to distinguish from other hash functions, such as the earlier ‘com’ hash function. Further details of the hash function are given further below. Each signer generates an individual contribution z;. The individual contribution is the sum of two components. The first component is a product of the global challenge, c, the signer’s Lagrange coefficient, Lssj, and the signer’s secret share, Si. The second component is the overall ephemeral randomness, that was generated in the second round. Each signer makes available their individual contribution, Zj, to the other signers. Figure 3 illustrates steps of a combine method performed by a central actor. The central actor obtains the LWE commitments, Wi, and individual contributions, Zi, generated by the signers, i. The central actor also obtains the public key, vk = (A,t), generated in the preliminaries shown in the first portion 201 of Figure 2. Here it is noted that t = As + e. The central actor generates an aggregated commitment, w. This step is the same as was performed by each of the signers in the third round described above. The aggregated commitment, w, is obtained by summing, across the signers, the LWE commitments, Wi, made available at the end of the second round. The aggregated commitment may be subjected to bit dropping as mentioned above. The central actor generates an aggregated response, z, by summing each of the individual contributions, Zi, made available at the end of the third round. The central actor then generates a global challenge, c. The global challenge, c, is generated by hashing the public key, vk, the message to be signed, M, and the calculated aggregate commitment, w. The hash is generated using a function Hraccoon. The Hash function Hc is labelled ‘raccoon’ to distinguish from other hash functions, such as the earlier ‘com’ hash function used to generate the commitment. The Hash function may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KM AC, TupleHash and Parallel Hash. In a further example, SHAKE described in NIST publication FIPS PUB 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions may be used. The Hash functions HcOm and Hraecoon should preferably be different, at least in the parameters used. The selection of different hash functions has the effect of domain separation and may improve the security of the signature scheme. A noisy commitment, y, is generated by the central actor. The noisy commitment, y, is generated from the difference of two components. The first component is a product of the uniform matrix, A, and the aggregated response, z. The second component is a product of the global challenge c, and t = As + e generated in the preliminaries. The calculated difference is subjected to bit shifting to multiply the value by two to the power Ut. The noisy commitment may then subject to bit dropping as mentioned above. A hint, h, is generated by the combine method. The hint is a difference between the aggregated commitment, w, and the noisy commitment, y. The signature of the message, M, is provided. The signature includes three components: the global challenge, c, the aggregated response, z, and the hint, h. Public parameter vt is referred to above. These are again described in more detail in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pino et al, 7th Feb 2024, EUROCRYPT 2024. In general, it is desirable to maximise the value of ut in order to drop more bits. This has the beneficial effect of shortening the bit sizes. However, security of the scheme against direct forgery attack decreases with increased ut. Accordingly, while different values of ut can be selected, in some examples, they may be chosen as follows: Vt ■ aw / lk|j T is the threshold number of users as identified above, aw is the standard deviation of the distribution used to select the error when generating the public key, and c is the global challenge. In a typical implementation, around 80% of the bits may be dropped when generating the noisy commitment, y. After forming the threshold signature a further party, who may or may not be a member of the signing set, can verify the signature. The party verifying the signature is assumed to also have a copy of the message, M, which has been signed and against which the signature is being checked. The party also has a copy of the public key, vk. Other public parameters described above, including ut, and the hash function, Hraccoon, are also available to the verifying party. The signature can be verified by checking that: c' = H(yk, M,Az — c.t + / i) c' = c If c' is equal to the challenge value c, the signature is verified. If c' is not equal to the challenge value c the signature is not verified. In other words, a signature derived value is a product of the uniform matrix, A, and the aggregated response, z, minus a product of the global challenge, c, and t = As + e from the public key. The signature derived value may be subjected to bit dropping of uw bits (not shown) and has the hint, h, added to it. A new challenge value, c', is calculated by taking a hash of: the public key, the message, and the signature derived value after bit dropping and addition of the hint. A further check is performed to see that a vector formed of a concatenation of the aggregated response, z, and the hint, h, is shorter than, B. The shortness of the vector relates to the module short integer solution (M-SIS) problem. B is the two-norm bound on the signature and is set larger than zero and less than q (recalling from above that the uniform matrix is a set of polynomials of modulo q). B should be set to a large enough value for the M-SIS problem to allow the signer to realistically find a signature. On the other hand, B should be set small enough to provide security with respect to the M-SIS problem. More information may be found in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pino et al, 7th Feb 2024, EUROCRYPT 2024. Further details on setting a suitable value of B may be found, for example, in Chitchanok Chuengsatiansup, Thomas Prest, Damien Stehle, Alexandre Wallet, and Keita Xagawa. ModFalcon: Compact signatures based on module-NTRU lattices, ASIA ACCS 20, pages 853 to866. In one example: In which I, k, q are defined in the Module Short Integer Solution problem, q is the modulo of the Ring, k and / are dimensions of the Ring, n is the order of polynomials of the Ring (see definition above). The parameter "0" is related to an algorithm called BKZ (block Korkine-Zolotarev). An approach to solve MSIS is via the BKZ algorithm. 0 is a parameter of the BKZ algorithm. The success probability and the running time of BKZ are both increasing functions of 0. Accordingly, the equation above guarantees that BKZ can only succeed with reasonable probability if 0 is set large enough. Accordingly, 0 can be set so that the running time required for BKZ to break the security of the signature scheme is too large to be tractable and the value B can be determined accordingly. A feature of the above method is that the overall ephemeral randomness, is generated at each signer based on a sum of the ephemeral randomness, ri, which is being masked, and the received masks (zero shares) and the mask (zero share) generated by the signer for itself. When the aggregated response, z, is generated in the combine method, all the masks are combined. By virtue of the masks being shares of zero, when they are added together they sum to zero leaving the sum of the ephemeral randomness, H, of each signer. By using this technique, if a state of a signer leaks, the masked randomness, f^, or the overall ephemeral randomness, rt, do not leak secret parameters of the threshold signature method. Accordingly, the masks add a layer of security known as adaptive security. Adaptive security provides security even against adversaries that can arbitrarily chose which signers to corrupt after observing all the communication channels. Second embodiment The ZeroShare technique was described above in connection with a postquantum threshold signature scheme. However, the technique is more generally applicable and may be used with classical threshold signature schemes as well. Figure 4 is a diagram showing steps of a classical threshold signature scheme. As before we assume that there are A signers, T of which are required to generate a signature. We also assume that there is a central actor which may be a central server / cloud or one of the N signers as described above. In a preliminary stage 401 a value a is sampled and a public key vk is generated, where a is the value of a secret key, sk. The value g is made a public parameter. In the following, letters indicated with a lower case (e.g., a, z) are over a ring (Zp, +, X), the values indicated by upper case letters and the verification key (e.g., R, vk) are over a “multiplicative” group (G, x). The central actor uses Linear Shamir Secret Sharing to generate A secret shares, ai. In accordance with this method, a polynomial, P, with degree T-l, is generated over zp. 7’is the threshold number of shares required to perform the signature. The threshold number of shares, T, may be considered, in some examples, to be the number of active signers required to generate the signature. The polynomial at zero is equal to the selected secret a i.e. P(0) = a. The Shamir Secret sharing generates A secret shares from the polynomial, P. The value A is the number of secret shares to be generated where A is greater than or equal to T the threshold number of secret shares required to complete the signature process. The A secret shares are provided to a set of potential signers. Reconstruction of the polynomial P will be performed later. The reconstruction is performed using Lagrange polynomials. For i c SS, we define: Lss.i | | jess / {i] where Lss,; is a Lagrange coefficient. A set of evaluation points, E, is defined each having coordinates Xi, st for each of A different values of i (corresponding to the A secret shares), ai = P(xi) In this case Accordingly, during the key generation process, each potential signer receives a respective secret share ski = a,. In a first round of the signature scheme shown in portion 402 of Figure 4, each signer samples an ephemeral randomness, n. Each signer generates a nonce, Ri, that is the public parameter, g, to the power of the ephemeral randomness, n. A commitment, cmti, is generated that is a hash of the identities of parties in a signing set, the message, M, and the nonce, Ri. As with the first embodiment, the hash function is designated Hcom to distinguish it from other hash functions used. The hash function may be a hash function such as BLAKE or SHA. Next a mask is generated from a function ‘ZeroShare()’. As with the first embodiment, the function ZeroShare is configured such that on summation of masks generated using ZeroShare over the signing set, SS, formed of N or fewer signers, it outputs 0. In other words, ZeroShare outputs an additive sharing of the value 0. The method for generating masks (zero shares) described in the first embodiment are equally applicable to the second embodiment and the description is not repeated. A masked ephemeral randomness, is generated as a sum of the ephemeral randomness n and the mask that is the mask value that the signer generates for itself. The commitment, cmti, and mask, of each signer are made available. The commitments are made generally available (made public to the signing set) whereas the masks are sent by a secure channel to each other party. How the mask is sent securely to each other party may vary from implementation-to-implementation but could include use of an alternative communication channel, encryption using the receiving parties public key or other known mechanism for securely transmitting to a particular signer. The techniques for secure communication described in connection with the first embodiment are equally applicable to the second embodiment. Each signer also receives from other signers in the signing set, SS, corresponding mask values that were generated in a similar way. In other words, each signer generates masks using the ZeroShare function and each signer receives a mask from each other signer. Each signer deletes their ephemeral randomness, n, and the masks generated using ZeroShare. This is referred to as deleting the values from the signer’s state in Figure 4. In a second round of the three-round signature scheme, shown in the third portion 403 of Figure 4, each signer has securely received masks from each other signer in the signing set as noted above. Each signer generates an overall randomness, rt, by adding the masked ephemeral randomness, to the sum of the received mask values. A further check is made to ensure that the contributions from the first round are complete. If the commitments from the first round are complete, each signer shares their nonce, Rt, generated in the first round in a second contribution, contrib?. This may be shared generally and does not need to be sent using a secure channel to each device separately. Of course, the communication may be secure within the group of signers. The bottom portion 404 of Figure 4 shows the third round of the signature method. Initially it is checked that the first and second rounds were successfully completed with contributions received from each of the signers. Each signer calculates an aggregated nonce, R, which is obtained by forming a product, across the signers, of the nonces, Ri, made available at the end of the second round. Each signer calculates a global challenge, c, that is a hash of the public key, vk, the message, M, and the aggregated nonce, R. Although not shown, the hash function used is Hciass. The Hash function H is labelled ‘class’ to distinguish from other hash functions, such as the earlier ‘com’ hash function used to generate the commitment. Each signer generates an individual contribution Zi. The individual contribution is the sum of two components. The first component is a product of the global challenge, c, the signer’s Lagrange coefficient, Lss,i, and the signer’s secret share, ai. The second component is the overall ephemeral randomness, rL, that was generated in the second round. Each signer makes available their individual contribution, Zj, to the other signers. Figure 5 shows steps of an aggregation phase performed by a central actor. The individual contributions shared in the third round are summed to generate an overall contribution, z. The nonces shared in the second round are multiplied together to generate an overall nonce, R. The signature is formed of the overall nonce and the overall contribution (z, R). Figure 6 shows steps of a method for verifying the signature. The signature may be verified by any party regardless of whether they are a member of the signing set. The party generates a challenge, c, by taking a hash of the public key, vk, the message, M, and the overall nonce, R. The hash function, H, and public key, vk, are known to the verifying party because these are made available as public parameters. The message, M, is known because the signature is being checked against the message. The signature is checked by checking the equality: gz = vkc x R where g and the public key, vk, are public parameters. If the equality holds true then the signature is verified. Third embodiment The first and second embodiments relate to three-round signature schemes. The third embodiment relates to a two-round signature scheme. Figures 7 to 8 illustrate a two-round threshold signature scheme in which the commitments take the form of a vector and can be generated in a pre-processing process before a single stage signature process. Figure 7 is a figure illustrating three processes: a setup process (Setup), a key generation process (KeyGen), and a pre-processing process (PP). The Setup process starts in step 1 by defining a polynomial Ring, A. The polynomial ring is of the same type as described in the first embodiment. In step 2, parameters of the polynomial ring and the signature scheme are denoted tspar. The object tspar includes details of the polynomial ring A, the number .Visa number of users, and the number T of signers required to complete a signature. In step 3, tspar is made available to all members of the signer group and the central actor. The central actor is defined as for the first two embodiments. In the key generation process, KeyGen, the parameters of tspar are parsed in step 1. In step 2, the central actor generates a secret, s, from a distribution Dt. Dt is a Gaussian distribution over Rq. Accordingly, s is a sampled polynomial modulo q. Similarly, a small error, e, that is small relative to the lattice of the ring A such that t will be close to a polynomial in the polynomial Ring A. In step 3, t is defined as the learning with errors (LWE) problem t = 2. (As+e). In the particular example shown, the LWE problem includes a multiple 2. However, in other implementations this term may be varied. The LWE problem is subject to bit dropping by an amount Ut. In steps 4 to 6 Shamir secret sharing is performed to generate a secret share, Si, for each user of N users. The polynomial is of degree T-l such that T secret shares are enough to reconstruct a polynomial P. The value of the polynomial P at 0 is equal to 2 times the secret, s. In step 7, a public key, vk, is defined which is the parameters of the polynomial ring and signature scheme, tspar, and the LWE problem, t. In step 8, a secret key, ski, is defined for each user in the signer group. The secret key, ski, is the secret share, Si, for the user. In step 9, the public key is made available. Each user receives a respective secret key, ski. The secret keys are not made publicly available or available to other users in the signer group. Accordingly, each user only receives their secret share, Si. The preprocessing (PP) process is performed by at least each user in a signing set of T users. The steps of the PP process do not require use of the message to be signed, M. Accordingly, the PP process may be performed as an offline process prior to signature in the Sign process. In step 1 of the PP process, the user parses the public key, vk, to obtain tspar and the LWE problem, t. In step 2, the user parses tspar to obtain the ring A, the number of users N and the threshold number of users T. In steps 3 to 5, a number, rep, of commitment values indicated by index h are generated by each user, rep is a number that is selected such that |T|rep-1 >2A. The parameter X is selected according to the number of bits of desired level of security. Accordingly, for 128-bit security, X is set to 128. T is a set of signed monomials, defined as (-1)^.^1( / ),06(0,1} x [n].In a subsequent signing step, random weights 0 will be generated that are elements of the set of monomials. Accordingly, rep, is a number of individual commitments, Wi,b, that are generated and rep is selected to ensure a large enough range of possible random weights and hence to the security of the scheme. In step 4, rep randomness, n.b, and associated errors, e'i.b are sampled using a Gaussian distribution. In step 5, each user generates individual commitments Wi.b, which are a product of the randomness and the polynomial Ring, A, plus the error. The individual commitments, Wi,b, are concatenated into an individual commitment vector, , in step 6. The rep randomness values, n,b, also form a rep randomness vector. In step 7, a maskA^- is generated from a function ‘ZeroShare()’. As with the first and second embodiment, the function ZeroShare is configured such that on summing of masks generated by ZeroShare over any subset of the signing set, SS, formed of N or fewer signers, it outputs 0. 2>=° jess Techniques for generating a mask have been described in connection with the first and second embodiments are applicable and will not be repeated here. The rep randomness vector, n,b, has the mask value Aiib that the signer has created for themselves added to it to generate a masked rep randomness vector, r^b. The original rep randomness vector, n,b, and the mask value are then deleted. The individual commitment vector is set as a token ppsid,i. The individual commitment vector and the masked rep generated randomness, r^b, form a state stsid. The token and state are returned from the preprocessing process. In step 11, the masks, are sent by a secure channel to each other party. The options for securely sending the masks discussed in the first and second embodiment are applicable and are not repeated here. Figure 8 shows steps of a signature process, Sign, performed by each signer and an aggregation process, Agg, that may be performed by the central actor, and a signature verification process, Verify, performed by a party receiving the signature. The Sign process is performed by each signer in a signing set, SS, of at least T users. The user first parses the secret key, ski, in step 1. In step 2, the user parses the state, stsid. Step 3 includes a series of checks and identifies that the Sign process is performed by users in a signing set, SS, that is a subset of the set of N user devices. The index i is used to indicate each user in the signing set, SS. The state is checked to ensure that each user in the signing set has performed the pre-processing method. In step 4, the user device obtains the individual commitment vectors from the tokens from other users in the signing set. In step 5, a commitment, ctnt, is generated that is a concatenation of a session id, the identity of users in the signing set, the message to be signed, M, and the individual commitment vectors of all users in the signing set. In step 6 a series of rep random weights, 0b having index b, are generated using a random oracle, such as a Hash function, G. G, which maps, {0, 1}* —> {IJxT^p-1 is used to aggregate the individual commitments into one commitment. In the preprocessing process each user outputs rep commitments and G is used in steps 9 and 10 to aggregate them. The hash function G may be a hash function of the type that appears in Fiat-Shamir based signatures, such as CRYST ALS-Dilithium and Schnorr signatures. The hash function G takes the public key, vk, and the commitment, ctnt, as inputs. Steps 9 and 10 aggregate the commitments. In step 9, the rep components of each individual commitment vector are summed together using the random weights generated in step 9 to generate an aggregated commitment per user, wj. The aggregated commitments per user are then summed over the users in the signing set in step 10 to generate an overall commitment, w. The overall commitment, w, is subject to bit dropping by uw bits. In step 11, an overall randomness is generated as the sum of the masked randomness, rQ, and the received masks that were sent via a secure channel. In step 12, a challenge, c, is generated using a hash function, H. The hash function H is different from hash function G. The hash functions may be derived from a single hash function using appropriate domain separation. The challenge is generated by taking a hash of the public key, vk, the message, M, and the overall commitment, w. In step 13, an individual contribution, Zi, is generated. The individual contribution is formed as a sum of two terms. The first term is a product of the challenge, c, a Lagrange coefficient, Lss,i, associated with the device and the secret shared stored by the device, Si. The second term is a sum over b of the random weights, Pb, and the overall randomness, r^. In step 14, the state, stsid, is set to null. In step 15, an individual signature contribution, ,is returned by each user. The individual signature contribution comprises the overall commitment, w, and the individual contribution, Zi. The aggregation process, Agg, shown in Figure 8 is a combine operation performed by the central actor. In step 1, the central actor obtains the public key, vk = (tspar,t), generated in the key generation phase. Here it is noted that t = 2.(As + e). In step 2, tspar is parsed to retrieve the polynomial ring, A, the number of users, N, and the threshold number of users for signature, T. At step 3, the individual signature contributions, sig^^, are parsed to retrieve the overall commitment, w, and the individual contribution, Zi. At step 4, the central actor generates a final commitment, w. The final commitment, w, is obtained by summing, across the signers, the overall commitments, Wi, included in the individual signature contributions. The final commitment is subjected to bit dropping in accordance with a parameter, uw, which is a parameter that is made openly available to signers using the signature method. At step 5, the central actor generates an aggregated response, z, by summing the individual contributions, Zi. At step 6, the central actor generates a global challenge, c. The global challenge, c, is generated by hashing the public key, vk, the message to be signed, M, and the total commitment, w, calculated in step 4. The central actor generates the hash using a function H. The Hash function may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. In a further example, SHAKE described in NIST publication FIPS PUB 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions may be used. In step 7, a noisy commitment, y, is generated by the central actor. The noisy commitment is generated from the difference of two components. The first component is a product of the polynomial ring, A, and the aggregated response, z. The second component is a product of the global challenge c, calculated in step 6, and t = 2.(As + e) generated in the key generation phase. The calculated difference is subjected to bit shifting to multiply the value by two to the power ut. This is a renormalization to allow for bit dropping. The noisy commitment is then subject to bit dropping by uw bits. Both ut and uw are public parameters. At step 8, a hint, h, is generated by the central actor. The hint is a difference between the total commitment, w, and the noisy commitment, y. At step 9, the signature of the message, M, is provided. The signature includes three components: the global challenge, c, the aggregated response, z, and the hint, h. Public parameters ut and uw are referred to above and may be generated as described in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pino et al, 7th Feb 2024. As the signature generated by the third embodiment is the same as that generated in the first embodiment, the verify process shown in Figure 8 is the same as that previously described. The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. For example, the techniques are equally applicable to a classical two-round threshold signature scheme such as a two-round Schnorr threshold signature (coined FROST in FROST: Flexible round-optimized Schnorr threshold signatures, Chelsea Komlo and Ian Goldberg, SAC 2020, volume 12804 of LNCS, pages 34^65. Springer, Heidelberg, October 2020). The described embodiments are based on the case where the masks are shares of the value zero. It will be apparent that the methods could be modified to provide a share of another predetermined number, which could be a public parameter, and that the predetermined number could then be subtracted in the aggregation phase. This is a simple variation of the techniques described above. The case in which the masks sum to zero is preferred because it is not necessary to include the extra step of subtracting the predetermined number. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

1. A threshold signature method performed by an information processing apparatus associated with a signer that has a secret share for generating a threshold signature, the method comprising:sampling a random value;generating masks corresponding to each signer in a signing set including the current signer, wherein the sum of the masks is equal to a predetermined number;summing the sampled random value and the mask for the current signer to generate a masked random value;deleting the random value and the share for the current signer;sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signer in the signing set;generating an overall random value by summing the masked random value and the received masks;using the overall random value to generate an individual contribution that is contribution to a threshold signature generated based on the signer’s secret share masked by the overall random value;wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated.

2. A method according to claim 1, wherein the predetermined number is zero and wherein when the individual contributions are summed, the contribution of the overall random values formed by the masks is zero.

3. A method according to claim 1, wherein the predetermined number is not zero, wherein when the individual contributions are summed, the predetermined number is subtracted to remove the contribution to the overall random value formed by the masks.

4. A method according to any preceding claim, wherein sending a respective generated mask to each other signer using a secure channel comprises communicating using an out-of-band communication channel.

5. A mask according to any preceding claim, wherein sending a respective generated mask to each other signer using a secure channel comprises encrypting each mask for a destination signer in the signing set using a public key of a public key encryption mechanism.

6. A method according to claim 5, wherein the mask is encrypted by:sampling a nonce;extending the nonce to generate an extended nonce;encrypting the mask by XOR with the extended nonce to generate an encrypted mask; andencrypting the nonce with a public key of the destination signer.

7. A method according to any preceding claim, wherein generating masks by a signer comprises randomly sampling masks for each other signer and setting the negative of the total of the randomly sampled masks to be sent to other signers as the value of the share for the signer, whereby the sum of the shares for the signer and each other signer is zero.

8. A method according to any of claims 1 to 6, wherein generating masks by a signer comprises generating random seeds associated with each other signer, generating masks from the seeds using a pseudo-random number generator, and setting the negative of the total of the masks to be sent to each other signer as the value of the mask for the signer, whereby the sum of the masks for the signer and each other signer is zero.

9. A method according to claim 8, wherein the seeds are strings having a length that is shorter than the length of each of the masks.

10. A method according to any preceding claim wherein the individual contribution takes the form of sum of the overall random value and a product of the Lagrange coefficient, the secret share, and a challenge that is generated based on a hash of the message.

11. A method according to any preceding claim, wherein sampling the random value, generating the masks, summing the sampled random value and the mask for the current signer, deleting the random value and the share for the current signer, and sending a respective generated mask to each other signer happen in a first round or preprocessing stage of the method.

12. A method according to claim 11, wherein the receiving masks from each other signer in the signing set, generating an overall random value, and using the overall random value to generate an individual contribution occur in a subsequent round of the method.

13. A method according to any preceding claim, wherein in addition to deleting the random value and the share for the current signer, the signer deletes the masks for all other signers after they have been sent using the secure channel.

14. An information processing apparatus comprising a processor and a memory, wherein the memory stores instructions that, when executed by the information processing apparatus, cause the information processing apparatus to perform a method comprising:sampling a random value from a distribution;generating masks corresponding to each signer in a signer set including the current signer, wherein the sum of the masks is equal to a predetermined number;summing the sampled random value and the mask for the current signer to generate a masked random value;deleting the random value and the share for the current signer;sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signers in the signing set;generating an overall random value by summing the masked random value and the received masks;using the overall random value to generate an individual contribution that is contribution to the signature generated based on the signer’s secret share masked by the 5 overall random value;wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated.10 15. A program that, when executed on an information processing apparatus, causethe information processing apparatus to perform a method according to any of claims 1 to 13.

Images