Secret share generation

Abstract

To provide a method for generating shares of a shared secret.SOLUTION: A computer-implemented method of generating shares of a shared secret, each of a group of participants having a respective first secret share of the shared secret, the method comprising the steps, performed by a first participant of the group, of generating a respective blinded share of the shared blinded secret, and obtaining at least a threshold number of respective intermediate shares from each of the first group of participants, wherein: Generating a respective intermediate share based on the respective blind share and the respective first secret share, generating an intermediate value based on each of the obtained intermediate shares, and generating a respective second secret share of the shared secret, wherein the respective second shared secret is generated based on the intermediate value and the respective blind share.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a method for generating shares of a shared secret. For example, the method may be used to generate new shares of a shared secret key. [Background technology]

[0002] In general, a shared secret may be used to share a data item that is distributed among a group of participants, each of whom has a different share of the secret. Typically, the secret can only be reconstructed if a certain number of participants (called the "threshold") make their shares available to be combined, e.g., to compute the secret.

[0003] Public key cryptography is a type of encryption system that uses a key pair: a private key known only to the owner of the private key, and a public key that is generated based on the corresponding private key and can be distributed without compromising the security of the private key.

[0004] Public key encryption allows a sender to encrypt a message using the recipient's public key (i.e., the public key that corresponds to a private key known only to the recipient). The encrypted message can only be decrypted using the recipient's private key.

[0005] Similarly, a sender can use their own private key to sign a message, e.g., to prove that the message was sent by the sender and / or to indicate that the sender agrees to the message. A signer (i.e., the party generating the signature) uses their private key to create a digital signature based on a message. Creating a digital signature based on a message means providing the message and the private key to a function that generates a signature based on both the message and the private key. The signature is appended to (e.g., tagged with) or associated with the message. Anyone who has the signer's corresponding public key can use the same message and the message's digital signature to verify whether the signature was validly created, i.e., whether the signature was actually created using the signer's private key. Digital signatures not only ensure the authenticity of the message, but also ensure message integrity and non-repudiation. That is, they can be used to prove that the message has not been altered since it was signed and that the signature creator cannot deny in the future that they created the signature.

[0006] Digital signature schemes typically involve three steps, or algorithms: a key generation algorithm is used to generate a random private key and the corresponding public key; a signing algorithm is used to generate a signature based on the message and the private key; and a verification algorithm is used to verify that, given a public key and a message, the signature was generated using the corresponding private key and according to the signing algorithm.

[0007] A common use of a shared secret is as a shared secret in a private / public key pair. That is, the private key can be distributed among a group of participants so that no single participant has access to the private key. Therefore, no single participant can generate a valid signature for a message. Instead, some or all of the participants must jointly generate the private key in order to generate a signature.

[0008] Instead of sharing secret key shares to generate signatures, participants may use threshold signature schemes. A threshold signature scheme allows a threshold number of participants in a group to create digital signatures based on a message using their individual shares of a shared secret key, without allowing any of the participants to use the private key. Here, a digital signature is a signature generated based on the message being signed. In such a scheme, a signature can be created only if a threshold number of participants agree to generate a signature on the message. Attempting to generate a signature using a small number of participants will not produce a valid signature. Therefore, a valid signature by a group (i.e., a signature generated using a message and a shared secret key) proves that there was a threshold number of people who agreed to generate the signature. This also means that an adversary would need to obtain a threshold number of shares of the private key to forge a signature with that private key. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] WO2017145010A1 Summary of the Invention [Means for solving the problem]

[0010] There are scenarios in which it is desirable to be able to generate new shares of a shared secret without changing the shared secret itself. For example, one or more participants who have respective shares of a shared secret may leave the group of participants, making their respective shares unavailable to reconstruct the shared secret or to perform computations using those shares, e.g., to generate signature shares in a threshold signature scheme. Or, as another example, some shares of the secret may become unavailable not as a result of a participant leaving the group, but as a result of being lost or compromised. Those shares may need to be replaced. As another example, the group of participants may expand to include one or more additional participants, who therefore require their own shares of the shared secret.

[0011] Similarly, there are scenarios in which it is desirable to change the shared secret threshold, i.e., to change the number of secret shares required to reconstruct the shared secret. For example, increasing the shared secret threshold may improve the security of the shared secret because a malicious party would need access to more shares to reconstruct the shared secret. This is particularly important when the shared secret is a private key used to encrypt data or control access to resources.

[0012] According to one aspect disclosed herein, there is provided a computer-implemented method for generating shares of a shared secret, the method comprising the steps of: generating respective blind shares of a shared blind secret, the method being executed by a first participant of a group of participants, each of the participants having a respective first secret share of the shared secret; obtaining at least a threshold number of respective intermediate shares from each of the first group of participants, each intermediate share being generated based on the respective blind share and the respective first secret share; generating an intermediate value based on each of the obtained intermediate shares; and generating respective second secret shares of the shared secret, each second shared secret being generated based on the intermediate value and the respective blind share.

[0013] The scheme may be used to generate new shares of the shared secret to increase or decrease the number of participants with valid shares of the shared secret, where a valid share may be considered valid in the sense that it is one of the second secret shares, and only use of the second secret share by the entire group of participants results in a valid computation.

[0014] The scheme may also be used to generate new shares of the shared secret to change the threshold of the shared secret, with the second share of the shared secret having a different threshold compared to the first share of the shared secret.

[0015] Lost or compromised shares may be replaced in the current scheme. If an "old" share is compromised, the present invention renders it useless because other participants in the scheme will only use the new share. Thus, an attacker must "begin again" in the sense of attempting to compromise another share.

[0016] As mentioned above, shared secrets are often used in the context of private keys, i.e., a private key may be a shared secret. More generally, a shared secret may be any data that requires a threshold number of people to reveal it or perform more computations with it.

[0017] For example, the data could be medical data or other such personal data, preferably without sharing the actual data (e.g., biometric or genetic data associated with an individual). Sharing the medical data in the form of a shared secret allows calculations (e.g., statistical analysis) to be performed using the data without revealing the sensitive data. If one or more of the participants in the scheme is the owner of the data, the owner can approve or deny access to the data, as the owner must participate in the calculation of the results. Other participants with shares can perform calculations using the data and obtain the results without knowing their individual secrets. The present invention allows the owner of the data to update their shares to "remove" other participants from the scheme.

[0018] Another use case for updating a shared secret is for a group of participants to create multiple "schemes" using the same shared secret, thereby increasing the security of the shared secret. Participants can create a shared secret and then reissue the shares multiple times, or rounds. As a result, all participants have multiple shares of the same shared secret that can be combined with shares from other participants corresponding to the same "scheme" or "round" to discover the secret. If these shares are all stored together, an attacker not only needs to attack multiple locations (i.e., participants), but also needs to figure out the correct combination of shares.

[0019] To facilitate an understanding of embodiments of the present disclosure and to show how such embodiments may be carried into effect, reference will now be made, by way of example only, to the accompanying drawings, in which: [Brief explanation of the drawings]

[0020] [Figure 1] 1 illustrates a schematic diagram of an exemplary system for updating shares of a shared secret, in accordance with an embodiment of the present invention; [Figure 2] FIG. 2 illustrates schematically an exemplary method for updating shares of a shared secret, according to an embodiment of the present invention. [Figure 3] FIG. 1 illustrates a schematic diagram of an exemplary system for generating a signature for a message, in accordance with some embodiments of the present invention. [Figure 4] FIG. 2 illustrates a schematic diagram of an exemplary method for generating a signature share of a message, according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0021] preface Although the following examples are described with respect to elliptic curve cryptography, the invention is not limited to any particular cryptography scheme and may be generally applied to any cryptography scheme, for example, RSA or other public key cryptography schemes.

[0022] Elliptic Curve Group The elliptic curve E satisfies the following equation: y 2 =x 3 +αx+b mod ρ In the above equation,

[0023]

number

[0024] and α, b are 4α 3 +27b 2 ≠ 0. The group on this elliptic curve is the identity element, the point at infinity.

[0025]

number

[0026] The group operation on elements in this group is called the addition of points on the elliptic curve and is denoted by +.

[0027]

number

[0028] and its degree is denoted by n.

[0029] We can use this group operation to define another operation on elements called point multiplication, denoted by .

[0030]

number

[0031] and Scala

[0032]

number

[0033] Then the point k·G is defined as the point G added to itself k times.

[0034] In elliptic curve cryptography, the private key is a scalar

[0035]

number

[0036] is defined as,

[0037]

number

[0038] is a notation for the set {1, ..., n-1}, and the corresponding public key is the point k·G on the elliptic curve. For example, in some blockchain protocols, the elliptic curve is chosen as the secp256k1 elliptic curve, and the values ​​α, b, and ρ are fully specified by this curve. The degree n of this group is calculated taking these values ​​into account, and is prime in the case of this curve. The secp256k1 standard also specifies the point G to be used as the generator of this group.

[0039] Elliptic Curve Digital Signature Algorithm To create a signature on the message msg using the private key α, the following steps are performed: 1. Compute the message digest e = hash(msg), which can be any hash function. For example, in some examples, hash(msg) = SHA256(SHA256(msg)), where SHA256(■) is the SHA-256 hash function. Note that instead, the message may be hashed once or more than once, using the same or different hash functions. 2. Choose a random integer k∈{1,…,n-1}, where n is the degree of the elliptic curve, e.g., the secp256k1 curve. In the following, k is called the ephemeral private key. 3. This temporary secret key k·G=(R x , R y ) to calculate the ephemeral public key. 4. γ = R x Calculate mod n. If γ=0, go back to step 2. 5. Temporary key k -1 Calculates the multiplicative inverse of mod n. 6.s=k -1 Calculate (e+αγ) mod n. If s=0, go back to step 2. 7. The signature of message msg is (γ, s).

[0040] The ephemeral key must be kept secret, otherwise it would be possible to calculate the private key given the message and the signature. Furthermore, a different ephemeral key must be used each time a signature is generated; otherwise, it would be possible to derive the private key α given two different signatures and their corresponding messages.

[0041] Given a message msg, a public key P = α · G, and the corresponding signature (γ, s), the signature can be verified by completing the following steps: 1. Compute the message digest e=hash(msg), e.g., e=SHA256(SHA256(meg)). 2. Multiplicative inverse s of s modulo n -1 Calculate. 3.j1=es -1 mod n and j2=γs -1 Calculate mod n. 4. Calculate the point Q = j1·G + j2·P. 5.

[0042]

number

[0043] If it is the point at infinity, the signature is invalid. 6.

[0044]

number

[0045] If Q = (Q x , Q y ) and u=Q X Calculate mod n. If u=γ, the signature is valid.

[0046] In a threshold signature scheme, this private key α is divided into key shares that are distributed among participants in a threshold scheme group.

[0047] Jointly verifiable random secret shares Suppose N participants want to create a shared secret that can only be regenerated by at least (t+1) participants in the scheme. To create the shared secret, the following steps are performed: 1. Participants agree on a unique label for each participant, i. Each participant, i, receives (t+1) random numbers.

[0048]

number

[0049] In the above equation, ∈ R is a set

[0050]

number

[0051] means the randomly generated elements of

[0052]

number

[0053] is the notation for the set {1, ..., n-1}. Then, each participant, for i=1, ..., N, calculates a secret polynomial of degree t f i (x)=α i0 +α i1 x+...+α it x t mod n Note that from now on we will omit the mod n notation, and it is assumed that all arithmetic operations on integers are done modulo n. 2. Each participant i, for example, communicates with participant j only using a secure communication channel to exchange values ​​f i (j) is sent to participant j. 3. Each participant i computes its own secret share of the shared secret polynomial as follows:

[0054]

number

[0055] The shared secret share is (i, α i ), where i is a participant label in the scheme. As explained in steps 1-3, this method for creating α secret shares is defined herein as follows: for participant i, α i =JVRSS(i). Note that "JVRSS" is usually an abbreviation for "Joint verification random secret sharing," which also includes steps 4 and 5. However, throughout this specification, JVRSS will be interpreted to mean performing at least steps 1 through 3, with steps 4 and 5 being optional steps.

[0056] Now that a participant has generated a shared polynomial, other participants can each verify that they have shared the correct information with all participants and that all participants have the same shared polynomial. This is done in the following way: 4. Each participant i generates an obfuscated coefficient α for k=0, …, t. ik · Broadcast G to all participants. 5. Each participant i is responsible for determining whether each participant j is responsible for j (i) By calculating G and verifying it, we can find the polynomial point f j Check that you have calculated (i) correctly.

[0057]

number

[0058] If all participants find that this formula applies to each polynomial, the group can collectively confirm that they all created the same shared polynomial.

[0059] Reconstructing the Shared Secret Suppose a participant wishes to reconstruct a shared secret α, which is the zeroth degree of a shared polynomial. This polynomial is (1, α1),…,((t+1), α t+1 ), to find the shared secret α, we compute

[0060]

number

[0061] This is derived from a general formula known as "Lagrange Interpolation".

[0062] Public Key Calculation N zeroth-order private polynomial coefficient public keys α for i=1,...,N, shared in step 4 of JVRSS i0 Given G, each participant corresponds to a shared secret α

[0063]

number

[0064] to calculate the shared public key P.

[0065] Adding a Shared Secret To compute the addition of two shared secrets shared among a group of N participants, where each secret polynomial has degree t, without any entity knowing the individual secrets, the following steps are performed: 1. Generate a first shared secret α, where participant i’s share is α for i=1,…,N. i =JVRSS(i), where the threshold is (t+1). 2. Generate a second shared secret b, where participant i’s share is b i =JVRSS(i), where the threshold is (t+1). 3. Each participant i calculates their own contribution share νi =α i +b i mod n. 4. All participants will receive a cumulative share of i broadcast to all other participants. 5. Each participant will receive a share of i Interpolate at least (t+1) of the above and calculate the following: ν=interpolate(ν i , …, ν t+i )=α+b

[0066] This method of adding a shared secret is denoted by ADDSS(i) for participant i, and each participant i knows v = (α + b).

[0067] Product of the shared secret To compute the product of two shared secrets shared among a group of N participants, each with a secret polynomial of degree t, the group performs the following steps: 1. Generate a first shared secret α, where participant i’s share is α for i=1,…,N. i = JVRSS(i). The degree of the shared secret polynomial is t, meaning that (t+1) participants need to recreate it. 2. Generate a second shared secret b, where participant i’s share is b i =JVRSS(i), and the degree of the shared secret polynomial is also t. 3. Each participant earns their own multiplicative share μ using i Calculate. μ i =α i b i 4. All participants receive a multiplicative share μ i broadcast to all other participants. 5. Each participant receives a share of μ i Interpolate at least (2t+1) of the above and calculate: μ=interpolate(μ i ,…,μ 2t+1 )=αb.

[0068] This method for computing the product of two shared secrets is denoted herein by μ=αb=PROSS(i) for participant i.

[0069] The reciprocal of the shared secret To calculate the inverse of the shared secret α, the following steps are performed: 1. All participants compute the product PROSS(i) of their shared secrets, the result of which is μ = αb mod n. 2. Each participant calculates the modulo inverse of μ, and the result is: μ -1 =(αb) -1 mod n 3. Each participant i computes its reverse secret share by computing:

[0070]

number

[0071] This method of computing the inverse of the shared secret is

[0072]

number

[0073] is shown by

[0074] Generating and verifying a shared secret key To compute the shared secret key α among N ≥ 2t+1 participants, t+1 of them need to create a signature, and the participants run JVRSS using the t+1 threshold and public key computation as described above. As a result, all participants i=1,...,N share the secret key α i and have a corresponding shared public key P = (α·G).

[0075] Generating ephemeral key shares To generate the temporary key shares and corresponding γ, as required in the signature, perform the following steps using a group of size N and a shared secret α of threshold (t+1): 1. Shared secret

[0076]

number

[0077] ,(t+1) ,shares ,are ,needed ,to ,recreate ,the ,inverse ,shares ,of ,(t+1) ,shares. 2. Each participant has k i Using the obfuscated coefficients shared in the verification of

[0078]

number

[0079] Calculate Calculate γ = x mod n. 3. Each participant i

[0080]

number

[0081] Remember.

[0082] Adding secrets with different thresholds In the case of secret addition of degrees t and t', the addition of two secrets requires a number of shares of max(t, t') + 1 to compute it. The reason behind this is that the additional step of sharing the secret shares creates shares of a new polynomial. This new addition polynomial is equivalent to the result of adding the individual polynomials of the two shared secrets. When adding two polynomials, the corresponding coefficients are added at each degree of x. Therefore, the degree of the addition polynomial must be the same as the highest degree of the two polynomials. This can be generalized to the addition of three or more polynomials, in which case the degree of the resulting polynomial is the same as the degree of the individual polynomial with the highest degree.

[0083] When the addition of two secrets with different thresholds is computed, the security of the secret with the higher threshold is reduced. This is because if the result (α + b) is known for respective thresholds t, t', assuming t < t', α can be computed with t shares and then (α + b) - α = b can be computed, and thus the value b is computed with only t shares. This lower threshold is hereinafter referred to as the "implicated threshold" of b.

[0084] Multiplication of secrets with different thresholds In the case of multiplying two secrets with thresholds t and t', the multiplication calculation requires t + t' + 1 shares. In this case, when multiplying the shares of two polynomials, shares of a new polynomial are obtained. Since this new polynomial is the result of multiplying the two individual polynomials, the degree of the result is the addition of the degrees of the two individual polynomials.

[0085] Multiplication can also be generalized to any number of shared secrets, and the resulting threshold is the sum Σ of the individual thresholds plus 1 ρ t ρ + 1, where ρ is applied to the individual shared secrets.

[0086] Similar to addition, multiplying two secrets with different thresholds results in a related threshold of the secret with the higher threshold. As described above, if the threshold of α is t and the threshold of b is t' and αb is known, and t < t', both α and b can be calculated with t shares. First, calculate α using (αb)α -1 and find b using only t shares of the secret.

[0087] Combine the addition and multiplication of shared secrets into one step To calculate any combination of addition and multiplication in one step, the above can be generalized. Assume a group of N participants wants to calculate the result αb + c, where α, b, and c are shared secrets with thresholds (t α +1), (t b +1), and (t c +1) respectively. There is a condition that max(t α + t b , t c ) < N, that is, the number of participants in the scheme must be greater than the maximum between the degree of the secret c and the degree of the multiplication result of the secrets α and b. 1. Each participant i calculates the secret shares α i = JVRSS(i), b i = JVRSS(i), c i = JVRSS(i) with thresholds (t α +1), (t b +1), and (t c +1) respectively. 2. Each participant i calculates the share λ i = α i b i + c i . 3. Each participant i shares the result λ i with other participants. 4. Each participant interpolates max(t α + t b , t c ) + 1 shares to find the result λ = int(λ1,..., λ i ,...) = αb + c.

[0088] This is done in the calculation of the shared signature according to some embodiments below:

[0089]

number

[0090] This is basically the interpolation for

[0091]

number

[0092] and

[0093]

number

[0094] In this case, t α +t b = 2t and t c = t, and interpolation is max(t α +t b , t c )+1=2t+1 shares.

[0095] Secret Share Generation Figure 1 illustrates an exemplary system 100 for implementing an embodiment of the present invention. As illustrated, the system 100 includes multiple parties (hereinafter also referred to as "participants") 102. Although only three participants 102 are shown in Figure 1, it should be understood that in general, the system may include any number of participants. Each of the participants 102 operates a respective computing device.

[0096] Each of the respective computing devices of each participant 102 comprises a respective processing unit, e.g., one or more central processing units (CPUs), accelerator processors (GPUs), application-specific processors, and / or field-programmable gate arrays (FPGAs), comprising one or more processors. Each computing device may also comprise memory, i.e., computer-readable storage in the form of a non-transitory computer-readable medium. The memory may comprise one or more memory units using one or more memory media, e.g., magnetic media such as hard disks, electronic media such as solid-state drives (SSDs), flash memory, or EEPROMs, and / or optical media such as optical disk drives. Each computing device may comprise at least one user terminal, e.g., a desktop or laptop computer, a tablet, a smartphone, or a wearable device such as a smartwatch. Alternatively or additionally, each computing device may comprise one or more other networked resources, such as cloud computing resources, accessed via the user terminal (cloud computing resources comprising resources of one or more physical server devices implemented at one or more sites). It will be understood that any act described as being performed by a party of system 100 may be performed by a respective computing device operated by that party.

[0097] Each of the participants 102 is configured to transmit data to one, some, or all of the other participants 102 over the Internet, using a LAN or WAN connection, or via alternative wired or wireless communication means. Unless the context requires otherwise, reference to a participant 102 transmitting data may be understood as transmitting the data to the other participants 102 individually, e.g., via a secure communication channel between a first participant 102a and a second participant 102b, or broadcasting the data to the entire group via email or other means. Again, unless the context requires otherwise, each participant 102 may transmit data in raw or encrypted form. For example, the data may be encrypted using the receiving participant's public key before being transmitted to the receiving participant.

[0098] One, some, or all of the participants have (e.g., have stored in memory) their respective shares of the shared secret. The participants who have their shares of the shared secret are collectively referred to as a first group of participants. In some examples, one or some of the participants may not have their respective shares of the shared secret. For example, their respective shares may have been lost (e.g., the memory storing the secret share may have been corrupted) or stolen. The participants who do not have their shares of the shared secret are collectively referred to as a second group of participants.

[0099] A shared secret is actually a data item that is "secret" in the sense that it is preferably kept private, i.e., not publicly accessible. A shared secret may be, for example, a shared secret key of a public / private key pair. In the following examples, the shared secret will be referred to as a shared secret key. In these examples, the shares of the shared secret will also be referred to as private key shares. However, it should be understood that these are merely examples.

[0100] Techniques for generating shares of a secret key (and shared secrets in general) are well known to those skilled in the art.

[0101] Preferably, the first participant 102a uses a Joint Secret Sharing Scheme (JVRSS), e.g., using the JVRSS technique described above, to generate a first private key share α of the private key α. i For example, the first participant 102a may have index 1 and generate a first private key share using α1=JVRSS(1) for participant 1, where the private key is denoted by α. Each participant 102 may generate a respective private key share α i For example, the second participant 102b may generate a second private key share for participant 2 using α2=JVRSS(2), and so on.

[0102] Generating the first secret key share α1 using a joint secret share scheme involves a set of numbers

[0103]

number

[0104] and then generating the first polynomial f1(x)=α 10 +α 11 x++α 1t x t mod n, where the set of numbers are the coefficients of the polynomial. Each of the other participants 102 may generate a respective polynomial using a respective set of numbers. For example, the second participant 102b may generate a second polynomial f(x)=α 20 +α 21 x++α 2t x tmod n. The participant 102 then transmits to each other participant the value of the respective function evaluated at the other participant's index. For example, the first participant 102a evaluates f1(2) for the second participant 102b and then transmits that value to the second participant 102b, evaluates f1(3) for the third participant 102c and then transmits that value to the third participant 102c, and so on. The first participant 102a obtains the respective values ​​generated by the other participants 102 as a function of the first participant's index. The values ​​may be transmitted via the Internet or via other means. The values ​​may be transmitted between each pair of participants via respective secure communication channels. Instead of transmitting directly, one or more participants 102 (e.g., the first participant 102a) may broadcast their respective values. Upon obtaining at least a threshold number of values ​​from at least a threshold number of participants, the first participant 102a generates a first secret key share based on the first values ​​and the mutually obtained data values, e.g., f2(1), f3(1), etc.

[0105] The first participant 102a may calculate a corresponding public key α·G based on the set of obfuscated coefficients, where the coefficients are the respective private key shares α of each participant 102. i is used to generate the temporary secret key share k i When generating ij The participants 102 may share the obfuscated coefficients α with each other participant 102. The coefficients are obfuscated by a common generation point G on the selected elliptic curve. These obfuscated coefficients may be transmitted directly between the participants 102 or may be broadcast to the group. For example, the first participant 102a may share the obfuscated coefficients α with each other participant 102. 10 ·G, α 11 ·G, α 12 ·G, etc. Then the public key corresponding to the private key can be calculated as follows:

[0106]

number

[0107] Private key share α i It should be understood that generating a corresponding public key is not required to generate a .SIGMA.ID, and thus this is an optional feature that a participant 102 may implement if they choose.

[0108] Private key share α i It should be noted that, can be generated using other methods, i.e., without using the JVRSS method described above. Methods for generating private key shares are known per se in the art. Similarly, methods for distributing shares of a private key (or other such data) are known per se in the art. That said, the private key share α i can be generated in a variety of ways, for example using Shamir's secret sharing scheme to generate a secret key share α i A dealer (e.g., a trusted one of the participants 102 or an independent party) may be used to generate and distribute one, some, or all of the private key shares α i One such scheme that can be used to generate and distribute .

[0109] Regardless of the particular method used to generate the private key shares, each of the first group of participants 102 will receive a respective private key share α of the private key α. i has (e.g., stores)

[0110] Each participant 102 in the new scheme (i.e., a scheme with new shares of the secret key) generates a respective blind key share of the shared blind key. The blind key share is used to obfuscate, or "blind," or "hide," another key share. That is, a blind key share is applied to a first key share to hide the first key share, allowing the resulting key share to be shared without revealing the first key share. In a simple example, the first key share might be 100 and the blind key shares might be 74, allowing for 174 shares to be shared. Here, without knowing that the blind key shares are 74, the recipient cannot reliably know the first key share. It should be understood that in practice, the key shares can be much larger.

[0111] Recall that "key shares" and "key" are used for brevity and can generally be replaced by "secret shares" and "secret," respectively. In practice, "shares" and "keys" can be large numbers. These participants 102 (hereafter referred to as the "new group") may include only participants from the first group of participants, or may include participants from a combination of the first and second groups of participants.

[0112] Preferably, the blind key share κ i may be computed using a joint secret sharing scheme, e.g., using the JVRSS technique described above. For example, the first participant 102a has index 1 and has κ for participant 1. i = JVRSS(1), where the blind key is denoted by κ. Each participant 102 may generate a blind key share κ i For example, the second participant 102b may generate a second blind key share for participant 2 using κ2=JVRSS(2), and so on.

[0113] Generating a blind key κ1 share using a joint secret sharing scheme comprises the same steps as described above for generating a private key share α1, except that the random number used to generate the blind key share κ1 is a different number than the one used to generate the private key share α1.

[0114] Private key share α i Similarly, alternatives to JVRSS may be used when generating the blind key share κ1.

[0115] The first group of participants 102 (i.e., their respective private key shares α i At least a threshold number of participants (with their respective blind key shares and their respective private key shares α i Based on this, the intermediate key share ν i That is, generate the intermediate key share v i is the blind key share and the secret key share α i Only participants 102 that are part of the first group of participants 102 have a private key share α i Since this intermediate key share ν i Note that we can generate intermediate key shares v i Note again that ∑ can generally be any secret share and is not specifically limited to being a key or private key.

[0116] In some examples, the intermediate key share v i is the sum of the blind key shares and the private key shares, i.e., ν i =α i +κ i However, the intermediate key share v i Alternatively, for example, ν i =α i It is not excluded that it can be calculated as -κ.

[0117] Intermediate key share ν iThe participants 102 who calculated i Send the intermediate key share v i may be sent directly between pairs of participants 102, may be broadcast generally to a new group of participants 102, or may be made public in some other way.

[0118] Each new group of participants 102 receives multiple intermediate key shares v i Each of the new group of participants 102 then obtains a number of intermediate key shares v i That is, the intermediate key v is calculated based on multiple intermediate key shares v i For example, each participant in the new group of participants 102 receives an intermediate key share v i can be interpolated.

[0119] Then, upon obtaining the intermediate key v, each of the new group of participants 102 acquires the intermediate key v and the blind key share κ i Based on the secret key α, a new share (e.g., an updated share) α i ', i.e., a new share α of the private key α i ' is the intermediate key ν and the blind key share κ i is a function of

[0120] In some examples, the new private key share α i ' is the sum of the intermediate key shares and the private key shares, i.e., α i '=ν-κ i However, the new private key share α i ' is another way, for example, α i '=ν+κ i It is not excluded that it can be calculated as follows.

[0121] In general, the intermediate share ν i Using the first operation to generate the second secret share κ i is the first secret share α iand then the intermediate share v to generate the intermediate key v i Then, a new share of the first secret, α i To find ', we use the intermediate key ν and the second secret share κ i The inverse of the first operation is performed on

[0122] Now, each of the new group of participants 102 has a new share of the private key. The new group of participants 102 may include participants 102 who did not previously have a share of the private key (i.e., the new group comprises participants 102 from the second group), or the new group may include only participants 102 from the first group of participants 102.

[0123] New share α of private key α i The threshold of ' is the blind share κ i The blind share κ is determined based on the threshold value of i is the new share of the private key, α i The private key share α is i Alternatively, the new share α of the private key α may have the same threshold as i ' threshold is the previous share α i The blind share κ is set to be higher than the threshold of i is the private key share α i may have a higher threshold than the blind share κ i The opposite is also true if has a lower threshold.

[0124] When a new share is "issued", the method for creating the shared secret is the same as the old share α i and the new share α i '. If we try to combine old and new shares, the calculation will give us the wrong share. Therefore, this calculation is done by using the old share α i or each participant gets a new share α i' works only if the adversaries are not aware of the shared secrets. When shares are updated, an element of trust in other participants may be required to use the new shares as well. Any user attempting to use an old share may be considered an adversary, such as would have been considered an adversary before the share was updated or reissued. As long as there are fewer "adversaries" than the minimum threshold in the scheme (i.e., the minimum of the thresholds before and after the share update), the scheme is secure because any attacks an adversary could perform will be caught and / or the adversary will simply be excluded from the scheme. Thus, there is no incentive to attack the scheme. The only problem occurs when there are more adversaries than the threshold, but this is not a new problem and is generally present in shared secret schemes.

[0125] 2 illustrates an exemplary method 200 performed by a participant 102 of the scheme. This method may be used to add or remove a participant 102 from the shared secret scheme in the event of a loss of a share, or alternatively. Additionally or alternatively, this method may also be used to change the threshold of the shared secret. The new share α i To issue ', the following steps are performed:

[0126] In step S201, each participant in the old scheme acquires a share α of a private key α, for example, using JVRSS. i was generated.

[0127] In step S202, each participant in the new scheme calculates the blind share κ using threshold (t+1). i =JVRSS(i). Note that other methods for generating key shares may be used.

[0128] In step S203, the old share α i At least (t+1) participants 102 each have an intermediate secret share v i =α i +κ i Calculate the secret key share α iand the blind key share κ i An alternative function may be used.

[0129] In step S204, these participants 102 broadcast the intermediate secret shares to all participants 102.

[0130] In step S205, all participants 102 calculate the intermediate share v=interpolate(v1,...,v t+1 ) = α + κ (t+1) to compute the blinded secret.

[0131] In step S206, each participant generates his or her new secret share α i '=ν-κ i =(α+κ)-κ i Depending on the function used in S203, the intermediate key ν and the blind key share κ i An alternative function of may be used.

[0132] These new secret shares can be used in the same way as the old secret shares, and any calculations done with them will result in the old shared secret. The previous method of updating the shares was to simply add a second polynomial with a degree 0 term, i.e., a constant term of zero. As a result, we are not changing the shared secret, which is defined to be of degree 0. This means that a secret key with a threshold of 2 cannot be updated without increasing the threshold, because we cannot perform JVRSS on a secret with a degree 1 polynomial and a zeroth degree of zero.

[0133] The security of a threshold signature scheme can be improved in two ways using share updates. First, if a share is found to be compromised, a participant 102 in the scheme can immediately use this method to render the share useless. Alternatively, the group running the scheme can agree to update the shares intermittently, so that an attacker would have to attack multiple locations within a specific time frame. This means that the scheme is secure over the long term. More generally, each participant in a new scheme can perform steps S202 through S206 periodically, or upon request from one of the participants 102.

[0134] Note that in the case of share loss, shares can only be reissued if at least (t+1) shares are still known. Furthermore, when removing a participant 102, the number of remaining participants 102 must be at least (t+1), otherwise there will be fewer shares than necessary to create the secret. Note that step S204 cannot be passed unless there are at least (t+1) participants, since (α+κ) cannot be calculated with fewer than (t+1) shares. This also applies when changing the threshold to a higher threshold; i.e., the scheme requires at least that threshold number.

[0135] As mentioned above, the threshold for the shared secret α may be changed. The method 200 of Figure 2 may be implemented to generate a new shared secret threshold for (t'+1) for the same secret α, and participants 102 then generate new shares using this threshold in the following manner:

[0136] In step S201, each participant in the old scheme receives a share α of the private key α. i , whose shares have a threshold of t+1.

[0137] In step S202, all participants 102 in the scheme calculate the blind share κ of threshold (t′+1). i =JVRSS(i),

[0138]

number

[0139] The highest of the two thresholds is labeled by .

[0140] In step S203, at least

[0141]

number

[0142] Participant 102 of the i =α i +κ i Calculate the secret key share α i and the blind key share κ i An alternative function may be used.

[0143] In step S204, these participants 102 broadcast their intermediate secret shares to all other participants 102.

[0144] In step S205, all participants 102 receive a blind secret

[0145]

number

[0146] Calculate.

[0147] In step S206, each participant generates his or her new secret share α i '=ν-κ i =(α+κ)-κ iDepending on the function used in S203, the intermediate key ν and the blind key share κ i An alternative function of may be used.

[0148] These new secret shares have a threshold of (t'+1), and interpolation over the threshold number of shares yields the shared secret α. When this is then used in a signature calculation (e.g., as described below), if the temporary key has a threshold of t, then the new signature shares will have a threshold of t+t'+1.

[0149] In some embodiments, the number of shares of the private key α, α i Both the threshold value of ' and the private key α can be changed.

[0150] Note that security can only be increased if a threshold number of "stale" shares are provably removed: we need to ensure that enough shares are removed so that the number of remaining shares is less than the stale threshold.

[0151] Suppose the secret has a threshold of t+1 and is increased to t'+1, where t'>t. Suppose there are n shares. Then, to increase security, it needs to be proven that there are less than t+1 old shares remaining, i.e., the scheme needs to make sure that there are fewer old shares than the threshold still present. This is because in that case there is no way to compute the secret with the old shares. If there are still t+1 old shares present, security remains at t+1, since these can be used to compute the secret, even if there are also new shares with a higher threshold. Security is based on the minimum number of shares required to compute the secret.

[0152] Participant 102 of the new scheme will receive a new share α i It can be verified that ' was computed correctly. This is done by adding the public keys corresponding to each secret and comparing them with the public key corresponding to the result of the addition.

[0153] As explained in the introduction above, the method for generating each secret α, κ provides enough information to compute the public key. Therefore, after computing the public key, the participants know α·G, κ·G. To verify the result, each participant may perform the following steps: 1. Calculate (α·G) + (κ·G) 2. Use (α+κ) to calculate (α+κ)·G 3. Compare these results to ensure they are the same.

[0154] Furthermore, if a participant 102 finds an incorrect result, the participant can determine which shares are incorrect. To do this, the participant 102 determines α i G and κ i Then, the participant 102 stores α i G and κ i Since we know G, the verification is the same as above. i +κ i Since we know that ∑ ...

[0155] As mentioned above, the new share α i ' can be used as part of a threshold signature scheme, i.e., the new share α i ' may be a private key share of the private key α. The present invention can be used to update a participant's share of the private key underlying the signatures of a signature scheme. The new share α i The number of ' may change and / or new private key shares α i The threshold may be subject to change.

[0156] Figure 3 shows the new private key share α i3 illustrates an exemplary system 300 for implementing a threshold-optimal signature scheme, e.g., a threshold-optimal ECDSA scheme, using '. Note that if old shares are used, the generated signature will be the same as the signature generated using new shares. As illustrated, system 100 comprises a coordinator 101 and a plurality of participants 102, including a group of participants 102. While only three participants 102 are shown in FIG. 3, it should be understood that in general, a system may comprise any number of participants. Furthermore, although in FIG. 1, coordinator 101 is shown as separate from participants 102, in some embodiments, coordinator 101 may be one of participants 102, e.g., first participant 102a. Participants 102 are described above with reference to FIG. 1.

[0157] In the following, we describe a scheme implemented using an elliptic curve cryptography scheme, but note that in general, embodiments of the present invention may be applied to other public key cryptography schemes, for example, RSA.

[0158] The coordinator 101 is the party that initiates the signature using a threshold number of signature shares generated by each participant in the group of participants 102. That is, the coordinator 101 generates a signature on the message to be signed. Again, note that generating a signature on a message is interpreted to mean that the signature depends on the message to be signed, or, in other words, that the signature is a function of the message to be signed. The coordinator 101 may also be the party that transmits or otherwise outputs the signature, and optionally the message, to a third party 103. For example, the third party 103 may be a certification authority or other form of authority, or another user. In other examples, the signature may be recorded in a database or other document. In some examples, the signature may be made publicly available, for example, recorded on a website or other publicly accessible medium.

[0159] The coordinator 101 may send a message to be signed to the participants 102. The message may be sent to all of the participants 102 or to a subset of the participants, for example, a threshold number of participants. In the example of Figure 1, the group of participants comprises three participants 102a, 102b, and 102c. The coordinator 101 may send a message to one participant, who then forwards the message to one, some, or all of the other participants.

[0160] Messages may be sent over the Internet using a LAN or WAN connection, or via alternative wired or wireless communication means. Messages may be sent to each participant 102 individually, e.g., via a secure communication channel between the coordinator 101 and each participant 102, or may be broadcast to the entire group, e.g., via email or other means. Messages may be sent in raw or encrypted form. For example, messages may be hashed one or more times.

[0161] One or more of the participants 102 may obtain the message through alternative means, i.e., not from the coordinator 101. For example, the message may be generated by one of the participants 102 or may otherwise be publicly available. One or more participants 102 may receive the message from a third party 103. A participant 102 that obtains the message may send the message (in raw or encrypted form) to one or more other participants 102. For example, a first participant 102 may send a message to a second participant 102b and / or a third participant 102c.

[0162] The coordinator 101 obtains (e.g., receives) a threshold number of signature shares. In the example of FIG. 1, the threshold is two, and only the first participant 102a and the second participant 102b decide to generate their respective signature shares. For example, one or more of the participants 102 who generate signature shares may transmit their respective shares directly to the coordinator 101, e.g., via a secure communication channel. Alternatively, one or more of the participants 102 may broadcast their respective shares and / or make their shares publicly available. As described above, the coordinator 101 may be a participant. In those embodiments, the coordinator 101 may also generate their respective signature shares. In that sense, obtaining at least one of the threshold number of signature shares means generating at least one signature share; therefore, the coordinator 101 need only receive one less than the threshold number of signature shares.

[0163] To obtain a signature share, the coordinator 101 may send a request for a signature share in a message. For example, the coordinator 101 may send a request for a signature share to one, some, or all of a group of participants 102.

[0164] Upon obtaining at least a threshold number of signature shares, the coordinator 101 generates a signature using the obtained shares. The coordinator 101 may then broadcast or transmit the signature to one or more other entities. Additionally or alternatively, the coordinator may store the signature and / or record it as part of a digital record, for example, in an email or other document.

[0165] Next, sign shares i A method for generating a signature share is described below. While the method is described from the perspective of a first participant 102a, it will be understood that each other participant 102 that generates a signature share does so using an equivalent method, albeit using particular data unique to the other participant 102.

[0166] Each participant 102 has access to the following data items: a respective private key share α i ' (i.e., a share of the private key α), each temporary private key share k i , and a common shared value γ generated based on a common ephemeral public key k·G. The common ephemeral public key corresponds to an ephemeral private key, i.e., is generated based on the ephemeral private key. Here, a value or key may be common in the sense that each participant has access to the same value or key. Note that, unless specified, generating a second key based on a first key does not necessarily imply that the first key itself is known. An example of how these data items may be generated is shown below.

[0167] The first participant 102a obtains or already has access to the message to be signed. The message may be in raw form (e.g., plaintext) or may be encrypted or encoded (e.g., ciphertext). The first participant 102a may obtain the message (in either form) from the coordinator and / or another participant 102. Alternatively, the first participant 102a may generate the message to be signed.

[0168] The first participant 102a generates a first signature share s1. The term "first" in this context is merely used as an arbitrary label to distinguish a particular participant and a particular signature share from other participants and signature shares, respectively, and indicates that the first participant 102a generates a signature share s1. i or the first participant to generate signature share s i Note that this does not necessarily mean that the first one in the ordered list of

[0169] In some embodiments, the first signature share s1 may be generated based on, i.e., a function of, a first message-independent component (MIC) and a first message-dependent component (MDC), where "first" is again merely used as a label. The MIC is generated separately from the message; that is, the MIC is not a function of the message being signed (i.e., the MIC is not generated based on the message), and knowledge of the message is not required to generate the MIC. In contrast, the MDC is a function of the message being signed, and knowledge of the message is required to generate the MDC.

[0170] In other embodiments, the first signature may not be a function of the first message-independent component (MIC). In these embodiments, the first message-independent component is generated and made available to the coordinator 101, for example, sent to the coordinator 101 or broadcast to one or more participants 102. The first message-independent component (MIC) may be shared with the coordinator prior to and separate from the first signature share.

[0171] The coordinator 101 obtains respective message-independent components (MICs) from at least a threshold number of participants and generates a signature based on the respective signature shares (which are functions of the respective message-dependent components (MDCs)) and the respective message-independent components (MICs), as described in more detail below.

[0172] Because a MIC does not require knowledge of the message, it can be pre-computed. In other words, the MIC can be generated before the message is obtained. Thus, multiple different MICs can be pre-computed, each used to generate a different respective signature share s1' for signing a different message, where the prime (') indicates a different instance of the first signature share.

[0173] Upon generating the first signature share s1, the first participant 102a makes the first signature share s1 available to the coordinator 101 for generating a signature s on the message. If the first participant 102a is the coordinator 101, making the first signature share s1 available to the coordinator 101 may simply mean outputting the first signature share s1 to a function for generating the signature s. Otherwise, the first participant 102a may send the first signature share s1 to the coordinator 101, or to one or more other participants 102 for forwarding to the coordinator 101, or may broadcast the first signature share s1, or may use a combination of these options.

[0174] As described above, the first signature share s1 may be generated based on the first MIC and the first MDC. Regardless of whether the first signature share is a function of the first MIC, the first MIC is generated based on (i.e., is a function of) the first private key share α1 (i.e., a share of the private key α known to the first participant 102a). The first MIC may also be based on (i.e., is a function of) the first ephemeral private key share k1 (i.e., a share of the ephemeral private key k known to the first participant 102a) and a shared value γ generated based on the ephemeral public key k·G corresponding to the ephemeral private key k. The first MDC may be generated based on (i.e., is a function of) the message (in raw or encrypted form) and may be generated based on the first ephemeral private key share k1. Variations of MICs and MDCs are provided below.

[0175] The first temporary secret key share k1 may be calculated using a joint secret sharing scheme, for example, using the JVRSS technique described above. For example, the first participant 102a has index 1 and has k i = JVRSS(1), where the temporary private key is denoted by k. Each participant 102 may generate a first temporary private key share k iFor example, the second participant 102b may generate a second temporary secret key share for participant 2 using k2=JVRSS(2), and so on.

[0176] Generating the first temporary secret key share k1 using a joint secret sharing scheme comprises the same steps as described above for generating the first secret key share α1, except that the random number used to generate the temporary secret key share k1 is a different number than the one used to generate the secret key share α1.

[0177] Note that the same private key α and private key share α1 are used for each signature, but the ephemeral private key k and ephemeral private key share k1 change for each signature (or they are randomly generated and therefore unlikely to be the same, rather than being intentionally chosen to be different).

[0178] The shared value γ is generated based on the ephemeral public key k·G corresponding to the ephemeral private key k. The ephemeral public key (x, y) has two components, usually called the x and y components. The shared value γ can be a function of the x component of the ephemeral public key, for example, γ = x mod n.

[0179] The temporary public key k·G may be generated based on a set of obfuscated coefficients, which were used to generate each participant 102's respective temporary private key share k1. That is, when generating the temporary private key share k1, each participant 102 uses the obfuscated coefficient k 1j G with each of the other participants 102. The coefficients are obfuscated by a common generation point G on the selected elliptic curve. These obfuscated coefficients may be transmitted directly between participants 102 or may be broadcast to the group. For example, the first participant 102a may share the obfuscated coefficient k 10 G, k 11 G, k 12 ·G etc. Then the temporary private key can be calculated as follows:

[0180]

number

[0181] In some embodiments, the first MIC is a first reverse share corresponding to the first temporary secret key share k1.

[0182]

number

[0183] That is, the first inverse share

[0184]

number

[0185] is a function of the first temporary secret key share k1.

[0186] First Reverse Share

[0187]

number

[0188] For example, for participant 1

[0189]

number

[0190] The intermediate value μ may be the inverse of the shared secret generated by calculating μ = kα mod n. As described above, calculating the inverse of the shared secret comprises calculating the product of the shared secrets. The first participant 102a generates the intermediate value μ as the product of the first temporary private key k and the first blind key α. For example, the intermediate value may be calculated for participant 1 by μ = kα = PROSS(1), with the result being μ = kα mod n.

[0191] This means that each participant 102 receives a multiplicative share μ i =k i α i where α i is a share of the first blind key α. Each participant 102 uses a joint secret sharing scheme, e.g., using the JVRSS technique described above, to derive their respective share α of the first blind key α. i For example, the first participant 102a may have an index of 1 and may calculate α for participant 1. i = JVRSS(1). Each participant may generate a first blind key share using i Share μ i , and generate an intermediate value μ based on each of the first inverse share

[0192]

number

[0193] may be generated by calculating the inverse of the intermediate value μ. For example, the first participant 102a may calculate the modulo inverse of μ, resulting in: μ -1 =(kα) -1 mod n

[0194] The first participant 102a then calculates the remainder inverse μ -1 and based on their respective first blind key shares α1, e.g.

[0195]

number

[0196] The first inverse share is calculated by

[0197]

number

[0198] can be calculated.

[0199] Note that the use of the blind key share α1 is optional and can be omitted from the above steps.

[0200] Optionally, the MIC may be generated based on a share (i.e., a function) of the second blind key β. That is, the MIC is based on the aforementioned data items as well as a first share β1 of the second blind key β. The first share of the second blind key β may be calculated using a joint secret sharing scheme, for example, using the JVRSS technique described above. For example, the first participant 102a has index 1 and has a β i =JVRSS(1) may be used to generate a first share of a second blind key, where the second blind key is denoted by β.

[0201] The MIC may be generated based on a first pre-signature share σ′, which is a function of the first intermediate share λ, and respective intermediate shares λ obtained from at least a threshold number of participants 102. That is, each of the participants 102 may generate a respective intermediate share λ and transmit and / or broadcast those intermediate shares λ to the other participants 102. The first participant 102a may collect the intermediate shares λ to generate a common intermediate value λ, for example, by interpolation of the intermediate shares λ. The first participant 102a (and, optionally, the other participants 102) may generate multiple pre-signature shares σ′, each for use in generating a different signature share s′.

[0202] The first intermediate share λ1 is the new first secret key share α i ' and the first inverse share

[0203]

number

[0204] In that case, at least a threshold number of participants 102 each have their own private key share α i ' and their respective inverse shares

[0205]

number

[0206] Each intermediate share λ1 is a function of

[0207] Alternatively, the first intermediate share λ1 is a first secret key share α i ' and the first blind key α i In that case, each of at least a threshold number of participants 102 may receive a respective first share of the private key, α i ' and the first blind key α i Each of the participants generates and shares an intermediate share λ1, which is a function of the respective shares of the participants.

[0208] In some embodiments, the first pre-signature share σ may also be generated based on the first share of the second blind key β. For example, the first intermediate share λ may be a function of the first share of the second blind key β. In additional or alternative embodiments, the first intermediate share λ may also be a function of the common value γ.

[0209] 4 shows an exemplary method 400 for generating a signature on a message according to an embodiment of the present invention. Steps S401-S408 are performed in this example by each of a threshold number of participants 102 (including the first participant 102a). Step S409 is performed by the coordinator 101, which may also be one of the participants performing steps S401-S408. It should be understood that some of the steps may be omitted or may be performed in a different order.

[0210] The exemplary method 400 allows for the creation of a shared secret of threshold (t+1) in a group of N≧2t+1 participants, where the signature threshold is also (t+1).

[0211] setting:

[0212] In step S401, each participant 102 receives a shared secret key share α i ' and the corresponding public key. i The generation of ' is described above. At this point, each participant i has a secret key share and a public key (α i ', P), where P is the notation of the public key corresponding to the shared secret key. The shared secret key has a threshold of (t+1).

[0213] Precomputation:

[0214] In step S402, each participant 102 calculates a shared ephemeral key share and a corresponding public key. For example, each participant 102 may calculate a shared ephemeral key using the JVRSS and the calculation of the public key given in the introduction. Each participant 102 may then calculate a reverse share based on the ephemeral private key. This allows each participant to obtain a reverse share.

[0215]

number

[0216] , r) and the threshold is (t+1).

[0217] In step S403, each participant 102 generates two different shared blind key shares. For example, each participant 102 generates a share α i =JVRSS(i) and β i= JVRSS(i), and each shared secret has a threshold (t+1). Note that in some instances, not all shared secrets need to have the same threshold.

[0218] In step S404, each participant 102 calculates the median share and broadcasts the median share to the other participants. For example, each participant i calculates the median share

[0219]

number

[0220] This value has a threshold of (2t+1).

[0221] In step S405, each participant 102 calculates a median value based on at least the median share. For example, each participant 102 may calculate an interpolation λ=interpolate(λ1, ..., λ) for the (2t+1) shares. 2t+1 )=k -1 The intermediate value may be calculated using α+β.

[0222] In step S406, each participant 102 calculates a pre-signature share. For example, each participant i calculates a pre-signature share σ i =λ-β i =(k -1 α+β)-β i Each participant 102 may calculate (γ,

[0223]

number

[0224] , σ i ), and the private key share and the corresponding public key (α i ', P).

[0225] Note that because a different temporary key is used for each signature, multiple temporary keys can be set at once, i.e., steps S402 to S406 can be repeated to create multiple temporary keys during pre-computation and store them for later use. These can be performed simultaneously, so there are no additional rounds of communication. Note that preferably, different values ​​of α and β should be used for each signature.

[0226] Generate the signature:

[0227] To sign the message msg, at least (t+1) participants must perform steps S407 and S408.

[0228] In step S407, at least a threshold number of participants 102 obtain the message to be signed and calculate a message digest. For example, the coordinator 101 may send a request to (t+1) participants to create signature shares on the message msg. Each participant i may calculate a message digest e=hash(msg). In some examples, this hash function is a double SHA-256 hash function. Another hash function may also be used.

[0229] In step S408, at least a threshold number of participants 102 calculate and transmit signature shares to the coordinator 101. For example, each participant i has a signature share

[0230]

number

[0231] , and then calculate the signature share (γ, s i ) to the coordinator. Note that the value γ may not be sent by all participants.

[0232] In step S409, the coordinator 101 calculates a signature. For example, the coordinator 101 calculates a signature by using the following formula: s=interpolate(s i , …, s t+1 )=k -1 (e+αγ) and finally the signature (γ, s) can be calculated.

[0233] There are several alternatives for precomputing the message-independent components of the signature shares. These include including γ in the calculation and precomputing (kα) -1 These can be selected independently of each other, so there are eight variations of the method 400 above.

[0234] One modification is to add (r,

[0235]

number

[0236] ,rσ i ), which means that γ is included in the pre-signature shares. Another modification is that the multiplication with γ may occur earlier during the calculation of the intermediate shares. Instead, in step S404

[0237]

number

[0238] In step S406, σ i =λ-β i =(γk -1 α+β)-β i and the signature share calculation is

[0239]

number

[0240] is.

[0241] Another fix is ​​to use λ instead i =α i α i '+β i λ = (kα) -1 (αα+β), and σ i =λ-(kα) -1 β i Two variations of including γ in the substitution points can be implemented in combination with this. Each participant has knowledge of kα since it is calculated in the pre-computation step S402. Furthermore, every participant 102 has knowledge of their λ i The shares are broadcast. Thus, each participant 102 has (at least) 2t+1 shares and knowledge of the value kα. Then, the following can be calculated: λ=kα -1 ×interpolate(λ1, …, λ 2t+1 )

[0242] Another modification is to instead calculate the intermediate value as λ = (αα + β) and the pre-signature share as σ i =λ-β i Finally, the signature share

[0243]

number

[0244] The two variations on when to include γ in the calculation can also be implemented in combination. Each participant 102

[0245]

number

[0246] Now we have knowledge of kα from the calculation of (kα) -1 mod n and put it into s ican be included in the calculation of

[0247] In summary, each participant 102 has α i ', k i , α i , β i In the exemplary method 400, two products need to be calculated, and kα is

[0248]

number

[0249] is used to calculate the shares, and interpolating these shares cancels out α, so k -1 is obtained, and the first product is used in the signature. -1 α is obtained and therefore, when the shares are expanded, the calculation result is

[0250]

number

[0251] kα and α i Consists of

[0252]

number

[0253] Calculations using shares start with α i Calculate only the (kα) -1 This can be done by multiplying

[0254] One version of the above scheme can be summarized as the signature being computed using shares consisting of a message-independent component (MIC) and a message-dependent component (MDC), where the MIC is the pre-signature share σ i and the MDC is based on message e.

[0255] An equivalent scheme would comprise calculating the MIC as above and then incorporating this into the signature together with the signature shares, e.g. after interpolating the signature shares produced by the MDC alone. Explicitly, the scheme could be the same up to the pre-computation step S406, where the intermediate shares are calculated using the γ value,

[0256]

number

[0257] and after interpolation, this becomes

[0258]

number

[0259] This becomes:

[0260] At this stage, participants are asked to choose (γ,

[0261]

number

[0262] λ, β i ), which is then used to represent the private key shares and the corresponding public key (α i ', P).

[0263] Participants then generate a signature share on a given message m, which is hashed to create a message digest e = hash(m).

[0264]

number

[0265] and sends it to the coordinator. Then, the coordinator s = interpolate(s1, …, s t+1 )+λ, =k -1 e+k -1 αγ Calculate the β condition and cancel it, so you get the expected signature share: (kα) -1 Similar variations of this protocol can be made when γ and γ are included in the calculation, as explained above.

[0266] The following variations for computing message-independent components can be implemented: i)λ=k -1 Calculating α+β, the signature share is

[0267]

number

[0268] and the signature is s = int(s1, ..., s t+1 ) + γλ. ii) Calculating λ=αα+β, the signature share is s i =α i e-β i and the signature is s=(kα) -1 (int(s1, ..., s t+1 ) + λ). iii) Calculating λ=αα+β, the signature share is

[0269]

number

[0270] and the signature is s=(kα) -1 (int(s1, ..., s t+1 ) + γλ). iv) Calculating λ=ααγ+β, the signature share is

[0271]

number

[0272] and the signature is s = (int(s1, ..., s t+1 )+(kα) -1 λ). v) Calculating λ=αα+β, the signature share is

[0273]

number

[0274] and the signature is s = (int(s1, ..., s t+1 )+γ(kα) -1 λ).

[0275] Note that the thresholds for the secrets can be different. That is, the thresholds for α, k, α, and β themselves do not necessarily need to be the same in order for the signature generation scheme to work. For example, if you have a group of six people, and three of them need to create a signature and / or a private key, you could technically do the calculation with a threshold of 4 for k and a threshold of 3 for the other shared secrets, and still have a threshold-optimal scheme.

[0276] It should be noted that the present invention may be applied to any threshold signature scheme (whether optimal or non-optimal) and is not limited to the particular schemes mentioned above.

[0277] In general, embodiments of the present invention can be used to generate a signature for any message. As a specific exemplary use case, the message can be part or all of a blockchain transaction. That is, the signature can be used to sign one or more inputs and / or one or more outputs of the blockchain transaction. For example, the generated signature can be used, at least in part, to unlock an output of the blockchain transaction. As a specific example, the output of a previous transaction could be a pay-to-public-key-hash (P2PKH) output that is locked to the hash of the public key. To unlock it, the input of a later transaction referencing the P2PKH output must include the (unhashed) public key and a signature generated based on the private key corresponding to the public key.

[0278] Expressed in scripts, "locking script" and "unlocking script" may take the following form:

[0279] Lock script = OP_DUP OP_HASH160<Public KeyHash> OP_EQUAL OP_CHECKSIG Unlock Script = <signature><Public Key>

[0280] With reference to the above embodiment,<Public Key> can be identified with P=α·G, <signature>, with a threshold signature s, and the previous transaction is the message to be signed. Note that, as above, ECDSA signatures are of the form (γ, s).

[0281] The present invention can be used to change which participants can generate signature shares and therefore which participants must come together to unlock funds, i.e., unlock the output of a blockchain transaction. Additionally or alternatively, the present invention can be used to increase the number of participants required to unlock funds.

[0282] It should be noted that the described signature generation method is not limited to any particular use case and may generally be used to generate a signature based on any message. Signing all or part of a blockchain transaction is but one example. The described method may be used, for example, to sign and / or approve legal documents (e.g., wills, deeds, or other contracts), communications between one or more parties, digital certificates (e.g., issued by a certificate authority), medical prescriptions, bank transfers or financial products, mortgage or loan applications, etc.

[0283] As a specific example, a group of participants (e.g., five participants total) may constitute a company's board of directors. A company vote may require a majority of the board (i.e., at least three participants) to agree to a particular vote. The board may use the described signature generation method to prove that at least three board members agreed to vote in favor of a particular outcome. In this example, the threshold for the signature generation scheme is three. That is, at least three board members must provide their respective signature shares for the coordinator to successfully generate a signature. A successfully generated signature therefore requires that at least the threshold number (i.e., three) of board members agreed to vote in favor of that outcome. Thus, a successful signature generation serves as a record of the vote, proving that a majority of the board voted in a particular way.

[0284] The present invention may be used to change who can vote on such matters and / or to increase or decrease the number of votes (i.e., shares) required to successfully determine the outcome of the vote.

[0285] Another use case of the present invention is in the field of digital certificates, for example, digital certificates issued according to the X.509 standard. A digital certificate contains a signature that signs some data. While the data can generally be any data, one specific example of data included in a digital certificate is a public key. The public key in a digital certificate is often called a "certified public key." The issuer of the digital certificate (a "certificate authority") may perform one or more checks (e.g., know-your-customer checks) on the owner of the public key, and if the checks are successful, the certificate authority issues a digital certificate that includes the certified public key. A user can use the certified public key to prove who they are, for example, by signing a message with the private key that corresponds to the certified public key.

[0286] One specific use of a certificate authority is to sign certificates used in HTTPS for secure browsing on the Internet. Another common use is for governments to issue ID cards for use in digitally signing documents. The certificate authority uses its private key to sign the public key (or any other data being certified). The invention can be used to change which participants have shares of the private key. The security of the private key may also be improved by increasing the private key threshold.

[0287] The principle behind the present invention is that a group of participants generate new shares of a shared secret based on their respective blind shares. The blind shares allow participants with old shares of the shared secret to distribute blinded (i.e., obfuscated) versions of their old shares to a "new" group of participants in the form of "intermediary shares." The intermediary shares are combined (or interpolated) to form an intermediate, from which each of the group of participants can apply (e.g., subtract or add) a blind share to obtain their respective new share of the shared secret. While the present invention has been described primarily with respect to ECC implementations, the present invention applies to other implementations as well, e.g., RSA.

[0288] It should be understood that the above embodiments have been described by way of example only. More generally, a method, apparatus, or program may be provided according to any one or more of the following statements:

[0289] Statement 1. A computer-implemented method for generating shares of a shared secret, the method comprising: a) generating a first secret share of a shared secret from a group of participants, each of the participants having a respective first secret share of the shared secret; b) executing a first secret share of the shared secret from a first participant of the group; generating respective blind shares of a shared blind secret; obtaining at least a threshold number of respective intermediate shares from each of a first group of participants, the respective intermediate shares being generated based on the respective blind shares and the respective first secret shares; generating an intermediate value based on each of the obtained intermediate shares; generating respective second secret shares of the shared secret, each second shared secret being generated based on the intermediate value and a respective blind share; A method comprising:

[0290] Statement 2. The method of statement 1, wherein a first of each intermediate share is generated by a first participant.

[0291] Statement 3. The method of statement 1 or statement 2, wherein the shared secret threshold is equal to the shared blind secret threshold.

[0292] In other words, the threshold for the second secret share is the same as the threshold for the first secret share.

[0293] Statement 4. The method of statement 1 or statement 2, wherein the threshold for the shared secret is different compared to the threshold for the shared blind secret.

[0294] That is, the threshold value of the second secret share is different compared to the first secret share.

[0295] Statement 5. The method of statement 4, wherein the threshold of the shared secret is greater than the threshold of the shared blind secret.

[0296] Statement 6. The method of statement 4, wherein the threshold of the shared secret is less than the threshold of the shared blind secret.

[0297] Statement 7. The method of any of statements 1 to 6, wherein each blind share of the shared blind secret is generated using a joint verifiable secret sharing scheme.

[0298] Statement 8. The step of generating each blind share using a joint secret sharing scheme comprises: generating a first data item, the first data item being a first polynomial; obtaining respective data items from at least a threshold number of participants, each data item being a respective polynomial generated by a respective participant; generating respective blind shares based on the first data item and each of the respective data items; The method of statement 7, comprising:

[0299] Statement 9. The method of statement 7 or statement 8, wherein obtaining the respective data items comprises obtaining the respective data items via respective communication channels between the first participant and each of the threshold number of participants.

[0300] Statement 10. The method of any of statements 7 to 9, comprising sending a respective instance of the first polynomial to at least each of a threshold number of participants, wherein each instance of the first polynomial is based on a respective participant.

[0301] Statement 11. The method of any of statements 1 to 7, wherein each blind share of the shared blind secret is generated using Shamir's secret sharing scheme.

[0302] Statement 12. The method of any of statements 1 to 11, wherein each first secret share of the shared secret is generated using a joint verifiable secret sharing scheme.

[0303] Statement 13. The method of any of statements 1 to 11, wherein each first secret share of the shared secret is generated using Shamir's secret sharing scheme.

[0304] Statement 14. The method of any of statements 1 to 13, wherein the shared secret is a private key and each second secret share is a respective private key share of the private key.

[0305] Statement 15. The shared blind secret is a blind private key, the intermediate value is an intermediate private key, and generating a first public key corresponding to the private key; generating a second public key corresponding to the blinded private key; generating a third public key corresponding to the intermediate private key; generating a first value based on the first and second public keys; verifying that the second secret share of the shared secret was correctly generated based on whether the first value matches the third public key; The method of statement 14, comprising:

[0306] Statement 16. to one, some, or all of each of the other participants in response to a determination that the second secret share was not correctly generated; obtaining respective first public keys corresponding to respective first secret shares of the participants; obtaining respective second public keys corresponding to respective blind shares of the participants; obtaining respective third public keys corresponding to respective intermediate shares of the participants; generating respective first values ​​based on respective first and second public keys of the participants; verifying that each second secret share of the shared secret was correctly generated by that participant based on whether each first value matches a respective third public key; 16. The method of claim 15, comprising the step of:

[0307] Statement 17. retrieving a message; generating digital signature shares based on the message and respective shares of the private key; 17. The method of any of statements 14 to 16, comprising:

[0308] Statement 18. retrieving a message; generating a first message-independent component and a first message-dependent component, the message-independent component being generated based on respective secret key shares and the message-dependent component being generated based on the message; making a first message independent component available to a coordinator; making a first signature share available to a coordinator for generating a signature based on at least a threshold number of signature shares, the first signature share comprising at least a message-dependent component; 17. The method of any of statements 14 to 16, comprising:

[0309] Statement 19. a memory comprising one or more memory units; a processing device comprising one or more processing units, wherein a memory stores code configured to execute on the processing device, the code being configured, when on the processing device, to perform the method of any of statements 1 to 18; A computer device comprising:

[0310] Statement 20. A computer program embodied in a computer-readable storage and configured to perform the method of any of statements 1 to 18 when executed on a computing device.

[0311] According to another aspect disclosed herein, a method may be provided that includes actions of each participant.

[0312] According to another aspect disclosed herein, a system may be provided that includes a computer device for each participant.

[0313] Other variations or uses of the disclosed techniques will be apparent to those of ordinary skill in the art given the disclosure herein. The scope of the present disclosure is not limited by the described embodiments, but only by the appended claims. [Explanation of symbols]

[0314] 100 systems 101 Coordinator 102 Parties 102 participants 102a First participant 102b Second participant 102c Third participant 103 Third party 200 ways 300 System 400 ways< / signature> < / signature>

Claims

1. 1. A computer-implemented method of generating shares of a shared secret, the method being executed by a first participant of a group of participants, each of the participants having a respective first secret share of the shared secret; generating respective blind shares of a shared blind secret; obtaining at least a threshold number of respective intermediate shares from each of the first group of participants, each intermediate share being generated based on a respective blind share and a respective first secret share; generating an intermediate value based on each of the obtained intermediate shares; generating respective second secret shares of the shared secret, each second secret share being generated based on the intermediate value and each blind share; A method comprising:

2. The method of claim 1 , wherein a first of the respective intermediate shares is generated by the first participant.

3. 3. The method of claim 1, wherein the threshold value of the shared secret is equal to the threshold value of the shared blind secret.

4. 3. The method of claim 1, wherein the threshold value of the shared secret is different compared to the threshold value of the shared blind secret.

5. The method of claim 4 , wherein the threshold value of the shared secret is greater than the threshold value of the shared blind secret.

6. The method of claim 4 , wherein the threshold value of the shared secret is less than the threshold value of the shared blind secret.

7. The method of claim 1 , wherein the respective blind shares of the shared blind secret are generated using a joint verifiable secret sharing scheme.

8. generating the respective blind shares using the joint secret sharing scheme, generating a first data item, said first data item being a first polynomial; obtaining respective data items from at least the threshold number of participants, each data item being a respective polynomial generated by a respective participant; generating the respective blind shares based on the first data item and each of the respective data items; The method of claim 7, comprising:

9. 9. The method of claim 7 or 8, wherein obtaining the respective data items comprises obtaining the respective data items via respective communication channels between the first participant and each of the threshold number of participants.

10. 10. The method of claim 7, comprising transmitting a respective instance of the first polynomial to at least each of the threshold number of participants, wherein the respective instances of the first polynomial are based on a respective participant.

11. The method of claim 1 , wherein the respective blind shares of the shared blind secret are generated using a Shamir's secret sharing scheme.

12. 12. The method of claim 1, wherein the respective first secret shares of the shared secret are generated using a joint verifiable secret sharing scheme.

13. 12. The method of claim 1, wherein the respective first secret shares of the shared secret are generated using Shamir's secret sharing scheme.

14. 14. The method of claim 1, wherein the shared secret is a private key and the respective second secret shares are respective private key shares of the private key.

15. the shared blind secret is a blind private key, the intermediate value is an intermediate private key; generating a first public key corresponding to the private key; generating a second public key corresponding to the blind private key; generating a third public key corresponding to the intermediate private key; generating a first value based on the first and second public keys; verifying that the second secret share of the shared secret was correctly generated based on whether the first value matches the third public key; The method of claim 14, comprising:

16. to one, some, or all of the other respective participants in response to determining that the second secret share was not correctly generated; obtaining respective first public keys corresponding to said respective first secret shares of the participants; obtaining respective second public keys corresponding to said respective blind shares of the participants; obtaining respective third public keys corresponding to said respective intermediate shares of the participants; generating respective first values ​​based on the respective first and second public keys of the participant; verifying that the respective second secret share of the shared secret was correctly generated by the participant based on whether the respective first value matches the respective third public key; The method of claim 15, comprising the step of:

17. retrieving a message; generating digital signature shares based on the message and the respective shares of the private key; 17. The method of any of claims 14 to 16, comprising:

18. retrieving a message; generating a first message-independent component and a first message-dependent component, the message-independent component being generated based on the respective private key shares and the message-dependent component being generated based on the message; making the first message independent component available to a coordinator; making a first signature share available to the coordinator for generating a signature based on at least the threshold number of signature shares, the first signature share comprising at least the message-dependent component; 17. The method of any one of claims 14 to 16, comprising:

19. a memory comprising one or more memory units; a processing device comprising one or more processing units, the memory storing code configured to run on the processing device, the code configured to perform the method of any of claims 1 to 18 when present on the processing device; A computer device comprising:

20. A computer program embodied in a computer readable storage and configured to perform the method according to any of claims 1 to 18 when executed on a computing device.

Images