Generate a shared secret key

Abstract

A computer-implemented method for generating secret key shares, the method being performed by a first participant in a group of participants and including the steps of: obtaining a first seed share, each of the other participants having their own seed share; generating a first master secret key share of a shared master secret key, the first master secret key share being generated based on the first seed share and each of the other participants' respective seed shares and each of the other participants having their own master secret key share; and generating one or more first secret key shares based on the first master secret key share, each first secret key share being a share of a respective shared secret key.

Description

[Technical Field]

[0001] This disclosure provides multiple shared secret keys (shared private key) and more specifically, how to generate each of the shared secret keys. share This article explains how to generate a share. [Background technology]

[0002] In general, a shared secret can be used to share a data item that is distributed among a group of participants. Each participant has a different secret. share Typically, the secret is shared by a certain number of participants (called the "threshold"), each of whom has a different share of the secret. share can only be reconstructed if the cipher suite is available, e.g., combined together to compute the secret.

[0003] Public key cryptography is a type of cryptosystem that uses a key pair: a private key known only to its owner, and a public key that is generated based on the corresponding private key and can be distributed without compromising the security of the private key.

[0004] Public key cryptography allows a sender to encrypt a message using the recipient's public key (i.e., the public key that corresponds to a private key known only to the recipient). The encrypted message can then only be decrypted using the recipient's private key.

[0005] Similarly, a sender can use their private key to sign a message, e.g., to prove that the message was sent by the sender and / or to show that the sender agreed to the message. A signer (i.e., the party generating the signature) uses their private key to create a digital signature based on a message. Creating a digital signature based on a message means providing the message and the private key to a function that generates a signature based on both the message and the private key. The signature is appended to (e.g., tagged with) or otherwise associated with the message. Anyone who has the signer's corresponding public key can use the same message and digital signature on the message to verify whether the signature was validly created, i.e., whether the signature was truly created using the signer's private key. In addition to ensuring the authenticity of the message, digital signatures also ensure the integrity and non-repudiation of the message. That is, a digital signature can be used to prove that the message has not been altered since it was signed with the signature and that the creator of the signature cannot deny creating the signature in the future.

[0006] A digital signature scheme typically involves three procedures, or algorithms: a key generation algorithm is used to generate a random private key and a corresponding public key; a signing algorithm is used to generate a signature based on a message and the private key; and a verification algorithm is used to verify whether a signature, given a public key and a message, was generated using the corresponding private key and according to the signing algorithm.

[0007] A common use of a shared secret is as the shared secret of a private-public key pair. That is, the private key can be distributed among a group of participants such that no single participant has access to the private key. Thus, no single participant can generate a valid signature of a message. Instead, some or all of the participants must jointly generate the private key in order for a signature to be generated.

[0008] Participants share a private key to generate the signature. share Instead of sharing a private key share, participants can instead use a threshold signature scheme. A threshold signature scheme allows a threshold number of participants in a group to create a digital signature based on a message using their individual shares of a shared secret key, without making the private key available to any of the participants. Here, a digital signature is a signature generated based on the message to be signed. In such a scheme, a signature can be created only if the threshold number of participants agree to create a signature for the message. Any attempt to create a signature using a smaller number of participants will not produce a valid signature. Thus, a valid signature by a group (i.e., one generated using the message and the shared secret key) clearly has the threshold number of people agreeing to create the signature. This also means that an adversary needs to obtain the threshold number of shares of the private key in order to forge a signature using that private key. Summary of the Invention

[0009] As noted above, a shared secret may correspond to a shared private key. In many scenarios, it is recommended that a given private key should not be used more than once. Additionally, due to the nature of public-private keys, and in particular the difficulty of deriving a private key from a corresponding public key, it is essential that the private key not be lost. Therefore, it is desirable to be able to generate a series of "shared private keys" to prevent key reuse (i.e., to prevent a group of users from having to reuse the same shared private key) and to enable key recovery (i.e., to allow a group of users to reconstruct a shared private key).

[0010] According to one aspect disclosed herein, share A computer-implemented method is provided for generating a first seed, the method being performed by a first participant of a group of participants. share Each participant receives their seed share and a first master secret key of the shared master secret key. share generating the first master private key share The first seed share , and each of the other participants' respective seeds share and each of the other participants has their own master private key share and said first master private key share One or more first private keys based on share and generating each first private key share is the value of each shared secret key. share and

[0011] Each participant in the group has a respective seed, e.g., a pseudo-randomly generated integer, from which each participant derives the value of their respective master private key. shareA general requirement of shared secret schemes is that no party has knowledge of the shared secret, in this case the master private key. Thus, each participant can discover the share of the master private key without revealing the master private key itself. share To share enough information so that secret sharing Alternatively, a group of participants can distribute information using a dealer (e.g., a trusted third party). It is not excluded that the entire group can be trusted, in which case participants can communicate freely among themselves. Whether the parties are trusted or not, each participant must have access to the secrets of their respective master private keys. share from which each participant obtains a respective share can be generated.

[0012] Each participant has the same master private key share , each of which has the same additional private key share Thus, a group of participants can use different private keys, for example, to sign messages or to encrypt and decrypt messages. share This achieves the first objective of preventing reuse of the shared secret key. share Because the master private key is generated based on a seed known to each participant, if the master private key or any private key derived from it is lost, the private keys can be recovered. Thus, the second goal of enabling key recovery of the shared secret key is achieved.

[0013] A key structure, sometimes referred to as a hierarchical deterministic (HD) wallet, is a collection of deterministically linked private keys, where at least some of the keys are associated with different levels and positions in the hierarchical structure. For example, a master private key is at the top of the hierarchy (i.e., level 0), and one or more child keys are at the next level (i.e., level 1). Each child key at level 1 is linked to the master private key. Each child key at level 1 may be linked to one or more respective sets of child keys at level 2. Thus, while being children of the master key, a child key at level 1 is also a parent to a child key at level 2. It will be understood that an HD wallet can include any number of levels and keys.

[0014] An embodiment of the present invention is share allows a “shared wallet” to be created, where each private key is shared with a master private key share The shared wallet can take a similar form to a traditional HD wallet. Instead of each participant having a private key wallet, they now have a private key share If necessary, each participant can, for example, sign share To generate the key, each key is generated at the same level and position in the key structure. share can be accessed. [Brief explanation of the drawings]

[0015] To assist in understanding embodiments of the present disclosure and to show how such embodiments may be carried into effect, reference will now be made, by way of example only, to the accompanying drawings in which: [Figure 1] FIG. 1 is a schematic block diagram of a system for implementing an embodiment of the present invention. [Figure 2] Figure 2 shows a schematic representation of a hierarchical deterministic key structure. [Figure 3] FIG. 3 is a flow chart illustrating one embodiment of the present invention. [Figure 4] FIG. 4 is a flow chart illustrating one example of a method for generating a signature, according to some embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0016] Introduction Although the following examples are described in terms of elliptic curve cryptography, the invention is not limited to any particular cryptography scheme and can be generally applied to any cryptography scheme, for example RSA or other public key cryptography.

[0017] Elliptic curve groups The elliptic curve E satisfies the following equation: y 2 =x 3 +ax+b mod p where a,b∈Z p and a, b are 4a 3 +27b 2 ≠0. A group on this elliptic curve is defined as the set of elements (x, y) that satisfy this equation, along with the point at infinity O, which is the identity element. The group operation on elements in this group is called elliptic curve point addition and is denoted by +. This group is defined as E(Z p ), and the order is represented by n.

[0018] This group operation allows us to define another operation on elements, denoted by ·, called point multiplication. Point G∈Z p and a scalar k∈Z * p Then, a point k·G is defined as the point summed to itself k times.

[0019] In elliptic curve cryptography, the private key is a scalar k∈Z n\{0}, where Z n \{0} is the notation for the set {1,...,n-1}, and the corresponding public key is the point k·G on the elliptic curve. For example, in some blockchain protocols, the elliptic curve is chosen as the secp256k1 elliptic curve, and the values ​​a, b, and p are fully specified by this curve. The order n of this group is computed given these values, which is prime in the case of this curve, and the secp256k1 standard also specifies the point G to be used as the generator of this group.

[0020] Elliptic Curve Digital Signature Algorithm To create a signature for a message msg using private key a, the following steps are performed: 1. Compute the message digest e=hash(msg), where any hash function can be used. For example, in some examples: hash(msg)=SHA(SHA256(msg)), where SHA256( ) is the SHA256 hash function. Note that instead of being hashed only once, a message can also be hashed more than once using the same or different hash functions. 2. Choose a random integer k∈{1, ,n-1}, where n is the order of the elliptic curve, e.g., the secp256k1 curve. In the following, k is referred to as the ephemeral private key. 3. This ephemeral private key k·G=(R x ,R y ) to calculate the ephemeral public key corresponding to 4.r=R x Calculate mod n. If r=0, go back to step 2. 5. The multiplicative inverse k of the ephemeral key -1 Calculate mod n. 6.s=k -1Calculate (e+ar) mod n. If s=0, go back to step 2. 7. The signature for the message msg is (r, s).

[0021] The ephemeral key must be kept secret, otherwise the private key can be calculated given the message and the signature. Additionally, each time a signature is generated, a different ephemeral key must be used. Otherwise, the private key a can be derived given two different signatures and their corresponding messages.

[0022] Given a message msg, a public key P = a·G, and the corresponding signature (r, s), the signature can be verified by completing the following steps: 1. Calculate the message digest e = hash(msg). For example, e=SHA256(SHA256(msg)). 2. The multiplicative inverse function s of s mod n -1 Calculate. 3.j1=es -1 mod n and j2=rs -1 Calculate mod n. 4. Calculate the point Q = j1·G + j2·G. 5. If Q=O, where O is the point at infinity, the signature is invalid. 6. If Q≠O, then Q:=(Q x ,Q y ), then u=Q x Calculate mod n. If u=r, the signature is valid.

[0023] In a threshold signature scheme, this private key a is a key distributed among participants in the threshold scheme group. share (key shares).

[0024] Joint Verifiable Random Secret Sharing Suppose N participants want to create a joint secret that can only be regenerated by at least (t+1) participants in the scheme. To create the shared secret, the following steps are performed: 1. Participants agree on a unique label i for each participant. Each participant i generates (t+1) random numbers. a ij ∈ R Z n \{0},∀j=0,···,t where ∈ R is the set Z n \{0} means a randomly generated element, Z n \{0} is the notation for the set {1,...,n-1}, where each participant has a secret polynomial of degree t. f i (x)=a io +a i1 x+···+a it x t mod n i=0, ,N Note that from now on we will omit the notation mod n, and it is assumed that all arithmetic operations on integers are done modulo n. 2. Each participant i sends a value f to the participant j using a secure communication channel, for example, with only the participant j. i (j) is transmitted. 3. Each participant i shares their own secret about the shared secret polynomial. share is calculated as follows:

number

[0025] shared secret share (shared secret share) is of the form (i,a i ), where i is the participant label in the scheme. shareThis method for creating a , as described in steps 1-3, where for participant i, we have a i =JVRSS(i). Note that "JVRSS" usually stands for "Joint verification random secret sharing" and includes steps 4 and 5 as well. However, throughout this document, JVRSS will be understood to mean performing at least steps 1 through 3, where steps 4 and 5 are optional steps.

[0026] Now that the participants have generated their shared polynomials, they can each verify that the other participants have shared the correct information for all participants, and that all participants have the same shared polynomial. This is done in the following way. 4. Each participant i broadcasts the obfuscated coefficients to all participants. a ik ·G, where k=0,···,t 5. Each participant i receives f j Calculating (i), and

number

[0027] If all participants can see that this equality holds for each polynomial, then the group can collectively verify that all participants created the same shared polynomial.

[0028] Reconstructing a shared secret Suppose a participant wishes to reconstruct a shared secret that is zeroth order with respect to a shared polynomial. i ),···,((t+1),a t+1Given (t+1) points on a polynomial in , then to find the shared secret a,

number

[0029] Public Key calculation N zeroth-order private polynomial coefficient public keys shared in step 4 of JVRSS a i0 G, where j=0, ,N Given a shared secret, each participant has a corresponding shared secret, a.

number

[0030] Addition of shared secrets To compute the sum of two shared secrets shared among a group of N participants, where each secret polynomial is of degree t and no entity knows the individual secrets, the following steps are performed: 1. Generate a first shared secret a, where a is the share is calculated by using the threshold value of (t+1) for i=0, ,N. i =JVRSS(i). 2. Generate a second shared secret b, where b is the share is the threshold value of (t+1), b i =JVRSS(i). 3. Each participant i performs their own summation of share Calculate (additive share). v i =a i +b i mod n 4. All participants will be asked to complete their summation. share v ibroadcast to all other participants. 5. Each participant must have at least (t+1) share v i Interpolate over v=interpolate(v1, ,v 1+t )=a+b

[0031] This method for adding a shared secret is denoted by ADDDSS(i) for participant i, and results in each participant i knowing that v=(a+b).

[0032] Product of shared secrets To compute the product of two shared secrets, both shared among a group of N participants, the group performs the following steps, where each secret polynomial is of degree t: 1. Generate a first shared secret a, where a is the share For i=0, ,N, a i = JVRSS(i)t. The shared secret polynomial is of degree t, which means that (t+1) participants need to recreate it. 2. Generate a second shared secret b, where b is the share is b i =JVRSS(i)t, and the shared secret polynomial is of degree t. 3. Each participant will i =a i b i Using their own multiplicative share μ i Calculate. 4. All participants will be asked to provide their multiplicative share broadcast to all other participants. 5. Each participant must have at least (2t+1) share μ i Interpolate over μ=interpolate(μ1, ,μ 2t+1 )=ab

[0033] This method for computing the product of two shared secrets is denoted here by μ=ab=PROSS(i), for participant i.

[0034] Inverse of shared secret To calculate the reciprocal of the shared secret a, the following steps are performed: 1. All participants calculate the product of the shared secret PROSS(i). The result is μ=ab mod n. 2. Each participant computes the modular inverse of μ. The result is μ -1 =(ab) -1 mod n. 3. Each participant i receives a i -1 =μ -1 b i By calculating their own reverse secret share Calculate.

[0035] This method for computing the inverse of the shared secret is, for participant i, a i -1 =INVSS(i).

[0036] Shared private key generation and verification To calculate the shared secret key among N ≥ 2t+1 participants needed to create the signature, participants run JVRSS using the t+1 threshold and public key calculation as described above. As a result, all participants i = 1,...,N share the secret key share a i , and the corresponding shared public key P = (a·G).

[0037] Ephemeral key shares generation Ephemeral keys, as required for signing share and to generate the corresponding r, a group of size N with a shared secret key a of threshold (t+1) performs the following steps: 1. Reverse Shared Secret share k i -1 =INVSS(i), where (t+1) share is required for re-creation do. 2. Each participant has k i Using the obfuscation coefficients shared in the verification of

number

[0038] Non-optimal signature generation Suppose at least 2t+1 participants want to create signatures on a message, and one of the participants chooses to coordinate this. To create a signature by the group using a shared secret key a, the following steps are performed: 1. The coordinator requests signatures on the message from at least 2t+1 participants. 2. Each participant i receives the ephemeral key (r,k i -1 ) All users correspond to the same ephemeral key. share You need to use 3. Each participant generates a message digest Calculate e=SHA256(SHA256(message)). 4. Each participant i creates their own signature share s i Calculate. s i =k i -1 (e+a i r) mod n where a i is their private key share is. 5. Each participant must provide their signature share (r, s i ) is sent to the coordinator. 6. When the coordinator receives a signature of 2t + 1 share , it s = interpolate(s1, ···, s 2t+1 ) and outputs the signature as (r, s). 7. The coordinator verifies the signature using standard ECDSA verification. If this fails, at least one share is required to be incorrect, and the signature generation algorithm should be run again.

[0039] Addition of secrets with different thresholds In the case of the t-th and t'-th secrets, the sum of the two secrets requires max(t, t') + 1 share for calculation. The reason behind this is that the share summation step of the shared secrets creates the share of a new polynomial. This new addition polynomial is equivalent to the result of the sum of the individual polynomials of the two shared secrets. The sum of two polynomials is the sum of the corresponding coefficients at each degree x. Therefore, the degree of the addition polynomial must be the same as the highest degree of the two polynomials. This can be generalized to the sum of more than two polynomials, where the degree of the resulting polynomial is the same as the highest degree of the individual polynomials.

[0040] Once the sum of two secrets with different thresholds is calculated, the security of the secret with the higher threshold is reduced. This is because if the result (a + b) using respective thresholds t, t' is now known and assuming t < t', then a can be calculated using t share and then (a + b) - a = b can be calculated, so that the value b is calculated using only t share . This lower threshold is hereinafter referred to as the "implicated threshold".

[0041] Multiplication of secrets with different thresholds In the case of multiplying two secrets with thresholds of t and t', the multiplication calculation requires share t + t' + 1. In this case, the multiplication of two polynomials share results in share a new polynomial. This new polynomial is the result of multiplying two individual polynomials, and thus the degree of the result is the sum of the degrees of the two individual polynomials.

[0042] Multiplication can also be generalized to any number of shared secrets, and the resulting threshold is the sum of the individual thresholds plus 1.

Number

[0043] Similar to addition, multiplying two secrets with different thresholds results in an implicit threshold related to the secret with the higher threshold. As before, if ab is known, where a has a threshold of t, b has a threshold of t', and t < t', both a and b can be calculated using share t. First, calculate a, and then use (ab)a -1 to find b using only the share t related to the secret.

[0044] Combining the addition and multiplication of shared secrets in one step Generalizing the above, any combination of addition and multiplication can be calculated in one step. Assume a group of N participants wants to calculate the result ab + c. Here, a, b, c are shared secrets with thresholds (t a + 1), (t b + 1), (t c + 1) respectively. Suppose. There exists a condition that max(t a + t b, t c ) < N, that is, the number of participants in the scheme must be greater than the maximum value between the degree order of the secret a and the degree related to the result of multiplying the secrets a and b. 1. Each participant i is assigned a threshold (t a +1), (t b +1), (t c +1) to reveal their secrets share a i =JVRSS(i), b i =JVRSS(i), c i Calculate =JVRSS(i). 2. Each participant i share λ i =a i b i +c i Calculate. 3. Each participant i receives the result λ i Share with other participants. 4. Each participant calculates max(t a +t b, t c )+1 share Interpolating over Result λ = int(λ1, ,λ i ,···)=ab+c.

[0045] This is done in the calculation of the shared signature according to some examples below: i =k i -1 (e+a i r), which essentially means that i b i =k i -1 a i r and c i =k i -1 This is the case with e. In this case, t a +t b = 2t and t c = t, and the interpolation is max(t a +t b, t c )+1=2t+1 share spanning.

[0046] HD Wallets Hierarchical Deterministic wallets, of which Bitcoin Improvement Proposal 32 (BIP32) wallets are a particular type, are deterministic wallets in which many keys can be derived from a single input. The input is some random entropy, called a seed, from which a master key is derived. The master key is then used to derive multiple child keys, as shown in Figure 2.

[0047] In BIP32, the master private key is the left 32 bytes of the HMAC-SHA512 result of the seed, or explicitly

number

number

number

[0048] HMAC requires two inputs: c and K. For simplicity, and so that users are only required to remember or store a single seed, the BIP32 protocol sets the first input as the string "Bitcoin Seed", i.e., c = ('Bitcoin Seed'). It will be understood that this is one example protocol for generating an HD wallet, and that different protocols may require different inputs, e.g., two randomly generated seeds. In other words, the use of the string "Bitcoin Seed" is not a mandatory requirement for generating an HD wallet.

[0049] parent secret key sk parent hardened child private key sk from child The formula for calculating is as follows:

number

[0050] Parent public key pk parent and parent private key sk parent to the non-hardened child private key sk child The equation for calculating is:

number

number

[0051] This can be used by external parties to derive various payment addresses as needed, avoiding key reuse while reducing communication and storage rounds.

[0052] Typically, HD wallets create a hierarchical tree-like structure of private and public key pairs, which provides for a large number of key pairs that can all be regenerated from a single seed.

[0053] private key share Generation of Figure 1 illustrates an exemplary system 100 for implementing an embodiment of the present invention. As shown, the system 100 includes multiple parties (hereinafter also referred to as "participants") 102. Although only three participants 102 are shown in Figure 1, it will be understood that in general, the system may consist of any number of participants. Each of the participants 102 operates a respective computing device.

[0054] Each computing device of each participant 102 includes a respective processing unit, including one or more processors, such as one or more central processing units (CPUs), accelerator processors such as graphics processing units (GPUs), other application-specific processors, and / or field-programmable gate arrays (FPGAs). Each computing device may also include memory, i.e., computer-readable storage devices in the form of non-transitory computer-readable media or media. Memory may include one or more memory units using one or more memory media, such as magnetic media such as hard disks, electronic media such as solid-state drives (SSDs), flash memory, or EEPROMs, and / or optical media such as optical disk drives. Each computing device may include at least one user terminal, such as a desktop or laptop computer, a tablet, a smartphone, or a wearable device such as a smartwatch. Alternatively or additionally, each computing device may include one or more other network resources, such as cloud computing resources accessed via the user terminal (cloud computing resources comprising resources of one or more physical server devices implemented at one or more sites). It will be understood that any action described as being performed by a party of system 100 may be performed by a respective computing device operated by that party.

[0055] Each participant 102 is configured to transmit data to one, some, or all other participants 102 across the Internet using a LAN or WAN connection or via alternative wired or wireless communication means. Unless the context requires otherwise, references to a participant 102 transmitting data can be understood as transmitting the data individually to the other participants 102, e.g., via a secure communication channel between a first participant 102a and a second participant 102b, or broadcasting the data to the entire group, e.g., via email or other means. Again, unless the context requires otherwise, each participant 102 can transmit data in raw form or in encrypted form. For example, the data can be encrypted using the recipient participant's public key before being sent to the recipient participant.

[0056] Embodiments of the present invention will be described primarily from the perspective of the first participant 102a. However, it will be understood that the general steps of the described methods may similarly be performed by other participants, such as, for example, the second participant 102b or the third participant 102c. It will also be understood that the terms "first," "second," "third," etc. are used merely as distinguishing labels herein and do not necessarily imply any ordering, unless the particular context in which the terms are used requires otherwise.

[0057] The present invention provides a method for each participant 102 in a group of participants 102 to have one or more shared secret keys, each linked to a shared master secret key. share That is, each participant can generate the master private key share can generate, and therefore possess, a master private key share to create a shared wallet, for example, by adding an additional private key. share can be derived.

[0058] The first participant 102a is the first seed share Obtain, e.g., generate or receive, a first seed share. As noted above, "first" is used here simply as a label. share The "seed share" may be an integer or a string, and is preferably known only to the first party 102a. share can be generated randomly or pseudo-randomly. share It is not excluded that the first party 102a previously knew the share (share), but preferably each participant's seed share is not a share (i.e., component) of the common seed. The second participant 102b and the third participant 102c also Each seed share For example, the second participant 102b receives the second seed share Generate 102b.

[0059] The first participant 102b has a first master private key share , i.e., the shared master secret key share Generate a first master private key (share of a shared master private key). share is the No. 1 seed share (i.e., the first participant share ) and the seed of each of the other participants share For example, following the example above, the first master private key share The first, second, and third seeds share Similarly, the second participant 102b and the third participant 102c each generate a second master private key share and the third master private key share Generate.

[0060] First Master Private Key share After generating the first participant 102a, the first participant 102a generates one or more first private keys sharewhere each first private key share of different shared secret keys share Again, "first" is the master private key share The secret key is generated based on a function of share It is used as a label to refer to many different "first private keys." share Each of the other participants, e.g., the second participant 102b and the third participant 102b, may also have a "first private key share" of the shared secret key. share You can also generate a private key. share (e.g., first master private key share , and the first private key share Each of the private keys may be generated together at once, or may be generated as needed. share Each may be stored together or separately. share One or more of may be deleted after use.

[0061] In some embodiments, the first participant 102a is the first seed share The first data item may be generated based on, or as a function of, at least a first seed to generate a first component of the first data item. share That is, the first component may include applying a hash function to at least the first seed. shareThe first data item is part or all of a hash of the first data item. Any hash function may be used, such as SHA256, SHA512, etc. In some examples, a hash function that performs more than one hash operation may be used, such as a double hash, such as SHA256 followed by SHA256. The other participants similarly generate their respective data items. For example, the second participant 102b generates a second data item, and the third participant 102c generates a third data item. The first participant 102a obtains, e.g., receives, the other data item and generates a first master private key based on, i.e., as a function of, the first data item and the other data items. share The other participants generate their master private keys in a similar manner. share Generate.

[0062] Preferably, the hash function is a hash-based message authentication code (HMAC) function. In these examples, since the HMAC function requires two inputs, the first participant 102a receives the first seed share and another input to the HMAC. The other input is a different seed. share , the same seed share , or data known to each participant (e.g., a known integer or string). In these examples, the first component may be the entire output of the HMAC function, or a portion of the output (e.g., the left 256 bytes).

[0063] Each master private key share teeth, secret sharing That is, each participant 102 may use the following scheme to generate its share of the shared secret: secret sharing Participate in a secret sharing scheme, for example: secret sharing The scheme is jointly verifiable secret sharing Scheme (joint verifiable secret sharing scheme, JVRSS), or Shamir's secret sharingThis scheme may be the Shamir's secret sharing scheme (SSSS), or another scheme. For example, as mentioned above, in JVRSS, each participant generates t+1 random numbers a ij and then use these numbers as coefficients of a polynomial of degree t. Here, in the present invention, the first participant generates a value a i0 may be set to be the "first component", eg, a part or portion of the hash of the first seed. The "first data item" is f i (x)=a io +a i1 x+···+a it x t mod n, and First Master Private Key share teeth,

number

[0064] The concept of HD key structure (or HD wallet) is as described above. The first participant 102a has a private key share where each private key share is the first master key share The HD key structure can be ultimately derived from the parent private key share and / or child private key share Some secret keys may contain multiple levels of share is the private key of each child share 's parents, and their respective parent private keys share It can be both a child of a father and a daughter.

[0065] Before explaining how to generate the HD key structure, let us first consider the master private key share a i-master One exemplary method for generating master key a is provided. This particular example uses JVRSS to generate master key a master and defines the master private key as follows:

number

number

number

[0066] At this point, participant 102 has a secret master key a i-master The secret share , and the individual chaincode c corresponding to seed i i-master The participant 102 has some threshold share a i-master Since it has share If any of the keys are lost, the key can still be recovered. share If i is lost, the key can be re-derived using the seed of each participant i.

[0067] First Master Private Key share Based on the first secret key shareOptions for generating the first private key are described herein. One option involves the use of a set of auxiliary private keys, for example, an auxiliary HD key structure or an auxiliary wallet. The first participant 102a may use an existing set of auxiliary private keys or may generate a new set. Each first private key share is the first master private key share , and each one of a set of auxiliary private keys, i.e., it is a function thereof. For example, the first participant 102a may generate a shared HD key structure (or shared wallet) using an HD key structure that includes auxiliary private keys at different levels and / or positions in the structure, where the shared HD key structure includes the set of auxiliary private keys at the corresponding levels and / or positions. share For example, the parent private key in the shared HD key structure share can be generated based on the auxiliary parent private key at the corresponding position in the auxiliary key structure. Similarly, share may be generated based on the auxiliary private key at the corresponding position in the auxiliary key structure.

[0068] Each of the other participants 102 has the same secondary private key, as well as their respective master private key share using the same shared secret key. share can be similarly generated. To do so, each participant needs the same auxiliary private key. In some examples, each participant 102 uses a common master auxiliary private key known to each participant, and derives any other necessary auxiliary private keys from the master auxiliary private key.

[0069] In some examples, each participant derives the auxiliary master private key using a common seed. The common seed may be generated by one participant, e.g., the first participant 102a, and shared with the other participants 102. Alternatively, the common seed may be secret sharingThe common seed may be generated collectively using a scheme, e.g., JVRSS or SSSS. The common seed may be generated based on a first shared secret (e.g., a shared master secret) and a second shared secret (e.g., a blinding or obfuscating key). That is, each participant has their own unique knowledge of the first shared secret. share , and each of the second shared secrets share Each participant has two share and combine them into "combined share Participants generate a “combined share.” share can be shared with each of the other participants 102, i.e., the first participant 102a can share each of the share from other participants 102. share may then be combined, e.g., interpolated, to generate a common seed from which the supplementary master private keys are generated. If the shared secret is a threshold secret, then each of the other participants may share a common secret. share Rather than requiring a common share, the first participant 102a may require a threshold number of common shares to generate a common seed. share Only requires

[0070] The supplemental master private key may be generated by applying a hash function to at least the common seed. The hash function may be an HMAC function, in which case both the common seed and the additional seed are input to the HMAC function. The supplemental master private key may be part of the HMAC output, for example the left 256 bytes.

[0071] These embodiments can be used to create a shared HD wallet, e.g., a shared BIP32 wallet. For example, another BIP32 wallet can be used to store the key share a i-master added to sk parent , sk child , etc. The master private key sk masteris derived from the seed as usual and is known to all participants. The master private key is used to generate the new key share Although it is not used in the calculation of master The first child key derived from sk may be used, hereafter referred to as sk master’ Private child key share (private child key share) is defined as follows: a i-child =a i-master +sk parent’ And the grandchild key is: a i-grandchild =a i-master +sk child’ Here, sk child is used as a normal BIP32 child key. parent This means that the complete child private key (which hopefully never exists) is a child =a+sk parent and the equivalent equation for the subkey. These keys are defined as hardened or non-hardened depending on whether the secondary wallet key is hardened or not.

[0072] One option with this wallet is to use the value sk, which is the blinded private key a + ρ. master The goal is to have a shared secret key a, and to derive all further child keys from this to associate with the shared secret key a without any single party explicitly knowing a. Explicitly, the steps for this are: 1. Participants perform two rounds of JVRSS, one corresponding to a shared secret key a and the other corresponding to a blinding secret ρ. Each participant i obtains the corresponding secret key share a i and Blind Secrets share ρ i It has the following characteristics. 2. Each participant i has their secret share sum of a i +ρ i and broadcasts it to the other participants. 3. Each participant must have at least t+1 share Interpolate over the (addition shares) to find a + ρ. 4.This result is sk master is used as a seed in

number

number

[0073] First Master Private Key share Based on the first secret key share Another option for generating ∑ i ...

[0074] A shared HD key structure may be generated, where each private key share (i.e., child keys share ) are the parent private keys share , and the child private key share Each child private key is generated based on an index assigned to it, which specifies the key's position in the tree. sharealso have their respective parent private keys share More specifically, each child private key share may be generated based on a first term and a second term. The first term is the parent private key share In some examples, the first term is the parent private key share The second term can be at least the parent private key share or the corresponding public key into a hash function. The input to the hash function also generates the child private key share In some cases, the parent private key share and the index may be concatenated.

[0075] The child private key is generated by inputting the parent private key into a hash function. Sometimes referred to as a "hardened child private key." Similarly, a child private key generated by inputting a parent private key into a hash function. share is referred to below as the "hardener private key" share A child private key generated by inputting the public key corresponding to a parent private key into a hash function is sometimes called a "hardened child private key share." In contrast, a child private key generated by inputting the public key corresponding to a parent private key into a hash function is sometimes called a "non-hardened child private key." Similarly, a child private key generated by inputting the public key corresponding to a parent private key into a hash function is sometimes called a "non-hardened child private key." share is referred to below as the "non-hardened private key" share (“non-hardened child private key share”).

[0076] The hash function may be an HMAC function. sharemay be generated based on the first part of the HMAC output, for example the left 256 bytes if the HMAC uses the SHA256 hash function.

[0077] parent private key share Chaincode share may also be input to a hash function, for example if the hash function requires two separate inputs. The purpose of a chaincode is to add more entropy to the derivation of the child key. share Regarding the private key share Chaincode share can be the second part of the HMAC output, e.g., the chaincode share can be the right 256 bytes. share ("Target Key share The chaincode for the target key share share is the parent private key share , target key share and the parent private key share Chaincode share is based on.

[0078] The above example shows the parent private key share or parent private key share The child private key is derived using the public key corresponding to share can also be generated using a master public key, or more generally, a parent public key. share In these instances, there is no chaincode for the full private key, since the full private key itself does not exist. That is, the participants do not know the full private key. Each participant 102 therefore has access to each child private key derived in this manner. share That is, participants 102 may agree to use a common chaincode for each parent private key corresponding to the complete parent private key. shareEach parent chaincode share For example, the first participant 102 may receive the corresponding master chain code from each participant. share and obtain the first master private key share First master chain code of share Then, the first child private key share When generating a chain, the common chain code, the public key corresponding to the parent private key, and the first child private key are required. share The second term is generated by inputting the index of each of the subkeys into a hash function (e.g., an HMAC function). The public key and the index may be concatenated. share is derived using the public key, so share (“non-hardened key share”).

[0079] Below is the child private key share and how to generate the corresponding public key.

[0080] Hardened child keys can be derived using the sum of individual BIP32 terms.

number

[0081] Then, the grandchild key is

number

[0082] The second term in these equations is calculated using JVRSS, where the constant term of participant i's secret polynomial is

number

number

number

[0083] An equivalent relationship exists for the subkey, etc. Interpolating this result results in the child key above. By deriving the child key in this way, even if the key is compromised, it is not possible to calculate the child key. This is even more secure than a regular BIP32 wallet.

[0084] Below, the non-hardened key share We describe two methods for generating a hardened key. The first method is similar to the method for generating a hardened key described above. share Although it has the drawback that the individual public keys corresponding to each Token need to be shared, this can be done simultaneously as the corresponding chaincode, and in any case there is no additional communication. The second method solves this problem of needing to share more information, and can be computed by any external party with knowledge of the public keys and chaincode, like a regular BIP32 wallet.

[0085] In the first method, each participant in the shared secret scheme uses an equation to derive a child private key share is derived.

number

[0086] Pair (a i-child ,a child ·G) is the shared secret scheme share(a i , a·G) can be used in the same way.

number

[0087] In the second method, when considering the derivation of the first child key, due to the derivation of the master key, a single chaincode c parent does not exist. In this case, c parent is defined as follows:

number

[0088] Participants add their individual chaincodes to obtain the first parent chaincode. After the first unhardened child key is derived, the chaincode reverts to its normal definition.

[0089] Each participant in the scheme then derives the child private key using the equation share is derived.

number

number

[0090] 3 illustrates an exemplary method 300 according to some embodiments of the present invention. In step S301, the first participant 102a share In step S302, the first participant 102a receives the first seed. share Based on the first master private key shareIn step S303, the first participant 102a generates a first master private key share Based on this, the HD key structure is generated.

[0091] Master Private Key share The private key generated based on share (e.g., child private key share Parent private key related to share ) may be used as part of a signature scheme to sign a message and / or as part of an encryption scheme to encrypt a message, or may be used for other purposes.

[0092] For example, when used as part of a signature scheme, the first participant 102a may have a first private key share First sign the message using share The second participant 102b can similarly generate a second signature for the message: share Similarly, the third participant 102c generates a third signature share The first, second, and third signatures can be generated. share The signature scheme may be a threshold signature scheme, in which case a threshold number of signatures share may be required to generate the signature.

[0093] 4 shows one example of a method 400 for signing, according to some embodiments of the present invention. Steps S401 to S408 are performed in this example for each threshold number of participants 102 (including the first participant 102a). Step S409 is performed by the coordinator 101, who may also be one of the participants performing steps S401 to S408. It will be understood that some steps may be omitted or performed in a different order.

[0094] An example method 400 allows a group of N≧2t+1 participants to create a shared secret with a threshold (t+1), where the signature threshold is also (t+1).

[0095] Setup: In step S401, each participant 102 generates a child private key share a i-child , and the corresponding public key. share a i-child The generation of the child private key is described above. At this point, each participant i has share and the public key (a i-child , P), where P is the shared secret key, i.e., a i-child ·G, is the notation for the public key corresponding to the shared secret key, which has a threshold of (t+1).

[0096] Pre-calculation: In step S402, each participant 102 generates a shared ephemeral key share , and the corresponding public key. For example, each participant 102 can calculate a shared ephemeral key using JVRSSJ and the calculation of the public key given in the preamble. Each participant 102 then calculates a reverse ephemeral key based on the ephemeral private key. share This allows each participant to calculate their inverse share. share (k i -1 , r) as a result and have a threshold of (t+1).

[0097] In step S403, each participant 102 receives two different shared blind keys. share For example, each participant 102 creates a shared blinding key share. share α i =JVRSS(i) and β i = JVRSS(i), where each shared secret has a threshold (t+1). Note that in some instances, not all of the shared secrets need to have the same threshold.

[0098] In step S404, each participant 102 share Calculate the intermediary share and share For example, each participant i broadcasts the intermediate share λ i =k i -1 a i-child +β i This value has a threshold of (2t+1).

[0099] In step S405, each participant 102 share For example, each participant 102 calculates the intermediate value based on (2t+1) share Intermediate values ​​can be calculated using interpolation over λ = interpolate(λ1, ,λ 2t+1 )=k -1 a+β.

[0100] In step S406, each participant 102 pre-signs share For example, each participant i computes a pre-signature share. share σ i =λ-β i =(k -1 a+β)-β i Each participant 102 can calculate (r, k i -1 ,σ i ), and the private key share , and the corresponding public key (a i-child ,P) can be stored.

[0101] Note that since a different ephemeral key is used for each signature, multiple ephemeral keys can be set at once. That is, steps S402 through S406 can be repeated during pre-computation to create multiple ephemeral keys and store them for later use. These can be performed simultaneously, so that there are no additional rounds of communication. Note that preferably, different values ​​of α and β should be used for each signature.

[0102] Signature generation: To sign the message msg, at least (t+1) participants must perform steps S407 and S408.

[0103] In step S407, at least a threshold number of participants 102 obtain the message to be signed and calculate the message digest. For example, the coordinator 101 calculates the signature for the message msg. share A request can be sent to the (t+1)th participant to create a message digest e. Each participant i can compute a message digest e = hash(msg). In some examples, this hash function is a double SHA256 hash function. Alternative hash functions may be used.

[0104] In step S408, at least a threshold number of participants 102 sign share and sends it to the coordinator 101. For example, each participant i calculates their signature share s i =k i -1 e+rσ i and then calculate their signature share (r,s i ) to the coordinator. Note that the value r does not have to be sent by all participants.

[0105] In step S409, the coordinator 101 calculates a signature. For example, the coordinator 101 calculates a signature s=interpolate(s1, . . . , s t+1 )=k -1 Calculate (e+ar), and finally calculate the signature (r,s).

[0106] signature share There are several alternatives for precomputing messages that are independent of the components of (kα). These can be broadly divided into two sets of variations: including r in the calculation, and -1 These can be selected independently of each other, so there are eight variations on the method 400 above.

[0107] One change is to change (r, k i -1 ,σ i ) which means that r is pre-signed. share Another modification is that multiplication with r also involves intermediate share The calculation of λ in step S404 can also come earlier during the calculation of λ. i =rk i -1 a i-child +β i Then, in step S406, σ i =λ-β i =(k -1 a+β)-β i and signature share The calculation of s i =k i -1 e+σ i This is due to the definition that

[0108] Another modification is to use λ instead. i =α i a i-child +β i Calculate the result, λ=(kα) -1 (αa+β), and σ i=λ-(kα) -1 β i Two variations involving r at alternative points can be performed in combination with this. Each participant has knowledge of kα, as calculated in pre-computation step S402. In addition, all participants 102 have knowledge of their λ i share Therefore, each participant 102 broadcasts (at least) 2t+1 share and knowledge of the value kα. They can then calculate

number

[0109] Another modification is to use the intermediate values ​​λ = (αa + β) instead, and σ i =λ-β i Before signing as share Finally, the signature share is, s i =k -1 e+r(kα) -1 σ i Two variations on including r in the calculation can also be combined. Each participant 102 will have k i -1 They then use this to calculate (kα) -1 Calculate mod n, and then s i can be included in the calculation of

[0110] In summary, each participant 102 has four secrets: share It is possible to generate a i-child , k i , α i , β i In the exemplary method 400, two products need to be calculated: (kα) -1 a i-child =k i -1 used to calculate kα (these shareThe interpolation over k when α is cancelled -1 ), and k for use in signing using the first product -1 a. And share If is expanded, the calculation is i -1 a i-child =(kα) -1 α i a i-c gives kα and a i-child Consists of k i -1 share Any computation using α must first be performed by itself. i Calculate only (kα) -1 This can be done by multiplying

[0111] To summarize one version of the above scheme, a signature consists of a message-independent component (MIC) and a message-dependent component (MDC): share where MIC is the share (pre-signature share)σ i and the MDC is based on message e.

[0112] An equivalent scheme would be to compute the MIC as above, and then generate a signature consisting of just the MDC, e.g. share After interpolation, the signature share and incorporating it into the signature. Explicitly, the scheme may be the same up to the pre-computation step S406. Here, share is the r value, λ i =k i -1 a i-child r+β i so that after interpolation, this becomes -1 It is ar+β.

[0113] At this stage, participants are asked to i-1 ,λ,β i ), and the private key share and the corresponding public key (a i-child ,P) and store this.

[0114] Next, we sign a given message m, which is hashed to create a message digest e = hash(m). share To generate s i =k i -1 e+β i , and sends it to the coordinator. The coordinator then s=interpolate(s1, ,s t+1 )+λ =k -1 e+k -1 ar and since the β term cancels out, the expected signature share A similar variation of this protocol, as described above, results in (kα) -1 and r can be included in the calculation.

[0115] The following variations can be implemented to calculate message-independent components. i)λ=k -1 Calculate a+β and then sign share Now, s i =k i -1 e-rβ i and the signature is s=int(s1, ,s t+1 ) + rλ. ii) Calculate λ = αar + β, then sign share Now, s i =α i e-β i and the signature is s=(kα) -1 (int(s1,...,s t+1 ) + λ). iii) Calculate λ=αa+β and then sign share Now, s i =k i -1 e-rβ i and the signature is s=(kα) -1 (int(s1,...,s t+1 ) + λ). iv) Calculate λ = αar + β and then sign share Now, s i =k i -1 e-(kα) -1 β i and the signature is s=int(s1, ,s t+1 )+(kα) -1 λ). v) Calculate λ = αa + β and then sign share Now, s i =k i -1 er(kα) -1 β i and the signature is s=int(s1, ,s t+1 )+r(kα) -1 λ).

[0116] Note that the secret threshold can be different, i.e., to implement the signature generation scheme, child The thresholds for k, α, and β themselves do not necessarily have to be the same. For example, if there are six groups and three are needed to create signatures and / or private keys, they could technically perform calculations with k at a threshold of 4 and the other shared secrets at a threshold of 3, and still have a threshold-optimal scheme.

[0117] Note that the present invention can be applied to any threshold signature scheme (whether optimal or non-optimal) and is not limited to the particular schemes mentioned above.

[0118] In general, embodiments of the present invention can be used to generate a signature for any message. As a particular example, the message can be part or all of a blockchain transaction. That is, the signature can be used to sign one or more inputs and / or one or more outputs of the blockchain transaction. For example, the generated signature can be used, at least in part, to unlock an output of the blockchain transaction. As a particular example, the output of a previous transaction can be the output of a pay-to-public-key-hash (P2PKH) that is locked to the hash of a public key. To be unlocked, an input of a later transaction referencing the P2PKH output needs to include the (unhashed) public key and a signature generated based on the private key corresponding to the public key.

[0119] The "locking script" and "unlocking script", represented by the script, may take the following form: Locking script=OP_DUP OP_HASH160<Public KeyHash> OP_EQUAL OP_CHECKSIG Unlocking script= <signature><Public Key>

[0120] With reference to the above embodiment,<Public Key> is P=a child can be considered equivalent to G, and <signature>contains a threshold signature s, where the previous transaction is the message to be signed. Note that, as mentioned above, ECDSA signatures are of the form (r,s).

[0121] Note that the described signature generation method is not limited to any particular use case and may be used generally to generate a signature based on any message. Signing all or part of a blockchain transaction is just one example. The described method may be used, for example, to sign and / or approve legal documents (e.g., wills, deeds, or other contracts), communications between one or more parties, digital certificates (e.g., those issued by a certificate authority), medical prescriptions, bank transfers or financial instruments, mortgage or loan applications, etc.

[0122] As a specific example, a group of participants (e.g., five participants total) can form the board of directors of a company. A corporate vote may require the consent of a majority of the board (i.e., at least three participants) for a particular vote. The board can use the described signature generation method to prove that at least three directors agreed to vote in favor of a particular outcome. In this example, the threshold for the signature generation scheme is three. That is, for the coordinator to successfully generate a signature, at least three board members must agree to generate their respective signatures. share If a signature is successfully generated, at least a threshold number of board members (i.e., three) must agree to vote in favor of that outcome. Thus, successful generation of a signature serves as a record of the vote and proves that a majority of the board voted in a particular way.

[0123] Another example use of the present invention is in the field of digital certificates, for example, digital certificates issued according to the X.509 standard. A digital certificate contains a signature that signs over some data. While the data can generally be any data, one specific example of data included in a digital certificate is a public key. The public key in a digital certificate is often referred to as a "certified public key." The issuer of the digital certificate (a "certificate authority") can perform one or more checks on the owner of the public key (e.g., a "know-your-customer" check), and if the checks are successful, the certificate authority issues a digital certificate that includes the certification public key. Users can use the certification public key to prove who they are, for example, by signing messages with the private key that corresponds to the certification public key. One specific use for a certification authority is to sign certificates used in HTTPS for secure browsing on the Internet. Another common use is to issue identity cards by governments for use in digitally signing documents. The certificate authority uses its private key to sign the public key (or any other data to be certified).

[0124] As mentioned above, embodiments of the present invention involve the use of a private key share encrypting a message with the public key corresponding to share In this case, the first participant 102a can decrypt a message encrypted by another party. As another option, the message may be encrypted with a public key corresponding to a complete private key, e.g., a complete child key, in which case at least a threshold number of participants must have access to each of the child private keys in order to decrypt the message. share The encrypted message can constitute part or all of a blockchain transaction. For example, the encrypted data can be included in a transaction recorded on the blockchain.

[0125] CONCLUSION Other variations or uses of the disclosed techniques may become apparent to those skilled in the art once given the disclosure herein. The scope of the disclosure is not limited by the described embodiments, but rather is limited only by the appended claims.

[0126] It will be appreciated that the above embodiments have been described by way of example only. More generally, a method, apparatus, or program may be provided in accordance with any one or more of the following statements.

[0127] Statement 1. Private key share 1. A computer-implemented method for generating a metric, the method being performed by a first participant of a group of participants; 1st seed share Each participant receives their seed share and First master secret of the shared master secret share generating the first master private key share The first seed share , and each of the other participants' respective seeds share and each of the other participants has their own master private key share and the first master private key share One or more first private keys based on share and generating each first private key share is the value of each shared secret key. share and

[0128] Statement 2. A method according to statement 1, said method comprising: at least said first seed for generating a first component of a first data item; share into a hash function, with each other participant having their own data item; obtaining each of the data items generated by the other participants, and share is generated based on the first data item and the respective data items.

[0129] Statement 3. The method according to statement 2, wherein at least the first seed share The step of inputting the first seed into a hash function to generate a first HMAC value includes: share into an HMAC function, and the first data item is a first portion of the first HMAC value.

[0130] Statement 4. A method according to any preceding statement, comprising: share The First Secret share To generate secret sharing The first secret generated by running the scheme is the master private key.

[0131] Statement 5. A method according to any preceding statement, wherein the method comprises: share generating a hierarchical deterministic key structure of the first master private key share the one or more first private keys generated based on share are the parent private keys share and / or each child private key share each parent private key at a given level in said key structure share is one or more child private keys at subsequent levels in the key structure share is the parent of.

[0132] Statement 6. A method according to any preceding statement, said method comprising the step of obtaining one or more secondary private keys, wherein said one or more primary private keys share each of said first master private keys share , and a respective one of the one or more auxiliary private keys.

[0133] Statement 7. A method according to statement 5 or 6, the method including a step of generating a first auxiliary master private key, wherein each of the one or more auxiliary private keys is generated based on the first auxiliary master private key.

[0134] Statement 8. The method of statement 7, the method including the step of obtaining a common seed value, wherein each other participant has the same common seed value, and wherein the first auxiliary master private key is generated based on the common seed value.

[0135] Statement 9. The method of statement 8, wherein generating the common seed value comprises: Second Secret, Part 1 share To generate secret sharing executing a scheme, wherein the second secret is a second private key; the first master private key share , and a first private key of the second private key share Based on the first binding share generating a at least a predetermined number of other bonds share This is the step to obtain other bonds. share Each is generated by a different participant and has the master private key of each share , and each of the second private keys share is based on the steps The first bond share , and at least a predetermined number of other bonds share and generating the common seed value based on

[0136] Statement 10. The method according to statement 8 or 9, wherein the first auxiliary master private key share Generating the common seed value includes inputting the common seed value into a hash function.

[0137] Statement 11. The method of statement 10, wherein inputting the common seed value into a hash function includes inputting the common seed value into an HMAC function to generate a second HMAC value; and share is the first component of the second HMAC value.

[0138] Statement 12. The method of statement 5, wherein each first child private key share are the parent private keys share where each first child private key is generated based on share are generated based on the respective first terms and the respective second terms, and the respective first terms are generated based on the respective parent private keys share and each second term is generated based on at least i) a respective parent private key share or the corresponding public key, and ii) their respective first child private keys. share is generated by inputting each index of

[0139] Statement 13. The method of statement 12, wherein the method comprises: share For each parent private key share Each parent chaincode share wherein each second term comprises: iii) generating a first master chain code; share is generated by inputting it into a hash function.

[0140] Statement 14. The method of statements 5, 12, or 13, wherein the method comprises: 1st parent private key share First parent chaincode of share generating the first parent private key share is the first parent private key share Steps From each other participant, their parent chaincode share and Each parent chaincode share generating a common chaincode based on the obtaining a first parent public key corresponding to the first private key, and generating one or more first child keys based on the respective first terms and the respective second terms; share and each of the first terms is the first parent private key share each second term being generated based on at least i) a first parent public key, ii) a respective first child private key, share and iii) the common chain code is generated by inputting the respective indexes according to the common chain code into a hash function.

[0141] Statement 15. The method of any one of statements 12 to 14, wherein the hash function is an HMAC function.

[0142] Statement 16. A method according to any preceding statement, the method including performing a signing phase of a digital signature scheme, the performing step comprising: Acquiring the message, and the message and the first private key share The first signature is based on one of share generating a

[0143] Statement 17. The method of statement 16, wherein the message constitutes at least a portion of a blockchain transaction.

[0144] Statement 18. A computer device, a memory including one or more memory units; a processing device including one or more processing units; The memory stores code configured to be executed on the processing device, the code being configured to, when executed, cause the processing device to perform a method as described in any one of statements 1 to 17.

[0145] Statement 19. A computer program stored on a computer-readable storage medium and configured to perform the method of any one of statements 1 to 17 when executed on one or more processors.

[0146] According to another aspect disclosed herein, a method may be provided that includes actions of each participant.

[0147] According to another aspect disclosed herein, a system may be provided that includes a computer device of each participant.< / signature> < / signature>

Claims

1. 1. A computer-implemented method for generating shares of a private key, comprising: The method is performed by a computing device of a first participant of a group of participants; This is the step to acquire the first seed share. Each of the other participants has their own seed share. Steps and generating a first master private key share of a shared master private key; the first master private key share is generated based on the first seed share and the respective seed share of each other participant; and Each of the other participants has their own share of the master private key. Steps and generating one or more first private key shares of a first private key based on the first master private key share; Each first private key share is a share of a respective shared private key. Steps and A method comprising:

2. The method comprises: inputting at least the first seed share into a hash function to generate a first component of a first data item; Each of the other participants has a respective data item. Steps and obtaining said respective data items generated by other participants; the first master private key share is generated based on the first data item and the respective data items; Steps and The method of claim 1 , comprising:

3. The step of inputting at least the first seed share into a hash function comprises: inputting at least the first seed share into an HMAC function to generate a first HMAC value; the first data item is a first portion of the first HMAC value; The method of claim 2.

4. the first master secret key share is generated by executing a secret sharing scheme to generate shares of a first secret; The first secret is the master private key.

4. The method according to any one of claims 1 to 3.

5. The method comprises: generating a hierarchical deterministic key structure of private key shares; the one or more first private key shares generated based on the first master private key share are respective parent private key shares and / or respective child private key shares, each parent private key share at a given level in the hierarchical deterministic key structure is the parent of one or more child private key shares at a subsequent level in the hierarchical deterministic key structure; 5. The method according to any one of claims 1 to 4.

6. The method comprises: obtaining one or more auxiliary private keys; each of the one or more first private key shares is generated based on the first master private key share and a respective one of the one or more auxiliary private keys; 6. The method according to any one of claims 1 to 5.

7. The method comprises: generating a first auxiliary master private key; each of the one or more auxiliary private keys is generated based on the first auxiliary master private key; 7. The method according to claim 5 or 6.

8. The method comprises: obtaining a common seed value; Each of the other participants has the same common seed value, and the first auxiliary master private key is generated based on the common seed value; The method of claim 7.

9. generating the common seed value executing a secret sharing scheme to generate a first share of a second secret; the second secret is a second secret key; Steps and generating a first combined share based on the first master private key share and a first private key share of the second private key; obtaining at least a predetermined number of other binding shares; each of the other combined shares is generated by another participant and is based on a respective share of the master private key and a respective share of the second secret; Steps and generating the common seed value based on the first binding share and at least a predetermined number of other binding shares; The method of claim 8, comprising:

10. generating a first auxiliary master private key share; inputting the common seed value into a hash function; 10. The method according to claim 8 or 9.

11. Inputting the common seed value into a hash function comprises: inputting the common seed value into an HMAC function to generate a second HMAC value; and the first master secret key share is a first component of the second HMAC value; The method of claim 10.

12. each first child private key share is generated based on a respective parent private key share; each first child private key share is generated based on a respective first term and a respective second term; each said first term is generated based on a respective parent private key share; and each second term is generated by inputting at least i) a respective parent private key share or corresponding public key, and ii) a respective index of each first child private key share into a hash function; The method of claim 5.

13. The method includes, for each first child private key share: generating a respective parent chaincode share associated with each parent private key share; Each second term is generated by inputting iii) the first master chain code share into a hash function; The method of claim 12.

14. The method comprises: generating a first parent chain code share of the first parent private key share; the first parent private key share is a share of a first parent private key; Steps and Acquiring a parent chaincode share from each of the other participants; generating a common chaincode based on each parent chaincode share; obtaining a first parent public key corresponding to the first private key; generating one or more first child key shares based on each first term and each second term; each said first term is generated based on said first parent private key share; each second term is generated by inputting at least i) the first parent public key, ii) a respective index for each first child private key share, and iii) a common chain code into a hash function; and 14. The method of claim 5, 12, or 13.

15. The hash function is an HMAC function.

15. The method according to any one of claims 12 to 14.

16. The method comprises: performing a signing phase of a digital signature scheme; The performing step includes: Acquiring the message, and generating a first signature share based on the message and one of the first private key shares; 16. The method of any one of claims 1 to 15, comprising:

17. The message constitutes at least a part of a blockchain transaction.

17. The method of claim 16.

18. A computer device comprising: a memory including one or more memory units; a processing device including one or more processing units; the memory storing code configured to be executed on the processing unit; The code, when executed, is configured to cause the processing device to perform the method of any one of claims 1 to 17. Computer equipment.

19. A computer program comprising: stored on a computer-readable storage medium; configured to perform the method of any one of claims 1 to 17 when executed on one or more processors. Computer program.

Images