Threshold signature implementation method, and system and node

Abstract

A distributed threshold signature implementation method, comprising: in a distributed key generation phase, each of n participants generating a first random value and a second random value, performing homomorphic encryption thereon and then exchanging same with other participants, and each participant generating a private key share on the basis of the collected first random value and second random value and the sum of secret shares generated by means of a distributed key generation protocol; in a distributed signature offline phase, each of at least t+1 participants executing: updating its own private key share, generating its own third random value and a corresponding third random value public key, and performing broadcasting; and in a distributed signature online stage, each of the at least t+1 participants executing: after the third random value public keys are all collected, calculating the total coordinates of the third random value public keys, and calculating r in a signature share regarding a message on the basis of the total coordinates, and further calculating a component si of the signature share regarding the message on the basis of r, the third random value of said participant and the updated private key share of said participant, so as to obtain the signature share.

Description

A method, system and node for implementing threshold signature

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 31, 2023, with application number 202311119660.7 and application name “A method, system and node for implementing threshold signature”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of this specification belong to the field of cryptography technology, and in particular, relate to a method, system, and node for implementing threshold signatures. Background Art

[0003] In cryptography, public-key cryptography, also known as asymmetric cryptography, uses a public-private key pair (denoted as PK-SK, where PK stands for public key and SK stands for secret key). This contrasts with cryptography that uses only a private key. Public-key cryptography includes encryption algorithms and digital signature algorithms. Public-private key pairs are the cornerstone of modern cryptographic security. Many applications are based on PK-SK, such as the application-layer encrypted transmission protocol based on HTTPS (Hypertext Transfer Protocol Secure) and blockchain.

[0004] A private key typically represents the identity of the party that possesses it. It can only be held by the owner and cannot be made public, whereas the corresponding public key can be made public. Signing with a private key can indicate the owner's approval of certain information in the digital world. The signed information in a protocol message can also represent the owner's actions. Generally, a single owner possesses a private key. This owner can use their private key to sign a message and send it to another party. Upon receiving the signature, the recipient can verify it using the corresponding public key. If verification is successful, the recipient can confirm that the owner signed the message and that the signed message has not been tampered with.

[0005] Sometimes, accounts require flexible access control policies, especially in the case where multiple parties jointly control an account on a blockchain. Under some requirements, an account needs to be jointly controlled by n participants. In this way, actions to control this account, such as transferring funds, require the approval of all n participants to execute the transfer behavior of the account. Under other requirements, it is not necessary for all n participants to agree, but the account can be controlled when t + 1 of them (t + 1 < n, t is the threshold) agree, which can be achieved through threshold signatures. In this type of threshold cryptography, the private key information is shared among multiple independent participants, and each private key calculation requires the agreement of multiple participants, thereby improving the security of the algorithm; moreover, when a small number of participants fail or become unavailable, it does not affect the availability of the private key. A secure (t, n) threshold cryptography algorithm should satisfy: (1) Any number of participants more than t can calculate the final signature, exchanged key, or plaintext, while t or fewer participants cannot obtain any information about the above results; (2) No information about the private key and the private key shares of the participants is leaked during the execution of the algorithm.

[0006] Summary of the Invention

[0007] The object of the present invention is to provide a method, system, and node for implementing threshold signatures, including:

[0008] A method for implementing distributed threshold signatures, including: Distributed key generation phase: Each of the n participants generates a first random value and a second random value respectively, and after homomorphic encryption, exchanges them with other participants; Each participant generates a private key share based on the sum of the first random value and the second random value collected and the secret share generated through the distributed key generation protocol; Offline phase of distributed signature, each of at least t + 1 participants performs: updating its own private key share, generating its own third random value and the public key corresponding to the third random value, and broadcasting; Online phase of distributed signature, each of the at least t + 1 participants performs: after collecting the public keys of the third random values, calculating the total coordinates of the public keys of the third random values, and calculating r in the signature share for the message based on the total coordinates, and also calculating the component s of the signature share for the message based on r, its own third random value, and the updated own private key share i , thereby obtaining the signature share.

[0009] A computer device, including:

[0010] A processor;

[0011] And a memory, in which a program is stored, and when the processor executes the program, the following operations are performed:

[0012] Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol;

[0013] Update its own private key share, generate its own third random value and corresponding third random value public key, and broadcast them;

[0014] After collecting the third random value public key, calculate the total coordinates of the third random value public key, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i , thus obtaining the signature share.

[0015] A storage medium for storing a program, wherein the program performs the following operations when executed:

[0016] Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol;

[0017] Update its own private key share, generate its own third random value and corresponding third random value public key, and broadcast them;

[0018] After collecting the third random value public key, calculate the total coordinates of the third random value public key, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i , thus obtaining the signature share.

[0019] The above solution provided in this application can support any threshold value. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0021] FIG1 is a schematic diagram of distributed threshold key generation in one embodiment;

[0022] FIG2 is a schematic diagram of a distributed threshold signature in one embodiment. DETAILED DESCRIPTION

[0023] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0024] The DKG (Distributed Key Generation) protocol is a distributed protocol that generates a set of keys through collaboration among multiple parties. The VSS (Verifiable Secret Sharing) protocol is an important theoretical foundation for the DKG protocol.

[0025] VSS allows for sharing secret data between multiple parties. Without leaking the secret data itself, the data can be split into multiple shards, each of which is kept by a different party. Later, when restoring the secret data, all shards must be collected to successfully restore the complete secret data.

[0026] The VSS protocol, first proposed by Shamir in 1979, is a polynomial-based secret sharing protocol. The VSS protocol is derived from Shamir's Secret Sharing (SSS), so we'll first introduce Shamir's Secret Sharing.

[0027] Shamir secret sharing includes two stages: secret sharing (or secret distribution) and secret reconstruction. First, a dealer needs to construct a polynomial: f(x) = a0 + a1x + a2x 2 +…+a n x n Polynomial(*)

[0028] Among them, a0 is the secret data to be shared.

[0029] This n-degree polynomial consists of a set of coefficients (a0, a1, a2, ..., a n ) is uniquely determined, and this set of coefficients includes n+1 values. In this way, if it is known that the curve corresponding to the n-degree polynomial passes through n+1 different points on the plane, the coordinates of n+1 different points are obtained (x1, y1), (x2, y2), ..., (x n ,y n ),(x n+1 ,y n+1), we can get a set of (n+1) linear equations of n+1 equations, and from this set of equations we can determine the n+1 coefficients a0, a1, a2, ..., a n The value of the polynomial (*) is determined, and finally the value of the secret data a0 is obtained. The coordinates of the n+1 different points (x1, y1), (x2, y2), ..., (x n ,y n ),(x n+1 ,y n+1 ) means n+1 secret shards.

[0030] The process of finding a curve passing through a number of existing points is called polynomial interpolation. There are many ways to implement polynomial interpolation. The following is a common Lagrange interpolation method. Given an nth degree polynomial*, it is known that the corresponding curve of the polynomial passes through n+1 points (x1, y1), (x2, y2), ..., (x n ,y n ),(x n+1 ,y n+1 ), then the polynomial of the n-degree curve can be obtained by Lagrange interpolation as follows:

[0031] Polynomial (**) and polynomial (*) are actually equivalent. If x = 0 in polynomial (*), then f(0) = a0, which means the value of the secret data a0 can be obtained. Therefore, if x = 0 in polynomial (**), the value of the secret data a0 can also be obtained, that is, f(0) = a0.

[0032] For n+1 points (x1,y1),…,(x n ,y n ),(x n+1 ,y n+1 ), the above polynomial (**) can also be expressed as:

[0033] in, Similarly, for constant terms or secret values, we have

[0034] In summary, we can select any n+1 points on the polynomial and share these n+1 points among n+1 participants, for example, each participant receives the coordinates of one point. Collecting the coordinates of any fewer than n+1 points will not reveal the original secret data a0. Only after obtaining all n+1 points can the value of secret data a0 be restored by reconstructing the polynomial coefficients. Furthermore, even if we collect the coordinates of fewer than n+1 points, for example, n points, the value of secret data a0 will not be revealed probabilistically, as there are an infinite number of n-degree curves passing through these n points. The degree n here is also called the degree of the polynomial.

[0035] On this basis, threshold Shamir secret sharing can be implemented. For example, t-of-n secret sharing is to share a secret between n participants, and stipulate that the threshold of the minimum secret shards required for recovery is greater than t, that is, greater than or equal to t+1. For example, in a transaction involving four parties, the agreed threshold is 3, that is, n=4, t=2, then the secret can only be restored when greater than or equal to t+1=3 participants provide their own secret shards, otherwise the secret cannot be restored. Specifically, a polynomial of degree t=2 can be constructed: f(x)=a0+a1x+a2x 2 Polynomial(***)

[0036] The curve corresponding to the 2-degree polynomial can be obtained to pass through 4 different points on the plane, that is, the coordinates of 4 different points are obtained (x1, y1), (x2, y2), (x3, y3), (x4, y4), and the coordinates of these 4 points are distributed to one participant respectively during the secret sharing phase. The 4 participants are set as Party1, Party2, Party3, and Party4. In this way, it is assumed that Party1 has a slice (x1, y1), Party2 has a slice (x2, y2), Party3 has a slice (x3, y3), and Party4 has a slice (x4, y4). Since the polynomial (**) can be determined by any 3 points on the corresponding curve, therefore, Party i In (i∈{1,2,3,4}), when any three participants provide their own secret shards, the polynomial (***) can be restored during the secret reconstruction phase, thereby obtaining the secret value a0. If fewer than three participants provide their own secret shards, the polynomial (***) cannot be restored, and the secret value a0 cannot be obtained. The above t is also called the threshold.

[0037] The aforementioned Shamir Secret Sharing and Threshold Shamir Secret Sharing require a role to generate polynomials and distribute secret shards. This role can be called a dealer. This dealer is an entity that knows the secret and must be a trusted third party by all participating parties. Furthermore, an entity is required to aggregate at least t+1 shards and derive the secret. This entity can be the dealer, a participating party, or another entity.

[0038] In engineering practice, polynomials are often defined in finite fields (based on elliptic curves or discrete logarithms) or prime number fields (based on RSA), rather than real number fields or natural number fields.

[0039] The classic Shamir secret sharing scheme assumes that all participants are honest. However, dishonest behavior, or malicious behavior, is possible. For example, a dealer could deceive one or more participants by sending incorrect secret shards to them.

[0040] In secret sharing, to verify malicious behavior, such as verifying whether the dealer is deceiving them (as described above, verifying whether the dealer sends an incorrect secret fragment), Verifiable Secret Sharing (VSS) is proposed. Feldman VSS is a practical VSS scheme based on Shamir's secret sharing, including:

[0041] The dealer has a secret and distributes n fragments of this secret to n participants, of which t+1 participants can reconstruct the secret. A similar threshold Shamir secret sharing scheme can be used to construct a t-degree polynomial: f(x) = a0 + a1x + a2x 2 +…+a t x t Polynomial (****)

[0042] Dealer is for each party i Choose any non-zero x i , calculate s i =f(x i ), and the sub-secret s i Encrypted and sent to the participating party i At the same time, the Dealer calculates Where j = 0, 1, 2, ..., t, and A is public j , that is, {A0,A1,A2,…,A t}. A j Also called public authentication parameters. Here A jThe method of generating the public key is the same as the method of generating the public key based on the private key on the elliptic curve. Therefore, A j It can also be called public key sharding or public key sharing.

[0043] For the case where the selected polynomial corresponds to an elliptic curve, the public A j It is safe because according to the properties of elliptic curves, it is impossible to j Reverse to get a j .

[0044] Public verification parameters {A0,A1,A2,…,A t} is also called a commitment. Since the commitment is bound to the coefficients of the polynomial, it can be used to verify whether a value of the polynomial is correct. In the implementation based on discrete logarithms, g is a generator of the cyclic group over a finite field. g can be between Dealer and Party. i The above sub-secrets are also called secret shares.

[0045] The participants receive the sub-secret s i After that, public verification parameters can be used to verify s i The validity of s can be verified by verifying whether the following equation holds: i Validity:

[0046] The right side of the polynomial (*****) can be derived as follows:

[0047] The right side of the polynomial (*****) can also be written as:

[0048] It can be seen that for Party i , a non-zero x selected by the Dealer i , x i For example, if it is i, then Party i It is possible to use i and public verification parameters {A0,A1,A2,…,A t}Calculate the right side of the polynomial (*****) and use the generator g and the sub-secret s i To calculate the left side of the polynomial (*****), we can determine whether the left and right sides of the polynomial (*****) are equal. Is it {A0,A1,A2,…,A t} corresponds to a point on the curve. This verification belongs to the verification of the secret distribution phase. For simplicity, we can usually take x i =i.

[0049] In engineering, it is generally implemented based on discrete logarithms. Modulo operations are used for the above equations, such as mod p, where p is a large prime number and p is also the value of Dealer and Party. i Pre-configured. mod p is also omitted in the following similar places.

[0050] During the secret reconstruction phase, for example, if at least t+1 participants each send their own secret shards to the dealer, the dealer can verify each secret shard using the public verification parameter corresponding to the polynomial. Failure to verify can be used to prove that the party sending the secret shard is malicious; secret shards that pass verification can be used as the basis for reconstructing the secret.

[0051] In the secret reconstruction phase, after collecting the secret shards of at least t+1 participants, the polynomial f(x) can be reconstructed through the Lagrange interpolation method to obtain the value of f(0), that is, the secret value.

[0052] In addition, through the public verification parameters {A0,A1,A2,…,A t The legitimacy of the secret a0 can also be verified, that is, it can be verified whether (0, a0) is a point on the curve, because the following relationship exists:

[0053] In other words, the verification of the legitimacy of the secret a0 can be simplified to being achieved through the public verification parameter A0.

[0054] In the above derivation, define 0 0 =1, and 0 k =0, k≠0.

[0055] The above solution requires a dealer, a centralized entity with access to the secret. As mentioned above, it needs to be a trusted third party, or in other words, all parties must trust the dealer. In a distributed scenario, both distributed secret distribution and distributed secret reconstruction are required. This requires eliminating the centralized dealer, thus achieving trustlessness. To address this problem, Rabin et al. proposed an improved protocol called Joint-Feldman in 1999. The basic idea of ​​this protocol is to execute the Feldman VSS protocol n times in parallel, with each participant generating a random polynomial locally and then sharing the randomly selected secret value among all participants. Since what is shared is a commitment to the secret, rather than the secret itself, the secret cannot be recovered unless there is collusion by multiple participants exceeding a threshold t. This distributed VSS protocol that eliminates the trusted third party is also called DVSS (Distributed VSS).

[0056] Specifically, taking four participants as an example, assuming the threshold t = 2, then the degree of the polynomial is also 2. The decentralized threshold secret sharing, also known as the Joint-Feldman implementation, includes the following:

[0057] Each P i (Party i Abbreviated as P i , i∈{1,2,3,4}) sets the secret s to be shared i0 , and randomly choose other parameters to generate a t-degree polynomial:

[0058] Participant P1 generates a 2nd degree polynomial:

[0059] f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 It is the secret s1 set by P1;

[0060] Participant P2 generates a 2nd degree polynomial:

[0061] f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 It is the secret s2 set by P2;

[0062] Participant P3 generates a 2nd degree polynomial:

[0063] f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 It is the secret s3 set by P3;

[0064] Participant P4 generates a 2nd degree polynomial:

[0065] f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret s4 set by P4.

[0066] Then, each participant P i Generate n values ​​on the curve corresponding to its own t-degree polynomial and distribute them. Here we still assume n = 4, t = 2, n = 1, 2, 3, 4, then:

[0067] Participant P1 generates s 11 =f1(1),s12 =f1(2),s 13 =f1(3),s 14 =f1(4), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 to P4;

[0068] Participant P2 generates s 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23 To P3, encrypt and send 24 to P4;

[0069] Participant P3 generates s 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 to P4;

[0070] Participant P4 generates s 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s 44 =f4(4), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3.

[0071] Moreover, each participant P i It also generates the public verification parameters corresponding to its own t-degree polynomial Where k = 0, 1, ..., t, and is announced to each participant. Specifically:

[0072] Participant P1 generates k=0,1,…,t,including Broadcast 10 ,A 11 ,A 12} to P2, P3 and P4;

[0073] Participant P2 generates k=0,1,…,t,including Broadcast 20 ,A 21 ,A 22} to P1, P3 and P4;

[0074] Participant P3 generation k=0,1,…,t,including Broadcast 30 ,A 31 ,A 32} to P1, P2 and P4;

[0075] Participant P4 generation k=0,1,…,t,including Broadcast 40 ,A 41 ,A 42} to P1, P2 and P3.

[0076] In this way, P1 receives s 21 After that, you can use {A 20 ,A 21 ,A 22} to verify; P1 receives s 31 After that, you can use {A 30 ,A 31 ,A 32} to verify; P1 receives s 41 After that, you can use {A 40 ,A 41 ,A 42} for verification; the verification method is similar to the above and will not be repeated here.

[0077] Similarly, P2 receives s 12 After that, you can use {A 10 ,A 11 ,A 12} to verify; P2 receives s 32 After that, you can use {A 30 ,A 31 ,A 32} to verify; P2 receives s 42 After that, you can use {A 40 ,A 41 ,A 42} to verify;

[0078] Similarly, P3 receives s 13 After that, you can use {A 10 ,A 11 ,A12} to verify; P3 receives s 23 After that, you can use {A 20 ,A 21 ,A 22} to verify; P3 receives s 43 After that, you can use {A 40 ,A 41 ,A 42} to verify;

[0079] Similarly, P4 receives s 14 After that, you can use {A 10 ,A 11 ,A 12} to verify; P4 receives s 24 After that, you can use {A 20 ,A 21 ,A 22} to verify; P4 receives s 34 After that, you can use {A 30 ,A 31 ,A 32} for verification.

[0080] Assume that the set of participants that pass the verification after verification is Qual, and Qual = {P1, P2, P3, P4}, then:

[0081] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 , and public authentication parameters {A 10 ,A 11 ,A 12}, {A 20 ,A 21 ,A 22}, {A 30 ,A 31 ,A 32}, {A 40 ,A 41 ,A 42};

[0082] P2 locally has different secret shares s generated by different parties 12 、s 22 、s 32 、s 42 , and public authentication parameters {A 10 ,A 11 ,A 12}, {A 20 ,A 21 ,A 22}, {A 30 ,A 31 ,A 32}, {A 40 ,A 41 ,A 42};

[0083] P3 locally has secret shares s generated by different parties 13 、s 23 、s 33 、s 43 , and public authentication parameters {A 10 ,A 11 ,A 12}, {A 20 ,A 21 ,A 22}, {A 30 ,A 31 ,A 32}, {A 40 ,A 41 ,A 42};

[0084] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 , and public authentication parameters {A 10 ,A 11 ,A 12}, {A 20 ,A 21 ,A 22}, {A 30 ,A 31 ,A 32}, {A 40 ,A 41 ,A 42}.

[0085] then:

[0086] Participant P1 can calculate the secret share s1 as: s1 = s 11 +s 21 +s 31 +s 41 ;

[0087] Participant P2 can calculate the secret share s2 as: s2 = s 12 +s 22 +s 32 +s 42 ;

[0088] Participant P3 can calculate the secret share s3 as: s3 = s 13+s 23 +s 33 +s 43 ;

[0089] Participant P4 can calculate the secret share s4 as: s4 = s 14 +s 24 +s 34 +s 44 ;

[0090] Each participant P i The secret share s calculated by itself can be i Broadcast to other participants. Then each participant P i After collecting at least threshold t+1 secret shares from {s1,s2,s3,s4}, the secret s0 can be reconstructed. Here, for t=2, each participant P i After collecting at least a threshold of t+1=2+1=3 secret shares, the secret s0 can also be reconstructed.

[0091] This is because the sum of the curves of each participant can be aggregated to obtain the total curve:

[0092] f(z)=f1(z)+f2(z)+f3(z)+f4(z)

[0093] f(z)=(a 10 +a 11 z+a 12 z 2 )+(a 20 +a 21 z+a 22 z 2 )+(a 30 +a 31 z+a 32 z 2 )+(a 40 +a 41 z+a 42 z 2 )

[0094] f(z)=(a 10 +a 20 +a 30 +a 40 )+(a 11 +a 21 +a 31 +a 41 )z+(a 12 +a 22 +a 32 +a 42 )z 2 Polynomial (I)

[0095] so:

[0096] s1=s 11 +s 21 +s 31 +s 41 =f1(1)+f2(1)+f3(1)+f4(1);

[0097] s2=s 12 +s 22 +s 32 +s 42 =f1(2)+f2(2)+f3(2)+f4(2);

[0098] s3=s 13 +s 23 +s 33 +s 43 =f1(3)+f2(3)+f3(3)+f4(3);

[0099] s4=s 14 +s 24 +s 34 +s 44 =f1(4)+f2(4)+f3(4)+f4(4);

[0100] For the total curve f(z), there is a relationship:

[0101] s1=f1(1)+f2(1)+f3(1)+f4(1)=f(1);

[0102] s2=f1(2)+f2(2)+f3(2)+f4(2)=f(2);

[0103] s3=f1(3)+f2(3)+f3(3)+f4(3)=f(3);

[0104] s4=f1(4)+f2(4)+f3(4)+f4(4)=f(4);

[0105] The secret is s0=a 10 +a 20 +a 30 +a 40 .

[0106] In this way, any participant P iAfter collecting at least three of the secret shares s1, s2, s3, and s4, we can obtain at least three points on the curve corresponding to polynomial (I), that is, at least three of the four coordinates (x1=1, y1=s1), (x2=2, y2=s2), (x3=3, y3=s3), and (x4=4, y4=s4), thereby recovering the total curve f(z). Furthermore, we can calculate f(0)=a 10 +a 20 +a 30 +a 40 =s0, so the secret s0 can be obtained.

[0107] Furthermore, by verifying the parameter {A 10 ,A 11 ,A 12}, {A 20 ,A 21 ,A 22}, {A 30 ,A 31 ,A 32}, {A 40 ,A 41 ,A 42} can also be used to secret s i The legitimacy of (0,s i ) is a point on the total curve. Specifically, the legitimacy is determined by verifying whether the following equation holds:

[0108] This is because the following relationship exists:

[0109] It is usually also assumed that the right side of the polynomial (II) is the public key share, denoted as pub i ,i=1,2,…,n, used to verify the corresponding private key share.

[0110] As mentioned above, we can generally take x i =i for each i=1,2,…,n. In this way, i can be used as the number of each participant.

[0111] For the verification of secret s0, that is, x i =0, the above formula can be further deduced as follows:

[0112] Definition 0 0 =1, and 0 k =0, k≠0, so the above formula can be further deduced:

[0113] It can be seen that based on the polynomial (III), the legitimacy of s0 can be verified.

[0114] Moreover, based on the derivation of the above polynomial (III), the verification of the legitimacy of s0 can be further simplified as follows:

[0115] It is also common to assume that the right side of the equal sign of polynomial (Ⅳ) is the total public key, denoted as pub.

[0116] The Joint-Feldman protocol described above enables distributed secret sharing, fulfilling the core concept of DKG. The series of secret sharing implementations, from Shamir to Threshold Shamir, the Feldman VSS protocol, and finally the Joint-Feldman DVSS protocol, is a series. In addition to the series of schemes starting with Shamir's secret sharing, there are also schemes based on Additive Secret Sharing, SPDZ (a key protocol in multi-party secure computation, first proposed in 2012), or the Chinese Remainder Theorem, which can ultimately achieve DKG. These are omitted here and will not be further elaborated.

[0117] Through the implementation of the above DKG protocol, the problem of single point failure resulting in overall unavailability caused by the generation of keys by a single entity can be overcome, as well as the problem of needing to trust a single point of key generation. i Broadcast the generated secret share s ij ,i,j∈(1,2,…,n), n is the number of participants, and each participant P i The secret share s calculated by itself can be i Broadcast to other participants, so that each participant P i After collecting at least a threshold of t+1 secret shares from {s1,s2,s3,s4}, the secret s0 can be reconstructed. This means that at least t+1 participants will obtain the final reconstructed secret s0, which will expose the secret s0 and make the overall curve unusable. To generate a new secret s0 next time, the DKG protocol process must be repeated.

[0118] The DKG protocol's properties regarding thresholds and secret commitments, combined with the matching threshold signature algorithm, can be used to construct a distributed threshold signature protocol. As a distributed system, blockchains make extensive use of signature algorithms. In this way, nodes in a blockchain generate secret shares in a distributed manner using DKG. After at least t+1 blockchain nodes use these secret shares as private key shares to sign the signature information and broadcast it, any blockchain node that has collected at least t+1 signature shares can recover the total signature and, using the aforementioned method, the total public key. This recovered total signature can then be verified using this total public key, thus implementing threshold signatures. Furthermore, this approach offers the advantage that each blockchain node's secret shares do not need to be broadcast to other nodes, thus preventing the exposure of their own secret shares and, consequently, private keys. Therefore, secret shares generated by a single DKG can be reused multiple times, eliminating the need to perform a complete DKG protocol for each threshold signature.

[0119] National cryptography refers to domestically produced cryptographic algorithms approved by the State Cryptography Administration, primarily including SM1, SM2, SM3, and SM4. In public key cryptography, the most widely used are ECC (Elliptic Curve Cryptography, an asymmetric (or public key) encryption algorithm based on the discrete logarithm problem, expressed as addition or multiplication of points on an elliptic curve) and RSA (an asymmetric cryptographic algorithm based on the difficult problem of factoring the product of the multiplication of two large prime numbers in number theory, named after the initials of its three inventors: Ron Rivest, Adi Shamirh, and Leonard Adleman). While maintaining the same security strength, ECC uses significantly smaller private key bits and smaller system parameters than RSA. This means that ECC requires significantly less storage space, lower transmission bandwidth, and fewer logic gates for hardware implementations, all while consuming less power. These advantages make ECC a public-key cryptography algorithm with promising development and application prospects. By 2000, several countries and industry organizations had adopted ECC as a public-key cryptography algorithm standard. Against this backdrop, my country began conducting research on ECC with independent intellectual property rights in 2001. By applying internationally recognized public-key cryptography algorithm design and security analysis theories and methods, and drawing on existing ECC research results both domestically and internationally, China developed the SM2 algorithm in 2004. The SM2 algorithm was first publicly released in December 2010, became China's commercial cryptography standard (GM / T0003-2012) in March 2012, and became China's national cryptography standard (GB / T32918-2016) in August 2016.

[0120] SM2 includes digital signature algorithms, key exchange protocols, and public key encryption algorithms. The basic SM2 signature algorithms include:

[0121] The signing party Alice chooses an elliptic curve E q (a, b) and base point g, and share this information with the verifier Bob, where q is the modulus;

[0122] Alice in a finite field Select a private key And generate the public key X=g based on the private key x ;

[0123] Alice in a finite field Select a random number And calculate K = g k =(x1,y1), where x1 and y1 are the horizontal and vertical coordinates of point K on the elliptic curve respectively;

[0124] Alice hashes the message m to be signed to obtain the digest value H(m), and calculates: r = H(m) + x1 mod q Formula (a)

[0125] And based on this calculation: s=(1+x) -1 (kr x) mod p; Formula (b)

[0126] Alice generates a signature σ = (r, s) and sends the message m, signature σ, and public key X to the signer Bob.

[0127] Bob uses the base point g, signature σ, and public key X to calculate the point K ′ Coordinates: K′=g s ·X r+s =(x′1,y′1) Formula (c)

[0128] Bob uses r in the signature σ, the message m, and the horizontal coordinate x′1 of the point K′ to verify the following equation: r=H(m)+x′1mod q Formula (d)

[0129] If the above equation holds, the signature is valid; otherwise, the signature is invalid.

[0130] This is because it is equivalent to verifying that the coordinates of point K′ (x′1, y′1) are equal to the coordinates of point K (x1, y1) used in the signature:

[0131] (x′1,y′1)=s·G+(r+s)·x·G=(1+x)·s·G+r·x·G=(kr·x)·G+r·x·G=k·G=(x1,y1)

[0132] Or it can be expressed in exponential form as follows:

[0133]

[0134] The above basic SM2 signature algorithm can be extended to a threshold signature algorithm. For example, through the above DKG process, n signers P1, P2, …, P n each have their own secret shares and there is a total public key, where the threshold value is t and t < n. Among the n participants, at least t + 1 signers each use their own secret shares as private key shares respectively, sign the same message to be signed and broadcast it. Any verifier that collects at least t + 1 signature shares can recover the total signature and can use the total public key to verify the total signature, thus realizing threshold signature. In the article "SM2 Elliptic Curve Threshold Cryptography Algorithm" published by Shang Ming et al. in the Journal of Cryptology in 2014, a distributed signature algorithm based on SM2 that satisfies the t - n threshold was constructed. That is, n participants generate private key shards and corresponding public keys respectively through a protocol, and at least t + 1 of the n participants need to participate in the SM2 distributed signature protocol to generate the corresponding SM2 signature and verify it. The disadvantage of this algorithm is that the above (t, n) must satisfy n ≥ 2t + 1, which makes the application very inflexible. For example, this algorithm cannot satisfy the (2, 4) threshold or the (2, 3) threshold, which are the most frequently used in actual use.

[0135] The above relationship can be represented by the distributed threshold key generation in Figure 1 and the distributed threshold signature in Figure 2.

[0136] The embodiment of the present application provides a distributed threshold signature method based on SM2.

[0137] The embodiment of the present application can include two parts, namely distributed threshold key generation and distributed threshold signature. These two parts are both processes in which participants stipulate how to transmit data to each other and how to process data through a protocol, so as to cooperate to achieve a specific purpose.

[0138] The process of the distributed threshold key generation protocol is introduced first below. In this process, it is assumed that there are n participants, namely P1, P2, …, P n . Through the distributed threshold key generation protocol, each participant P i (i = {1, 2, …, n}) can generate their own private key share x′ i .

[0139] Each participant P i can generate its own public - private key pair for homomorphic encryption, such as Paillier public - private key pair (E i , ei ), where e i is the private key, E i is the corresponding public key. Homomorphic encryption technology can process plaintext data "homomorphically", that is, map the plaintext data to a new, confidential state, so that only the recipient with the key can obtain the plaintext data. Paillier homomorphic addition is a public key encryption system widely used in cryptography, proposed by Pascal Paillier in 1999. Its main feature is that it has additive homomorphic properties, which means that given two ciphertexts, the ciphertext of the sum of their corresponding plaintexts can be calculated without decryption. Specifically, suppose there are two plaintexts m1 and m2, and their Paillier encrypted ciphertexts are c1 and c2 respectively. Paillier's additive homomorphic property can realize the calculation of the product of c1 and c2 to obtain a new ciphertext c, which is exactly the ciphertext of the sum of m1 and m2. The additive homomorphic property is an important feature of the Paillier encryption algorithm, which can be simply expressed as: E(m1)·E(m2)=E(m1+m2), where the point product·is the subsequent homomorphic addition This homomorphic property allows certain forms of computation to be performed on encrypted data without revealing the original data.

[0140] Each participant P i After generating a homomorphically encrypted public-private key pair, the public key can be sent to other parties.

[0141] For example, after participant P1 generates the Paillier-encrypted public-private key (E1, e1), it broadcasts the homomorphically encrypted public key E1 to other participants; after participant P2 generates the Paillier-encrypted public-private key (E2, e2), it broadcasts the homomorphically encrypted public key E2 to other participants; after participant P3 generates the Paillier-encrypted public-private key (E3, e3), it broadcasts the homomorphically encrypted public key E3 to other participants; after participant P4 generates the Paillier-encrypted public-private key (E4, e4), it broadcasts the homomorphically encrypted public key E4 to other participants; after participant P5 generates the Paillier-encrypted public-private key (E5, e5), it broadcasts the homomorphically encrypted public key E5 to other participants.

[0142] Each participant P i A second random value γ can be generated i , there are 5 participants P1, P2, P3, P4, P5, which generate the second random values ​​γ1, γ2, γ3, γ4, γ5 respectively. i The secret value γ generated by each i The sum is γ, that is

[0143] Moreover, each participant P i A t-degree polynomial f can be generated i (z) = a i0 +a i1 z+a i2 z 2 +…+a it z t , where a i0 It's P i The secret of the setting, here set to γ i The threshold here is t, so the degree of the polynomial is also t.

[0144] Assume the threshold is 2 and the total number of participants is 5, that is, t = 2, n = 5. There are 5 participants P1, P2, P3, P4, and P5, and they use their own secret values ​​γ1, γ2, γ3, γ4, and γ5 to construct the polynomial, where:

[0145] P1 generates a 2nd degree (t=2) polynomial: f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 is the secret γ1 set by P1;

[0146] P2 generates a 2nd degree (t=2) polynomial: f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 is the secret γ2 set by P2;

[0147] P3 generates a 2nd degree (t=2) polynomial: f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 is the secret γ3 set by P3;

[0148] P4 generates a 2nd degree (t=2) polynomial: f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret γ4 set by P4;

[0149] P5 generates a 2nd degree (t=2) polynomial: f5(z)=a 50 +a 51 z+a 52 z 2 , where a 50It is the secret γ5 set by P5;

[0150] Furthermore, each participant P i You can generate n secret shares, keep one of them for yourself, and encrypt and send the rest to other participants. i Generate the coordinates of n points on the curve corresponding to its own polynomial as n secret shares, retain the coordinates of one point for itself, and encrypt and send the coordinates of the remaining points to other participants.

[0151] Specific examples include:

[0152] P1 generates 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4),s 15 =f1(5), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 To P4, encrypt and send 15 to P5;

[0153] P2 generates 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4),s 25 =f2(5), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23 To P3, encrypt and send 24 To P4, encrypt and send 25 To P5;

[0154] P3Generators 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4),s 35 =f3(5), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 To P4, encrypt and send 35 to P5;

[0155] P4Generators 41 =f4(1),s42 =f4(2),s 43 =f4(3),s 44 =f4(4),s 45 =f4(5), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3, encrypt and send 45 to P5;

[0156] P5 Generations 51 =f5(1),s 52 =f5(2),s 53 =f5(3),s 54 =f5(4),s 55 =f5(5), keep s 55 , and encrypt and send s 51 To P1, encrypt and send s 52 To P2, encrypt and send s 53 To P3, encrypt and send 54 to P4;

[0157] so:

[0158] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 、s 51 ;

[0159] P2 locally has different secret shares s generated by different parties 12 、s 22 、s 32 、s 42 、s 52 ;

[0160] P3 locally has secret shares s generated by different parties 13 、s 23 、s 33 、s 43 、s 53 ;

[0161] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 、s 54 ;

[0162] P5 locally has secret shares s generated by different parties 15 、s25 、s 35 、s 45 、s 55 .

[0163] In addition, each participant P i The secret value generated by itself can be calculated as γ i The corresponding homomorphic encryption value R i =E i (γ i ) and broadcast it to other participants.

[0164] Then, each participant P i A secret share s that can be kept by itself ii and from other participants P j The secret share s obtained ji The sum of the secret shares is obtained after aggregation, and the aggregation method is, for example, summation. For example, if the participant P i The sum of the secret shares For example:

[0165] Participant P1 can calculate the sum of the secret shares ω1 as: ω1 = s 11 +s 21 +s 31 +s 41 +s 51 ;

[0166] Participant P2 can calculate the sum of the secret shares ω2 as: ω2 = s 12 +s 22 +s 32 +s 42 +s 52 ;

[0167] Participant P3 can calculate the sum of the secret shares ω3 as: ω3=s 13 +s 23 +s 33 +s 43 +s 53 ;

[0168] Participant P4 can calculate the sum of the secret shares ω4 as: ω4 = s 14 +s 24 +s 34 +s 44 +s 54 ;

[0169] Participant P5 can calculate the sum of the secret shares ω5 as: ω5 = s 15 +s 25 +s 35 +s 45 +s55 .

[0170] Moreover, each participant P i You can also generate the public verification parameter A corresponding to your own t-degree polynomial ik =a ik G, where k = 0, 1, ..., t, and is announced to each participant. Specifically:

[0171] Participant P1 generates A 1k =a 1k G, k=0,1,…,t=2, including A 10 =a 10 G=s 10 G, A 11 =a 11 G, A 12 =a 12 G, broadcast {A 10 ,A 11 ,A 12} to P2, P3, P4 and P5;

[0172] Participant P2 generates A 2k =a 2k G, k=0,1,…,t=2, including A 20 =a 20 G=s 20 G, A 21 =a 21 G, A 22 =a 22 G, broadcast {A 20 ,A 21 ,A 22} to P1, P3, P4 and P5;

[0173] Participant P3 generates A 3k =a 3k G, k=0,1,…,t=2, including A 30 =a 30 G=s 30 G, A 31 =a 31 G, A 32 =a 32 G, broadcast {A 30 ,A 31 ,A 32} to P1, P2, P4 and P5;

[0174] Participant P4 generates A 4k =a 4k G, k=0,1,…,t=2, including A 40 =a 40 G=s40 G, A 41 =a 41 G, A 42 =a 42 G, broadcast {A 40 ,A 41 ,A 42} to P1, P2, P3 and P5;

[0175] Participant P5 generates A 5k =a 5k G, k=0,1,…,t=2, including A 50 =a 50 G=s 50 G, A 51 =a 51 G, A 52 =a 52 G, broadcast {A 50 ,A 51 ,A 52} to P1, P2, P3 and P4.

[0176] Each participant P i You can also use P j The public authentication parameters j0 ,A j1 ,…,A jt Verify P j Secret shares sent ji , for example, verified by the following formula: s ji G=A j0 +iA j1 +…+i t A jt

[0177] Specifically:

[0178] Participant P1 passes s 21 G=A 20 +A 21 +A 22 Verifications 21 , through s 31 G=A 30 +A 31 +A 32 Verifications 31 , through s 41 G=A 40 +A 21 +A 42 Verifications 41 , through s 51 G=A 50 +A 51 +A 52 Verifications51 ;

[0179] Participant P2 passes s 12 G=A 10 +2A 11 +2 2 A 12 Verifications 12 , through s 32 G=A 30 +2A 31 +2 2 A 32 Verifications 32 , through s 42 G=A 40 +2A 21 +2 2 A 42 Verifications 42 , through s 52 G=A 50 +2A 51 +2 2 A 52 Verifications 52 ;

[0180] Participant P3 passes s 13 G=A 10 +3A 11 +3 2 A 12 Verifications 13 , through s 23 G=A 30 +3A 31 +3 2 A 32 Verifications 23 , through s 43 G=A 40 +3A 21 +3 2 A 42 Verifications 43 , through s 53 G=A 50 +3A 51 +3 2 A 52 Verifications 53 ;

[0181] Participant P4 uses s 14 G=A 10 +4A 11 +4 2 A 12 Verifications 14 , through s 24 G=A 20 +4A 21 +42 A 22 Verifications 24 , through s 34 G=A 40 +4A 21 +4 2 A 42 Verifications 42 , through s 54 G=A 50 +4A 51 +4 2 A 52 Verifications 52 ;

[0182] Participant P5 passes s 15 G=A 10 +5A 11 +5 2 A 12 Verifications 15 , through s 25 G=A 20 +5A 21 +5 2 A 22 Verifications 25 , through s 35 G=A 30 +5A 31 +5 2 A 32 Verifications 35 , through s 45 G=A 40 +5A 41 +5 2 A 42 Verifications 45 ;

[0183] If either party fails the verification, they can terminate the agreement.

[0184] On the other hand, each participant P i The first random value can be randomly selected Then the five participants P1, P2, P3, P4, and P5 generate the first random values ​​x1, x2, x3, x4, and x5 respectively. The corresponding public keys are Each participant P i The first random value corresponding to the public key generated by itself can be broadcast to other participants P i,j≠i Then P i Locally has: {X1,X2,X3,...,X n Specifically, for the five participants P1, P2, P3, P4, and P5, each local has {X1, X2, X3, X4, and X5}.

[0185] At this point, each participant P i The first random value corresponding to the public key set {X j} j∈[1,n] and the second random value homomorphic ciphertext set {R j} j∈[1,n] .

[0186] Each participant P i The first random value may correspond to a public key set {X j} j∈[1,n] The total public key X is calculated in a similar way as above, for example using the following formula:

[0187] As mentioned above, the total public key can be used to verify the total signature after subsequent aggregation. n .

[0188] In addition, each participant P i For P j The first mask number between the two parties can be randomly selected And the first intermediate ciphertext D can be calculated by homomorphic algorithm i,j And send to P j , for example using Paillier encryption and computing

[0189] Thus, for participant P i , you can receive Then you can use your own homomorphic encryption private key for decryption, such as the public key E encrypted with Paillier encryption i The corresponding private key e1 is decrypted to obtain x j γ i -β j,i =α i,j . Furthermore, P i The first intermediate value can be calculated And broadcast the first intermediate value δ i To other participants.

[0190] In the next step, participant P i Collect the first intermediate value δ j,j∈[1,n] After that, we can calculate Then you can As its own private key shard.

[0191] For example, for 5 parties P1, P2, P3, P4, P5:

[0192] P1 randomly selects the first mask number β between the participants for P2 1,2 , using Paillier encryption and computing the first intermediate ciphertext And send D 1,2 To P2; similarly, P1 randomly selects a first mask number β between participants for P3 1,3 , calculate the first intermediate ciphertext And send D 1,3 To P3; similarly, P1 randomly selects a first mask number β between participants for P4 1,4 , calculate the first intermediate ciphertext And send D 1,4 To P4; similarly, P1 randomly selects a first mask number β between participants for P5 1,5 , calculate the first intermediate ciphertext And send D 1,5 To P5.

[0193] P2 randomly selects the first mask number β between the participants for P1 2,1 , using Paillier encryption and computing the first intermediate ciphertext And send D 2,1 To P1; similarly, P2 randomly selects a first mask number β between participants for P3 2,3 , calculate the first intermediate ciphertext And send D 2,3 To P3; similarly, P2 randomly selects a first mask number β between participants for P4 2,4 , calculate the first intermediate ciphertext And send D 2,4 To P4; similarly, P2 randomly selects a first mask number β between participants for P5 2,5 , calculate the first intermediate ciphertext And send D 2,5 To P5.

[0194] P3 randomly selects the first mask number β between the participants for P1 3,1 , using Paillier encryption and computing the first intermediate ciphertext And send D 3,1 To P1; similarly, P3 randomly selects a first mask number β between participants for P2 3,2 , calculate the first intermediate ciphertext And send D 3,2 To P2; similarly, P3 randomly selects a first mask number β between participants for P43,4 , calculate the first intermediate ciphertext And send D 3,4 To P4; similarly, P3 randomly selects a first mask number β between participants for P5 3,5 , calculate the first intermediate ciphertext And send D 3,5 To P5.

[0195] P4 randomly selects the first mask number β between the participants for P1 4,1 , using Paillier encryption and computing the first intermediate ciphertext And send D 4,1 To P1; similarly, P4 randomly selects a first mask number β between participants for P2 4,2 , calculate the first intermediate ciphertext And send D 4,2 to P2; similarly, P4 randomly selects a first mask number β between participants for P3 4,3 , calculate the first intermediate ciphertext And send D 4,3 To P3; similarly, P4 randomly selects a first mask number β between participants for P5 4,5 , calculate the first intermediate ciphertext And send D 4,5 To P5.

[0196] P5 randomly selects the first mask number β between the participants for P1 51 , using Paillier encryption and computing the first intermediate ciphertext And send D 5,1 To P1; similarly, P5 randomly selects a first mask number β between participants for P2 5,2 , calculate the first intermediate ciphertext And send S 5,2 To P2; similarly, P5 randomly selects a first mask number β between participants for P3 5,3 , calculate the first intermediate ciphertext And send S 5,3 To P3; similarly, P5 randomly selects a first mask number β between participants for P4 5,4 , calculate the first intermediate ciphertext And send S 5,4 To P4.

[0197] In this way, P1 can receive S 2,1 、S 3,1 、S 4,1 、S5,1 , thus, P1 can decrypt and get x2·γ1-β 2,1 =α 1,2 , x3·γ1-β 3,1 =α 1,3 , x4·γ1-β 4,1 =α 1,4 , x5·γ1-β 5,1 =α 1,5 Then P1 can calculate the intermediate value And broadcast δ1.

[0198] Similarly, P2 can receive D 1,2 、D 3,2 、D 4,2 、D 5,2 , thus, P2 can decrypt and get x1·γ2-β 1,2 =α 2,1 , x3·γ2-β 3,2 =α 2,3 , x4·γ2-β 4,2 =α 2,4 , x5·γ2-β 5,2 =α 2,5 Then P2 can calculate the intermediate value And broadcast δ2.

[0199] Similarly, P3 can receive D 1,3 、D 2,3 、D 4,3 、D 5,3 , thus, P3 can decrypt and get x1·γ3-β 1,3 =α 3,1 , x2·γ3-β 2,3 =α 3,2 , x4·γ3-β 4,3 =α 3,4 , x5·γ3-β 5,3 =α 3,5 Then P3 can calculate the intermediate value And broadcast δ3.

[0200] Similarly, P4 can receive D 1,4 、D 2,4 、D 3,4 、D 5,4 , thus, P4 can decrypt to get x1·γ4-β 1,4 =α 4,1 , x2·γ4-β2,4 =α 4,2 , x3·γ4-β 3,4 =α 4,3 , x5·γ4-β 5,4 =α 4,5 Then P4 can calculate the intermediate value And broadcast δ4.

[0201] Similarly, P5 can receive D 1,5 、D 2,5 、D 3,5 、D 4,5 , thus, P5 can be decrypted to obtain x1·γ5-β 1,5 =α 5,1 , x2·γ5-β 2,5 =α 5,2 , x3·γ5-β 3,5 =α 5,3 , x4·γ5-β 4,5 =α 5,4 Then P5 can calculate the intermediate value And broadcast δ5.

[0202] In the next step, participant P1 collects all j,j∈[1,5] After that, we can calculate

[0203] Similarly, P2 collects all δ j,j∈[1,5] After that, we can also calculate

[0204] Similarly, P3 collects all δ j,j∈[1,5] After that, we can also calculate

[0205] Similarly, P4 collects all δ j,j∈[1,5] After that, we can also calculate

[0206] Similarly, P5 collects all δ j,j∈[1,5] After that, we can also calculate

[0207] Then, participant P1 can As its own private key share (i.e. private key shard);

[0208] Similarly, participant P2 can As its own private key share;

[0209] Similarly, participant P3 can As its own private key share;

[0210] Similarly, participant P4 can As its own private key share;

[0211] Similarly, participant P5 can As its own private key share;

[0212] Thus, each participant P i Finally, the first random value x generated by each participant is obtained i The sum of the two random values ​​γ i However, since the process of exchanging information between participants combines homomorphic encryption and the design of intermediate ciphertext and intermediate value, the information of any participant P is not exposed. i The first random value x of each i and a second random value γ i . Then, combined with the sum of secret shares obtained by the distributed key generation protocol, each participant P i You can get your own private key share x′ i .

[0213] The following describes the distributed signature process, which can be divided into two parts: an offline phase and an online phase. The distributed key generation process described above requires n parties to participate in the protocol. The distributed threshold signature process described below only requires at least t+1 parties to participate in the protocol. For the specific case, we will still use the threshold t=2 as an example.

[0214] Offline phase: Update own private key share x′ i , generate its own third random value k i And the corresponding third random value homomorphic ciphertext K i and the third random value public key G i , Broadcast K i and G i ; Generate a second mask and exchange the second intermediate plaintext through homomorphic encryption. Specifically, it may include:

[0215] S21:

[0216] First, there are t+1 participants, each of whom P i Calculate the Lagrange coefficient And use the Lagrange coefficient to update its own private key share: x″ i ←l i (0)·x′ i For example, if i is 1, 2, or 3, then:

[0217] Participant P1 calculates the Lagrange coefficient And update its own private key share x″1←l1(0)·x′1;

[0218] Participant P2 calculates the Lagrange coefficient And update its own private key share x″2←l2(0)·x′2;

[0219] Participant P3 calculates the Lagrange coefficient And update its own private key share x″3←l3(0)·x′3.

[0220] Second, each of the t+1 participants generates a third random value k i And the corresponding third random value homomorphic ciphertext K i and the third random value public key G i , and broadcast the third random value homomorphic ciphertext K i and the third random value public key G i For example, participant P i ,i∈[1,t+1] generates the third random value k i ,and Participant P i The third random value homomorphic ciphertext can be calculated, such as the Paillier ciphertext K i =E i (k i ), and calculate the third random value public key G i ,like Specifically, when t+1 is 3 and the participants are P1, P2, and P3:

[0221] P1 generates a third random value k1, calculates the Paillier ciphertext K1=E1(k1) of the third random value, and calculates the public key of the third random value Broadcast K1 and G1;

[0222] P2 generates a third random value k2, calculates the Paillier ciphertext K2=E2(k2) of the third random value, and calculates the third random value public key Broadcast K2 and G2;

[0223] P3 generates a third random value k3, calculates the Paillier ciphertext K3=E3(k3) of the third random value, and calculates the third random value public key Broadcast K3 and G3.

[0224] In addition, each participant P i A second mask is also generated, and a second intermediate plaintext is exchanged through homomorphic encryption. Specifically, it may include:i For participant P j Generate the second mask And based on the updated private key share x″ i , the received third random value homomorphic ciphertext K j and the second mask number The second intermediate ciphertext is calculated from the homomorphic ciphertext With other participants P j Exchange the second intermediate ciphertext Decrypt the second intermediate ciphertext Get the second intermediate plaintext Specifically, it can be the following S22 and S23.

[0225] S22:

[0226] The participant P who receives the broadcast i , for P j Sent K j , select a second mask Here, the range of the subscript of the finite field is q to the power of 5, which is a proven range of values ​​with cryptographic security. Generally available in Select a larger value in the range. i The second intermediate ciphertext can be calculated by homomorphic algorithm And send to P j :

[0227] Specifically:

[0228] After P1 receives K2=E2(k2) broadcast by P2, it selects a second mask Furthermore, P1 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P2, where:

[0229] Thus, P2 receives Although P2 has the corresponding Paillier private key e2, k2 is also generated by P2, but due to the second mask selected by P1 The concealing effect of P2 is that P1’s private key share x ′ 1 ′ , thus completing the information transmission on this basis. The following is similar and will not be repeated here.

[0230] Similarly, after P1 receives K3=E3(k3) broadcast by P3, it selects a second mask Furthermore, P1 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P3, where:

[0231] Similarly, after P2 receives K1=E1(k1) broadcast by P1, it selects a second mask Furthermore, P2 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P1, where:

[0232] Similarly, after P2 receives K3=E3(k3) broadcast by P3, it selects a second mask Furthermore, P2 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P3, where:

[0233] Similarly, after P3 receives K1=E1(k1) broadcast by P1, it selects a second mask Furthermore, P3 can calculate the second intermediate ciphertext through the homomorphic encryption algorithm And sent to P1, where:

[0234] Similarly, after P3 receives K2=E2(k2) broadcast by P2, it selects a second mask Furthermore, P3 can calculate the second intermediate ciphertext through the homomorphic encryption algorithm And sent to P2, where:

[0235] S23:

[0236] Furthermore, each participant P i The received second intermediate ciphertext Use the corresponding homomorphic encryption private key to decrypt and get the plaintext This is called the second intermediate plaintext, where:

[0237] So far, P i Locally has k i , updated own private key share x″ i and for P j of

[0238] Online phase: Each of the at least t+1 participants P i Use the collected third random value public key G iCalculate the total coordinate K of the third random value public key, and use the total coordinate K to calculate r in the signature share of message m, also based on r and its own third random value k i , updated own private key share x″ i , for participant P j The second intermediate plaintext and the second mask number Calculate the signature share component s for message m i , thus obtaining the signature share σ i (r,s i ).

[0239] S31:

[0240] Each of the at least t+1 participants P i , you can collect the third random value public key G j,j∈[1,t+1] , so that the total coordinates can be calculated based on at least t+1 third random value public keys Among them, x1 and y1 are the horizontal and vertical coordinates of point K on the elliptic curve respectively.

[0241] On the other hand, P i The message m to be signed can be hashed to obtain the digest value H(m), and r=H(m)+x1modq in the signature share can be calculated based on the total coordinate point K. This is similar to the above formula (a).

[0242] Since any P i The message m is the same, that is, H(m) is also the same. Moreover, t+1 k j The sum of the two is also the same, and the total coordinate K is also the same. Therefore, any P i The r in the calculated signature share is also the same.

[0243] S32:

[0244] P i It can be based on r and its own third random value k i , updated own private key share x″ i , for participant P j The second intermediate plaintext and the second mask number Calculate the signature share component s for message m i , thus obtaining the signature share σ i (r,s i ).

[0245] The specific calculation of s is as follows i :

[0246] in, To put it simply, x″ i is the updated private key share, which is equal to l i (0)·x′ i .

[0247] In this way, after any party obtains at least t+1 signature shares, it can aggregate the at least t+1 signature shares into a total signature It can be proved That is (1+x) -1 ·(kr·x). It can be seen that the s in the total signature σ here is the same as the s in formula (b) in the basic SM2 signature algorithm mentioned above. Therefore, the correctness of the total signature σ can be verified using the above-mentioned total public key X.

[0248] In addition, the total private key is the sum of the updated private key shares:

[0249] Continuing with the above example, any party (which can be any one of the n=5 participants or a party other than the n=5 participants) obtains t+1=3 signature shares:

[0250] For example, based on P1 calculation:

[0251] Similarly, based on P2 calculation: s2=k2·(l2(0)·x′2+l1(0)·x′1+l3(0)·x′3)+l2(0)·rx′2

[0252] Similarly, based on P3 calculation: s3=k3·(l3(0)·x′3+l1(0)·x′1+l2(0)·x′2)+l3(0)·rx′3

[0253] so:

[0254] It should be noted that the above example mainly illustrates the case where there are exactly t+1 participants. In fact, it can also be the case where there are more than t+1 participants. That is, when the number of participants in the distributed signature protocol phase is more than t+1, the above process can still produce the same aggregate signature as when there are t+1 participants, and thus can still be verified by the total public key.

[0255] Similar to ECC-based cryptography, the same k cannot be used twice for encryption, otherwise it will be cracked and obtained by others. Therefore, it is best to use a new k each time the signature is signed. This can be done by at least t+1 participants performing the offline phase again to generate at least t+1 ki , thus obtaining a new k.

[0256] The above process can be performed once by n participants in a coordinated distributed key generation phase, followed by at least t+1 participants performing both the offline and online phases for each subsequent signature. Alternatively, n participants can perform the distributed key generation phase once, followed by at least t+1 participants performing multiple offline phases, thereby generating multiple different k values, and thus different R values ​​and corresponding r values, for use in each subsequent online signature phase.

[0257] In this application, a homomorphic algorithm scheme such as Paillier is used to replace the multi-party MPC multiplication protocol used in the document "SM2 Elliptic Curve Threshold Cryptography Algorithm", so as to overcome the restriction condition n≥2t+1, thereby achieving a distributed threshold signature algorithm with arbitrary thresholds.

[0258] Secondly, in the entire distributed threshold key generation process, no participant can know the complete total private key, only their own threshold private key fragment x″ i , only t+1 participants out of n people can cooperate to sign. In the distributed threshold signature process, it is not necessary for all n users to participate. As long as at least t+1 of the n users participate, distributed signature can be achieved, which greatly improves the fault tolerance of the system.

[0259] Furthermore, the embodiment of the present application supports an offline-online mode, in which only one round of interaction is required between the participants in the online stage, which greatly simplifies the complexity of signing.

[0260] The following describes an embodiment of a computer device of the present application, including:

[0261] processor;

[0262] and a memory storing a program, wherein when the processor executes the program, the following operations are performed:

[0263] Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol;

[0264] Update its own private key share, generate its own third random value and corresponding third random value public key, and broadcast them;

[0265] After collecting the third random value public key, calculate the total coordinates of the third random value public key, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i, thus obtaining the signature share.

[0266] The following describes an embodiment of a storage medium of the present application for storing a program, wherein the program performs the following operations when executed:

[0267] Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol;

[0268] Update its own private key share, generate its own third random value and corresponding third random value public key, and broadcast them;

[0269] After collecting the third random value public key, calculate the total coordinates of the third random value public key, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i , thus obtaining the signature share.

[0270] In the 1990s, improvements to a technology could be clearly divided into hardware improvements (for example, improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many improvements to method flows today can be regarded as direct improvements to hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement to a method flow cannot be implemented using hardware entity modules. For example, programmable logic devices (PLDs)

[0271] A Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose logic functions are determined by user programming. Designers can integrate a digital system onto a PLD by programming it themselves, eliminating the need for a chip manufacturer to design and manufacture a dedicated integrated circuit. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0272] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0273] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0274] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0275] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0276] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram.

[0277] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0278] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0279] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0280] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0281] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0282] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0283] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0284] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0285] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A method for implementing distributed threshold signature, comprising: Distributed key generation phase: Each of the n participants generates a first random value and a second random value, and exchanges them with other participants after homomorphic encryption; Each participant generates a private key share based on the collected first random value and the second random value and the sum of the secret shares generated by the distributed key generation protocol; In the offline phase of the distributed signature, each of at least t+1 participants performs: updating its own private key share, generating its own third random value and corresponding third random value public key and broadcasting; In the online phase of the distributed signature, each of the at least t+1 participants performs: after collecting the third random value public key, calculate the total coordinates of the third random value public key, and calculate r in the signature share for the message based on the total coordinates, and also calculate the component s of the signature share for the message based on r and its own third random value and updated private key share. i , thus obtaining the signature share.

2. According to the method as claimed in claim 1, after any party obtains at least t+1 signature shares, the at least t+1 signature shares are aggregated into a total signature.

3. According to the method described in claim 2, the n participants also generate a total public key through a distributed key generation protocol; after any party obtains the total signature and the total public key, the total public key is used to verify the correctness of the total signature.

4. The method according to claim 1, in the distributed key generation stage, each of the n participants specifically performs: S11: Generate a first random value and a second random value, calculate and broadcast the homomorphic ciphertext of the second random value; and use the second random value as a secret to generate the sum of their respective secret shares through a distributed key generation protocol; S12: receiving the second random value homomorphic ciphertext, generating a first mask number between the participants for other participants, calculating a first intermediate ciphertext based on the first mask number between the participants, the first random value generated by itself, and the exchanged second random value homomorphic ciphertext, and sending the first intermediate ciphertext to the corresponding receiving participant; S13: Receive the first intermediate ciphertext sent by other participants, decrypt it to obtain the first intermediate plaintext, calculate the intermediate value based on its own first random value and second random value, the decrypted first intermediate plaintext and the first mask between the participants, and broadcast the intermediate value; The private key share is calculated based on the sum of the private key shares obtained by itself and the sum of the collected intermediate values.

5. The method according to claim 4, wherein the distributed key generation phase further comprises: Generate a public key share of the first random value and broadcast it; After collecting the public key shares of n participants, the total public key is calculated.

6. The method according to claim 1, wherein each of the at least t+1 participants in the offline phase updates its own private key share, specifically comprising: Use the Lagrange coefficient to update your own private key share.

7. According to the method as claimed in claim 1, each of the at least t+1 participants in the offline stage also generates its own third random value homomorphic ciphertext and broadcasts it, generates a second mask, and exchanges a second intermediate plaintext through homomorphic encryption.

8. The method according to claim 7, wherein each of the at least t+1 participants in the offline phase further generates its own third random value homomorphic ciphertext and broadcasts it, further generates a second mask, and exchanges a second intermediate plaintext through homomorphic encryption, specifically comprising: Generate a second mask for other participants, and homomorphically ciphertext based on the updated private key share and the received third random value The second intermediate ciphertext is calculated using the homomorphic ciphertext of the second mask number, and the second intermediate ciphertext is exchanged with other participants; the second intermediate ciphertext is decrypted to obtain the second intermediate plaintext.

9. The method according to claim 8, wherein generating a second mask for a participant, calculating a second intermediate ciphertext based on an updated private key share, a received third random value homomorphic ciphertext and the homomorphic ciphertext of the second mask, exchanging the second intermediate ciphertext with other participants; and decrypting the second intermediate ciphertext to obtain a second intermediate plaintext, specifically comprises: S22: The participant receiving the broadcast generates a second mask for other participants, calculates a second intermediate ciphertext based on the updated private key share, the received third random value homomorphic ciphertext and the homomorphic ciphertext of the second mask, and sends the second intermediate ciphertext to the corresponding participant; S23: Perform homomorphic decryption on the received second intermediate ciphertext to obtain a second intermediate plaintext.

10. The method according to claim 8, wherein each of the at least t+1 participants in the online stage specifically performs: S31: using the collected third random value public keys to calculate the total coordinate K of the third random value public key, and using the total coordinate to calculate r in the signature share for the message m; S32: Calculate the signature share component s for the message m based on r and its own third random value, the updated private key share of itself, the second intermediate plaintext for other participants, and the second mask. i , thus obtaining the signature share.

11. A computer device comprising: processor; and a memory, wherein a program is stored, wherein when the processor executes the program, the following operations are performed: Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first random value and the second random value and the secret share generated by the distributed key generation protocol; Update its own private key share, generate its own third random value and corresponding third random value public key and broadcast them; After collecting all the third random value public keys, calculate the total coordinates of the third random value public keys, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i , thus obtaining the signature share.

12. A storage medium for storing a program, wherein the program performs the following operations when executed: Generate a first random value and a second random value, and exchange them with other participants after homomorphic encryption; each participant generates a private key share based on the sum of the collected first random value and the second random value and the secret share generated by the distributed key generation protocol; Update its own private key share, generate its own third random value and corresponding third random value public key and broadcast them; After collecting all the third random value public keys, calculate the total coordinates of the third random value public keys, and calculate r in the signature share of the message based on the total coordinates. Also calculate the component s of the signature share of the message based on r, its own third random value, and the updated private key share. i , thus obtaining the signature share.

Images