Key share updating method, computer device, and storage medium

Abstract

A key share updating method in a distributed threshold signature scheme, the total number of participants being n and a threshold being t, and the method comprising: each of the n participants setting a secret value to 0, and using the secret value of 0 to generate a new t-degree random polynomial; each participant generating n new secret shares on the basis of the new t-degree random polynomial generated by the participant, retaining one of the secret shares for themselves, and encrypting the remaining secret shares and sending said secret shares to the other participants; and each participant generating a new private key share on the basis of an original private key share and a local new secret share.

Description

A secret key share updating method, computer device and storage medium

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 31, 2023, with application number 202311121667.2 and application name “A method for updating key shares, computer equipment and storage medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of this specification belong to the field of cryptography technology, and in particular, relate to a method for updating secret key shares in a distributed threshold signature scheme, a computer device, and a storage medium. Background Art

[0003] In cryptography, public-key cryptography, also known as asymmetric cryptography, uses a public-private key pair (denoted as PK-SK, where PK stands for public key and SK stands for secret key). This contrasts with cryptography that uses only a single private key. Public-key cryptography includes encryption algorithms and digital signature algorithms. Public-private key pairs are the cornerstone of modern cryptographic security. Many applications are based on PK-SK, such as the HTTPS (Hypertext Transfer Protocol Secure) application-layer encrypted transmission protocol and blockchain.

[0004] A private key typically represents the identity of the party that possesses it. It can only be held by the owner and cannot be made public, whereas the corresponding public key can be made public. Signing with a private key can indicate the owner's approval of certain information in the digital world. The signed information in a protocol message can also represent the owner's actions. Generally, a single owner possesses a private key. This owner can use their private key to sign a message and send it to another party. Upon receiving the signature, the recipient can verify it using the corresponding public key. If verification is successful, the recipient can confirm that the owner signed the message and that the signed message has not been tampered with.

[0005] Sometimes accounts require flexible access control strategies, especially when multiple parties on the blockchain jointly control an account. Under some requirements, an account needs to be jointly controlled by n parties. In this way, the behavior of controlling this account, such as transferring money, requires the approval of all n parties in order to control the transfer behavior of the account. Under other requirements, it is not necessary for all n parties to agree, but the account can be controlled with the consent of t+1 parties (t<n, t is also called the threshold), which can be achieved through threshold signatures. In this type of threshold cryptography, private key information is shared with multiple independent participants, and each private key calculation requires the consent of multiple participants, thereby improving the security of the algorithm; and when a small number of participants fail or are unavailable, it does not affect the availability of the private key. A secure (t, n) threshold cryptographic algorithm should satisfy the following requirements: (1) any number of participants greater than t can compute the final signature, exchanged key, or plaintext, while t or fewer participants cannot obtain any information about the above results; (2) no information about the private key and the private key shares of the participants is leaked during the execution of the algorithm.

[0006] Summary of the Invention

[0007] The present invention aims to provide a method for updating secret key shares in a threshold signature scheme, a computer device, and a storage medium, including:

[0008] A method for updating secret key shares in a distributed threshold signature scheme, where the total number of participants is n and the threshold is t, comprises:

[0009] Each of the n participants sets the secret value to 0 and uses the secret value 0 to generate a new random polynomial of degree t;

[0010] Each participant generates n new secret shares based on a new t-degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to other participants;

[0011] Each participant generates a new private key share based on the original private key share and the local new secret share.

[0012] A computer device embodiment includes:

[0013] processor;

[0014] and a memory storing a program, wherein when the processor executes the program, the following operations are performed:

[0015] Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial;

[0016] Generate n new secret shares based on a new random polynomial of degree t generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants;

[0017] Generate a new private key share based on the original private key share and the local new secret share.

[0018] A storage medium embodiment is configured to store a program, wherein the program performs the following operations when executed:

[0019] Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial;

[0020] Generate n new secret shares based on a new t-degree random polynomial generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants;

[0021] Generate a new private key share based on the original private key share and the local new secret share.

[0022] In the above scheme provided by this application, the original total public key can still be used to verify the total signature after the aggregation of the new signature shares generated by the updated secret shares. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] FIG1 is a schematic diagram of distributed threshold key generation in one embodiment;

[0025] FIG2 is a schematic diagram of a distributed threshold signature according to an embodiment;

[0026] FIG3 is a distributed key update process in one embodiment. DETAILED DESCRIPTION

[0027] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0028] The DKG (Distributed Key Generation) protocol is a distributed protocol that generates a set of keys through collaboration among multiple parties. The VSS (Verifiable Secret Sharing) protocol is an important theoretical foundation for the DKG protocol.

[0029] VSS allows for sharing secret data between multiple parties. Without leaking the secret data itself, the data can be split into multiple shards, each of which is kept by a different party. Later, when restoring the secret data, all shards must be collected to successfully restore the complete secret data.

[0030] The VSS protocol, first proposed by Shamir in 1979, is a polynomial-based secret sharing protocol. The VSS protocol is derived from Shamir's Secret Sharing (SSS), so we'll first introduce Shamir's Secret Sharing.

[0031] Shamir secret sharing includes two stages: secret sharing (or secret distribution) and secret reconstruction. First, a dealer needs to construct a polynomial: f(x) = a0 + a1x + a2x 2 +…+a n x n Polynomial(*)

[0032] Among them, a0 is the secret data to be shared.

[0033] This n-degree polynomial consists of a set of coefficients (a0, a1, a2, ..., a n ) is uniquely determined, and this set of coefficients includes n+1 values. In this way, if it is known that the curve corresponding to the n-degree polynomial passes through n+1 different points on the plane, the coordinates of n+1 different points are obtained (x1, y1), (x2, y2), ..., (x n ,y n ), (x n+1 ,y n+1 ), we can get a set of (n+1) linear equations of n+1 equations, and from this set of equations we can determine the n+1 coefficients a0, a1, a2, ..., a n The value of the polynomial (*) is determined, and finally the value of the secret data a0 is obtained. The coordinates of the n+1 different points (x1, y1), (x2, y2), ..., (x n ,y n ), (x n+1 ,yn+1 ) means n+1 secret shards.

[0034] The process of finding a curve passing through a number of existing points is called polynomial interpolation. There are many ways to implement polynomial interpolation. The following is a common Lagrange interpolation method. Given an nth degree polynomial*, it is known that the corresponding curve of the polynomial passes through n+1 points (x1, y1), (x2, y2), ..., (x n ,y n ), (x n+1 ,y n+1 ), then the polynomial of the n-degree curve can be obtained by Lagrange interpolation as follows:

[0035] Polynomial (**) and polynomial (*) are actually equivalent. If x = 0 in polynomial (*), then f(0) = a0, which means the value of the secret data a0 can be obtained. Therefore, if x = 0 in polynomial (**), the value of the secret data a0 can also be obtained, that is, f(0) = a0.

[0036] For n+1 points (x1, y1), ..., (x n ,y n ), (x n+1 ,y n+1 ), the above polynomial (**) can also be expressed as:

[0037] in, Similarly, for constant terms or secret values, we have

[0038] In summary, we can select any n+1 points on the polynomial and share these n+1 points among n+1 participants, for example, each participant receives the coordinates of one point. Collecting the coordinates of any fewer than n+1 points will not reveal the original secret data a0. Only after obtaining all n+1 points can the value of secret data a0 be restored by reconstructing the polynomial coefficients. Furthermore, even if we collect the coordinates of fewer than n+1 points, for example, n points, the value of secret data a0 will not be revealed probabilistically, as there are an infinite number of n-degree curves passing through these n points. The degree n here is also called the degree of the polynomial.

[0039] On this basis, threshold Shamir secret sharing can be implemented. For example, t-of-n secret sharing is to share a secret between n participants, and stipulate that the threshold of the minimum secret shards required for recovery is greater than t, that is, greater than or equal to t+1. For example, in a transaction involving four parties, the agreed threshold is 3, that is, n=4, t=2, then the secret can only be restored when greater than or equal to t+1=3 participants provide their own secret shards, otherwise the secret cannot be restored. Specifically, a polynomial of degree t=2 can be constructed: f(x)=a0+a1x+a2x 2 Polynomial(***)

[0040] The curve corresponding to the 2-degree polynomial can be obtained to pass through 4 different points on the plane, that is, the coordinates of 4 different points are obtained (x1, y1), (x2, y2), (x3, y3), (x4, y4), and the coordinates of these 4 points are distributed to one participant respectively during the secret sharing phase. The 4 participants are set as Party1, Party2, Party3, and Party4. In this way, it is assumed that Party1 has a slice (x1, y1), Party2 has a slice (x2, y2), Party3 has a slice (x3, y3), and Party4 has a slice (x4, y4). Since the polynomial (**) can be determined by any 3 points on the corresponding curve, Party i In (i∈{1, 2, 3, 4}), if any three participants provide their own secret slices, the polynomial (***) can be restored during the secret reconstruction phase, thereby obtaining the secret value a0. If fewer than three participants provide their own secret slices, the polynomial (***) cannot be restored, and the secret value a0 cannot be obtained. The above t is also called the threshold.

[0041] The aforementioned Shamir Secret Sharing and Threshold Shamir Secret Sharing require a role to generate polynomials and distribute secret shards. This role can be called a dealer. This dealer is an entity that knows the secret and must be a trusted third party by all participating parties. Furthermore, an entity is required to aggregate at least t+1 shards and derive the secret. This entity can be the dealer, a participating party, or another entity.

[0042] In engineering practice, polynomials are often defined in finite fields or prime number fields rather than real number fields or natural number fields.

[0043] The classic Shamir secret sharing scheme assumes that all participants are honest. However, dishonest behavior, or malicious behavior, is possible. For example, a dealer could deceive one or more participants by sending incorrect secret shards to them.

[0044] In secret sharing, to verify malicious behavior, such as verifying whether the dealer is deceiving them (as described above, verifying whether the dealer sends an incorrect secret fragment), Verifiable Secret Sharing (VSS) is proposed. Feldman VSS is a practical VSS scheme based on Shamir's secret sharing, including:

[0045] The dealer has a secret and distributes n fragments of this secret to n participants, of which t participants can reconstruct the secret. A similar threshold Shamir secret sharing scheme can be used to construct a t-degree polynomial: f(x) = a0 + a1x + a2x 2 +…+a t x t Polynomial (****)

[0046] Dealer is for each party i Choose any non-zero x i , calculate s i =f(x i ), and the sub-secret s i Encrypted and sent to the participating party i At the same time, the Dealer calculates Where j = 0, 1, 2, ..., t, and A is public j , that is, open {A0, A1, A2, ..., A t}. A j Also called public authentication parameters. Here A j The method of generating the public key is the same as the method of generating the public key based on the private key on the elliptic curve. Therefore, A j It can also be called public key sharding (share, or public key sharing, public key share).

[0047] For the case where the selected polynomial corresponds to an elliptic curve, the public A j It is safe because according to the properties of elliptic curves, it is impossible to j Reverse to get a j .

[0048] Public verification parameters {A0, A1, A2, ..., A t} is also called a commitment. Since the commitment is bound to the coefficients of the polynomial, it can be used to verify whether a value of the polynomial is correct. In the implementation based on discrete logarithms, g is a generator of the cyclic group over a finite field. g can be between Dealer and Party. iThe above sub-secrets are also called secret shares.

[0049] The participants receive the sub-secret s i After that, public verification parameters can be used to verify s i The validity of s can be verified by verifying whether the following equation holds: i Validity:

[0050] The right side of the polynomial (*****) can be derived as follows:

[0051] The right side of the polynomial (*****) can also be written as:

[0052] It can be seen that for Party i , a non-zero x selected by the Dealer i , x i For example, if it is i, then Party i It can be used with i and public verification parameters {A0, A1, A2, ..., A t}Calculate the right side of the polynomial (*****) and use the generator g and the sub-secret s i To calculate the left side of the polynomial (*****), we can determine whether the left and right sides of the polynomial (*****) are equal. Is it {A0, A1, A2, ..., A t} corresponds to a point on the curve. This verification belongs to the verification of the secret distribution phase. For simplicity, we can usually take x i =i.

[0053] In engineering, it is generally implemented based on discrete logarithms. Modulo operations are used for the above equations, such as mod p, where p is a large prime number and p is also the value of Dealer and Party. i Pre-configured. mod p is also omitted in the following similar places.

[0054] During the secret reconstruction phase, for example, if at least t+1 participants each send their own secret shards to the dealer, the dealer can verify each secret shard using the public verification parameter corresponding to the polynomial. Failure to verify can be used to prove that the party sending the secret shard is malicious; secret shards that pass verification can be used as the basis for reconstructing the secret.

[0055] In the secret reconstruction phase, after collecting the secret shards of at least t+1 participants, the polynomial f(x) can be reconstructed through the Lagrange interpolation method to obtain the value of f(0), that is, the secret value.

[0056] In addition, through the public verification parameters {A0, A1, A2, ..., A t The legitimacy of the secret a0 can also be verified, that is, it can be verified whether (0, a0) is a point on the curve, because the following relationship exists:

[0057] In other words, the verification of the legitimacy of the secret a0 can be simplified to being achieved through the public verification parameter A0.

[0058] In the above derivation, define 0 0 =1, and 0 k =0, k≠0.

[0059] The above solution requires a dealer, a centralized entity with access to the secret. As mentioned above, it needs to be a trusted third party, or in other words, all parties must trust the dealer. In a distributed scenario, both distributed secret distribution and distributed secret reconstruction are required. This requires eliminating the centralized dealer, thus achieving trustlessness. To address this problem, Rabin et al. proposed an improved protocol called Joint-Feldman in 1999. The basic idea of ​​this protocol is to execute the Feldman VSS protocol n times in parallel, with each participant generating a random polynomial locally and then sharing the randomly selected secret value among all participants. Since what is shared is a commitment to the secret, rather than the secret itself, the secret cannot be recovered unless there is collusion and cheating by multiple participants exceeding a threshold t. This distributed VSS protocol that eliminates the trusted third party is also called DVSS (Distributed VSS).

[0060] Specifically, taking four participants as an example, assuming the threshold t = 2, then the degree of the polynomial is also t = 2. The decentralized threshold secret sharing, also known as the Joint-Feldman implementation, includes the following:

[0061] Each P i (Party i Abbreviated as P i , i∈{1, 2, 3, 4}) sets the secret s to be shared i0 , and randomly choose other parameters to generate a t-1 degree polynomial:

[0062] Participant P1 generates a 2nd degree polynomial:

[0063] f1(z)=a 10 +a 11 z+a 12 z2 , where a 10 It is the secret s1 set by P1;

[0064] Participant P2 generates a 2nd degree polynomial:

[0065] f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 It is the secret s2 set by P2;

[0066] Participant P3 generates a 2nd degree polynomial:

[0067] f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 It is the secret s3 set by P3;

[0068] Participant P4 generates a 2nd-degree polynomial:

[0069] f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret s4 set by P4.

[0070] Then, each participant P i Generate n values ​​on the curve corresponding to its own t-degree polynomial and distribute them. Here we still assume n = 4, t = 2, n = 1, 2, 3, 4, then:

[0071] Participant P1 generates s 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 to P4;

[0072] Participant P2 generates s 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23To P3, encrypt and send 24 to P4;

[0073] Participant P3 generates s 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 to P4;

[0074] Participant P4 generates s 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s 44 =f4(4), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3.

[0075] Moreover, each participant P i It also generates its own public verification parameters corresponding to the t-1 degree polynomial Where k = 0, 1, ..., t, and is announced to each participant, specifically:

[0076] Participant P1 generates include Broadcast 10 , A 11 , A 12} to P2, P3 and P4;

[0077] Participant P2 generates include Broadcast 20 , A 21 , A 22} to P1, P3 and P4;

[0078] Participant P3 generation include Broadcast 30 , A 31 , A 32} to P1, P2 and P4;

[0079] Participant P4 generation include Broadcast 40 , A41 , A 42} to P1, P2 and P3.

[0080] In this way, P1 receives s 21 After that, you can use {A 20 , A 21 , A 22} to verify; P1 receives s 31 After that, you can use {A 30 , A 31 , A 32} to verify; P1 receives s 41 After that, you can use {A 40 , A 41 , A 42} for verification; the verification method is similar to the above and will not be repeated here.

[0081] Similarly, P2 receives s 12 After that, you can use {A 10 , A 11 , A 12} to verify; P2 receives s 32 After that, you can use {A 30 , A 31 , A 32} to verify; P2 receives s 42 After that, you can use {A 40 , A 41 , A 42} to verify;

[0082] Similarly, P3 receives s 13 After that, you can use {A 10 , A 11 , A 12} to verify; P3 receives s 23 After that, you can use {A 20 , A 21 , A 22} to verify; P3 receives s 43 After that, you can use {A 40 , A 41 , A 42} to verify;

[0083] Similarly, P4 receives s 14 After that, you can use {A 10 , A 11 , A 12} to verify; P4 receives s 24 After that, you can use {A 20 , A 21 , A 22} to verify; P4 receives s34 After that, you can use {A 30 , A 31 , A 32} for verification.

[0084] Assume that the set of participants that pass the verification after verification is Qual, and Qual = {P1, P2, P3, P4}, then:

[0085] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42};

[0086] P2 locally has different secret shares s generated by different parties 12 、s 22 、s 32 、s 42 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42};

[0087] P3 locally has different secret shares s generated by different parties 13 、s 23 、s 33 、s 43 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A40 , A 41 , A 42};

[0088] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42}.

[0089] then:

[0090] Participant P1 can calculate the secret share s1 as: s1 = s 11 +s 21 +s 31 +s 41 ;

[0091] Participant P2 can calculate the secret share s2 as: s2 = s 12 +s 22 +s 32 +s 42 ;

[0092] Participant P3 can calculate the secret share s3 as: s3 = s 13 +s 23 +s 33 +s 43 ;

[0093] Participant P4 can calculate the secret share s4 as: s4 = s 14 +s 24 +s 34 +s 44 ;

[0094] Each participant P i The secret share s calculated by itself can be i Broadcast to other participants. Then each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4}, the secret s0 can be reconstructed. Here, for t=2, each participant P iAfter collecting at least a threshold of t+1=2+1=3 secret shares, the secret s0 can also be reconstructed.

[0095] This is because the sum of the curves of each participant can be summed up to get the total curve: f(z)=f1(z)+f2(z)+f3(z)+f4(z) f(z=(a 10 +a 11 z+a 12 z 2 )+(a 20 +a 21 z+a 22 z 2 )+(a 30 +a 31 z+a 32 z 2 ) +(a 40 +a 41 z+a 42 z 2 ) f(z)=(a 10 +a 20 +a 30 +a 40 )+(a 11 +a 21 +a 31 +a 41 )z+(a 12 +a 22 +a 32 +a 42 )z 2 Polynomial (I)

[0096] Thus: s1=s 11 +s 21 +s 31 +s 41 =f1(1)+f2(1)+f3(1)+f4(1); s2=s 12 +s 22 +s 32 +s 42 =f1(2)+f2(2)+f3(2)+f4(2); s3=s 13 +s 23 +s 33 +s 43 =f1(3)+f2(3)+f3(3)+f4(3); s4=s 14 +s 24 +s 34 +s 44 =f1(4)+f2(4)+f3(4)+f4(4);

[0097] For the total curve f(z), there is the relationship: s1=f1(1)+f2(1)+f3(1)+f4(1)=f(1); s2=f1(2)+f2(2)+f3(2)+f4(2)=f(2); s3=f1(3)+f2(3)+f3(3)+f4(3)=f(3); s4=f1(4)+f2(4)+f3(4)+f4(4)=f(4);

[0098] The secret is s0=a 10 +a 20 +a 30 +a 40 .

[0099] In this way, any participant P i After collecting at least three of the secret shares s1, s2, s3, and s4, we can obtain at least three points on the curve corresponding to polynomial (I), that is, at least three of the four coordinates (x1=1, y1=s1), (x2=2, y2=s2), (x3=3, y3=s3), and (x4=4, y4=s4), thereby recovering the total curve f(z). Furthermore, we can calculate f(0)=a 10 +a 20 +a 30 +a 40 =s0, so the secret s0 can be obtained.

[0100] Furthermore, by verifying the parameter {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42} can also be used to secret s i The legitimacy of (0, s i ) is a point on the total curve. Specifically, the legitimacy is determined by verifying whether the following equation holds:

[0101] This is because the following relationship exists:

[0102] It is also common to assume that the right side of the polynomial (II) is the public key share, denoted as pub i , i = 1, 2, ..., n, to verify the corresponding private key share.

[0103] As mentioned above, we can generally take x i =i for each i=1, 2, ..., n. In this way, i can be used as the number of each participant.

[0104] For the verification of secret s0, that is, x i =0, the above formula can be further deduced as follows:

[0105] It can be seen that based on the polynomial (III), the legitimacy of s0 can be verified.

[0106] Moreover, based on the derivation of the above polynomial (III), the verification of the legitimacy of s0 can be further simplified as follows:

[0107] It is also common to assume that the right side of the equal sign of polynomial (IV) is the total public key, denoted as pub.

[0108] The Joint-Feldman protocol described above enables distributed secret sharing, fulfilling the core concept of DKG. The series of secret sharing implementations, from Shamir to Threshold Shamir, the Feldman VSS protocol, and finally the Joint-Feldman DVSS protocol, is a series. In addition to the series of schemes starting with Shamir's secret sharing, there are also schemes based on Additive Secret Sharing, SPDZ (a key protocol in multi-party secure computation, first proposed in 2012), or the Chinese Remainder Theorem, which can ultimately achieve DKG. These are omitted here and will not be further elaborated.

[0109] Through the implementation of the above DKG protocol, the problem of single point failure resulting in overall unavailability caused by the generation of keys by a single entity can be overcome, as well as the problem of needing to trust a single point of key generation. i Broadcast the generated secret share s ij , i, j∈(1, 2, ..., n), n is the number of participants, and each participant P i The secret share s calculated by itself can be i Broadcast to other participants, so that each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4}, the secret s0 can be reconstructed. This means that at least t+1 participants will obtain the final reconstructed secret s0, which will expose the secret s0 and make the overall curve unusable. If a new secret s0 is to be generated next time, the DKG protocol process must be repeated.

[0110] The DKG protocol's properties regarding thresholds and secret commitments, combined with the matching threshold signature algorithm, can be used to construct a distributed threshold signature protocol. Blockchains, as distributed systems, make extensive use of signature algorithms. In this way, nodes in a blockchain generate secret shares in a distributed manner using DKG. After at least t+1 blockchain nodes use these secret shares as private key shares to sign the signature information and broadcast it, any blockchain node that has collected at least t+1 signature shares can recover the total signature and, using the aforementioned method, the total public key. This recovered total signature can then be verified using this total public key, thus implementing threshold signatures. Furthermore, this approach offers the advantage that each blockchain node's secret shares do not need to be broadcast to other nodes, thus preventing the exposure of their own secret shares and, consequently, private keys. Therefore, secret shares generated by a single DKG can be reused multiple times, eliminating the need to perform a complete DKG protocol for each threshold signature.

[0111] The basic ECDSA signature algorithms include:

[0112] The signing party Alice chooses an elliptic curve E q (a, b) and base point G, and share this information with the verifier Bob, where q is the modulus.

[0113] Alice in a finite field Select a private key x and generate a public key X = x G based on the private key;

[0114] Alice in a finite field Choose a random number k and calculate R=k -1 G, calculate r = f(R), with r ≠ 0; where f(R) can be the horizontal coordinate of R.

[0115] Alice hashes the message m to be signed to obtain the digest value h, i.e. h = hash(m), and calculates: σ = k(h + x·r) mod q (Formula (a))

[0116] Alice generates a signature sig = (r, σ), and sends the message m, signature sig, and public key X to the signature verifier Bob.

[0117] Bob uses the public key X to verify the following equation for the received message m and signature sig: r=f(σ -1 ·h·G+σ -1 ·r·X) Formula (b)

[0118] If equation b holds true, the signature is valid, otherwise it is invalid. This is because, from equation (a), we can get: k -1 =σ-1 (h+x·r)mod q, and then R=k -1 G and k -1 Substituting r=f(R) we can get: r=f(R)=f(k -1 ·G)=f(σ -1 (h+x·r)·G)=f(σ -1 ·h·G+σ -1 ·x·r·G) =f(σ- 1 ·h·G+σ- 1 ·r·X)

[0119] That is, according to the right side of formula (b), Bob can use σ, r in the received signature, as well as the message m and public key X to perform calculations and verify whether the calculation result is equal to r in the signature.

[0120] The basic ECDSA signature algorithm mentioned above can be extended to a threshold signature algorithm. For example, after the above DKG process, n signing parties P1, P2, ..., P n Each party has its own secret share and a total public key, where the threshold value is t, and t < n. At least t+1 signers among the n participants each use their own secret share as a private key share. After signing and broadcasting the same information to be signed, any verifier that has collected at least t+1 signature shares can recover the total signature and verify it using the total public key, thus achieving threshold signature. A specific implementation is the article "UC Non-Interactive, Proactive, Threshold ECDSA with Identifiable Aborts" published by Fireblocks at CCS20. This article constructs a distributed ECDSA signature scheme under a malicious model. The disadvantage of this scheme is that it requires a large number of zero-knowledge proofs to resist malicious adversaries, resulting in high communication and computational costs. At the same time, the threshold value of this scheme is fixed at t = n-1, and no solution with an arbitrary threshold value is given.

[0121] The embodiment of the present application provides a distributed threshold signature method based on ECDSA. In this embodiment, each signatory can generate a threshold private key through a dealer-less or dealer-less method such as threshold Shamir, Feldman or Joint-Feldman protocol, or through other DKG schemes. The implementation result of this type of DKG scheme is that the participant P i (i∈n) has a private key share ω i, any at least t+1 private key shares correspond to a total private key ω. The result of this DKG can also generate a total public key X. This total public key X and the total private key ω have the relationship: ω·G=X.

[0122] Furthermore, after n participants obtain their own private key shares based on the DKG, they can use their own private key shares to sign the same message, generating signature shares. Any at least t+1 signature shares can be aggregated into a total signature, which can be verified by the total public key.

[0123] The above relationship can be represented by the distributed threshold key generation in FIG1 and the distributed threshold signature in FIG2 .

[0124] The present embodiment includes two parts: distributed threshold key generation and distributed threshold signature. Both parts involve a process in which participants, through an agreement, specify how to transmit and process data, thereby achieving a specific goal. Distributed threshold signature includes both an offline phase and an online phase.

[0125] The following first introduces the process of distributed threshold key generation protocol. In this process, it is assumed that there are n participants, namely P1, P2, ..., P n Through the distributed threshold key generation protocol, each participant P i (i={1, 2, ..., n}) can generate their own private key shares.

[0126] Specifically, each participant P i A t-degree polynomial f can be generated i (z) = a i0 +a i1 z+a i2 z 2 +…+a it z t , where a i0 It's P i Setting secrets i0 . The threshold here is t), so the degree of the polynomial is also t.

[0127] Assume the threshold is 2 and the total number of participants is 5, that is, t = 2, n = 5, then there are 5 participants P1, P2, P3, P4, P5, where:

[0128] P1 generates a 2nd degree (t=2) polynomial: f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 Is the secret set by P1 10 ;

[0129] P2 generates a 2nd degree (t=2) polynomial: f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 Is the secret set by P2 20 ;

[0130] P3 generates a 2nd degree (t=2) polynomial: f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 It is the secret of P3 setting 30 ;

[0131] P4 generates a 2nd degree (t=2) polynomial: f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret of P4 settings 40 ;

[0132] P5 generates a 2nd degree (t=2) polynomial: f5(z)=a 50 +a 51 z+a 52 z 2 , where a 50 It is the secret of P5 setting 50 ;

[0133] Furthermore, each participant P i You can generate n secret shares, keep one of them for yourself, and encrypt and send the rest to other participants. i Generate the coordinates of n points on the curve corresponding to its own polynomial as n secret shares, retain the coordinates of one point for itself, and encrypt and send the coordinates of the remaining points to other participants.

[0134] Specific examples include:

[0135] P1 generates 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4),s 15 =f1(5), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send14 To P4, encrypt and send 15 to P5;

[0136] P2 generates 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4),s 25 =f2(5), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23 To P3, encrypt and send 24 To P4, encrypt and send 25 to P5;

[0137] P3Generators 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4),s 35 =f3(5), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 To P4, encrypt and send 35 to P5;

[0138] P4Generators 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s 44 =f4(4),s 45 =f4(5), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3, encrypt and send 45 to P5;

[0139] P5 Generations 51 =f5(1),s 52 =f5(2),s 53 =f5(3),s 54 =f5(4),s 55 =f5(5), keep s 55 , and encrypt and send s 51 To P1, encrypt and send s 52 To P2, encrypt and send s 53 To P3, encrypt and send54 to P4;

[0140] so:

[0141] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 、s 51 ;

[0142] P2 locally has different secret shares s generated by different parties 12 、s 22 、s 32 、s 42 、s 52 ;

[0143] P3 locally has secret shares s generated by different parties 13 、s 23 、s 33 、s 43 、s 53 ;

[0144] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 、s 54 ;

[0145] P5 locally has secret shares s generated by different parties 15 、s 25 、s 35 、s 45 、s 55 .

[0146] Then, each participant P i A secret share s that can be kept by itself ii and from other participants P j The secret share s obtained ji After aggregation, the private key shares are obtained. The aggregation method is, for example, summation. For example, if the participant P i Private key share For example:

[0147] Participant P1 can calculate the private key share s1 as: s1 = s 11 +s 21 +s 31 +s 41 +s 51 ;

[0148] Participant P2 can calculate the private key share s2 as: s2 = s12 +s 22 +s 32 +s 42 +s 52 ;

[0149] Participant P3 can calculate the private key share s3 as: s3 = s 13 +s 23 +s 33 +s 43 +s 53 ;

[0150] Participant P4 can calculate the private key share s4 as: s4 = s 14 +s 24 +s 34 +s 44 +s 54 ;

[0151] Participant P5 can calculate the private key share s5 as: s5 = s 15 +s 25 +s 35 +s 45 +s 55 .

[0152] Moreover, each participant P i You can also generate the public verification parameter A corresponding to your own t-degree polynomial ik =a ik G, where k = 0, 1, ..., t, and is announced to each participant, specifically:

[0153] Participant P1 generates A 1k =a 1k G, k = 0, 1, ..., t = 2, including A 10 =a 10 G=s 10 G, A 11 =a 11 G, A 12 =a 12 G, broadcast {A 10 , A 11 , A 12} to P2, P3, P4 and P5;

[0154] Participant P2 generates A 2k =a 2k G, k = 0, 1, ..., t = 2, including A 20 =a 20 G=s 20 G, A 21 =a 21 G, A 22 =a22 G, broadcast {A 20 , A 21 , A 22} to P1, P3, P4 and P5;

[0155] Participant P3 generates A 3k =a 3k G, k = 0, 1, ..., t = 2, including A 30 =a 30 G=s 30 G, A 31 =a 31 G, A 32 =a 32 G, broadcast {A 30 , A 31 , A 32} to P1, P2, P4 and P5;

[0156] Participant P4 generates A 4k =a 4k G, k = 0, 1, ..., t = 2, including A 40 =a 40 G=s 40 G, A 41 =a 41 G, A 42 =a 42 G, broadcast {A 40 , A 41 , A 42} to P1, P2, P3 and P5;

[0157] Participant P5 generates A 5k =a 5k G, k = 0, 1, ..., t = 2, including A 50 =a 50 G=s 50 G, A 51 =a 51 G, A 52 =a 52 G, broadcast {A 50 , A 51 , A 52} to P1, P2, P3 and P4.

[0158] Each participant P i You can also use P j The public authentication parameters j0 , A j1 ,…,A jt Verify P j Secret shares sent ji , for example, verified by the following formula: sji G=A j0 +iA j1 +…+i t A jt

[0159] Specifically:

[0160] Participant P1 passes s 21 G=A 20 +A 21 +A 22 Verifications 21 , through s 31 G=A 30 +A 31 +A 32 Verifications 31 , through s 41 G=A 40 +A 21 +A 42 Verifications 41 , through s 51 G=A 50 +A 51 +A 52 Verifications 51 ;

[0161] Participant P2 passes s 12 G=A 10 +2A 11 +2 2 A 12 Verifications 12 , through s 32 G=A 30 +2A 31 +2 2 A 32 Verifications 32 , through s 42 G=A 40 +2A 21 +2 2 A 42 Verifications 42 , through s 52 G=A 50 +2A 51 +2 2 A 52 Verifications 52 ;

[0162] Participant P3 passes s 13 G=A 10 +3A 11 +3 2 A 12 Verifications 13 , through s 23G=A 30 +3A 31 +3 2 A 32 Verifications 23 , through s 43 G=A 40 +3A 21 +3 2 A 42 Verifications 43 , through s 53 G=A 50 +3A 51 +3 2 A 52 Verifications 53 ;

[0163] Participant P4 uses s 14 G=A 10 +4A 11 +4 2 A 12 Verifications 14 , through s 24 G=A 20 +4A 21 +4 2 A 22 Verifications 24 , through s 34 G=A 40 +4A 21 +4 2 A 42 Verifications 42 , through s 54 G=A 50 +4A 51 +4 2 A 52 Verifications 52 ;

[0164] Participant P5 passes s 15 G=A 10 +5A 11 +5 2 A 12 Verifications 15 , through s 25 G=A 20 +5A 21 +5 2 A 22 Verifications 25 , through s 35 G=A 30 +5A 31 +5 2 A 32 Verifications 35 , through s 45G=A 40 +5A 41 +5 2 A 42 Verifications 45 ;

[0165] If either party fails the verification, they can terminate the agreement.

[0166] On the other hand, each participant P i The total public key X can be calculated in a similar way as above, for example using the following formula:

[0167] As mentioned above, the total public key can be used to verify the total signature after subsequent aggregation.

[0168] In addition, in order to resist the attack of malicious adversaries, each participant P i A hash value of the public key corresponding to its own secret can be generated and broadcast, so that the recipient can verify each participant P through the hash value i The correctness of the sent secret corresponding to the public key. For example:

[0169] P1 calculation H1() is the hash algorithm, A 10 =a 10 G is secret s 10 Corresponding public key (obtained through operations on the elliptic curve, here in the form of product); P1 can broadcast To other participants, any recipient receives Afterwards, you can use the Verification A 10 Correctness, thus resisting attacks from malicious adversaries;

[0170] P2 calculation H1() is the hash algorithm, A 20 =a 20 G is secret s 20 Corresponding public key (obtained through operations on the elliptic curve, here in the form of product); P2 can broadcast To other participants, any recipient receives Afterwards, you can use the Verification A 20 Correctness, thus resisting attacks from malicious adversaries;

[0171] P3 calculation H1() is the hash algorithm, A 30 =a 30 G is secret s 30Corresponding public key (obtained through operations on the elliptic curve, here in the form of product); P3 can broadcast To other participants, any recipient receives Afterwards, you can use the Verification A 30 Correctness, thus resisting attacks from malicious adversaries;

[0172] P4 calculation H1() is the hash algorithm, A 40 =a 40 G is secret s 40 Corresponding public key (obtained through operations on the elliptic curve, here in the form of product); P4 can broadcast To other participants, any recipient receives Afterwards, you can use the Verification A 40 Correctness, thus resisting attacks from malicious adversaries;

[0173] P5 Calculation H1() is the hash algorithm, A 50 =a 50 G is secret s 50 Corresponding public key (obtained through operations on the elliptic curve, here in the form of product); P5 can broadcast To other participants, any recipient receives Afterwards, you can use the Verification A 50 Correctness, thus resisting attacks from malicious adversaries;

[0174] In addition, each participant P i You can generate your own public-private key pair for homomorphic encryption, such as the Paillier public-private key pair (E i , e i ), where e i is the private key, E iis the corresponding public key. Homomorphic encryption technology can process plaintext data "homomorphically", that is, map the plaintext data to a new, confidential state, so that only the recipient with the key can obtain the plaintext data. Paillier homomorphic addition is a public key encryption system widely used in cryptography, proposed by Pascal Paillier in 1999. Its main feature is that it has additive homomorphic properties, which means that given two ciphertexts, the ciphertext of the sum of their corresponding plaintexts can be calculated without decryption. Specifically, suppose there are two plaintexts m1 and m2, and their Paillier encrypted ciphertexts are c1 and c2 respectively. Paillier's additive homomorphic property can realize the calculation of the product of c1 and c2 to obtain a new ciphertext c, which is exactly the ciphertext of the sum of m1 and m2. This homomorphic property can complete certain forms of calculations on encrypted data without leaking the original data.

[0175] Each participant P i After generating a homomorphically encrypted public-private key pair, the public key can be sent to other parties.

[0176] For example, after participant P1 generates the Paillier-encrypted public-private key (E1, e1), it broadcasts the homomorphically encrypted public key E1 to other participants; after participant P2 generates the Paillier-encrypted public-private key (E2, e2), it broadcasts the homomorphically encrypted public key E2 to other participants; after participant P3 generates the Paillier-encrypted public-private key (E3, e3), it broadcasts the homomorphically encrypted public key E3 to other participants; after participant P4 generates the Paillier-encrypted public-private key (E4, e4), it broadcasts the homomorphically encrypted public key E4 to other participants; after participant P5 generates the Paillier-encrypted public-private key (E5, e5), it broadcasts the homomorphically encrypted public key E5 to other participants.

[0177] In this way, each participant P i The local computer can store its own secrets, its own private key share, its own homomorphically encrypted private key, the total public key, and the homomorphically encrypted public key of each participant.

[0178] In one embodiment, in order to resist the attack of malicious adversaries, a first zero-knowledge proof can be used to provide proof of the homomorphic encryption public key. i The first zero-knowledge proof ψ can be generated i , the ψ i Can be used to prove the public key E i is a valid Paillier public key. Accordingly, the recipient who receives the homomorphic encryption public key and the corresponding first zero-knowledge proof can verify the corresponding homomorphic encryption public key through the first zero-knowledge proof. For example, any recipient Pj Received from participant P i Sent ψ i and E i After that, you can use E j and ψ j As input (input to the proof algorithm of zero-knowledge proof), verify ψ j Is it E j This is an acceptable proof of a legitimate Paillier public key. If the verification passes, the process of this embodiment can continue with the subsequent process. Otherwise, it is illegal and the process can be terminated.

[0179] After the above distributed threshold key generation process, there is a total polynomial: f(z)=f1(z)+f2(z)+f3(z)+f4(z)+f5(z)=a 10 +a 11 z+a 12 z 2 +a 20 +a 21 z+a 22 z 2 +a 30 +a 31 z+a 32 z 2 +a 40 +a 41 z+a 42 z 2 +a 50 +a 51 z+a 52 z 2 =(a 10 +a 20 +a 30 +a 40 +a 50 )+(a 11 +a 21 +a 31 +a 41 +a 51 )z +(a 12 +a 22 +a 32 +a 42 +a 52 )z 2

[0180] As mentioned above, the polynomial corresponds to a total curve, and the following relationship exists: s1=f1(1)+f2(1)+f3(1)+f4(1)+f5(1)=f(1); s2=f1(2)+f2(2)+f3(2)+f4(2)+f5(2)=f(2); s3=f1(3)+f2(3)+f3(3)+f4(3)+f5(3)=f(3); s4=f1(4)+f2(4)+f3(4)+f4(4)+f5(4)=f(4); s5=f1(5)+f2(5)+f3(5)+f4(5)+f5(5)=f(5);

[0181] In the aforementioned DKG scheme, each participant P i The secret share s calculated by itself can be i Broadcast to other participants. Then each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4, s5}, the secret s0 can be reconstructed. For example, for a threshold of 2, each participant P i After collecting at least 3 secret shares, the secret s0 can also be reconstructed.

[0182] In this embodiment, the purpose is to realize distributed threshold signature, so the secret share s is not used. i It is not sent to other participants, but as a private key share. In this way, no participant or other party can recover the total secret after obtaining at least t+1 secret shares, that is, the total private key cannot be obtained. This ensures that the private key shares obtained by multiple participants through a single distributed threshold key generation protocol can be repeatedly used for distributed threshold signatures in the future.

[0183] The following describes the distributed threshold signature process in this embodiment, which can include both an offline phase and an online phase. The aforementioned distributed key generation process requires n parties to participate in the protocol. The following distributed threshold signature process only requires at least t+1 parties to participate in the protocol. Here, we continue to use the threshold t=2 as an example.

[0184] Offline phase: At least t+1 participants generate their own first random value k i and a second random value γ i Each participant also uses the homomorphic encryption algorithm and obtains the coordinate component r and the mask value χ of their respective private key share components through the offline phase protocol i Specific examples may include:

[0185] t+1 participants, each participant P i Calculate the Lagrange coefficient And calculate the private key share xi =λ i s i For example, if i is 1, 2, or 3, then:

[0186] Participant P1 calculates the Lagrange coefficient And calculate the private key share component x1=λ1s1;

[0187] Participant P2 calculates the Lagrange coefficient And calculate the private key share component x2=λ2s2;

[0188] Participant P3 calculates the Lagrange coefficient And calculate the private key share component x3=λ3s3.

[0189] S11:

[0190] Each of at least t+1 participants generates a first random value and a second random value, and a corresponding homomorphic ciphertext of the first random value and a public key hash of the second random value. i , i∈[1, t+1] generates the first random value k i and a second random value γ i ,and On this basis, the participant P i The first random value homomorphic ciphertext can be calculated, such as the Paillier ciphertext K i =E i (k i ), and calculate the second random value public key hash, such as g i =H1(γ i G), H1() is a hash algorithm, similar to the above. When t+1 is 3 and the participants are P1, P2, and P3:

[0191] P1 generates a first random value k1 and a second random value γ1, and calculates the Paillier ciphertext K1=E1(k1) of the first random value, and calculates the public key hash g1=H1(γ1G) of the second random value;

[0192] P2 generates a first random value k2 and a second random value γ2, and calculates the Paillier ciphertext K2=E2(k2) of the first random value, and calculates the public key hash g2=H1(γ2G) of the second random value;

[0193] P3 generates a first random value k3 and a second random value γ3, and calculates the Paillier ciphertext K3=E3(k3) of the first random value, and calculates the public key hash g3=H1(γ3G) of the second random value;

[0194] Furthermore, for each of at least t+1 participants, Pi The generated first random value homomorphic ciphertext can be sent to other participants, such as:

[0195] P1 broadcasts K1 to P2 and P3;

[0196] P2 broadcasts K2 to P1 and P2;

[0197] P3 broadcasts K3 to P1 and P2;

[0198] S12:

[0199] The participant P who receives the broadcast i , for P j Sent K j , select two mask numbers β i，j , Here, the range of the subscript of the finite field is q to the power of 5, which is a proven range of values ​​with cryptographic security. i，j , Generally available in Select a larger value in the range. i The intermediate ciphertext D can be calculated by homomorphic algorithm i，j and And send to P j :

[0200] In the above two formulas, Represent homomorphic multiplication and homomorphic addition operations respectively.

[0201] Specifically:

[0202] After P1 receives K2=E2(k2) broadcast by P2, it selects two masks β 1，2 , Then P1 can calculate the intermediate ciphertext D through the homomorphic algorithm 1，2 and And sent to P2, where:

[0203] In this way, P2 receives D 1，2 =E2(α 1，2 )and Although P2 has the corresponding Paillier private key e2, k2 is also generated by P2, but due to the mask β selected by P1 1，2 , Due to the masking effect, P2 cannot infer P1's private key share x1 and random value γ1, thus completing the information transmission on this basis. The following is similar and will not be repeated here.

[0204] After P1 receives K3=E3(k3) broadcast by P3, it can calculate the intermediate ciphertext D through the homomorphic algorithm 1，3 and And sent to P3, where:

[0205] Similarly, after P2 receives K1=E1(k1) broadcast by P1, it can calculate the intermediate ciphertext D through the homomorphic algorithm 2，1 and And sent to P1, where:

[0206] After P2 receives K3=E3(k3) broadcast by P3, it can calculate the intermediate ciphertext D through the homomorphic algorithm 2，3 and And sent to P3, where:

[0207] Similarly, after P3 receives K1=E1(k1) broadcast by P1, it can calculate the intermediate ciphertext D through the homomorphic algorithm 3，1 and And sent to P1, where:

[0208] After P3 receives K2=E2(k2) broadcast by P2, it can calculate the intermediate ciphertext D through the homomorphic algorithm 3，2 and And sent to P2, where:

[0209] S13:

[0210] Furthermore, each participant P i For the received intermediate ciphertext D j，i and Use the corresponding homomorphic encryption private key to decrypt and obtain the plaintext α j，i , This is called the intermediate plaintext, where: α j，i =γ j ·k i -β j，i ,

[0211] Then, based on the first random value k i and a second random value γ i and the intermediate plaintext α j，i , Calculate the intermediate value δ i , and can be based on the private key share component x i and the first random value k i and the intermediate plaintext α j，i , Calculate the private key share mask value χ i :

[0212] Here, there are two relations:

[0213] This is because:

[0214] In addition, a second random value γ can be calculated i The corresponding public key Γ i =γ i G.

[0215] Furthermore, P i The intermediate value δ can be i and a second random value γ i The corresponding public key Γ i Send to other parties.

[0216] Specifically:

[0217] P1 receives the ciphertext D 2，1 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 2，1 , Where: α 2，1 =γ2·k1-β 2，1 , P1 receives the ciphertext D 3，1 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 3，1 , Where: α 3，1 =γ3·k1-β 3，1 , Then calculate δ1=γ1k1+(α 2，1 +β 2，1 +α 3，1 +β 3，1 ), In addition, P1 can calculate the public key Γ1=γ1G corresponding to the second random value γ1. Furthermore, P1 can send the intermediate value δ1 and the public key Γ1 corresponding to the second random value γ1 to other participants P2 and P3.

[0218] P2 receives the ciphertext D 1，2 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 1，2 , Where: α 1，2 =γ1·k2-β 1，2 , P2 receives the ciphertext D 3，2 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 3，2 , Where: α 3，2 =γ3·k2-β 3，2 , Then calculate δ2=γ2k2+(α 1，2 +β 1，2 +α 3，2 +β 3，2 ), In addition, P2 can calculate the public key Γ2 corresponding to the second random value γ2 = γ2G. Furthermore, P2 can send the intermediate value δ2 and the public key Γ2 corresponding to the second random value γ2 to other participants P1 and P2.

[0219] P3 receives the ciphertext D 1，3 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 1，3 , Where: α 1，3 =γ1·k3-β 13， P3 receives the ciphertext D 2，3 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 2，3 , Where: α 2，3 =γ2·k3-β 2，3 , Then calculate δ3=γ3k3+(α 1，3 +β 1，3 +α 2，3 +β 2，3 ), In addition, P3 can calculate the public key Γ3 corresponding to the second random value γ3 = γ3G. Furthermore, P3 can send the intermediate value δ3 and the public key Γ3 corresponding to the second random value γ3 to other participants P1 and P2.

[0220] So far, Pi Locally has δ j∈[t+1] , Γ j∈[t+1] , k i , χ i . Thus, P i It can be calculated that point R=(∑ j∈[t+1] δ j ) -1 ·(∑ j∈[t+1] Γ j )). In fact, from the above relationship 1, we can get that R=(∑ j∈[t+1] δ j ) -1 ·(∑ j∈[t+1] Γ j )=((k1+k2+...+k t+1 )·(γ1+γ2+...+γ t+1 )) -1 ·(∑ j∈[t+1] Γ j )=k -1 γ -1 ·(∑ j∈[t+1] Γ j )=k -1 γ -1 ·(∑ j∈[t+1] γ j G)=k -1 γ -1 γG=k -1 G, it can be seen that this is the same as the above ECDSA form. i We can calculate r = f(R), where f(R) is the horizontal coordinate of point R. i Locally save (r, k i , χ i ), and the offline phase ends.

[0221] For example:

[0222] P1 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k1, and χ1. As above, P1 can calculate point R based on δ1, Γ1, δ2, Γ2, δ3, and Γ3, and r = f(R), so P1 can save (r, k1, χ1) locally.

[0223] Similarly, P2 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k2, χ2. As above, P2 can calculate the point R based on δ1, Γ1, δ2, Γ2, δ3, Γ3, and r = f(R), so P2 can save (r, k2, χ2) locally.

[0224] Similarly, P3 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k3, χ3. As above, P3 can calculate the point R based on δ1, Γ1, δ2, Γ2, δ3, Γ3, and r = f(R), so P3 can save (r, k3, χ3) locally.

[0225] In addition, in S11, each of the participants can also generate a first random value homomorphic ciphertext K i The second zero-knowledge proof Φ i , and broadcast it to other participants; accordingly, in S12, each participant receives the first random value homomorphic ciphertext K i and the corresponding second zero-knowledge proof Φ i After that, through the second zero-knowledge proof Φ i Verify the corresponding first random value homomorphic ciphertext K i This can resist attacks from malicious adversaries. If the verification is passed, the process of this embodiment can continue with the subsequent process. Otherwise, it is illegal and the process can be terminated.

[0226] In addition, in S11, each of the participants can also generate a second random value public key Γ i =γ i G's corresponding hash g i =H1(γ i G)=H1(Γ i ) and broadcast it to other participants; accordingly, in the subsequent offline phase, each participant receives the second random value public key Γ i =γ i G and its corresponding hash g i Then, through the hash g i Verify the corresponding second random value public key Γ i This can resist attacks from malicious adversaries. If the verification is passed, the process of this embodiment can continue with the subsequent process. Otherwise, it is illegal and the process can be terminated.

[0227] In addition, in S12, each of the participants can also generate a third zero-knowledge proof Φ i，j And the fourth zero-knowledge proof Φ i，j Used to prove the intermediate ciphertext D i，j Corresponding Zero-knowledge proof Prove intermediate ciphertext Corresponding Correspondingly, in S13, each participant receives the intermediate ciphertext D i，j and the corresponding third zero-knowledge proof Φ i，j After that, through the third zero-knowledge proof Φ i，j Verify the corresponding intermediate ciphertext Di，j , and similarly, each participant receives the intermediate ciphertext And the corresponding fourth zero-knowledge proof After that, through the fourth zero-knowledge proof Verify the corresponding intermediate ciphertext This can resist attacks from malicious adversaries. If the verification is passed, the process of this embodiment can continue with the subsequent process. Otherwise, it is illegal and the process can be terminated.

[0228] Online phase: The at least t+1 participants each use their own first random value k i , private key share component mask value χ i and the coordinate component r to sign the same message, obtaining at least t+1 signature shares σ i .

[0229] For message m, its hash value is H(m). Each of at least t+1 participants P i , using the locally saved (r, k i , χ i ) can calculate H(m) to get the signature share sig i =(r,σ i ), specifically, σ i The following formula can be used for calculation:

[0230] σ i =k i H(m)+χ i r

[0231] In this way, after either party obtains at least t+1 signature shares, they can aggregate the at least t+1 signature shares into a total signature sig = (r, σ). Furthermore, the correctness of the total signature σ can be verified using the aforementioned total public key X. This is because the form of this formula is consistent with the form in the aforementioned ECDSA.

[0232] First of all, it should be noted that the following relationship exists:

[0233] In this way, at least t+1 signature shares are aggregated into a total signature σ:

[0234] Here x = s 10 +s 20 +...+s n0 =f(0), it can be seen that σ here = k·H(m)+k·x·r, which is essentially the same as formula (a) in the aforementioned ECDSA signature algorithm. Therefore, it is obvious that the total public key X can be used for verification.

[0235] Continuing with the above example, any party (which can be any one of the n=5 participants or a party other than the n=5 participants) obtains t+1=3 signature shares:

[0236] σ1=k1H(m)+χ1r

[0237] σ2=k2H(m)+χ2r

[0238] σ3=k3H(m)+χ3r

[0239] First, the following relationship exists:

[0240] Then calculate σ=∑ i∈[1，3] σ i =∑ i∈[1，3] (k i H(m)+χ i r)=∑ i∈[1，3] k i H(m)+∑ j∈[1，3] χ i r=(k1+k2+k3)·H(m)+(k1+k2+k3)·(x1+x2+x3)·r=k·H(m)+k·x·r

[0241] Here x = s 10 +s 20 +...+s 50 =f(0), which is equal to the sum of the secrets set by the n participants in the distributed threshold signature protocol. It can be seen that here σ = k·H(m)+k·x·r, which is essentially the same as formula (a) in the aforementioned ECDSA signature algorithm. Therefore, it is clear that the total public key X can be used for verification.

[0242] It should be noted that the above example mainly illustrates the case where there are exactly t+1 participants. In reality, there can be more than t+1 participants. In the above relationship x1+x2+x3=λ1s1+λ2s2+λ3s3, for example, it becomes:

[0243] x1+x2+x3+x4=λ1s1+λ2s2+λ3s3+λ4s4

[0244] The derivation of this formula also equals f(0) = s 10 +s 20 +s 30 +s 40 +s 50, which is also equal to the sum of the secrets set by the n participants in the distributed threshold signature protocol. This is also the result of the Lagrange interpolation calculation above. Therefore, when the number of participants in the distributed signature protocol exceeds t+1, the above process can still produce the same aggregate signature as at t+1, and thus can still be verified by the total public key.

[0245] The effectiveness of the aforementioned embodiments of this application lies, first, in supporting arbitrary threshold values. Secondly, to combat malicious adversaries, Fireblocks' article, "UC Non-Interactive, Proactive, Threshold ECDSA with Identifiable Aborts," published at CCS20, utilizes numerous zero-knowledge proofs. In contrast, the preferred embodiment provided by this application only requires proving that the corresponding plaintext of the Paillier ciphertext falls within a specific range in the distributed signature protocol, without requiring other zero-knowledge proofs. This reduces computational and communication complexity by 40%, and the proposed solution is provably secure under a general group model.

[0246] Similar to ECC-based cryptography, the same k cannot be used twice for encryption, otherwise it will be cracked and obtained by others. Therefore, it is best to use a new k each time the signature is signed. This can be done by at least t+1 participants performing the offline phase again to generate at least t+1 k i , thus obtaining a new k.

[0247] The above process can be performed once by n participants in a coordinated distributed key generation phase, followed by at least t+1 participants performing both the offline and online phases for each subsequent signature. Alternatively, n participants can perform the distributed key generation phase once, followed by at least t+1 participants performing multiple offline phases, thereby generating multiple different k values, and thus different R values ​​and corresponding r values, for use in each subsequent online signature phase.

[0248] In distributed threshold signatures, key shards (i.e. key shares) often need to be updated to ensure security. Here are some situations where key shards may need to be updated:

[0249] Key leakage: If any key shard is leaked, all key shards must be updated to ensure the security of the signature. Because the security of distributed threshold signatures relies on the confidentiality of key shards, if one shard is leaked, an attacker can recover the complete private key by combining multiple shards.

[0250] Periodic Updates: To increase security, key shards can be updated regularly. This reduces the window of opportunity for attackers to guess, infer, or infiltrate the key. The frequency of updates can be adjusted based on security requirements to balance security and performance.

[0251] In short, the purpose of updating key shards is to ensure the security and availability of distributed threshold signatures. Whether due to leaks or periodic updates, it is necessary to handle them with caution and ensure the security of the key.

[0252] When updating the secret key shares in a distributed threshold signature scheme, it is best to ensure that after n participants update their own private key shares, the corresponding total private key and total public key remain unchanged. This way, because the total public key remains unchanged, the total signature obtained by aggregating the signature shares of at least t+1 participants using the distributed threshold signature scheme can still be verified using the same total public key. Conversely, if the corresponding total public key changes after the secret key shares in the distributed threshold signature scheme are updated, a new total public key must be distributed. In other words, maintaining the total public key unchanged eliminates the need for distributing a new total public key, especially when any party outside the n participants needs to use the total public key to verify the total signature.

[0253] Assuming that the value of the threshold t remains unchanged before and after the update, based on the above scheme, the following describes an embodiment of a method for updating a key share in the distributed threshold signature scheme of the present application, including:

[0254] S310: Each of the n participants sets a secret value to 0, and uses the secret value 0 to generate a new t-degree random polynomial.

[0255] The secret value set by each of the n participants is 0, then each participant P i A new polynomial of degree t can be generated: f i ′(z)=0+a′ i1 z+…+a′ it z t

[0256] The value of 0 is the value of a in the above polynomial. i0 The value of Pi is the secret s set i0 =a i0 =0.

[0257] where a′ i1 ,...,a′ it Indicates P i The coefficients of the generated polynomial of degree t are different from the new private key share s generated by the distributed key generation protocol. i The coefficient a used in the process i1 ,…,a it .

[0258] Specifically, let the threshold t be 2 and the total number of participants be 5, that is, t = 2, n = 5, then there are 5 participants P1, P2, P3, P4, P5, where:

[0259] P1 generates a 2nd degree (t=2) polynomial: f′1(z)=0+a′ 11 z+a′ 12 z 2 , where a′ 10 = 0 is the secret s′ set by P1 10 ;

[0260] P2 generates a 2nd degree (t=2) polynomial: f′2(z)=0+a′ 21 z+a′ 22 z 2 , where a′ 20 = 0 is the secret s′ set by P2 20 ;

[0261] P3 generates a 2nd degree (t=2) polynomial: f′3(z)=0+a′ 31 z+a′ 32 z 2 , where a′ 30 = 0 is the secret s′ set by P3 30 ;

[0262] P4 generates a 2nd degree (t=2) polynomial: f′4(z)=0+a′41z+a′ 42 z 2 , where a′ 40 = 0 is the secret s′ set by P4 40 ;

[0263] P5 generates a 2nd degree (t=2) polynomial: f′5(z)=0+a′ 51 z+a′ 52 z 2 , where a′ 50 = 0 is the secret s′ set by P5 50 ;

[0264] S320: Each participant P i It generates n new secret shares based on a new t-degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to other participants.

[0265] For example, participant P i Generate the coordinates of n points on the curve corresponding to its own polynomial as n new secret shares, retain the coordinates of one point for itself, and broadcast the coordinates of the remaining points to other participants.

[0266] Specific examples include:

[0267] P1 generates s′ 11 =f′1(1),s′ 12 =f′1(2),s′ 13 =f′1(3),s′ 14 =f′1(4),s′ 15 =f′1(5), keep s′ 11 , and encrypt and send s′ respectively 12 To P2, encrypt and send s′ 13 To P3, encrypt and send s′ 14 To P4, encrypt and send s′ 15 to P5;

[0268] P2 generates s′ 21 =f′2(1),s′ 22 =f′2(2),s′ 23 =f′2(3),s′ 24 =f′2(4),s′ 25 =f′2(5), keep s′ 22 , and encrypt and send s′ respectively 21 To P1, encrypt and send s′ 23 To P3, encrypt and send s′ 24 To P4, encrypt and send s′ 25 to P5;

[0269] P3 generates s′ 31 =f′3(1),s′ 32 =f′3(2),s′ 33 =f′3(3),s′ 34 =f′3(4),s′ 35 =f′3(5), keep s′ 33 , and encrypt and send s′ respectively 31 To P1, encrypt and send s′ 32 To P2, encrypt and send s′ 34 To P4, encrypt and send s′ 35 to P5;

[0270] P4 generates s′ 41 =f′4(1),s′ 42 =f′4(2),s′ 43 =f′4(3),s′ 44 =f′4(4),s′ 45 =f′4(5), keep s′ 44 , and encrypt and send s′ respectively 41To P1, encrypt and send s′ 42 To P2, encrypt and send s′ 43 To P3, encrypt and send s′ 45 to P5;

[0271] P5 generates s′ 51 =f′5(1),s′ 52 =f′5(2),s′ 53 =f′5(3),s′ 54 =f′5(4),s′ 55 =f′5(5), keep s′ 55 , and encrypt and send s′ respectively 51 To P1, encrypt and send s′ 52 To P2, encrypt and send s′ 53 To P3, encrypt and send s′ 54 to P4;

[0272] so:

[0273] P1 locally generates new secret shares s′ with different participants 11 , s′ 21 , s′ 31 , s′ 41 , s′ 51 ;

[0274] P2 locally generates new secret shares s′ with different participants 12 , s′ 22 , s′ 32 , s′ 42 , s′ 52 ;

[0275] P3 locally generates new secret shares s′ with different participants 13 , s′ 23 , s′ 33 , s′ 43 , s′ 53 ;

[0276] P4 locally generates new secret shares s′ with different participants 14 , s′ 24 , s′ 34 , s′ 44 , s′ 54 ;

[0277] P5 locally generates new secret shares s′ with different participants 15 , s′ 25 , s′ 35 , s′ 45 , s′ 55 .

[0278] S330: Each participant P i Generate a new private key share based on the original private key share and the local new secret share.

[0279] Each participant P i The original private key share is s i , then the new private key share s′ i It can be obtained as follows:

[0280] Specific examples include:

[0281] Participant P1 can calculate the new private key share s′1 as: s′1=s1+s′ 11 +s′ 21 +s′ 31 +s′ 41 +s′ 51 ;

[0282] Participant P2 can calculate the new private key share s′2 as: s′2=s2+s′ 12 +s′ 22 +s′ 32 +s′ 42 +s′ 52 ;

[0283] Participant P3 can calculate the new private key share s′3 as: s′3=s3+s′ 13 +s′ 23 +s′ 33 +s′ 43 +s′ 53 ;

[0284] Participant P4 can calculate the new private key share s′4 as: s′4=s4+s′ 14 +s′ 24 +s′ 34 +s′ 44 +s′ 54 ;

[0285] Participant P5 can calculate the new private key share s′5 as: s′5=s5+s′ 15 +s′ 25 +s′ 35 +s′ 45 +s′ 55 .

[0286] Moreover, each participant P i You can also generate your own new t-degree polynomial corresponding to the public verification parameter A' ik =a′ ikG, where k = 1, ..., t, and is announced to each participant, specifically:

[0287] Participant P1 generates A′ 1k =a′ 1k G, k=1,...,t=2, including A′ 11 =a′ 11 G, A′ 12 =a′ 12 G, broadcast {A′ 11 , A′ 12} to P2, P3, P4 and P5; it should be noted that there is no new A′ 10 , because the corresponding a′ here 10 = 0, and A in the t-degree polynomial before P1 10 =a 10 G=s 10 G;

[0288] Participant P2 generates A′ 2k =a′ 2k G, k=1,...,t=2, including A′ 21 =a′ 21 G, A′ 21 =a′ 22 G, broadcast {A′ 21 , A′ 21} to P1, P3, P4 and P5; it should be noted that there is no new A′ 20 , because the corresponding a′ here 20 = 0, and A in the t-degree polynomial before P2 20 =a 20 G=s 20 G;

[0289] Participant P3 generates A′ 3k =a′ 3k G, k=1,...,t=2, including A′ 31 =a′ 31 G, A′ 32 =a′ 32 G, broadcast {A′ 31 , A′ 32} to P1, P2, P4 and P5; it should be noted that there is no new A′ 30 , because the corresponding a′ here 30 = 0, and A in the t-degree polynomial before P3 30 =a 30 G=s 30 G;

[0290] Participant P4 generates A′ 4k=a′ 4k G, k=1,...,t=2, including A′ 41 =a′ 41 G, A′ 42 =a′ 42 G, broadcast {A′ 41 , A′ 42} to P1, P2, P3 and P5; it should be noted that there is no new A′ 40 , because the corresponding a′ here 40 = 0, and A in the t-degree polynomial before P4 40 =a 40 G=s 40 G;

[0291] Participant P5 generates A′ 5k =a′ 5k G, k=1,...,t=2, including A′ 51 =a′ 51 G, A′ 52 =a′ 52 G, broadcast {A′ 51 , A′ 52} to P1, P2, P3 and P4; it should be noted that there is no new A′ 50 , because the corresponding a′ here 50 = 0, and A in the t-degree polynomial before P5 50 =a 50 G=s 50 G.

[0292] Thus, each participant P i According to P j The public authentication parameters {A′ j1 ,…,A′ jt Verify P j The new secret share s′ sent ji , for example, verified by the following formula: s′ ji G=iA′ j1 +…+i t A′ jt

[0293] Specifically:

[0294] Participant P1 passes s′ 21 G=A′ 21 +A′ 22 Verify s′ 21 , through s′ 31 G=A′ 31 +A′ 32 Verify s′ 31 , through s′41 G=A′ 41 +A′ 42 Verify s′ 41 , through s′ 51 G=A′ 51 +A′ 52 Verify s′ 51 ;

[0295] Participant P2 passes s′ 12 G=2A′ 11 +2 2 A′ 12 Verify s′ 12 , through s′ 32 G=2A′ 31 +2 2 A′ 32 Verify s′ 32 , through s′ 42 G=2A′ 41 +2 2 A′ 42 Verify s′ 42 , through s′ 52 G=2A′ 51 +2 2 A′ 52 Verify s′ 52 ;

[0296] Participant P3 uses s′ 13 G=3A′ 11 +3 2 A′ 12 Verify s′ 13 , through s′ 23 G=3A′ 21 +3 2 A′ 22 Verify s′ 23 , through s′ 43 G=3A′ 41 +3 2 A′ 42 Verify s′ 43 , through s′ 53 G=3A′ 51 +3 2 A′ 52 Verify s′ 53 ;

[0297] Participant P4 passes s′ 14 G=4A′ 11 +4 2 A′ 12 Verify s′ 14 , through s′ 24 G=4A′21 +4 2 A′ 22 Verify s′ 24 , through s′ 34 G=4A′ 31 +4 2 A′ 32 Verify s′ 34 , through s′ 54 G=4A′ 51 +4 2 A′ 52 Verify s′ 54 ;

[0298] Participant P5 passes s′ 15 G=5A′ 11 +5 2 A′ 12 Verify s′ 15 , through s′ 25 G=5A′ 21 +5 2 A′ 22 Verify s′ 25 , through s′ 35 G=5A′ 31 +5 2 A′ 32 Verify s′ 41 , through s′ 45 G=5A′ 41 +5 2 A′ 42 Verify s′ 45 .

[0299] If either party fails the verification, they can terminate the agreement.

[0300] Moreover, each participant P i The total public key X remains unchanged, that is, it is still:

[0301] As mentioned above, the original total public key can still be used to verify the total signature after aggregation of new signature shares generated by the updated secret shares.

[0302] In addition, the private key in the original homomorphic encryption public-private key pair may also be leaked, so each participant P i You can generate your own new public-private key pair for homomorphic encryption, such as the Paillier new public-private key pair (E′ i , e′ i ), where e′ i is the new private key, E′ i is the corresponding new public key.

[0303] Each participant P i After generating a new homomorphically encrypted public-private key pair, the new public key can be sent to other participants. For example, after participant P1 generates a new Paillier-encrypted public-private key pair (E′1, e′1), it broadcasts the new homomorphically encrypted public key E′1 to other participants; after participant P2 generates a new Paillier-encrypted public-private key pair (E′2, e′2), it broadcasts the new homomorphically encrypted public key E′2 to other participants; after participant P3 generates a new Paillier-encrypted public-private key pair (E′3, e′3), it broadcasts the new homomorphically encrypted public key E′3 to other participants; after participant P4 generates a new Paillier-encrypted public-private key pair (E′4, e′4), it broadcasts the new homomorphically encrypted public key E′4 to other participants; after participant P5 generates a new Paillier-encrypted public-private key pair (E′5, e′5), it broadcasts the new homomorphically encrypted public key E′5 to other participants.

[0304] In one embodiment, in order to resist the attack of malicious adversaries, a fifth zero-knowledge proof can be used to provide proof of the new public key for homomorphic encryption. i The fifth zero-knowledge proof ψ′ can be generated i , the ψ′ i Can be used to prove the new public key E′ i is a valid Paillier public key. Accordingly, the recipient who receives the homomorphically encrypted new public key and the corresponding fifth zero-knowledge proof can verify the corresponding homomorphically encrypted new public key through the fifth zero-knowledge proof. For example, any recipient P j Received from participant P i ψ′ i and E′ i After that, we can use E′ i and ψ′ i As input (input to the proof algorithm of zero-knowledge proof), verify ψ′ i Is it E′ i This is an acceptable proof of a legitimate Paillier public key. If the verification passes, the process of this embodiment can continue with the subsequent process. Otherwise, it is illegal and the process can be terminated.

[0305] It should be noted that, since each of the n participants in the above embodiment sets the secret value to 0, and uses the secret value 0 to generate a new t-degree random polynomial, the corresponding curve of the polynomial is a curve passing through the point (0, 0). The new curve corresponding to the new t-degree random polynomial generated by each of the n participants is still a curve passing through the point (0, 0) after superposition. The new t-degree random polynomial is superimposed on the original t-degree random polynomial, that is, the new curve is superimposed on the original t-degree random polynomial corresponding curve, and the new secret share obtained after taking a certain horizontal coordinate on the superimposed curve is also equivalent to the sum of the first vertical axis coordinate after taking the same horizontal coordinate on the original curve and the second vertical axis coordinate after taking the same horizontal coordinate on the new curve, and the sum of the second vertical axis coordinate after taking the same horizontal coordinate on the new curve is the sum of the second vertical axis coordinates after taking the same horizontal coordinate on the new curve. The above formula reflects this point:

[0306] Furthermore, the value of the superimposed curve at zero is the same as the original curve, meaning that if the total private key is the same, then the corresponding total public key is also the same. Therefore, the original total public key can be used to verify the new total signature obtained by aggregating the signature shares obtained using the new private key shares.

[0307] The following describes an embodiment of a computer device of the present application, including:

[0308] processor;

[0309] and a memory storing a program, wherein when the processor executes the program, the following operations are performed:

[0310] Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial;

[0311] Generate n new secret shares based on a new t-degree random polynomial generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants;

[0312] Generate a new private key share based on the original private key share and the local new secret share.

[0313] The following describes an embodiment of a storage medium of the present application, which is used to store a program, wherein the program performs the following operations when executed:

[0314] Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial;

[0315] Generate n new secret shares based on a new t-degree random polynomial generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants;

[0316] Generate a new private key share based on the original private key share and the local new secret share.

[0317] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures such as diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0318] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0319] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0320] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0321] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0322] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram.

[0323] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0324] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0325] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0326] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0327] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0328] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0329] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0330] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0331] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A method for updating secret key shares in a distributed threshold signature scheme, where the total number of participants is n and the threshold is t, the method includes: Each of the n participants sets the secret value to 0 and uses the secret value 0 to generate a new t-degree random polynomial; Each participant generates n new secret shares based on the new t-degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to other participants; Each participant generates a new private key share based on the original private key share and the local new secret share.

2. The method of claim 1, further comprising: Each of the n participants generates a public verification parameter corresponding to a new t-degree polynomial and broadcasts it; Accordingly, each participant verifies the corresponding secret share sent according to the broadcasted public verification parameters.

3. The method according to claim 2, wherein the public verification parameters corresponding to the new t-degree polynomial include A′ ik =a′ ik G, where k=1,...,t.

4. The method of claim 2, wherein each participant verifies the corresponding secret share sent according to the broadcasted public verification parameter, comprising: Each participant P i According to P j The public authentication parameters {A′ j1 ,…,A′ jt Verify P j The new secret share s′ sent ji , verified by the following formula: s′ ji G=iA′ j1 +…+i t A′ jt 5. The method of claim 1, further comprising: Each participant generates its own new public-private key pair for homomorphic encryption and sends the new public key to other participants.

6. The method of claim 5, further comprising: Each participant generates a fifth zero-knowledge proof for verifying the new public key.

7. The method of claim 6, further comprising: After each participant receives the homomorphically encrypted new public key and the corresponding fifth zero-knowledge proof, the corresponding homomorphically encrypted new public key is verified through the fifth zero-knowledge proof.

8. The method of claim 1, further comprising: Any party obtains the total signature after aggregation of the signature shares obtained using the new private key shares and verifies it using the original total public key.

9. A computer device comprising: processor; and a memory, wherein a program is stored, wherein when the processor executes the program, the following operations are performed: Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial; Generate n new secret shares based on the new t-degree random polynomial generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants; Generate a new private key share based on the original private key share and the local new secret share.

10. A storage medium for storing a program, wherein the program performs the following operations when executed: Set the secret value to 0 and use the secret value 0 to generate a new t-degree random polynomial; Generate n new secret shares based on the new t-degree random polynomial generated by itself, retain one of the secret shares for itself, and encrypt and send the remaining secret shares to other participants; Generate a new private key share based on the original private key share and the local new secret share.

Images