Method for implementing distributed digital certificate, computer device, and storage medium

Abstract

A method for implementing a distributed digital certificate, comprising: each of n parties generating a respective threshold secret key share by means of a distributed key generation protocol; each of at least t+1 of the N parties generating a random value by means of an offline phase protocol; each of the at least t+1 parties receiving a certificate application, and signing application information in the certificate application by means of an online phase protocol and on the basis of the threshold secret key share and the random value generated by means of the offline phase protocol, so as to generate a certificate share; and after obtaining at least t+1 certificate shares, any one of the parties aggregating the at least t+1 signature shares into a total certificate.

Description

A method, computer device and storage medium for implementing distributed digital certificates

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 31, 2023, with application number 202311121706.9 and application name “A method, computer device and storage medium for implementing distributed digital certificates”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of this specification belong to the field of cryptography technology, and more particularly, relate to a method, computer device, and storage medium for implementing distributed digital certificates. Background Art

[0003] In the early days of the internet, secure information transmission became a major concern. To address this, various encryption algorithms were invented, such as symmetric encryption algorithms like DES. However, these algorithms required both parties to share a secret key, which was difficult to achieve on the internet. Therefore, public-key cryptography was invented, allowing secure communication without directly exchanging keys. However, public-key cryptography introduced a new problem: how to verify the authenticity of the public key. To address this, digital certificates were invented.

[0004] Digital certificates are based on the Public Key Infrastructure (PKI). In PKI, there is a widely trusted third party called a Certificate Authority (CA). The CA's mission is to verify the identity of an entity and issue digital certificates for it. When an entity (such as a website) requires a digital certificate, it first generates a public and private key pair and then sends the public key and some identity information to the CA. The CA verifies the authenticity of this information and then generates a digital certificate containing the entity's public key and identity information, signing the certificate with the CA's private key.

[0005] When another entity (such as a user) needs to verify the identity of the first entity, it can request the first entity's digital certificate. The user can verify the signature of the certificate with the CA's public key and then use the public key in the certificate to encrypt information or verify the first entity's digital signature.

[0006] As can be seen, the main function of a digital certificate is to verify the authenticity of the public key, thereby ensuring the secure transmission of information. It can be used in various network security scenarios, such as:

[0007] Secure communication: By using digital certificates, two entities can communicate securely without directly exchanging keys. For example, when you visit an HTTPS website, your browser requests the website's digital certificate and then uses the public key in the certificate to encrypt the information.

[0008] Authentication: A digital certificate contains information about an entity's identity, which can be used to verify the entity's identity. For example, when you download a piece of software, you can check the software's digital signature to ensure it was issued by a company you trust.

[0009] Data integrity: By using digital certificates, entities can generate digital signatures, which can be used to verify the integrity of data. For example, when you receive an email, you can check the digital signature of the email to ensure that the email has not been tampered with.

[0010] Therefore, digital certificates are often compared to a user's online ID card. Public key certificates typically contain the certificate holder's identity information, the certificate holder's public key, the CA's information, and additional information, plus a digital signature using the CA's private key.

[0011] A certificate authority plays a vital role in the digital certificate world. It is a widely trusted third-party organization that verifies the identity of entities (such as individuals, companies, websites, etc.) and issues digital certificates to them. The following are some of the main functions of a certificate authority:

[0012] Identity verification: One of the primary responsibilities of a CA is to verify the identity of the entity applying for a digital certificate. This typically involves a series of identity verification processes, such as verifying a company's registration information or an individual's ID card information. Only after successful identity verification will the CA issue a digital certificate to the entity.

[0013] Certificate issuance: Once an entity's identity is verified, the CA issues a digital certificate. This certificate contains the entity's public key and other identifying information, such as the entity's name and the certificate's validity period. All of this information is signed with the CA's private key to ensure the certificate's authenticity and integrity.

[0014] Certificate revocation: In some cases, an issued certificate may need to be revoked. For example, if the certificate's private key is compromised or the certificate owner no longer needs the certificate, the certificate may need to be revoked. The CA is responsible for managing a certificate revocation list (CRL), which records all revoked certificates.

[0015] Trust Anchor: CAs are the trust anchors of the public key infrastructure (PKI). This means that we trust CAs, and therefore we also trust certificates signed by CAs. Most operating systems and browsers have the public keys of some widely trusted CAs built-in so that users can verify certificates signed by these CAs.

[0016] In traditional digital certificate schemes, the certificate authority is often a centralized organization.

[0017] With the rapid development of the internet, digital certificates have become a crucial tool for ensuring network security. However, traditional digital certificate systems have several issues, primarily due to their overreliance on centralized certificate authorities (CAs). As the core of trust, the security and reliability of CAs directly impact the security of the entire system. However, in recent years, several serious security incidents have exposed the vulnerabilities of centralized CA systems.

[0018] To address these issues, researchers are exploring new certificate system models, the most promising of which is the distributed digital certificate system. Distributed digital certificate systems are primarily based on blockchain and other distributed ledger technologies. These technologies provide a decentralized way to store and verify data, allowing for the issuance and verification of certificates without a centralized CA.

[0019] The emergence of a distributed digital certificate system can address some of the issues with traditional CA systems. First, without a centralized CA, the system's security no longer relies on a single point of trust, which improves its robustness. Second, all operations are recorded on the blockchain, increasing transparency and enabling users to verify the issuance and revocation of certificates.

[0020] Public-key cryptography, also known as asymmetric cryptography, is a cryptography used in digital certificates. It uses a public-private key pair (denoted as PK-SK, where PK stands for public key and SK stands for secret key), as opposed to cryptography that uses only a single private key. Public-key cryptography includes encryption algorithms and digital signature algorithms. Public-private key pairs are the cornerstone of modern cryptographic security. Many applications are based on PK-SK, such as the HTTPS (Hypertext Transfer Protocol Secure) application-layer encrypted transmission protocol and blockchain.

[0021] A private key typically represents the identity of the party that possesses it. It can only be held by the owner and cannot be made public, whereas the corresponding public key can be made public. Signing with a private key can indicate the owner's approval of certain information in the digital world. The signed information in a protocol message can also represent the owner's actions. Generally, a single owner possesses a private key. This owner can use their private key to sign a message and send it to another party. Upon receiving the signature, the recipient can verify it using the corresponding public key. If verification is successful, the recipient can confirm that the owner signed the message and that the signed message has not been tampered with.

[0022] In a traditional centralized CA, a CA uses its own private key to sign the public key of a first entity (such as a website). When a second entity (such as a user) accesses the website, in order to avoid leaking personal information, it needs to first verify the identity of the first entity and can request the digital certificate of the first entity. After the user receives the digital certificate of the first entity, the signature of the certificate can be verified using the public key of the CA. If the verification is successful, the authenticity of the website certificate issued by the CA can be confirmed based on the authority of the CA, so the website can be trusted. Furthermore, when the user sends information to the website, the public key in the certificate can be used to encrypt the information to be transmitted. Since only the website has the corresponding private key, only the website can decrypt the transmitted information. In this way, the privacy of information transmitted on the network is ensured.

[0023] In a distributed CA, there's no centralized CA. Instead, there are typically multiple authoritative organizations. These multiple authoritative organizations can act as nodes in multiple networks. Through distributed key negotiation, these nodes generate their own public-private key pairs, each with a single master public key. Each node's signature on the same information using its own private key is called a signature share. When multiple signature shares are aggregated, a master signature is generated, which can be verified using the master public key. This ensures that certificates are only issued when all (or a majority) of the multiple authoritative organizations agree.

[0024] The above is equivalent to jointly controlling an account. Sometimes, accounts require flexible access control policies, such as when multiple parties jointly control an account on a blockchain. In some cases, n parties must jointly control an account. In this case, actions controlling this account, such as transferring funds, require the approval of all n parties.

[0025] In addition, a threshold function can also be implemented. For example, among 5 nodes, at least 3 nodes need to give their approval, that is, at least 3 nodes provide signature shares, so that they can be aggregated into a total signature, and this total signature can be verified by the total public key. When multiple parties jointly control an account, it is not necessary for all n participants to agree. Instead, when t + 1 participants (t < n, t is also called the threshold) among them agree, they can control the account, and this can be achieved through threshold signature.

[0026] In this type of threshold cryptography, the private key information is shared among multiple independent participants. Each calculation of the private key requires the agreement of multiple participants, thus improving the security of the algorithm. Moreover, when a small number of participants fail or become unavailable, it does not affect the availability of the private key. A secure (t, n) threshold cryptography algorithm should satisfy: (1) Any number of participants more than t can calculate the final signature, exchanged key or plaintext, while t or fewer participants cannot obtain any information about the above results; (2) No information about the private key and the private key shares of the participants is leaked during the execution of the algorithm.

[0027] Summary of the Invention

[0028] The object of the present invention is to provide a method, computer device and storage medium for implementing distributed digital certificates, including: A method for implementing distributed digital certificates, including:

[0029] Each of the n participants generates its own threshold private key share through a distributed key generation protocol;

[0030] Each of at least t + 1 participants among the n participants generates a random value through an offline phase protocol;

[0031] Each of the at least t + 1 participants receives a certificate application, and signs the application information in the certificate application based on the threshold private key share and the random value generated by the offline phase protocol through an online phase protocol, generating a certificate share.

[0032] A method for updating key shares in a distributed threshold signature scheme, the first set of participants before the change includes n participants, the second set of participants after the change includes n' participants, and the threshold before and after the change changes from t to t'. This method includes:

[0033] The first set of participants before the change and the second set of participants after the change intersect to obtain a third set Each of at least t+1 participants generates a new random polynomial of degree t′ based on the original private key share as the secret value; where S is a subset of the participant index, satisfying |S| = t+1;

[0034] Third Collection Each of the at least t+1 participants generates n′ new secret shares based on the new t′ degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to the second set Other parties involved in the

[0035] Second party set Each participant in the process generates a new private key share based on the local new secret share.

[0036] A method for implementing distributed threshold signature, comprising:

[0037] Each of the n participants generates their own threshold private key share through a distributed key generation protocol;

[0038] At least t+1 of the n participants each generate a random value through the offline phase protocol;

[0039] Each of the at least t+1 participants signs the message based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

[0040] A computer device comprises: a processor; and a memory in which a program is stored, wherein when the processor executes the program, the computer device performs the following operations:

[0041] Generate respective threshold private key shares through a distributed key generation protocol; generate a random value through an offline phase protocol; sign a message based on the threshold private key share and the random value generated by the offline phase protocol through an online phase protocol to generate a signature share.

[0042] A storage medium for storing a program, wherein the program performs the following operations when executed:

[0043] Generate respective threshold private key shares through a distributed key generation protocol; generate a random value through an offline phase protocol; sign a message based on the threshold private key share and the random value generated by the offline phase protocol through an online phase protocol to generate a signature share.

[0044] The above solution provided by this application can therefore get rid of dependence on centralized institutions, making it more flexible and robust. It can tolerate a certain degree of private key shard leakage and loss, thereby effectively avoiding the security risks brought about by improper private key management, and is more suitable for decentralized scenarios such as blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0046] FIG1 is a schematic diagram of distributed threshold key generation in one embodiment;

[0047] FIG2 is a schematic diagram of a distributed threshold signature according to an embodiment;

[0048] FIG3 is a distributed key update process in one embodiment;

[0049] FIG4 is a method flow diagram for implementing distributed digital certificates in one embodiment;

[0050] FIG5 is a flow chart of a method for implementing distributed digital certificates in one embodiment. DETAILED DESCRIPTION

[0051] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only a portion of the embodiments of this specification, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of this specification without inventive effort shall fall within the scope of protection of this specification.

[0052] The DKG (Distributed Key Generation) protocol is a distributed protocol that generates a set of keys through collaboration among multiple parties. The VSS (Verifiable Secret Sharing) protocol is an important theoretical foundation for the DKG protocol.

[0053] VSS allows for sharing secret data between multiple parties. Without leaking the secret data itself, the data can be split into multiple shards, each of which is kept by a different party. Later, when restoring the secret data, all shards must be collected to successfully restore the complete secret data.

[0054] The VSS protocol, first proposed by Shamir in 1979, is a polynomial-based secret sharing protocol. The VSS protocol is derived from Shamir's Secret Sharing (SSS), so we'll first introduce Shamir's Secret Sharing.

[0055] Shamir secret sharing includes two stages: secret sharing (or secret distribution) and secret reconstruction. First, a dealer needs to construct a polynomial: f(x) = a0 + a1x + a2x 2 +…+a n x n Polynomial(*)

[0056] Among them, a0 is the secret data to be shared.

[0057] This n-degree polynomial consists of a set of coefficients (a0, a1, a2, ..., a n ) is uniquely determined, and this set of coefficients includes n+1 values. In this way, if it is known that the curve corresponding to the n-degree polynomial passes through n+1 different points on the plane, the coordinates of n+1 different points (x1, y1) are obtained. (x 2， y2),...,(x n ,y n ), (x n+1 ,y n+1 ), we can get a set of (n+1) linear equations of n+1 equations, and from this set of equations we can determine the n+1 coefficients a0, a1, a2, ..., a n The value of the polynomial (*) is determined, and finally the value of the secret data a0 is obtained. The coordinates of the n+1 different points (x1, y1), (x2, y2), ..., (x n ,y n ), (x n+1 ,y n+1 ) means n+1 secret shards.

[0058] The process of finding a curve passing through a number of existing points is called polynomial interpolation. There are many ways to implement polynomial interpolation. The following is a common Lagrange interpolation method. Given an nth degree polynomial*, it is known that the corresponding curve of the polynomial passes through n+1 points (x1, y1), (x2, y2), ..., (x n ,y n ), (x n+1 ,y n+1 ), then the polynomial of the n-degree curve can be obtained by Lagrange interpolation as follows:

[0059] Polynomial (**) and polynomial (*) are actually equivalent. If x = 0 in polynomial (*), then f(0) = a0, which means the value of the secret data a0 can be obtained. Therefore, if x = 0 in polynomial (**), the value of the secret data a0 can also be obtained, that is, f(0) = a0.

[0060] For n+1 points (x1, y1), ..., (x n ,y n ), (x n+1 ,y n+1 ), the above polynomial (**) can also be expressed as:

[0061] in, Similarly, for constant terms or secret values, we have

[0062] In summary, we can select any n+1 points on the polynomial and share these n+1 points among n+1 participants, for example, each participant receives the coordinates of one point. Collecting the coordinates of any fewer than n+1 points will not reveal the original secret data a0. Only after obtaining all n+1 points can the value of secret data a0 be restored by reconstructing the polynomial coefficients. Furthermore, even if we collect the coordinates of fewer than n+1 points, for example, n points, the value of secret data a0 will not be revealed probabilistically, as there are an infinite number of n-degree curves passing through these n points. The degree n here is also called the degree of the polynomial.

[0063] On this basis, threshold Shamir secret sharing can be implemented. For example, t-of-n secret sharing is to share a secret between n participants, and stipulate that the threshold of the minimum secret shards required for recovery is greater than t, that is, greater than or equal to t+1. For example, in a transaction involving four parties, the agreed threshold is 3, that is, n=4, t=2, then the secret can only be restored when greater than or equal to t+1=3 participants provide their own secret shards, otherwise the secret cannot be restored. Specifically, a polynomial of degree t=2 can be constructed: f(x)=a0+a1x+a2x 2 Polynomial(***)

[0064] The curve corresponding to the 2-degree polynomial can be obtained to pass through 4 different points on the plane, that is, the coordinates of 4 different points are obtained (x1, y1), (x2, y2), (x3, y3), (x4, y4), and the coordinates of these 4 points are distributed to one participant respectively during the secret sharing phase. The 4 participants are set as Party1, Party2, Party3, and Party4. In this way, it is assumed that Party1 has a slice (x1, y1), Party2 has a slice (x2, y2), Party3 has a slice (x3, y3), and Party4 has a slice (x4, y4). Since the polynomial (**) can be determined by any 3 points on the corresponding curve, Party i In (i∈{1, 2, 3, 4}), if any three participants provide their own secret slices, the polynomial (***) can be restored during the secret reconstruction phase, thereby obtaining the secret value a0. If fewer than three participants provide their own secret slices, the polynomial (***) cannot be restored, and the secret value a0 cannot be obtained. The above t is also called the threshold.

[0065] The aforementioned Shamir Secret Sharing and Threshold Shamir Secret Sharing require a role to generate polynomials and distribute secret shards. This role can be called a dealer. This dealer is an entity that knows the secret and must be a trusted third party by all participating parties. Furthermore, an entity is required to aggregate at least t+1 shards and derive the secret. This entity can be the dealer, a participating party, or another entity.

[0066] In engineering practice, polynomials are often defined in finite fields or prime number fields rather than real number fields or natural number fields.

[0067] The classic Shamir secret sharing scheme assumes that all participants are honest. However, dishonest behavior, or malicious behavior, is possible. For example, a dealer could deceive one or more participants by sending incorrect secret shards to them.

[0068] In secret sharing, to verify malicious behavior, such as verifying whether the dealer is deceiving them (as described above, verifying whether the dealer sends an incorrect secret fragment), Verifiable Secret Sharing (VSS) is proposed. Feldman VSS is a practical VSS scheme based on Shamir's secret sharing, including:

[0069] The dealer has a secret and distributes n fragments of this secret to n participants, of which t participants can reconstruct the secret. A similar threshold Shamir secret sharing scheme can be used to construct a t-degree polynomial: f(x) = a0 + a1x + a2x 2 +…+a t x t Polynomial (****)

[0070] Dealer is for each party i Choose any non-zero x i , calculate s i =f(x i ), and the sub-secret s i Encrypted and sent to the participating party i At the same time, the Dealer calculates Where j = 0, 1, 2, ..., t-1, and A is public j , that is, open {A0, A1, A2, ..., A t-1}. A j Also called public authentication parameters. Here A j The method of generating the public key is the same as the method of generating the public key based on the private key on the elliptic curve. Therefore, A j It can also be called public key sharding (share, or public key sharing, public key share).

[0071] For the case where the selected polynomial corresponds to an elliptic curve, the public A j It is safe because according to the properties of elliptic curves, it is impossible to j Reverse to get a j .

[0072] Public verification parameters {A0, A1, A2, ..., A t-1} is also called a commitment. Since the commitment is bound to the coefficients of the polynomial, it can be used to verify whether a value of the polynomial is correct. In the implementation based on discrete logarithms, g is a generator of the cyclic group over a finite field. g can be between Dealer and Party. iThe above sub-secrets are also called secret shares.

[0073] The participants receive the sub-secret s i After that, public verification parameters can be used to verify s i The validity of s can be verified by verifying whether the following equation holds: i Validity:

[0074] The right side of the polynomial (*****) can be derived as follows:

[0075] The right side of the polynomial (*****) can also be written as:

[0076] It can be seen that for Party i , a non-zero x selected by the Dealer i , x i For example, if it is i, then Party i It can be used with i and public verification parameters {A0, A1, A2, ..., A t}Calculate the right side of the polynomial (*****) and use the generator g and the sub-secret s i To calculate the left side of the polynomial (*****), we can determine whether the left and right sides of the polynomial (*****) are equal. Is it {A0, A1, A2, ..., A t} corresponds to a point on the curve. This verification belongs to the verification of the secret distribution phase. For simplicity, we can usually take x i =i.

[0077] In engineering, it is generally implemented based on discrete logarithms. Modulo operations are used for the above equations, such as mod p, where p is a large prime number and p is also the value of Dealer and Party. i Pre-configured. mod p is also omitted in the following similar places.

[0078] During the secret reconstruction phase, for example, if at least t+1 participants each send their own secret shards to the dealer, the dealer can verify each secret shard using the public verification parameter corresponding to the polynomial. Failure to verify can be used to prove that the party sending the secret shard is malicious; secret shards that pass verification can be used as the basis for reconstructing the secret.

[0079] In the secret reconstruction phase, after collecting the secret shards of at least t+1 participants, the polynomial f(x) can be reconstructed through the Lagrange interpolation method to obtain the value of f(0), that is, the secret value.

[0080] In addition, through the public verification parameters {A0, A1, A2, ..., A t The legitimacy of the secret a0 can also be verified, that is, it can be verified whether (0, a0) is a point on the curve, because the following relationship exists:

[0081] In other words, the verification of the legitimacy of the secret a0 can be simplified to being achieved through the public verification parameter A0.

[0082] In the above derivation, define 0 0 =1, and 0 k =0, k≠0.

[0083] The above solution requires a dealer, a centralized entity with access to the secret. As mentioned above, it needs to be a trusted third party, or in other words, all parties must trust the dealer. In a distributed scenario, both distributed secret distribution and distributed secret reconstruction are required. This requires eliminating the centralized dealer, thus achieving trustlessness. To address this problem, Rabin et al. proposed an improved protocol called Joint-Feldman in 1999. The basic idea of ​​this protocol is to execute the Feldman VSS protocol n times in parallel, with each participant generating a random polynomial locally and then sharing the randomly selected secret value among all participants. Since what is shared is a commitment to the secret, rather than the secret itself, the secret cannot be recovered unless there is collusion and cheating by multiple participants exceeding a threshold t. This distributed VSS protocol that eliminates the trusted third party is also called DVSS (Distributed VSS).

[0084] Specifically, taking four participants as an example, assuming the threshold t = 2, then the degree of the polynomial is also t = 2. The decentralized threshold secret sharing, also known as the Joint-Feldman implementation, includes the following:

[0085] Each P i (Party i Abbreviated as P i , i∈{1, 2, 3, 4}) sets the secret s to be shared i0 , and randomly choose other parameters to generate a t-1 degree polynomial:

[0086] Participant P1 generates a 2nd degree polynomial:

[0087] f1(z)=a 10 +a 11 z+a 12 z2 , where a 10 It is the secret s1 set by P1;

[0088] Participant P2 generates a 2nd-degree polynomial:

[0089] f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 It is the secret s2 set by P2;

[0090] Participant P3 generates a 2nd degree polynomial:

[0091] f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 It is the secret s3 set by P3;

[0092] Participant P4 generates a 2nd-degree polynomial:

[0093] f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret s4 set by P4.

[0094] Then, each participant P i Generate n values ​​on the curve corresponding to its own t-degree polynomial and distribute them. Here we still assume n = 4, t = 2, n = 1, 2, 3, 4, then:

[0095] Participant P1 generates s 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 to P4;

[0096] Participant P2 generates s 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23To P3, encrypt and send 24 to P4;

[0097] Participant P3 generates s 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 to P4;

[0098] Participant P4 generates s 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s 44 =f4(4), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3.

[0099] Moreover, each participant P i It also generates its own public verification parameters corresponding to the t-1 degree polynomial Where k = 0, 1, ..., t, and is announced to each participant, specifically:

[0100] Participant P1 generates include Broadcast 10 , A 11 , A 12} to P2, P3 and P4;

[0101] Participant P2 generates include Broadcast 20 , A 21 , A 22} to P1, P3 and P4;

[0102] Participant P3 generation include Broadcast 30 , A 31 , A 32} to P1, P2 and P4;

[0103] Participant P4 generation include Broadcast 40 , A41 , A 42} to P1, P2 and P3.

[0104] In this way, P1 receives s 21 After that, you can use {A 20 , A 21 , A 22} to verify; P1 receives s 31 After that, you can use {A 30 , A 31 , A 32} to verify; P1 receives s 41 After that, you can use {A 40 , A 41 , A 42} for verification; the verification method is similar to the above and will not be repeated here.

[0105] Similarly, P2 receives s 12 After that, you can use {A 10 , A 11 , A 12} to verify; P2 receives s 32 After that, you can use {A 30 , A 31 , A 32} to verify; P2 receives s 42 After that, you can use {A 40 , A 41 , A 42} to verify;

[0106] Similarly, P3 receives s 13 After that, you can use {A 10 , A 11 , A 12} to verify; P3 receives s 23 After that, you can use {A 20 , A 21 , A 22} to verify; P3 receives s 43 After that, you can use {A 40 , A 41 , A 42} to verify;

[0107] Similarly, P4 receives s 14 After that, you can use {A 10 , A 11 , A 12} to verify; P4 receives s 24 After that, you can use {A 20 , A 21 , A 22} to verify; P4 receives s34 After that, you can use {A 30 , A 31 , A 32} for verification.

[0108] Assume that the set of participants that pass the verification after verification is Qual, and Qual = {P1, P2, P3, P4}, then:

[0109] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42};

[0110] P2 locally has secret shares s generated by different parties 12 、s 22 、s 32 、s 42 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42};

[0111] P3 locally has different secret shares s generated by different parties 13 、s 23 、s 33 、s 43 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A40 , A 41 , A 42};

[0112] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 , and public authentication parameters {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42}.

[0113] then:

[0114] Participant P1 can calculate the secret share s1 as: s1 = s 11 +s 21 +s 31 +s 41 ;

[0115] Participant P2 can calculate the secret share s2 as: s2 = s 12 +s 22 +s 32 +s 42 ;

[0116] Participant P3 can calculate the secret share s3 as: s3 = s 13 +s 23 +s 33 +s 43 ;

[0117] Participant P4 can calculate the secret share s4 as: s4 = s 14 +s 24 +s 34 +s 44 ;

[0118] Each participant P i The secret share s calculated by itself can be i Broadcast to other participants. Then each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4}, the secret s0 can be reconstructed. Here, for t=2, each participant P iAfter collecting at least t+1=2+1=3 secret shares, the secret s0 can also be reconstructed.

[0119] This is because the sum of the curves of each participant can be summed up to get the total curve: f(z)=f1(z)+f2(z)+f3(z)+f4(z) f(z=(a 10 +a 11 z+a 12 z 2 )+(a 20 +a 21 z+a 22 z 2 )+(a 30 +a 31 z+a 32 z 2 ) +(a 40 +a 41 z+a 42 z 2 ) f(z)=(a 10 +a 20 +a 30 +a 40 )+(a 11 +a 21 +a 31 +a 41 )z+(a 12 +a 22 +a 32 +a 42 )z 2 Polynomial (I)

[0120] Thus: s1=s 11 +s 21 +s 31 +s 41 =f1(1)+f2(1)+f3(1)+f4(1); s2=s 12 +s 22 +s 32 +s 42 =f1(2)+f2(2)+f3(2)+f4(2); s3=s 13 +s 23 +s 33 +s 43 =f1(3)+f2(3)+f3(3)+f4(3); s4=s 14 +s 24 +s 34 +s 44 =f1(4)+f2(4)+f3(4)+f4(4);

[0121] For the total curve f(z), there is the relationship: s1=f1(1)+f2(1)+f3(1)+f4(1)=f(1); s2=f1(2)+f2(2)+f3(2)+f4(2)=f(2); s3=f1(3)+f2(3)+f3(3)+f4(3)=f(3); s4=f1(4)+f2(4)+f3(4)+f4(4)=f(4);

[0122] The secret is s0=a 10 +a 20 +a 30 +a 40 .

[0123] In this way, any participant P i After collecting at least three of the secret shares s1, s2, s3, and s4, we can obtain at least three points on the curve corresponding to polynomial (I), that is, at least three of the four coordinates (x1=1, y1=s1), (x2=2, y2=s2), (x3=3, y3=s3), and (x4=4, y4=s4), thereby recovering the total curve f(z). Furthermore, we can calculate f(0)=a 10 +a 20 +a 30 +a 40 =s0, so the secret s0 can be obtained.

[0124] Furthermore, by verifying the parameter {A 10 , A 11 , A 12}, {A 20 , A 21 , A 22}, {A 30 , A 31 , A 32}, {A 40 , A 41 , A 42} can also be used to i The legitimacy of (0, s i ) is a point on the total curve. Specifically, the legitimacy is determined by verifying whether the following equation holds:

[0125] This is because the following relationship exists:

[0126] It is also common to assume that the right side of the polynomial (II) is the public key share, denoted as pub i , i = 1, 2, ..., n, to verify the corresponding private key share.

[0127] As mentioned above, we can generally take x i =i for each i=1, 2, ..., n. In this way, i can be used as the number of each participant.

[0128] For the verification of secret s0, that is, x i =0, the above formula can be further deduced as follows:

[0129] It can be seen that based on the polynomial (III), the legitimacy of s0 can be verified.

[0130] Moreover, based on the derivation of the above polynomial (III), the verification of the legitimacy of s0 can be further simplified as follows:

[0131] It is also common to assume that the right side of the equal sign of polynomial (IV) is the total public key, denoted as pub.

[0132] The Joint-Feldman protocol described above enables distributed secret sharing, fulfilling the core concept of DKG. The series of secret sharing implementations, from Shamir to Threshold Shamir, the Feldman VSS protocol, and finally the Joint-Feldman DVSS protocol, is a series. In addition to the series of schemes starting with Shamir's secret sharing, there are also schemes based on Additive Secret Sharing, SPDZ (a key protocol in multi-party secure computation, first proposed in 2012), or the Chinese Remainder Theorem, which can ultimately achieve DKG. These are omitted here and will not be further elaborated.

[0133] Through the implementation of the above DKG protocol, the problem of single point failure resulting in overall unavailability caused by the generation of keys by a single entity can be overcome, as well as the problem of needing to trust a single point of key generation. i Broadcast the generated secret share s ij , i, j∈(1, 2, ..., n), n is the number of participants, and each participant P i The secret share s calculated by itself can be i Broadcast to other participants, so that each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4}, the secret s0 can be reconstructed. This means that at least t+1 participants will obtain the final reconstructed secret s0, which will expose the secret s0 and make the overall curve unusable. If a new secret s0 is to be generated next time, the DKG protocol process must be repeated.

[0134] The DKG protocol's properties regarding thresholds and secret commitments, combined with the matching threshold signature algorithm, can be used to construct a distributed threshold signature protocol. Blockchains, as distributed systems, make extensive use of signature algorithms. In this way, nodes in a blockchain generate secret shares in a distributed manner using DKG. After at least t+1 blockchain nodes use these secret shares as private key shares to sign the signature information and broadcast it, any blockchain node that has collected at least t+1 signature shares can recover the total signature and, using the aforementioned method, the total public key. This recovered total signature can then be verified using this total public key, thus implementing threshold signatures. Furthermore, this approach offers the advantage that each blockchain node's secret shares do not need to be broadcast to other nodes, thus preventing the exposure of their own secret shares and, consequently, private keys. Therefore, secret shares generated by a single DKG can be reused multiple times, eliminating the need to perform a complete DKG protocol for each threshold signature.

[0135] The basic ECDSA signature algorithms include:

[0136] The signing party Alice chooses an elliptic curve E q (a, b) and base point G, and share this information with the verifier Bob, where q is the modulus.

[0137] Alice in a finite field Select a private key x and generate a public key X = x G based on the private key;

[0138] Alice in a finite field Choose a random number k and calculate R=k -1 G, calculate r = f(R), with r ≠ 0; where f(R) can be the horizontal coordinate of R.

[0139] Alice hashes the message m to be signed to obtain the digest value h, i.e. h = hash(m), and calculates: σ = k(h + x·r) mod q (Formula (a))

[0140] Alice generates a signature sig = (r, σ), and sends the message m, signature sig, and public key X to the signature verifier Bob.

[0141] Bob uses the public key X to verify the following equation for the received message m and signature sig: r=f(σ -1 ·h·G+σ -1 ·r·X) Formula (b)

[0142] If equation b holds true, the signature is valid, otherwise it is invalid. This is because, from equation (a), we can get: k -1 =σ-1 (h+x·r)mod q, and then R=k -1 G and k -1 Substituting r=f(R) we can get: r=f(R)=f(k -1 ·G)=f(σ -1 (h+x·r)·G)=f(σ -1 ·h·G+σ -1 ·x·r·G) =f(σ -1 ·h·G+σ -1 ·r·X)

[0143] That is, according to the right side of formula (b), Bob can use σ, r in the received signature, as well as the message m and public key X to perform calculations and verify whether the calculation result is equal to r in the signature.

[0144] The basic ECDSA signature algorithm mentioned above can be extended to a threshold signature algorithm. For example, after the above DKG process, n signing parties P1, P2, ..., P n Each party has its own secret share and a total public key, where the threshold value is t and t<n. At least t+1 signers among the n participants each use their own secret share as a private key share. After signing and broadcasting the same information to be signed, any verifier that has collected at least t+1 signature shares can recover the total signature and verify it using the total public key, thereby realizing threshold signature. A specific implementation is the article "UC Non-Interactive, Proactive, Threshold ECDSA with Identifiable Aborts" published by Fireblocks at CCS20. This article constructs a distributed ECDSA signature scheme under a malicious model. The disadvantage of this scheme is that it requires a large number of zero-knowledge proofs to resist malicious adversaries, which requires a large communication cost and computational cost. At the same time, the threshold value of this scheme is fixed at t=n-1, and no scheme with an arbitrary threshold value is given.

[0145] The embodiment of the present application provides a distributed threshold signature method based on ECDSA. In this embodiment, each signatory can generate a threshold private key through a dealer-less or dealer-less method such as threshold Shamir, Feldman or Joint-Feldman protocol, or through other DKG schemes. The implementation result of this type of DKG scheme is that the participant P i (i∈n) has a private key share ω i , any at least t+1 private key shares correspond to a total private key ω. The result of this DKG can also generate a total public key X. This total public key X and the total private key ω have the relationship: ω·G=X.

[0146] Furthermore, after n participants obtain their own private key shares based on the DKG, they can use their own private key shares to sign the same message, generating signature shares. Any at least t+1 signature shares can be aggregated into a total signature, which can be verified by the total public key.

[0147] The above relationship can be represented by the distributed threshold key generation in FIG1 and the distributed threshold signature in FIG2 .

[0148] The present embodiment includes two parts: distributed threshold key generation and distributed threshold signature. Both parts involve a process in which participants, through an agreement, specify how to transmit and process data, thereby achieving a specific goal. Distributed threshold signature includes both an offline phase and an online phase.

[0149] The following first introduces the process of distributed threshold key generation protocol. In this process, it is assumed that there are n participants, namely P1, P2, ..., P n Through the distributed threshold key generation protocol, each participant P i (i={1, 2, ..., n}) can generate their own private key shares.

[0150] Specifically, each participant P i A t-degree polynomial f can be generated i (z) = a i0 +a i1 z+a i2 z 2 +…+a it z t , where a i0 It's P i Setting secrets i0 The threshold here is t, so the degree of the polynomial is also t.

[0151] Assume the threshold is 2 and the total number of participants is 4, that is, t = 2, n = 4, then there are 4 participants P1, P2, P3, P4, where:

[0152] P1 generates a 2nd degree (t=2) polynomial: f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 Is the secret set by P1 10 ;

[0153] P2 generates a 2nd degree (t=2) polynomial: f2(z)=a 20 +a 21 z+a22 z 2 , where a 20 Is the secret set by P2 20 ;

[0154] P3 generates a 2nd degree (t=2) polynomial: f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 It is the secret of P3 setting 30 ;

[0155] P4 generates a 2nd degree (t=2) polynomial: f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret of P4 settings 40 ;

[0156] Furthermore, each participant P i You can generate n secret shares, keep one of them for yourself, and encrypt and send the rest to other participants. i Generate the coordinates of n points on the curve corresponding to its own polynomial as n secret shares, retain the coordinates of one point for itself, and encrypt and send the coordinates of the remaining points to other participants.

[0157] Specific examples include:

[0158] P1 generates 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 to P4;

[0159] P2 generates 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23 To P3, encrypt and send 24 to P4;

[0160] P3Generators31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 to P4;

[0161] P4Generators 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s 44 =f4(4), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 to P3;

[0162] so:

[0163] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 ;

[0164] P2 locally has secret shares s generated by different parties 12 、s 22 、s 32 、s 42 ;

[0165] P3 locally has different secret shares s generated by different parties 13 、s 23 、s 33 、s 43 ;

[0166] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 .

[0167] Then, each participant P i A secret share s that can be kept by itself ii and from other participants P j The secret share s obtained ji After aggregation, the private key shares are obtained. The aggregation method is, for example, summation. For example, if the participant P i Private key share For example:

[0168] Participant P1 can calculate the private key share s1 as: s1 = s 11 +s 21 +s 31 +s 41 ;

[0169] Participant P2 can calculate the private key share s2 as: s2 = s 12 +s 22 +s 32 +s 42 ;

[0170] Participant P3 can calculate the private key share s3 as: s3 = s 13 +s 23 +s 33 +s 43 ;

[0171] Participant P4 can calculate the private key share s4 as: s4 = s 14 +s 24 +s 34 +s 44 .

[0172] Moreover, each participant P i You can also generate the public verification parameter A corresponding to your own t-degree polynomial ik =a ik G, where k = 0, 1, ..., t, and is announced to each participant, specifically:

[0173] Participant P1 generates A 1k =a 1k G, k = 0, 1, ..., t = 2, including A 10 =a 10 G=s 10 G, A 11 =a 11 G, A 12 =a 12 G, broadcast {A 10 , A 11 , A 12} to P2, P3, P4;

[0174] Participant P2 generates A 2k =a 2k G, k = 0, 1, ..., t = 2, including A 20 =a 20 G=s 20 G, A 21 =a 21 G, A 22 =a 22 G, broadcast {A20 , A 21 , A 22} to P1, P3, P4;

[0175] Participant P3 generates A 3k =a 3k G, k = 0, 1, ..., t = 2, including A 30 =a 30 G=s 30 G, A 31 =a 31 G, A 32 =a 32 G, broadcast {A 30 , A 31 , A 32} to P1, P2, P4;

[0176] Participant P4 generates A 4k =a 4k G, k = 0, 1, ..., t = 2, including A 40 =a 40 G=s 40 G, A 41 =a 41 G, A 42 =a 42 G, broadcast {A 40 , A 41 , A 42} to P1, P2, P3.

[0177] Each participant P i You can also use P j The public authentication parameters sent j0 , A j1 ,…,A jt Verify P j Secret shares sent ji , for example, verified by the following formula: s ji G=A j0 +iA j1 +…+i t A jt

[0178] Specifically:

[0179] Participant P1 passes s 21 G=A 20 +A 21 +A 22 Verifications 21 , through s 31 G=A 30 +A 31 +A 32 Verifications31 , through s 41 G=A 40 +A 21 +A 42 Verifications 41 ;

[0180] Participant P2 passes s 12 G=A 10 +2A 11 +2 2 A 12 Verifications 12 , through s 32 G=A 30 +2A 31 +2 2 A 32 Verifications 32 , through s 42 G=A 40 +2A 21 +2 2 A 42 Verifications 42 ;

[0181] Participant P3 passes s 13 G=A 10 +3A 11 +3 2 A 12 Verifications 13 , through s 23 G=A 30 +3A 31 +3 2 A 32 Verifications 23 , through s 43 G=A 40 +3A 21 +3 2 A 42 Verifications 43 ;

[0182] Participant P4 uses s 14 G=A 10 +4A 11 +4 2 A 12 Verifications 14 , through s 24 G=A 20 +4A 21 +4 2 A 22 Verifications 24 , through s 34 G=A 40 +4A 21 +4 2 A42 Verifications 42 ;

[0183] If either party fails the verification, they can terminate the agreement.

[0184] On the other hand, each participant P i The total public key X can be calculated in a similar way as above, for example using the following formula:

[0185] As mentioned above, the total public key can be used to verify the total signature after subsequent aggregation.

[0186] After the above distributed threshold key generation process, there is a total polynomial: f(z)=f1(z)+f2(z)+f3(z)+f4(z)=a 10 +a 11 z+a 12 z 2 +a 20 +a 21 z+a 22 z 2 +a 30 +a 31 z+a 32 z 2 +a 40 +a 41 z+a 42 z 2 =(a 10 +a 20 +a 30 +a 40 )+(a 11 +a 21 +a 31 +a 41 )z +(a 12 +a 22 +a 32 +a 42 )z 2

[0187] As mentioned above, the polynomial corresponds to a total curve, and the following relationship exists: s1=f1(1)+f2(1)+f3(1)+f4(1)=f(1); s2=f1(2)+f2(2)+f3(2)+f4(2)=f(2); s3=f1(3)+f2(3)+f3(3)+f4(3)=f(3); s4=f1(4)+f2(4)+f3(4)+f4(4)=f(4);

[0188] In the aforementioned DKG scheme, each participant P iThe secret share s calculated by itself can be i Broadcast to other participants. Then each participant P i After collecting at least t+1 secret shares from {s1, s2, s3, s4}, the secret s0 can be reconstructed. For example, for a threshold of 2, each participant P i After collecting at least 3 secret shares, the secret s0 can also be reconstructed.

[0189] In this embodiment, the purpose is to realize distributed threshold signature, so the secret share s is not used. i It is not sent to other participants, but as a private key share. In this way, no participant or other party can recover the total secret after obtaining at least t+1 secret shares, that is, the total private key cannot be obtained. This ensures that the private key shares obtained by multiple participants through a single distributed threshold key generation protocol can be repeatedly used for distributed threshold signatures in the future.

[0190] The following describes the distributed threshold signature process in this embodiment, which can include both an offline phase and an online phase. The aforementioned distributed key generation process requires n participants to participate in the protocol. The following distributed threshold signature process only requires at least a threshold number of participants to participate in the protocol. Here, we still use the threshold t = 2 as an example.

[0191] Offline phase: At least t+1 participants generate their own first random value k i and a second random value γ i Each participant also uses the homomorphic encryption algorithm and obtains the coordinate component r and the mask value χ of their respective private key share components through the offline phase protocol i Specific examples may include:

[0192] t+1 participants, each participant P i Calculate the Lagrange coefficient And calculate the private key share x i =λ i s i For example, if i is 1, 2, or 3, then:

[0193] Participant P1 calculates the Lagrange coefficient And calculate the private key share component x1=λ1s1;

[0194] Participant P2 calculates the Lagrange coefficient And calculate the private key share component x2=λ2s2;

[0195] Participant P3 calculates the Lagrange coefficient And calculate the private key share component x3=λ3s3.

[0196] S11:

[0197] Each of at least t+1 participants generates a first random value and a second random value, and a corresponding homomorphic ciphertext of the first random value and a public key hash of the second random value. i , i∈[1, t+1] generates the first random value k i and a second random value γ i ,and On this basis, the participant P i The first random value homomorphic ciphertext can be calculated, such as the Paillier ciphertext K i =E i (k i ), and calculate the second random value public key hash, such as g i =H1(γ i G), H1() is a hash algorithm, similar to the above. When t+1 is 3, and the participants are P1, P2, and P3:

[0198] P1 generates a first random value k1 and a second random value γ1, and calculates the Paillier ciphertext K1=E1(k1) of the first random value, and calculates the public key hash g1=H1(γ1G) of the second random value;

[0199] P2 generates a first random value k2 and a second random value γ2, and calculates the Paillier ciphertext K2=E2(k2) of the first random value, and calculates the public key hash g2=H1(γ2G) of the second random value;

[0200] P3 generates a first random value k3 and a second random value γ3, and calculates the Paillier ciphertext K3=E3(k3) of the first random value, and calculates the public key hash g3=H1(γ3G) of the second random value;

[0201] Furthermore, for each of at least t+1 participants, P i The generated first random value homomorphic ciphertext can be sent to other participants, such as:

[0202] P1 broadcasts K1 to P2 and P3;

[0203] P2 broadcasts K2 to P1 and P2;

[0204] P3 broadcasts K3 to P1 and P2;

[0205] S12:

[0206] The participant P who receives the broadcast i , for P j Sent K j , select two mask numbers βi，j , Here, the range of the subscript of the finite field is q to the power of 5, which is a proven range of values ​​with cryptographic security. i，j , Generally available in Select a larger value in the range. i The intermediate ciphertext D can be calculated by homomorphic algorithm i，j and And send to P j :

[0207] In the above two formulas, Represent homomorphic multiplication and homomorphic addition operations respectively.

[0208] Specifically:

[0209] After P1 receives K2=E2(k2) broadcast by P2, it selects two masks β 1，2 , Then P1 can calculate the intermediate ciphertext D through the homomorphic algorithm 1，2 and And sent to P2, where:

[0210] In this way, P2 receives D 1，2 =E2(α 1，2 )and Although P2 has the corresponding Paillier private key e2, k2 is also generated by P2, but due to the mask β selected by P1 i，j , Due to the masking effect, P2 cannot infer P1's private key share x1 and random value γ1, thus completing the information transmission on this basis. The following is similar and will not be repeated here.

[0211] After P1 receives K3=E3(k3) broadcast by P3, it can calculate the intermediate ciphertext D through the homomorphic algorithm 1，3 and And sent to P3, where:

[0212] Similarly, after P2 receives K1=E1(k1) broadcast by P1, it can calculate the intermediate ciphertext D through the homomorphic algorithm 2，1 and And sent to P1, where:

[0213] After P2 receives K3=E3(k3) broadcast by P3, it can calculate the intermediate ciphertext D through the homomorphic algorithm 2，3 and And sent to P3, where:

[0214] Similarly, after P3 receives K1=E1(k1) broadcast by P1, it can calculate the intermediate ciphertext D through the homomorphic algorithm 3，1 and And sent to P1, where:

[0215] After P3 receives K2=E2(k2) broadcast by P2, it can calculate the intermediate ciphertext D through the homomorphic algorithm 3，2 and And sent to P2, where:

[0216] S13:

[0217] Furthermore, each participant P i For the received intermediate ciphertext D j，i and Use the corresponding homomorphic encryption private key to decrypt and obtain the plaintext α j，i , This is called the intermediate plaintext, where: α j，i =γ j ·k i -β j，i ,

[0218] Then, based on the first random value k i and a second random value γ i and the intermediate plaintext α j，i , Calculate the intermediate value δ i , and can be based on the private key share component x i and the first random value k i and the intermediate plaintext α j，i , Calculate the private key share mask value χ i :

[0219] Here, there are two relations:

[0220] This is because:

[0221] In addition, a second random value γ can be calculated i The corresponding public key Γ i =γ i G.

[0222] Furthermore, P i The intermediate value δ can be i and a second random value γ i The corresponding public key Γ i Send to other parties.

[0223] Specifically:

[0224] P1 receives the ciphertext D 2，1 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 2，1 , Where: α 2，1 =γ2·k1-β 2，1 , P1 receives the ciphertext D 3，1 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 3，1 , Where: α 3，1 =γ3·k1-β 3，1 , Then calculate δ1=γ1k1+(α 2，1 +β 2，1 +α 3，1 +β 3，1 ), χ1=x1k1+ In addition, P1 can calculate the public key Γ1=γ1G corresponding to the second random value γ1. Furthermore, P1 can send the intermediate value δ1 and the public key Γ1 corresponding to the second random value γ1 to other participants P2 and P3.

[0225] P2 receives the ciphertext D 1，2 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 1，2 , Where: α 1，2 =γ1·k2-β 1，2 , P2 receives the ciphertext D 3，2 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 3，2 , Where: α 3，2 =γ3·k2-β3，2 , Then calculate δ2=γ2k2+(α 1，2 +β 1，2 +α 3，2 +β 3，2 ),χ2=x2k2+ In addition, P2 can calculate the public key Γ2 corresponding to the second random value γ2 = γ2G. Furthermore, P2 can send the intermediate value δ2 and the public key Γ2 corresponding to the second random value γ2 to other participants P1 and P2.

[0226] P3 receives the ciphertext D 1，3 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 1，3 , Where: α 1，3 =γ1·k3-β 1，3 , P3 receives the ciphertext D 2，3 and Use the corresponding homomorphic encryption private key to decrypt and obtain the intermediate plaintext α 2，3 , Where: α 2，3 =γ2·k3- Then calculate δ3=γ3k3+(α 1，3 +β 1，3 +α 2，3 +β 2，3 ), In addition, P3 can calculate the public key Γ3 corresponding to the second random value γ3 = γ3G. Furthermore, P3 can send the intermediate value δ3 and the public key Γ3 corresponding to the second random value γ3 to other participants P1 and P2.

[0227] So far, P i Locally has δ j∈[t+1] , Γ j∈[t+1] , k i , χ i . Thus, P i It can be calculated that point R=(∑ j∈[t+1] δ j ) -1 ·(∑ j∈[t+1] Γ j )). In fact, from the above relationship 1, we can get that R=(∑ j∈[t+1] δ j ) -1 ·(∑ j∈[t+1] Γ j )=((k1+k2+…+k t+1 )·(γ1+γ2+…+γt+1 )) -1 ·(∑ j∈[t+1] Γ j )=k -1 γ -1 ·(∑ j∈[t+1] Γ j )=k -1 γ -1 ·(∑ j∈[t+1] γ j G)=k -1 γ -1 γG=k -1 G, it can be seen that this is the same as the above ECDSA form. i We can calculate r = f(R), where f(R) is the horizontal coordinate of point R. i Locally save (r, k i , χ i ), and the offline phase ends.

[0228] For example:

[0229] P1 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k1, χ1. As above, P1 can calculate the point R based on δ1, Γ1, δ2, Γ2, δ3, Γ3, and r = f(R), so P1 can save (r, k1, χ1) locally.

[0230] Similarly, P2 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k3, χ2. As above, P2 can calculate the point R based on δ1, Γ1, δ2, Γ2, δ3, Γ3, and r = f(R), so P2 can save (r, k2, χ2) locally.

[0231] Similarly, P3 locally has δ1, Γ1, δ2, Γ2, δ3, Γ3, k3, χ3. As above, P3 can calculate the point R based on δ1, Γ1, δ2, Γ2, δ3, Γ3, and r = f(R), so P3 can save (r, k3, χ3) locally.

[0232] Online phase: The at least t+1 participants each use their own first random value k in the online phase i , private key share component mask value χ i and the coordinate component r to sign the same message, obtaining at least t+1 signature shares σ i .

[0233] For message m, its hash value is H(m). Each of at least t+1 participants P i , using the locally saved (r, k i , χ i) can calculate H(m) to get the signature share sig i =(r,σ i ), specifically, σ i It can be calculated using the following formula: i =k i H(m)+χ i r

[0234] In this way, after either party obtains at least t+1 signature shares, they can aggregate the at least t+1 signature shares into a total signature sig = (r, σ). Furthermore, the correctness of the total signature σ can be verified using the aforementioned total public key X. This is because the form of this formula is consistent with the form in the aforementioned ECDSA.

[0235] First of all, it should be noted that the following relationship exists:

[0236] In this way, at least t+1 signature shares are aggregated into a total signature σ:

[0237] Here x = s 10 +s 20 +…+s n0 =f(0), it can be seen that σ here = k·H(m)+k·x·r, which is essentially the same as formula (a) in the aforementioned ECDSA signature algorithm. Therefore, it is obvious that the total public key X can be used for verification.

[0238] Continuing with the above example, any party (can be any one of the n=4 participants, or a party other than the n=4 participants) obtains t+1=3 signature shares: σ1=k1H(m)+χ1r σ2=k2H(m)+χ2r σ3=k3H(m)+χ3r

[0239] First, the following relationship exists:

[0240] Then calculate σ=∑ i∈[1，3] σ i =∑ i∈[1，3] (k i H(m)+χ i r)=∑ i∈[1，3] k i H(m)+∑ j∈[1，3] χ i r

[0241] =(k1+k2+k3)·H(m)+(k1+k2+k3)·(x1+x2+x3)·r=k·H(m)+k·x·r

[0242] Here x = s 10+s 20 +…+s 40 =f(0), which is equal to the sum of the secrets set by the n participants in the distributed threshold signature protocol. It can be seen that here σ = k·H(m)+k·x·r, which is essentially the same as formula (a) in the aforementioned ECDSA signature algorithm. Therefore, it is clear that the total public key X can be used for verification.

[0243] The effect of the above-mentioned embodiment of the present application is firstly that any threshold value can be supported.

[0244] Similar to ECC-based cryptography, the same k cannot be used twice for encryption, otherwise it will be cracked and obtained by others. Therefore, it is best to use a new k each time the signature is signed. This can be done by at least t+1 participants performing the offline phase again to generate at least t+1 k i , thus obtaining a new k.

[0245] The above process can be performed once by n participants in a coordinated distributed key generation phase, followed by at least t+1 participants performing both the offline and online phases for each subsequent signature. Alternatively, n participants can perform the distributed key generation phase once, followed by at least t+1 participants performing multiple offline phases, thereby generating multiple different k values, and thus different R values ​​and corresponding r values, for use in each subsequent online signature phase.

[0246] SM2 includes digital signature algorithms, key exchange protocols, and public key encryption algorithms. The basic SM2 signature algorithms include:

[0247] The signing party Alice chooses an elliptic curve E q (a, b) and base point g, and share this information with the verifier Bob, where q is the modulus;

[0248] Alice in a finite field Select a private key And generate the public key X=g based on the private key x ;

[0249] Alice in a finite field Select a random number And calculate K = g k =(x1y1), where x1 and y1 are the horizontal and vertical coordinates of point K on the elliptic curve respectively;

[0250] Alice hashes the message m to be signed to obtain the digest value H(m), and calculates: r = H(m) + x1 mod q Formula (a)

[0251] And based on this calculation: s=(1+x)-1 (kr x) mod p; Formula (b)

[0252] Alice generates a signature σ = (r, s), and sends the message m, signature σ, and public key X to the signer Bob.

[0253] Bob uses the base point g, signature σ, and public key X to calculate the coordinates of point K': K' = g s ·X r+s =(x′1, y′1) Formula (c)

[0254] Bob uses r in the signature σ, the message m, and the horizontal coordinate x′1 of the point K′ to verify the following equation: r=H(m)+x′1mod q Formula (d)

[0255] If the above equation holds true, the signature is valid; otherwise, the signature is invalid.

[0256] This is because it is equivalent to verifying that the coordinates of point K′ (x′1, y′1) are equal to the coordinates of point K used in the signature (x1, y1): (x′1, y′1) = s·G+(r+s)·x·G = (1+x)·s·G+r·x·G = (kr·x)·G+r·x·G

[0257] =k·G=(x1,y1)

[0258] Or expressed in exponential form as follows:

[0259] The basic SM2 signature algorithm mentioned above can also be extended to a threshold signature algorithm. For example, after the above DKG process, n signing parties P1, P2, ..., P nEach has its own secret share and there is a total public key, where the threshold value is t and t < n. Among the n participants, at least t + 1 signers each use their own secret share as the private key share respectively to sign the same message to be signed and broadcast. Any verifier that collects at least t + 1 signature shares can recover the total signature and can verify the total signature using the total public key, thus achieving threshold signature. In the article "SM2 Elliptic Curve Threshold Cryptography Algorithm" published by Shang Ming et al. in the Journal of Cryptology in 2014, a distributed signature algorithm based on SM2 that satisfies the t - n threshold was constructed. That is, n participants generate private key shards and corresponding public keys respectively through a protocol. At least t + 1 of the n participants need to participate in the SM2 distributed signature protocol to generate the corresponding SM2 signature and verify. The disadvantage of this algorithm is that the above (t, n) must satisfy n ≥ 2t + 1, which makes the application very inflexible. For example, this algorithm cannot satisfy the (2, 4) threshold or the (2, 3) threshold, which are the most frequently used in actual use.

[0260] The embodiment of the present application provides a distributed threshold signature method based on SM2.

[0261] The embodiment of the present application can include two parts, namely distributed threshold key generation and distributed threshold signature. These two parts are both processes in which participants stipulate how to transmit data to each other and how to process data through a protocol, so as to cooperate to achieve a specific purpose.

[0262] The process of the distributed threshold key generation protocol is introduced first below. In this process, it is assumed that there are n participants, namely P1, P2,..., P n . Through the distributed threshold key generation protocol, each participant P i (i = {1, 2,..., n}) can generate its own private key share x′ i .

[0263] Each participant P i can generate its own public and private key pair for homomorphic encryption, such as the Paillier public and private key pair (E i , e i ), where e i is the private key and E iis the corresponding public key. Homomorphic encryption technology can process plaintext data "homomorphically", that is, map the plaintext data to a new, confidential state, so that only the recipient with the key can obtain the plaintext data. Paillier homomorphic addition is a public key encryption system widely used in cryptography, proposed by Pascal Paillier in 1999. Its main feature is that it has additive homomorphic properties, which means that given two ciphertexts, the ciphertext of the sum of their corresponding plaintexts can be calculated without decryption. Specifically, suppose there are two plaintexts m1 and m2, and their Paillier encrypted ciphertexts are c1 and c2 respectively. Paillier's additive homomorphic property can realize the calculation of the product of c1 and c2 to obtain a new ciphertext c, which is exactly the ciphertext of the sum of m1 and m2. The additive homomorphic property is an important feature of the Paillier encryption algorithm, which can be simply expressed as: E(m1)·E(m2)=E(m1+m2), where the point product·is the subsequent homomorphic addition This homomorphic property allows certain forms of computation to be performed on encrypted data without revealing the original data.

[0264] Each participant P i After generating a homomorphically encrypted public-private key pair, the public key can be sent to other parties.

[0265] For example, after participant P1 generates the Paillier-encrypted public-private key (E1, e1), it broadcasts the homomorphically encrypted public key E1 to other participants; after participant P2 generates the Paillier-encrypted public-private key (E2, e2), it broadcasts the homomorphically encrypted public key E2 to other participants; after participant P3 generates the Paillier-encrypted public-private key (E3, e3), it broadcasts the homomorphically encrypted public key E3 to other participants; after participant P4 generates the Paillier-encrypted public-private key (E4, e4), it broadcasts the homomorphically encrypted public key E4 to other participants; after participant P5 generates the Paillier-encrypted public-private key (E5, e5), it broadcasts the homomorphically encrypted public key E5 to other participants.

[0266] Each participant P i A second random value γ can be generated i , there are 5 participants P1, P2, P3, P4, P5, which generate the second random value γ1, γ2, γ3, γ4, γ5 respectively. i The secret value γ generated by each i The sum is γ, that is

[0267] Moreover, each participant P i A t-degree polynomial f can be generated i(z) = a i0 +a i1 z+a i2 z 2 +…+a it z t , where a i0 It's P i The secret of the setting, here set to γ i The threshold here is t, so the degree of the polynomial is also t.

[0268] Assume the threshold is 2 and the total number of participants is 5, that is, t = 2, n = 5. There are 5 participants P1, P2, P3, P4, and P5, and they use their own secret values ​​γ1, γ2, γ3, γ4, and γ5 to construct the polynomial, where:

[0269] P1 generates a 2nd degree (t=2) polynomial: f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 is the secret γ1 set by P1;

[0270] P2 generates a 2nd degree (t=2) polynomial: f2(z)=a 20 +a 21 z+a 22 z 2 , where a 20 is the secret γ2 set by P2;

[0271] P3 generates a 2nd degree (t=2) polynomial: f3(z)=a 30 +a 31 z+a 32 z 2 , where a 30 is the secret γ3 set by P3;

[0272] P4 generates a 2nd degree (t=2) polynomial: f4(z)=a 40 +a 41 z+a 42 z 2 , where a 40 It is the secret γ4 set by P4;

[0273] P5 generates a 2nd degree (t=2) polynomial: f5(z)=a 50 +a 51 z+a 52 z 2 , where a 50 It is the secret γ5 set by P5;

[0274] Furthermore, each participant Pi You can generate n secret shares, keep one of them for yourself, and encrypt and send the rest to other participants. i Generate the coordinates of n points on the curve corresponding to its own polynomial as n secret shares, retain the coordinates of one point for itself, and encrypt and send the coordinates of the remaining points to other participants.

[0275] Specific examples include:

[0276] P1 generates 11 =f1(1),s 12 =f1(2),s 13 =f1(3),s 14 =f1(4),s 15 =f1(5), keep s 11 , and encrypt and send s 12 To P2, encrypt and send s 13 To P3, encrypt and send 14 To P4, encrypt and send 15 to P5;

[0277] P2 generates 21 =f2(1),s 22 =f2(2),s 23 =f2(3),s 24 =f2(4),s 25 =f2(5), keep s 22 , and encrypt and send s 21 To P1, encrypt and send s 23 To P3, encrypt and send 24 To P4, encrypt and send 25 to P5;

[0278] P3Generators 31 =f3(1),s 32 =f3(2),s 33 =f3(3),s 34 =f3(4),s 35 =f3(5), keep s 33 , and encrypt and send s 31 To P1, encrypt and send s 32 To P2, encrypt and send s 34 To P4, encrypt and send 35 to P5;

[0279] P4Generators 41 =f4(1),s 42 =f4(2),s 43 =f4(3),s44 =f4(4),s 45 =f4(5), keep s 44 , and encrypt and send s 41 To P1, encrypt and send s 42 To P2, encrypt and send s 43 To P3, encrypt and send 45 to P5;

[0280] P5 Generations 51 =f5(1),s 52 =f5(2),s 53 =f5(3),s 54 =f5(4),s 55 =f5(5), keep s 55 , and encrypt and send s 51 To P1, encrypt and send s 52 To P2, encrypt and send s 53 To P3, encrypt and send 54 to P4;

[0281] so:

[0282] P1 locally has secret shares s generated by different parties 11 、s 21 、s 31 、s 41 、s 51 ;

[0283] P2 locally has secret shares s generated by different parties 12 、s 22 、s 32 、s 42 、s 52 ;

[0284] P3 locally has different secret shares s generated by different parties 13 、s 23 、s 33 、s 43 、s 53 ;

[0285] P4 locally has secret shares s generated by different parties 14 、s 24 、s 34 、s 44 、s 54 ;

[0286] P5 locally has secret shares s generated by different parties 15 、s 25 、s 35 、s 45、s 55 .

[0287] In addition, each participant P i The secret value generated by itself can be calculated as γ i The corresponding homomorphic encryption value R i =E i (γ i ) and broadcast it to other participants.

[0288] Then, each participant P i A secret share s that can be kept by itself ii and from other participants P j The secret share s obtained ji The sum of the secret shares is obtained after aggregation, and the aggregation method is, for example, summation. For example, if the participant P i The sum of the secret shares For example:

[0289] Participant P1 can calculate the sum of the secret shares ω1 as: ω1 = s 11 +s 21 +s 31 +s 41 +s 51 ;

[0290] Participant P2 can calculate the sum of the secret shares ω2 as: ω2 = s 12 +s 22 +s 32 +s 42 +s 52 ;

[0291] Participant P3 can calculate the sum of the secret shares ω3 as: ω3=s 13 +s 23 +s 33 +s 43 +s 53 ;

[0292] Participant P4 can calculate the sum of the secret shares ω4 as: ω4 = s 14 +s 24 +s 34 +s 44 +s 54 ;

[0293] Participant P5 can calculate the sum of the secret shares ω5 as: ω5 = s 15 +s 25 +s 35 +s 45 +s 55 .

[0294] Moreover, each participant Pi You can also generate the public verification parameter A corresponding to your own t-degree polynomial ik =a ik G, where k = 0, 1, ..., t, and is announced to each participant, specifically:

[0295] Participant P1 generates A 1k =a 1k G, k = 0, 1, ..., t = 2, including A 10 =a 10 G=s 10 G, A 11 =a 11 G, A 12 =a 12 G, broadcast {A 10 ,A 11 ,A 12} to P2, P3, P4 and P5;

[0296] Participant P2 generates A 2k =a 2k G, k = 0, 1, ..., t = 2, including A 20 =a 20 G=s 20 G, A 21 =a 21 G, A 22 =a 22 G, broadcast {A 20 ,A 21 ,A 22} to P1, P3, P4 and P5;

[0297] Participant P3 generates A 3k =a 3k G, k = 0, 1, ..., t = 2, including A 30 =a 30 G=s 30 G, A 31 =a 31 G, A 32 =a 32 G, broadcast {A 30 ,A 31 ,A 32} to P1, P2, P4 and P5;

[0298] Participant P4 generates A 4k =a 4k G, k = 0, 1, ..., t = 2, including A 40 =a 40 G=s 40 G, A 41 =a 41 G, A42 =a 42 G, broadcast {A 40 ,A 41 ,A 42} to P1, P2, P3 and P5;

[0299] Participant P5 generates A 5k =a 5k G, k = 0, 1, ..., t = 2, including A 50 =a 50 G=s 50 G, A 51 =a 51 G, A 52 =a 52 G, broadcast {A 50 ,A 51 ,A 52} to P1, P2, P3 and P4.

[0300] Each participant P i You can also use P j The public authentication parameters j0 ,A j1 ,…,A jt Verify P j Secret shares sent ji , for example, verified by the following formula: s ji G=A j0 +iA j1 +…+i t A jt

[0301] Specifically:

[0302] Participant P1 passes s 21 G=A 20 +A 21 +A 22 Verifications 21 , through s 31 G=A 30 +A 31 +A 32 Verifications 31 , through s 41 G=A 40 +A 21 +A 42 Verifications 41 , through s 51 G=A 50 +A 51 +A 52 Verifications 51 ;

[0303] Participant P2 passes s12 G=A 10 +2A 11 +2 2 A 12 Verifications 12 , through s 32 G=A 30 +2A 31 +2 2 A 32 Verifications 32 , through s 42 G=A 40 +2A 21 +2 2 A 42 Verifications 42 , through s 52 G=A 50 +2A 51 +2 2 A 52 Verifications 52 ;

[0304] Participant P3 passes s 13 G=A 10 +3A 11 +3 2 A 12 Verifications 13 , through s 23 G=A 30 +3A 31 +3 2 A 32 Verifications 23 , through s 43 G=A 40 +3A 21 +3 2 A 42 Verifications 43 , through s 53 G=A 50 +3A 51 +3 2 A 52 Verifications 53 ;

[0305] Participant P4 uses s 14 G=A 10 +4A 11 +4 2 A 12 Verifications 14 , through s 24 G=A 20 +4A 21 +4 2 A 22 Verifications 24 , through s34 G=A 40 +4A 21 +4 2 A 42 Verifications 42 , through s 54 G=A 50 +4A 51 +4 2 A 52 Verifications 52 ;

[0306] Participant P5 passes s 15 G=A 10 +5A 11 +5 2 A 12 Verifications 15 , through s 25 G=A 20 +5A 21 +5 2 A 22 Verifications 25 , through s 35 G=A 30 +5A 31 +5 2 A 32 Verifications 35 , through s 45 G=A 40 +5A 41 +5 2 A 42 Verifications 45 ;

[0307] If either party fails the verification, they can terminate the agreement.

[0308] On the other hand, each participant P i The first random value can be randomly selected Then the five participants P1, P2, P3, P4, and P5 generate the first random values ​​x1, x2, x3, x4, and x5 respectively. The corresponding public keys are Each participant P i The first random value corresponding to the public key generated by itself can be broadcast to other participants P i，j≠i Then P i Locally has: {X1,X2,X3,...,X n Specifically, for the five participants P1, P2, P3, P4, and P5, each local has {X1, X2, X3, X4, and X5}.

[0309] At this point, each participant P iThe first random value corresponding to the public key set {X j} j∈[1，n] and the second random value homomorphic ciphertext set {R j} j∈[1，n] .

[0310] Each participant P i The first random value may correspond to a public key set {X j} j∈[1，n] The total public key X is calculated in a similar way as above, for example using the following formula:

[0311] As mentioned above, the total public key can be used to verify the total signature after subsequent aggregation. n .

[0312] In addition, each participant P i For P j The first mask number between the two parties can be randomly selected And the first intermediate ciphertext D can be calculated by homomorphic algorithm i，j And send to P j , for example using Paillier encryption and computing

[0313] Thus, for participant P i , you can receive Then you can use your own homomorphic encryption private key for decryption, such as the public key E encrypted with Paillier encryption i The corresponding private key e1 is decrypted to obtain x j γ i -β j，i =α i，j . Furthermore, P i The first intermediate value can be calculated And broadcast the first intermediate value δ i To other participants.

[0314] In the next step, participant P i Collect the first intermediate value δ j，j∈[1，n] After that, we can calculate Then you can As its own private key shard.

[0315] For example, for 5 parties P1, P2, P3, P4, P5:

[0316] P1 randomly selects the first mask number β between the participants for P2 1，2, using Paillier encryption and computing the first intermediate ciphertext And send D 1，2 To P2; similarly, P1 randomly selects a first mask number β between participants for P3 1，3 , calculate the first intermediate ciphertext And send D 1，3 To P3; similarly, P1 randomly selects a first mask number β between participants for P4 1，4 , calculate the first intermediate ciphertext And send D 1，4 To P4; similarly, P1 randomly selects a first mask number β between participants for P5 1，5 , calculate the first intermediate ciphertext And send D 1，5 To P5.

[0317] P2 randomly selects the first mask number β between the participants for P1 2，1 , using Paillier encryption and computing the first intermediate ciphertext And send D 2，1 To P1; similarly, P2 randomly selects a first mask number β between participants for P3 2，3 , calculate the first intermediate ciphertext And send D 2，3 To P3; similarly, P2 randomly selects a first mask number β between participants for P4 2，4 , calculate the first intermediate ciphertext And send D 2，4 To P4; similarly, P2 randomly selects a first mask number β between participants for P5 2，5 , calculate the first intermediate ciphertext And send D 2，5 To P5.

[0318] P3 randomly selects the first mask number β between the participants for P1 3，1 , using Paillier encryption and computing the first intermediate ciphertext And send D 3，1 To P1; similarly, P3 randomly selects a first mask number β between participants for P2 3，2 , calculate the first intermediate ciphertext And send D 3，2 To P2; similarly, P3 randomly selects a first mask number β between participants for P4 3，4 , calculate the first intermediate ciphertext And send D3，4 To P4; similarly, P3 randomly selects a first mask number β between participants for P5 3，5 , calculate the first intermediate ciphertext And send D 3，5 To P5.

[0319] P4 randomly selects the first mask number β between the participants for P1 4，1 , using Paillier encryption and computing the first intermediate ciphertext And send D 4，1 To P1; similarly, P4 randomly selects a first mask number β between participants for P2 4，2 , calculate the first intermediate ciphertext And send D 4，2 to P2; similarly, P4 randomly selects a first mask number β between participants for P3 4，3 , calculate the first intermediate ciphertext And send D 4，3 To P3; similarly, P4 randomly selects a first mask number β between participants for P5 4，5 , calculate the first intermediate ciphertext And send D 4，5 To P5.

[0320] P5 randomly selects the first mask number β between the participants for P1 5，1 , using Paillier encryption and computing the first intermediate ciphertext And send D 5，1 To P1; similarly, P5 randomly selects a first mask number β between participants for P2 5，2 , calculate the first intermediate ciphertext And send D 5，2 To P2; similarly, P5 randomly selects a first mask number β between participants for P3 5，3 , calculate the first intermediate ciphertext And send D 5，3 To P3; similarly, P5 randomly selects a first mask number β between participants for P4 5，4 , calculate the first intermediate ciphertext And send D 5，4 To P4.

[0321] In this way, P1 can receive D 2，1 、D 3，1 、D 4，1 、D 5，1 , thus, P1 can decrypt and get x2·γ1-β 2，1 =α1，2 , x3·γ1-β 3，1 =α 1，3 , x4·γ1-β 4，1 =α 1，4 , x5·γ1-β 5，1 =α 1，5 Then P1 can calculate the intermediate value And broadcast δ1.

[0322] Similarly, P2 can receive D 1，2 、D 3，2 、D 4，2 、D 5，2 , thus, P2 can decrypt and get x1·γ2-β 1，2 =α 2，1 , x3·γ2-β 3，2 =α 2，3 , x4·γ2-β 4，2 =α 2，4 , x5·γ2-β 5，2 =α 2，5 Then P2 can calculate the intermediate value And broadcast δ2.

[0323] Similarly, P3 can receive D 1，3 、D 2，3 、D 4，3 、D 5，3 , thus, P3 can decrypt and get x1·γ3-β 1，3 =α 3，1 , x2·γ3-β 2，3 =α 3，2 , x4·γ3-β 4，3 =α 3，4 , x5·γ3-β 5，3 =α 3，5 Then P3 can calculate the intermediate value And broadcast δ3.

[0324] Similarly, P4 can receive D 1，4 、D 2，4 、D 3，4 、D 5，4 , thus, P4 can decrypt to get x1·γ4-β 1，4 =α 4，1 , x2·γ4-β 2，4 =α 4，2 , x3·γ4-β 3，4 =α 4，3 , x5·γ4-β 5，4 =α4，5 Then P4 can calculate the intermediate value And broadcast δ4.

[0325] Similarly, P5 can receive D 1，5 、D 2，5 、D 3，5 、D 4，5 , thus, P5 can be decrypted to obtain x1·γ5-β 1，5 =α 5，1 , x2·γ5-β 2，5 =α 5，2 , x3·γ5-β 3，5 =α 5，3 , x4·γ5-β 4，5 =α 5，4 Then P5 can calculate the intermediate value And broadcast δ5.

[0326] In the next step, participant P1 collects all j，j∈[1，5] After that, we can calculate

[0327] Similarly, P2 collects all δ j，j∈[1，5] After that, we can also calculate

[0328] Similarly, P3 collects all δ j，j∈[1，5] After that, we can also calculate

[0329] Similarly, P4 collects all δ j，j∈[1，5] After that, we can also calculate

[0330] Similarly, P5 collects all δ j，j∈[1，5] After that, we can also calculate

[0331] Then, participant P1 can As its own private key share (i.e. private key shard);

[0332] Similarly, participant P2 can As its own private key share;

[0333] Similarly, participant P3 can As its own private key share;

[0334] Similarly, participant P4 can As its own private key share;

[0335] Similarly, participant P5 can As its own private key share;

[0336] Thus, each participant P i Finally, the first random value x generated by each participant is obtained i The sum of the two random values ​​γ i However, since the process of exchanging information between participants combines homomorphic encryption and the design of intermediate ciphertext and intermediate value, the information of any participant P is not exposed. i The first random value x of each i and a second random value γ i . Then, combined with the sum of secret shares obtained by the distributed key generation protocol, each participant P i You can get your own private key share x′ i .

[0337] The following describes the distributed signature process, which can be divided into two parts: an offline phase and an online phase. The distributed key generation process described above requires n parties to participate in the protocol. The distributed threshold signature process described below only requires at least t+1 parties to participate in the protocol. For the specific case, we will still use the threshold t=2 as an example.

[0338] Offline phase: Update own private key share x′ i , generate its own third random value k i And the corresponding third random value homomorphic ciphertext K i and the third random value public key G i , Broadcast K i and G i ; Generate a second mask and exchange the second intermediate plaintext through homomorphic encryption. Specifically, it may include:

[0339] S21:

[0340] First, there are t+1 participants, each of whom P i Calculate the Lagrange coefficient And use the Lagrange coefficient to update its own private key share: x″ i ←l i (0)·x′ i For example, if i is 1, 2, or 3, then:

[0341] Participant P1 calculates the Lagrange coefficient And update its own private key share x″1←l1(0)·x′1;

[0342] Participant P2 calculates the Lagrange coefficient And update its own private key share x″2←l2(0)·x′2;

[0343] Participant P3 calculates the Lagrange coefficient And update its own private key share x″3←l3(0)·x′3.

[0344] Second, each of the t+1 participants generates a third random value k i And the corresponding third random value homomorphic ciphertext K i and the third random value public key G i , and broadcast the third random value homomorphic ciphertext K i and the third random value public key G i For example, participant P i , i∈[1, t+1] generates a third random value k i ,and Participant P i The third random value homomorphic ciphertext can be calculated, such as the Paillier ciphertext K i =E i (k i ), and calculate the third random value public key G i ,like Specifically, when t+1 is 3 and the participants are P1, P2, and P3:

[0345] P1 generates a third random value k1, calculates the Paillier ciphertext K1=E1(k1) of the third random value, and calculates the public key of the third random value Broadcast K1 and G1;

[0346] P2 generates a third random value k2, calculates the Paillier ciphertext K2=E2(k2) of the third random value, and calculates the third random value public key Broadcast K2 and G2;

[0347] P3 generates a third random value k3, calculates the Paillier ciphertext K3=E3(k3) of the third random value, and calculates the third random value public key Broadcast K3 and G3.

[0348] In addition, each participant P i A second mask is also generated, and a second intermediate plaintext is exchanged through homomorphic encryption. Specifically, it may include: i For participant P j Generate the second mask And based on the updated private key share x″ i, the received third random value homomorphic ciphertext K j and the second mask number The second intermediate ciphertext is calculated from the homomorphic ciphertext With other participants P j Exchange the second intermediate ciphertext Decrypt the second intermediate ciphertext Get the second intermediate plaintext Specifically, it can be the following S22 and S23.

[0349] S22:

[0350] The participant P who receives the broadcast i , for P j Sent K j , select a second mask Here, the range of the subscript of the finite field is q to the power of 5, which is a proven range of values ​​with cryptographic security. Generally available in Select a larger value in the range. i The second intermediate ciphertext can be calculated by homomorphic algorithm And send to P j :

[0351] Specifically:

[0352] After P1 receives K2=E2(k2) broadcast by P2, it selects a second mask Furthermore, P1 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P2, where:

[0353] Thus, P2 receives Although P2 has the corresponding Paillier private key e2, k2 is also generated by P2, but due to the second mask selected by P1 Due to the concealing effect, P2 cannot infer P1’s private key share x″1, thus completing the information transmission on this basis. The following is similar and will not be repeated here.

[0354] Similarly, after P1 receives K3=E3(k3) broadcast by P3, it selects a second mask Furthermore, P1 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P3, where:

[0355] Similarly, after P2 receives K1=E1(k1) broadcast by P1, it selects a second mask Furthermore, P2 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P1, where:

[0356] Similarly, after P2 receives K3=E3(k3) broadcast by P3, it selects a second mask Furthermore, P2 can calculate the second intermediate ciphertext through the homomorphic algorithm And sent to P3, where:

[0357] Similarly, after P3 receives K1=E1(k1) broadcast by P1, it selects a second mask Furthermore, P3 can calculate the second intermediate ciphertext through the homomorphic encryption algorithm And sent to P1, where:

[0358] Similarly, after P3 receives K2=E2(k2) broadcast by P2, it selects a second mask Furthermore, P3 can calculate the second intermediate ciphertext through the homomorphic encryption algorithm And sent to P2, where:

[0359] S23:

[0360] Furthermore, each participant P i The received second intermediate ciphertext Use the corresponding homomorphic encryption private key to decrypt and get the plaintext This is called the second intermediate plaintext, where:

[0361] So far, P i Locally has k i , updated own private key share x″ i and for P j of

[0362] Online phase: Each of the at least t+1 participants P i Use the collected third random value public key G i Calculate the total coordinate K of the third random value public key, and use the total coordinate K to calculate r in the signature share of message m, also based on r and its own third random value k i , updated own private key share x″ i , for participant P j The second intermediate plaintext and the second mask number Calculate the signature share component s for message m i , thus obtaining the signature share σ i (r,s i ).

[0363] S31:

[0364] Each of the at least t+1 participants P i , you can collect the third random value public key G j，j∈[1，t+1] , so that the total coordinates can be calculated based on at least t+1 third random value public keys Among them, x1 and y1 are the horizontal and vertical coordinates of point K on the elliptic curve respectively.

[0365] On the other hand, P i The message m to be signed can be hashed to obtain the digest value H(m), and r=H(m)+x1modq in the signature share can be calculated based on the total coordinate point K. This is similar to the above formula (a).

[0366] Since any P i The message m is the same, that is, H(m) is also the same. Moreover, t+1 k j The sum of the two is also the same, and the total coordinate K is also the same. Therefore, any P i The r in the calculated signature share is also the same.

[0367] S32:

[0368] P i It can be based on r and its own third random value k i , updated own private key share x″ i , for participant P j The second intermediate plaintext and the second mask number Calculate the signature share component s for message m i , thus obtaining the signature share σ i (r,s i ).

[0369] The specific calculation of s is as follows i :

[0370] in, To put it simply, x″ i is the updated private key share, which is equal to l i (0)·x′ i .

[0371] In this way, after any party obtains at least t+1 signature shares, it can aggregate the at least t+1 signature shares into a total signature It can be proved That is (1+x) -1 ·(kr·x). It can be seen that the s in the total signature σ here is the same as the s in formula (b) in the basic SM2 signature algorithm mentioned above. Therefore, the correctness of the total signature σ can be verified using the above-mentioned total public key X.

[0372] In addition, the total private key is the sum of the updated private key shares:

[0373] Continuing with the above example, any party (which can be any one of the n=5 participants or a party other than the n=5 participants) obtains t+1=3 signature shares:

[0374] For example, based on P1 calculation:

[0375] Similarly, based on P2 calculation: s2=k2·(l2(0)·x′2+l1(0)·x′1+l3(0)·x′3)+l2(0)·rx′2

[0376] Similarly, based on P3 calculation: s3=k3·(l3(0)·x′3+l1(0)·x′1+l2(0)·x′2)+l3(0)·rx′3

[0377] so:

[0378] It should be noted that the above example mainly illustrates the case where there are exactly t+1 participants. In fact, it can also be the case where there are more than t+1 participants. That is, when the number of participants in the distributed signature protocol phase is more than t+1, the above process can still produce the same aggregate signature as when there are t+1 participants, and thus can still be verified by the total public key.

[0379] Similar to ECC-based cryptography, the same k cannot be used twice for encryption, otherwise it will be cracked and obtained by others. Therefore, it is best to use a new k each time the signature is signed. This can be done by at least t+1 participants performing the offline phase again to generate at least t+1 k i , thus obtaining a new k.

[0380] The above process can be performed once by n participants in a coordinated distributed key generation phase, followed by at least t+1 participants performing both the offline and online phases for each subsequent signature. Alternatively, n participants can perform the distributed key generation phase once, followed by at least t+1 participants performing multiple offline phases, thereby generating multiple different k values, and thus different R values ​​and corresponding r values, for use in each subsequent online signature phase.

[0381] In this application, a homomorphic algorithm scheme such as Paillier is used to replace the multi-party MPC multiplication protocol used in the document "SM2 Elliptic Curve Threshold Cryptography Algorithm", so as to overcome the restriction condition n≥2t+1, thereby achieving a distributed threshold signature algorithm with arbitrary thresholds.

[0382] Secondly, in the entire distributed threshold key generation process, no participant can know the complete total private key, only their own threshold private key fragment x″ i , only t+1 participants out of n people can cooperate to sign. In the distributed threshold signature process, it is not necessary for all n users to participate. As long as at least t+1 of the n users participate, distributed signature can be achieved, which greatly improves the fault tolerance of the system.

[0383] Furthermore, the embodiment of the present application supports an offline-online mode, in which only one round of interaction is required between the participants in the online stage, which greatly simplifies the complexity of signing.

[0384] In distributed threshold signatures, key shards (i.e. key shares) often need to be updated to ensure security. Here are some situations where key shards may need to be updated:

[0385] Member Changes: In distributed threshold signatures, the addition or departure of members may result in changes to the key shards. When a new member joins, the existing key shards need to be recalculated and redistributed to ensure that the new member can participate in signing operations. Similarly, when a member leaves, their key shards need to be removed.

[0386] Threshold Change: If you want to change the threshold, you need to recalculate and reassign the key shards. Because the number of key shards is closely related to the threshold, modifying the threshold will result in a change in the key shards.

[0387] In the key share update of the distributed threshold signature scheme, it is best to ensure that after member change and / or threshold value change, the corresponding total private key and total public key remain unchanged. In this way, since the total public key remains unchanged, the total signature obtained by aggregating the signature shares implemented by at least t + 1 participants through the aforementioned distributed threshold signature scheme can still be verified by the same total public key. On the contrary, if the total public key corresponding to the key share update in the distributed threshold signature scheme changes, a new total public key needs to be distributed. That is to say, keeping the total public key unchanged can avoid distributing a new total public key, especially for the case where any party other than the participants needs to verify the total signature using the total public key.

[0388] Suppose the first set of participants before the change Suppose it includes n participants {P1,..., P n}, and the second set of participants after the change Suppose it includes n' participants {P1,..., P n′}. It may be that n' > n, that is, new participants join; or it may be that n' < n, that is, some participants withdraw. The threshold before and after the change is changed from t to t'. Based on the aforementioned scheme, the following introduces an embodiment of the key share update method in the distributed threshold signature scheme of this application, including:

[0389] S310: In the third set obtained by intersecting the first set of participants before the change and the second set of participants after the change each of at least t + 1 participants generates a new random polynomial of degree t' based on the original private key share component as the secret value.

[0390] Let S be a subset of the participant indices, satisfying |S| = t + 1. The first set of participants before the change and the second set of participants after the change intersect to obtain the third set Then satisfying that is The participants in the set are both members of the old set and members of the new set which also means that the second set of participants after the change contains at least t + 1 members of the first set of participants before the change

[0391] The third set at least t + 1 participants P i , each of which has the original private key share component x iSpecifically, as mentioned above, each participant P i Calculate the Lagrange coefficient And calculate the private key share x i =λ i s i Among them, s i Is the first participant set before the change The n participants in the process obtain the private key shares through the original distributed threshold key generation process. The specific calculation process can refer to the previous record.

[0392] Furthermore, the third set Each of at least t+1 participants can generate a new t′ degree random polynomial based on the original private key share as the secret value. t+1 participants P in i , i = {1, 2, ..., t+1}, generate a new t′ degree random polynomial: f i ′(z)=a′ i，t′ z t′ +…+a′ i，1 z+x i

[0393] It can be seen that x i as the secret value in the new t′ degree random polynomial.

[0394] In fact, there exists a new total polynomial:

[0395] where a′ i1 ,...,a′ it Indicates P i The coefficients of the generated polynomial of degree t′ are different from the new private key share s generated by the distributed key generation protocol. i The coefficient a used in the process i1 ,…,a it .

[0396] S320: The third set Each of the at least t+1 participants generates n′ new secret shares based on the new t′ degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to the second set other participants in the .

[0397] For example, the third set Each of the at least t+1 participants generates n′ new secret shares based on a new t′ degree random polynomial generated by itself, denoted as s′ ij =fi ′(j) j∈[1，n′] .

[0398] Furthermore, the third set Each of at least t+1 participants can retain one of the secret shares and encrypt and send the remaining secret shares to the second set For example, the third set Each of the t+1 participants P i , retain s′ ii , send s′ ij To P j (where j∈[1,n′] and j≠i).

[0399] Moreover, each participant P i You can also generate the public verification parameter A' corresponding to your own t' degree polynomial i，l =a′ i，l G, where l = 0, 1, ..., t', and is published to each participant.

[0400] Furthermore, each participant P i You can also use P j The public authentication parameter {A′ j，0 ,A′ j，1 ,…,A′ j，t′ Verify P j The secret share f sent j ′(i), for example, is verified by the following formula: f j ′(i)G=A′ j，0 +iA′ j，1 +i t′ A′ j，t′

[0401] If either party fails the verification, they can terminate the agreement.

[0402] On the other hand, each participant P i The new total public key X′ can be calculated in a similar way as above, for example using the following formula:

[0403] As mentioned above, the total public key can be used to verify the total signature after aggregation of new signature shares generated by the updated secret shares.

[0404] S330: Second participant collection Each participant in the process generates a new private key share based on the local new secret share.

[0405] Each participant P i The original private key share is si , then the new private key share s′ i It can be obtained as follows:

[0406] It can be proved that the new total private key x′=∑ i∈t+1 x i =f′(0)=f(0), which is the same as the original total private key. Obviously, the new total public key is also the same as the original total public key. Therefore, the original total public key can still be used to verify the total signature after the aggregation of the new signature shares generated by the updated secret shares.

[0407] In a specific example, the first party set before the change Including n=4 participants {P1, ..., P4}, the changed second participant set There are n′=5 participants {P1, ..., P5}. n′=5>n=4, which means a new participant has joined, for example, participant P5. Assume that the thresholds before and after the change are both 2, that is, t=t′=2. Then it includes:

[0408] S410: The first participant set before the change Set up with the changed second party The third set obtained by intersection In the process, each of at least three participants generates a new random polynomial of degree t′=2 based on the original private key share component as a secret value.

[0409] The first party set before the change Set up with the changed second party The intersection gives the third set but satisfy Right now The participants in the set are both the old set The members of the new set members, then It may be any of the four sets {P1, P2, P3}, {P1, P2, P4}, {P1, P3, P4}, {P2, P3, P4}. Take {P1, P2, P3} as an example, and other situations are similar.

[0410] Describes the first party set before the change The four parties in the process of generating secret key shares through the distributed threshold key generation protocol, as mentioned above, have the following main conclusions:

[0411] P1 sets the secret s 10, the private key share is s1=s 11 +s 21 +s 31 +s 41 ;

[0412] P2 sets the secret s 20 , the private key share is s2=s 12 +s 22 +s 32 +s 42 ;

[0413] P3 sets the secret s 30 , the private key share is s3=s 13 +s 23 +s 33 +s 43 ;

[0414] P4 sets the secret s 40 , the private key share is s4=s 14 +s 24 +s 34 +s 44 ;

[0415] Before the change, the original private key shares generated by t+1=3 participants in the offline phase are, for example, x1=λ1s1, x2=λ2s2, and x3=λ3s3, where Then the original total private key is x=∑ i∈[1，t+1] x i =s 10 +s 20 +s 30 +s 40 =f(0), please refer to the previous record for the specific derivation.

[0416] The set of second participants after the change P1, P2, P3 in:

[0417] P1 calculates the Lagrange coefficient and calculate

[0418] P2 calculates the Lagrange coefficient and calculate

[0419] P3 calculates the Lagrange coefficient and calculate

[0420] then:

[0421] P1 generates a random t′=2nd degree polynomial f′1(z)=a′1，2 z 2 +a′ 1，1 z+x1;

[0422] P2 generates a random t′=2nd degree polynomial f′2(z)=a′ 2，2 z 2 +a′ 2，1 z+x2;

[0423] P3 generates a random t′=2nd degree polynomial f′3(z)=a′ 3，2 z 2 +a′ 3，1 z+x3;

[0424] Then there is a total new polynomial: f′(z)=a′ 1，2 z 2 +a′ 1，1 z+x1+a′ 2，2 z 2 +a′ 2，1 z+x2+a′ 3，2 z 2 +a′ 3，1 z+x3=(a′ 1，2 +a′ 2，2 +a′ 3，2 )z 2 +(a′ 1，1 +a′ 2，1 +a′ 3，1 )z+(x1+x2+x3)

[0425] S420:

[0426] P1 generates f′1(1), f′1(2), f′1(3), f′1(4), and f′1(5), retains f′1(1), encrypts f′1(2) and sends it to P2, encrypts f′1(3) and sends it to P3, encrypts f′1(4) and sends it to P4, and encrypts f′1(5) and sends it to P5;

[0427] P2 generates f′2(1), f′2(2), f′2(3), f′2(4), and f′2(5), retains f′2(2), encrypts f′2(1) and sends it to P1, encrypts f′2(3) and sends it to P3, encrypts f′2(4) and sends it to P4, and encrypts f′2(5) and sends it to P5;

[0428] P3 generates f′3(1), f′3(2), f′3(3), f′3(4), and f′3(5), retains f′3(3) for itself, encrypts f′3(1) and sends it to P1, encrypts f′3(2) and sends it to P2, encrypts f′3(4) and sends it to P4, and encrypts f′3(5) and sends it to P5.

[0429] so:

[0430] P1 locally has f′1(1), f′2(1), f′3(1);

[0431] P2 locally has f′1(2), f′2(2), f′3(2);

[0432] P3 locally has f′1(3), f′2(3), f′3(3);

[0433] P4 locally has f′1(4), f′2(4), f′3(4);

[0434] P5 locally has f′1(5), f′2(5), f′3(5).

[0435] also:

[0436] Participant P1 can generate A′ 1，l =a′ 1，l G, l = 0, 1, ..., t' = 2, including A' 1，0 =a′ 1，0 G=x1G,A′ 1，1 =a′ 1，1 G, A′ 1，2 =a′ 1，2 G, broadcast {A′ 1，0 ,A′ 1，1 ,A′ 1，2} to P2, P3, P4, P5;

[0437] Participant P2 can generate A′ 2，l =a′ 2，l G′=0, 1, ..., t′=2, including A′ 2，0 =a′ 2，0 G=x2G,A′ 2，1 =a′ 2，1 G, A′ 2，2 =a′ 2，2 G, broadcast {A′ 2，0 ,A′ 2，1 ,A′ 2，2} to P1, P3, P4, P5;

[0438] Participant P3 can generate A′ 3，l =a′ 3，l G, l = 0, 1, ..., t' = 2, including A' 3，0 =a′ 3，0 G=x3G,A′ 3，1 =a′ 3，1 G, A′ 3，2 =a′3，2 G, broadcast {A′ 3，0 ,A′ 3，1 ,A′ 3，2} to P1, P2, P4, P5.

[0439] and then:

[0440] Participant P1 can use f′2(1)G=A′ 2，0 +A′ 2，1 +A′ 2，2 Verify f′2(1), through f′3(1) G=A′ 3，0 +A′ 3，1 +A′ 3，2 Verify f′3(1);

[0441] Participant P2 can use f′1(2)G=A′ 1，0 +2A′ 1，1 +2 2 A′ 1，2 Verify f′1(2), through f′3(2) G=A′ 3，0 +2A′ 3，1 +2 2 A′ 3，2 Verify f′3(2);

[0442] Participant P3 can use f′1(3)G=A′ 3，0 +3A′ 3，1 +′3 3 A′ 3，2 Verify f′1(2), through f′2(3) G=A′ 2，0 +3A′ 2，1 +3 3 A′ 2，2 Verify f′2(3);

[0443] Participant P4 can use f′1(4)G=A′ 1，0 +4A′ 1，1 +4 4 A′ 1，2 Verify f′1(4), through f′2(4) G=A′ 2，0 +4A′ 2，1 +4 4 A′ 2，2 Verify f′2(4), through f′3(4) G=A′ 3，0 +4A′ 3，1 +4 4 A′ 3，2 Verify f′3(4);

[0444] Participant P5 can use f′1(5)G=A′ 1，0 +5A′1，1 +5 5 A′ 1，2 Verify f′1(5), through f′2(5) G=A′ 2，0 +5A′ 2，1 +5 5 A′ 2，2 Verify f′2(5), through f′3(5) G=A′ 3，0 +5A′ 3，1 +5 5 A′ 3，2 Verify f′3(5).

[0445] If either party fails the verification, they can terminate the agreement.

[0446] On the other hand, each participant P i The new total public key X′ can be calculated in a similar way as above, for example using the following formula:

[0447] As previously mentioned, this new total public key X′ can be used to verify the aggregated signature of the new signature shares subsequently generated using the updated secret shares. Furthermore, not only can the total number of participants be dynamically changed, but the threshold value can also be dynamically changed while keeping the total public and private keys (X, x) unchanged. Based on the scheme in this application, any threshold signature scheme based on the discrete logarithm problem can be constructed, including threshold ECDSA, threshold SM2, and threshold Schnorr signature schemes. These schemes support dynamic changes in the threshold value t and the total number of participants n, without requiring the assumption of a majority of honest participants.

[0448] S430:

[0449] P1 calculates the new private key share s′1=∑ i∈S f′ i (1)=f′1(1)+f′2(1)+f′3(1);

[0450] P2 calculates the new private key share s′2=∑ i∈S f′ i (2)=f′1(2)+f′2(2)+f′3(2);

[0451] P3 calculates the new private key share s′3=∑ i∈S f′ i (3)=f′1(3)+f′2(3)+f′3(3);

[0452] P4 calculates the new private key share s′4=∑ i∈S f′ i (4)=f′1(4)+f′2(4)+f′3(4);

[0453] P5 calculates the new private key share s′5=∑ i∈S f′ i (5)=f′1(5)+f′2(5)+f′3(5).

[0454] After the change, the new private key shares of t+1=3 participants in the offline phase are x′1=λ1s′1, x′2=λ2s′2, x′3=λ3s′3, where The new total private key is:

[0455] As can be seen, the new total private key is equal to the original total private key, that is, x′ = x. Obviously, the corresponding new total public key is also equal to the original total public key. Therefore, the original total public key can still be used to verify the total signature after the aggregation of new signature shares generated using the updated secret shares.

[0456] In another specific example, the first party set before the change Including n=4 participants {P1, ..., P4}, the changed second participant set There are n′=3 participants {P1, P2, P3}. n′=3<n=4, which means a participant has withdrawn, for example, participant P4. Assume that the thresholds before and after the change are both 2, that is, t=t′=2. This includes:

[0457] S510: The first participant set before the change Set up with the changed second party The third set obtained by intersection In the process, each of at least three participants generates a new random polynomial of degree t′=2 based on the original private key share component as a secret value.

[0458] The first party set before the change Set up with the changed second party The intersection gives the third set but satisfy Right now The participants in the set are both the old set The members of the new set members, then is {P1, P2, P3}.

[0459] Describes the first party set before the change The four parties in the process of generating secret key shares through the distributed threshold key generation protocol, as mentioned above, have the following main conclusions:

[0460] P1 sets the secret s 10 , the private key share is s1=s 11 +s 21 +s 31 +s 41 ;

[0461] P2 sets the secret s 20 , the private key share is s2=s 12 +s 22 +s 32 +s 42 ;

[0462] P3 sets the secret s 30 , the private key share is s3=s 13 +s 23 +s 33 +s 43 ;

[0463] P4 sets the secret s 40 , the private key share is s4=s 14 +s 24 +s 34 +s 44 ;

[0464] Before the change, the original private key shares generated by t+1=3 participants in the offline phase are, for example, x1=λ1s1, x2=λ2s2, and x3=λ3s3, where Then the original total private key is x=∑ i∈[1，t+1] x i =s 10 +s 20 +s 30 +s 40 =f(0), please refer to the previous record for the specific derivation.

[0465] The set of second participants after the change P1, P2, P3 in:

[0466] P1 calculates the Lagrange coefficient and calculate

[0467] P2 calculates the Lagrange coefficient and calculate

[0468] P3 calculates the Lagrange coefficient and calculate

[0469] then:

[0470] P1 generates a random t′=2nd degree polynomial f′1(z)=a′ 1，2 z 2 +a′ 1，1 z+x1;

[0471] P2 generates a random t′=2nd degree polynomial f′2(z)=a′ 2，2 z 2 +a′ 2，1 z+x2;

[0472] P3 generates a random t′=2nd degree polynomial f′3(z)=a′ 3，2 z 2 +a′ 3，1 z+x3;

[0473] Then there is a total new polynomial: f′(z)=a′ 1，2 z 2 +a′ 1，1 z+x1+a′ 2，2 z 2 +a′ 2，1 z+x2+a′ 3，2 z 2 +a′ 3，1 z+x3=(a′ 1，2 +a′ 2，2 +a′ 3，2 )z 2 +(a′ 1，1 +a′ 2，1 +a′ 3，1 )z+(x1+x2+x3)

[0474] S520:

[0475] P1 generates f′1(1), f′1(2), and f′1(3), retains f′1(1), encrypts f′1(2) and sends it to P2, and encrypts f′1(3) and sends it to P3;

[0476] P2 generates f′2(1), f′2(2), and f′2(3), retains f′2(2), encrypts f′2(1) and sends it to P1, and encrypts f′2(3) and sends it to P3;

[0477] P3 generates f′3(1), f′3(2), and f′3(3), retains f′3(3) for itself, encrypts f′3(1) and sends it to P1, and encrypts f′3(2) and sends it to P2.

[0478] so:

[0479] P1 locally has f′1(1), f′2(1), f′3(1);

[0480] P2 locally has f′1(2), f′2(2), f′3(2);

[0481] P3 locally has f′1(3), f′2(3), f′3(3).

[0482] also:

[0483] Participant P1 can generate A′ 1，l =a′ 1，l G, l = 0, 1, ..., t' = 2, including A' 1，0 =a′ 1，0 G=x1G,A′ 1，1 =a′ 1，1 G, A′ 1，2 =a′ 1，2 G, broadcast {A′ 1，0 ,A′ 1，1 ,A′ 1，2} to P2, P3;

[0484] Participant P2 can generate A′ 2，l =a′ 2，l G′=0, 1, ..., t′=2, including A′ 2，0 =a′ 2，0 G=x2G,A′ 2，1 =a′ 2，1 G, A′ 2，2 =a′ 2，2 G, broadcast {A′ 2，0 ,A′ 2，1 ,A′ 2，2} to P1, P3;

[0485] Participant P3 can generate A′ 3，l =a′ 3，l G, l = 0, 1, ..., t' = 2, including A' 3，0 =a′ 3，0 G=x3G,A′ 3，1 =a′ 3，1 G, A′ 3，2 =a′ 3，2 G, broadcast {A′ 3，0 ,A′ 3，1 ,A′ 3，2} to P1, P2.

[0486] and then:

[0487] Participant P1 can use f′2(1)G=A′ 2，0 +A′ 2，1 +A′ 2，2 Verify f′2(1), through f′3(1) G=A′ 3，0 +A′3，1 +A′ 3，2 Verify f′3(1);

[0488] Participant P2 can use f′1(2)G=A′ 1，0 +2A′ 1，1 +2 2 A′ 1，2 Verify f′1(2), through f′3(2) G=A′ 3，0 +2A′ 3，1 +2 2 A′ 3，2 Verify f′3(2);

[0489] Participant P3 can use f′1(3)G=A′ 3，0 +3A′ 3，1 +3 3 A′ 3，2 Verify f′1(2), through f′2(3) G=A′ 2，0 +3A′ 2，1 +3 3 A′ 2，2 Verify f′2(3).

[0490] If either party fails the verification, they can terminate the agreement.

[0491] On the other hand, each participant P i The new total public key X′ can be calculated in a similar way as above, for example using the following formula:

[0492] As mentioned above, the new total public key X′ can be used to verify the total signature after aggregation of new signature shares generated subsequently using the updated secret shares.

[0493] S530:

[0494] P1 calculates the new private key share s′1=∑ i∈S f′ i (1)=f′1(1)+f′2(1)+f′3(1);

[0495] P2 calculates the new private key share s′2=∑ i∈S f′ i (2)=f′1(2)+f′2(2)+f′3(2);

[0496] P3 calculates the new private key share s′3=∑ i∈S f′ i (3)=f′1(3)+f′2(3)+f′3(3).

[0497] After the change, the new private key shares of t+1=3 participants in the offline phase are x′1=λ1s′1, x′2=λ2s′2, x′3=λ3s′3, where The new total private key is:

[0498] As can be seen, the new total private key is equal to the original total private key, that is, x′ = x. Obviously, the corresponding new total public key is also equal to the original total public key. Therefore, the original total public key can still be used to verify the total signature after the aggregation of new signature shares generated using the updated secret shares.

[0499] In another specific example, the first party set before the change Including n=4 participants {P1, ..., P4}, the changed second participant set The threshold is changed from 2 to 1, i.e. t = 2, t′ = 1. This includes:

[0500] S610: The first participant set before the change Set up with the changed second party The third set obtained by intersection In the process, each of at least three participants generates a new random polynomial of degree t′=1 based on the original private key share component as a secret value.

[0501] The first party set before the change Set up with the changed second party The intersection gives the third set but satisfy Right now The participants in the set are both the old set The members of the new set members, then It may be any of the four sets {P1, P2, P3}, {P1, P2, P4}, {P1, P3, P4}, {P2, P3, P4}. Take {P1, P2, P3} as an example, and other situations are similar.

[0502] Describes the first party set before the change The four parties in the process of generating secret key shares through the distributed threshold key generation protocol, as mentioned above, have the following main conclusions:

[0503] P1 sets the secret s 10 , the private key share is s1=s 11 +s21 +s 31 +s 41 ;

[0504] P2 sets the secret s 20 , the private key share is s2=s 12 +s 22 +s 32 +s 42 ;

[0505] P3 sets the secret s 30 , the private key share is s3=s 13 +s 23 +s 33 +s 43 ;

[0506] P4 sets the secret s 40 , the private key share is s4=s 14 +s 24 +s 34 +s 44 ;

[0507] Before the change, the original private key shares generated by t+1=3 participants in the offline phase are, for example, x1=λ1s1, x2=λ2s2, and x3=λ3s3, where Then the original total private key is x=∑ i∈[1，t+1] x i =s 10 +s 20 +s 30 +s 40 =f(0), please refer to the previous record for the specific derivation.

[0508] The set of second participants after the change P1, P2, P3 in:

[0509] P1 calculates the Lagrange coefficient and calculate

[0510] P2 calculates the Lagrange coefficient and calculate

[0511] P3 calculates the Lagrange coefficient and calculate

[0512] then:

[0513] P1 generates a random polynomial of degree t′=1 f′1(z)=a′ 1，1 z+x1;

[0514] P2 generates a random polynomial of degree t′=1 f′2(z)=a′ 2，1 z+x2;

[0515] P3 generates a random polynomial of degree t′=1 f′3(z)=a′ 3，1 z+x3;

[0516] Then there is a total new polynomial: f′(z)=a′ 1，1 z+x1+a′ 2，1 z+x2+a′ 3，1 z+x3=(a′ 1，1 +a′ 2，1 +a′ 3，1 )z+(x1+x2+x3)

[0517] S620:

[0518] P1 generates f′1(1), f′1(2), f′1(3), and f′1(4), retains f′1(1), encrypts f′1(2) and sends it to P2, encrypts f′1(3) and sends it to P3, and encrypts f′1(4) and sends it to P4;

[0519] P2 generates f′2(1), f′2(2), f′2(3), and f′2(4), retains f′2(2), encrypts f′2(1) and sends it to P1, encrypts f′2(3) and sends it to P3, and encrypts f′2(4) and sends it to P4;

[0520] P3 generates f′3(1), f′3(2), f′3(3), and f′3(4), retains f′3(3) for itself, encrypts f′3(1) and sends it to P1, encrypts f′3(2) and sends it to P2, and encrypts f′3(4) and sends it to P4.

[0521] so:

[0522] P1 locally has f′1(1), f′2(1), f′3(1);

[0523] P2 locally has f′1(2), f′2(2), f′3(2);

[0524] P3 locally has f′1(3), f′2(3), f′3(3);

[0525] P4 locally has f′1(4), f′2(4), f′3(4).

[0526] also:

[0527] Participant P1 can generate A′ 1，l =a′ 1，lG, l = 0, 1, ..., t' = 1, including A' 1，0 =a′ 1，0 G=x1G,A′ 1，1 =a′ 1，1 G, broadcast {A′ 1，0 ,A′ 1，1} to P2, P3, P4;

[0528] Participant P2 can generate A′ 2，l =a′ 2，l G′=0, 1, ..., t′=2, including A′ 2，0 =a′ 2，0 G=x2G,A′ 2，1 =a′ 2，1 G, broadcast {A′ 2，0 ,A′ 2，1} to P1, P3, P4;

[0529] Participant P3 can generate A′ 3，l =a′ 3，l G, l = 0, 1, ..., t' = 2, including A' 3，0 =a′ 3，0 G=x3G,A′ 3，1 =a′ 3，1 G, broadcast {A′ 3，0 ,A′ 3，1} to P1, P2, P4.

[0530] and then:

[0531] Participant P1 can use f′2(1)G=A′ 2，0 +A′ 2，1 Verify f′2(1), through f′3(1) G=A′ 3，0 +A′ 3，1 Verify f′3(1);

[0532] Participant P2 can use f′1(2)G=A′ 1，0 +2A′ 1，1 Verify f′1(2), through f′3(2) G=A′ 3，0 +2A′ 3，1 Verify f′3(2);

[0533] Participant P3 can use f′1(3)G=A′ 3，0 +3A′ 3，1 Verify f′1(2), through f′2(3) G=A′ 2，0 +3A′ 2，1 Verify f′2(3);

[0534] Participant P4 can use f′1(4)G=A′ 1，0 +4A′ 1，1 Verify f′1(4), through f′2(4) G=A′ 2，0 +4A′ 2，1 Verify f′2(4), through f′3(4) G=A′ 3，0 +4A′ 3，1 Verify f′3(4).

[0535] If either party fails the verification, they can terminate the agreement.

[0536] On the other hand, each participant P i The new total public key X′ can be calculated in a similar way as above, for example using the following formula:

[0537] As mentioned above, the new total public key X′ can be used to verify the total signature after aggregation of new signature shares generated subsequently using the updated secret shares.

[0538] S630:

[0539] P1 calculates the new private key share s′1=∑ i∈S f′ i (1)=f′1(1)+f′2(1)+f′3(1);

[0540] P2 calculates the new private key share s′2=∑ i∈S f′ i (2)=f′1(2)+f′2(2)+f′3(2);

[0541] P3 calculates the new private key share s′3=∑ i∈S f′ i (3)=f′1(3)+f′2(3)+f′3(3);

[0542] P4 calculates the new private key share s′4=∑ i∈S f′ i (4)=f′1(4)+f′2(4)+f′3(4).

[0543] After the change, the new private key shares of t′+1=2 participants in the offline phase are, for example, x′1=λ1s′1, x′2=λ2s′2, and x′3=λ3s′3, where The new total private key is:

[0544] As can be seen, the new total private key is equal to the original total private key, that is, x′ = x. Obviously, the corresponding new total public key is also equal to the original total public key. Therefore, the original total public key can still be used to verify the total signature after the aggregation of new signature shares generated using the updated secret shares.

[0545] In another specific example, the first party set before the change Including n=4 participants {P1, ..., P4}, the changed second participant set There are n′=3 participants {P1, P2, P3}. n′=3<n=4, that is, a participant has withdrawn, for example, participant P4 has withdrawn, the threshold changes from 2 to 1, that is, t=2, t′=1. Then it includes:

[0546] S710: The first participant set before the change Set up with the changed second party The third set obtained by intersection In the process, each of at least three participants generates a new random polynomial of degree t′=1 based on the original private key share component as a secret value.

[0547] The first party set before the change Set up with the changed second party The intersection gives the third set but satisfy Right now The participants in the set are both the old set The members of the new set members, then is {P1, P2, P3}.

[0548] Describes the first party set before the change The four parties in the process of generating secret key shares through the distributed threshold key generation protocol, as mentioned above, have the following main conclusions:

[0549] P1 sets the secret s 10 , the private key share is s1=s 11 +s 21 +s 31 +s 41 ;

[0550] P2 sets the secret s 20 , the private key share is s2=s 12 +s 22 +s 32 +s 42 ;

[0551] P3 sets the secret s 30 , the private key share is s3=s 13 +s 23 +s 33 +s 43 ;

[0552] P4 sets the secret s 40 , the private key share is s4=s 14 +s 24 +s 34 +s 44 ;

[0553] Before the change, the original private key shares generated by t+1=3 participants in the offline phase are, for example, x1=λ1s1, x2=λ2s2, and x3=λ3s3, where Then the original total private key is x=∑ i∈[1，t+1] x i =s 10 +s 20 +s 30 +s 40 =f(0), please refer to the previous record for the specific derivation.

[0554] The set of second participants after the change P1, P2, P3 in:

[0555] P1 calculates the Lagrange coefficient and calculate

[0556] P2 calculates the Lagrange coefficient and calculate

[0557] P3 calculates the Lagrange coefficient and calculate

[0558] then:

[0559] P1 generates a random polynomial of degree t′=1 f′1(z)=a′ 1，1 z+x1;

[0560] P2 generates a random polynomial of degree t′=1 f′2(z)=a′ 2，1 z+x2;

[0561] P3 generates a random polynomial of degree t′=1 f′3(z)=a′ 3，1 z+x3;

[0562] Then there is a total new polynomial: f′(z)=a′ 1，1z+x1+a′ 2，1 z+x2+a′ 3，1 z+x3=(a′ 1，1 +a′ 2，1 +a′ 3，1 )z+(x1+x2+x3)

[0563] S720:

[0564] P1 generates f′1(1), f′1(2), and f′1(3), retains f′1(1), encrypts f′1(2) and sends it to P2, and encrypts f′1(3) and sends it to P3;

[0565] P2 generates f′2(1), f′2(2), and f′2(3), retains f′2(2), encrypts f′2(1) and sends it to P1, and encrypts f′2(3) and sends it to P3;

[0566] P3 generates f′3(1), f′3(2), and f′3(3), retains f′3(3) for itself, encrypts f′3(1) and sends it to P1, and encrypts f′3(2) and sends it to P2.

[0567] so:

[0568] P1 locally has f′1(1), f′2(1), f′3(1);

[0569] P2 locally has f′1(2), f′2(2), f′3(2);

[0570] P3 locally has f′1(3), f′2(3), f′3(3).

[0571] also:

[0572] Participant P1 can generate A′ 1，l =a′ 1，l G, l = 0, 1, ..., t' = 1, including A' 1，0 =a′ 1，0 G=x1G,A′ 1，1 =a′ 1，1 G, broadcast {A′ 1，0 ,A′ 1，1} to P2, P3;

[0573] Participant P2 can generate A′ 2，l =a′ 2，l G′=0, 1, ..., t′=2, including A′ 2，0 =a′ 2，0 G=x2G,A′ 2，1 =a′ 2，1 G, broadcast {A′ 2，0 ,A′2，1} to P1, P3;

[0574] Participant P3 can generate A′ 3，l =a′ 3，l G, l = 0, 1, ..., t' = 2, including A' 3，0 =a′ 3，0 G=x3G,A′ 3，1 =a′ 3，1 G, broadcast {A′ 3，0 ,A′ 3，1} to P1, P2.

[0575] and then:

[0576] Participant P1 can use f′2(1)G=A′ 2，0 +A′ 2，1 Verify f′2(1), through f′3(1) G=A′ 3，0 +A′ 3，1 Verify f′3(1);

[0577] Participant P2 can use f′1(2)G=A′ 1，0 +2A′ 1，1 Verify f′1(2), through f′3(2) G=A′ 3，0 +2A′ 3，1 Verify f′3(2);

[0578] Participant P3 can use f′1(3)G=A′ 3，0 +3A′ 3，1 Verify f′1(2), through f′2(3) G=A′ 2，0 +3A′ 2，1 Verify f′2(3).

[0579] If either party fails the verification, they can terminate the agreement.

[0580] On the other hand, each participant P i The new total public key X′ can be calculated in a similar way as above, for example using the following formula:

[0581] As mentioned above, the new total public key X′ can be used to verify the total signature after aggregation of new signature shares generated subsequently using the updated secret shares.

[0582] S730:

[0583] P1 calculates the new private key share s′1=∑ i∈S f′ i (1)=f′1(1)+f′2(1)+f′3(1);

[0584] P2 calculates the new private key share s′2=∑ i∈S f′ i (2)=f′1(2)+f′2(2)+f′3(2);

[0585] P3 calculates the new private key share s′3=∑ i∈S f′ i (3)=f′1(3)+f′2(3)+f′3(3).

[0586] After the change, the new private key shares of t′+1=2 participants in the offline phase are, for example, x′1=λ1s′1 and x′2=λ2s′2, where The new total private key is:

[0587] As can be seen, the new total private key is equal to the original total private key, that is, x′ = x. Obviously, the corresponding new total public key is also equal to the original total public key. Therefore, the original total public key can still be used to verify the total signature after the aggregation of new signature shares generated using the updated secret shares.

[0588] Based on the dynamic protocol of this scheme, any threshold signature scheme based on the discrete logarithm problem can be constructed, including threshold ECDSA, threshold SM2, and threshold Schnorr signature schemes. The distributed threshold signature scheme provided by this application eliminates the need for a complete private key and tolerates a certain degree of private key fragmentation leakage and loss, effectively avoiding the security risks associated with improper private key management. Furthermore, the distributed threshold signature scheme and distributed key update scheme provided by this application can also support dynamic changes in the threshold value t and the total number of participants n, while maintaining the total public key unchanged, thus avoiding the need to distribute a new total public key.

[0589] CN109150539A discloses a blockchain-based distributed CA authentication system, method, and device. While the threshold (k, n) is mentioned, this solution still requires a centralized certificate management center to split the private key into n shares and distribute them to different nodes, then implement distributed signatures for these k nodes. In other words, this solution still requires a centralized organization and is not fully decentralized. This is due to the lack of a fundamental cryptographic breakthrough—namely, a fully distributed key generation and threshold signature scheme at the underlying algorithm level.

[0590] Based on the distributed key generation and distributed threshold signature scheme implemented above, this application provides the following method for implementing distributed digital certificates, as shown in FIG4 , including:

[0591] S810: Each of the n participants generates their own threshold private key share through a distributed key generation protocol.

[0592] S820: Each of at least t+1 participants among the n participants generates a random value through the offline phase protocol.

[0593] The above S810 and S820 can be implemented by the following method 1 or method 2:

[0594] Method 1:

[0595] Distributed key generation phase: Each of the n participants generates their own private key share through the distributed key generation protocol, and each generates a homomorphically encrypted public-private key pair, and sends the homomorphically encrypted public key to other participants;

[0596] In the offline phase of the distributed signature, each of at least t+1 participants performs: generating its own first random value and second random value, and also adopting the homomorphic encryption algorithm of the homomorphic encryption public-private key pair and obtaining the coordinate component through the offline phase protocol and the second random value and obtaining the private key share component masking value based on their respective private key shares.

[0597] The above-mentioned method 1 is the distributed key generation stage and the offline stage of distributed signature in the distributed threshold signature based on ECDSA, which will not be repeated here.

[0598] Method 2:

[0599] Distributed key generation phase: Each of the n participants generates a first random value and a second random value, which are exchanged with the other participants after homomorphic encryption. Each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol.

[0600] During the offline phase of the distributed signature, each of at least t+1 participants performs the following: updating their own private key share, generating their own third random value and corresponding third random value public key, and broadcasting them.

[0601] The above-mentioned method 2, namely the distributed key generation stage and the offline stage of distributed signature in the distributed threshold signature based on SM2, will not be repeated here.

[0602] S830: Each of the at least t+1 participants receives a certificate application, signs the application information in the certificate application based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol, and generates a certificate share.

[0603] The certificate application may include application information, specifically including the public key of the applicant, and may also include identity information of the applicant, etc. Thus, each of the t+1 participants may sign the application information to generate a certificate share.

[0604] S840: After any party obtains at least t+1 certificate shares, the at least t+1 signature shares are aggregated into a total certificate.

[0605] Based on the distributed key generation and distributed threshold signature schemes implemented above, this application also provides the following blockchain-based method for implementing distributed digital certificates, as shown in Figure 5, including:

[0606] S910: Each of the n participants, acting as a node on the blockchain, generates its own threshold private key share through a distributed key generation protocol;

[0607] S920: Each of at least t+1 participants among the n participants serves as a node on the blockchain and generates a random value through the offline phase protocol;

[0608] S930: Each of the at least t+1 participants receives a certificate application, signs the application information in the certificate application based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol, generates a certificate share, and records the generated certificate share in the blockchain ledger.

[0609] In one implementation, the generated certificate shares are recorded in the blockchain ledger, which may be a receipt. For example, at least t+1 certificate shares generated by at least t+1 participants are recorded in a receipt in the blockchain ledger. Furthermore, the total certificate may also be stored in the blockchain ledger.

[0610] In a blockchain system, different participants can establish a distributed blockchain network through the deployment of nodes. A decentralized (or multi-centralized) distributed ledger, constructed using a chained block structure, is stored on each node (or a majority of nodes, such as consensus nodes) in the distributed blockchain network. Such a blockchain system must address the consistency and correctness of ledger data across multiple nodes in the decentralized (or multi-centralized) network. Each node (or multiple nodes) runs a blockchain program. Under certain fault-tolerance requirements, a consensus mechanism ensures that all loyal nodes have the same transactions, ensuring that all loyal nodes execute the same transaction results. Transactions and execution results are then packaged into blocks.

[0611] The execution results or related information of the transaction can be recorded in the receipt of the blockchain. Specifically, the execution results / related information can be expressed as events in the receipt. The structure of the event is, for example, in the following format:

[0612] Event:

[0613] [topic][msg]

[0614] [topic][msg]

[0615] ......

[0616] In the above example, the number of events can be one or more. Each event can include fields such as topic and data. Through the built-in SDK, blockchain clients or blockchain nodes can listen for events on a specific topic and, when listening for events on a specific topic, pull the content of the corresponding message. Furthermore, they can perform pre-defined processing after listening for specific topics or certain content in the corresponding message.

[0617] Through this event mechanism, a node can store execution results in the message corresponding to a topic, allowing listeners (i.e., clients or blockchain nodes with a built-in blockchain SDK) to obtain the corresponding execution results. Event monitoring can be registered with a blockchain node through the SDK. Specifically, a blockchain node can bind a hook function to a generated event within the running blockchain platform code (the hook function can be compiled along with the platform code during the development phase). This hook function is a callback function that is called when the monitored event occurs and can execute specific processing logic. The monitoring code can, for example, include the transaction content of the monitored blockchain transaction, the generated receipt, and so on. After registering an event monitoring event with the blockchain node through the SDK, the blockchain node can save a mapping between the monitored event and the listener (e.g., the network connection of the client / node that has installed the SDK and initiated event monitoring, which generally includes information such as the IP address and port number). When the hook function monitors the occurrence of the corresponding event topic, it can call the hook function, which then queries the mapping and pushes the monitored event to the network connection. In this way, the SDK initiating the monitoring can obtain the monitored event through the maintained network connection. Once all transactions on a blockchain have been executed and organized into blocks, the blockchain platform code can monitor the transaction results for receipts and broadcast the monitored events to the SDK that initiated the monitoring. This monitoring mechanism allows nodes to monitor registered events for specific topics. When such events occur, they access the message corresponding to that topic through a maintained connection, thereby obtaining the message's content, which includes public verification parameters. In short, the blockchain's event mechanism can be used to broadcast public verification parameters, and the event monitoring mechanism can be used to receive the broadcasted content.

[0618] Based on such a monitoring mechanism, any party (it can be one of the participants or any party outside the participants, the latter for example, a user who visits a website and needs to verify the website's certificate) can collect at least t+1 certificate shares on the blockchain ledger, for example, by monitoring events on a specific topic.

[0619] After obtaining at least t+1 certificate shares, the at least t+1 certificate shares can be aggregated into a total certificate. The details are as described above. As described above, the total certificate can be stored in the blockchain ledger.

[0620] In addition, the n participants also generate a total public key through a distributed key generation protocol; after any party obtains the total certificate and the total public key, the total public key is used to verify the correctness of the total certificate.

[0621] The above-mentioned embodiments of the present application are based on the aforementioned distributed key generation and threshold signature scheme, and therefore can get rid of dependence on centralized institutions, making them more flexible and robust. They can tolerate a certain degree of private key shard leakage and loss, thereby effectively avoiding the security risks brought about by improper private key management, and are more suitable for decentralized scenarios such as blockchain.

[0622] Furthermore, combined with the aforementioned key share update scheme, it can support dynamic changes in the total number of participants and threshold values. This makes it possible and easy to implement dynamic addition and exit of participants and dynamic adjustment of threshold values ​​while maintaining the total public key unchanged.

[0623] This application also provides an embodiment of a method for implementing distributed threshold signature, including:

[0624] Each of the n participants generates their own threshold private key share through a distributed key generation protocol;

[0625] At least t+1 of the n participants each generate a random value through the offline phase protocol;

[0626] Each of the at least t+1 participants signs the message based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

[0627] Among them, after any party obtains at least t+1 signature shares, the at least t+1 signature shares are aggregated into a total signature.

[0628] Among them, the n participants also generate a total public key through a distributed key generation protocol; after any party obtains the total signature and the total public key, it uses the total public key to verify the correctness of the total signature.

[0629] The distributed key generation phase, offline phase, and online phase specifically include:

[0630] Distributed key generation phase: Each of the n participants generates their own private key share through the distributed key generation protocol, and each generates a homomorphically encrypted public-private key pair, and sends the homomorphically encrypted public key to other participants;

[0631] In the offline phase of the distributed signature, each of at least t+1 participants performs: generating its own first random value and second random value, further employing the homomorphic encryption algorithm of the homomorphically encrypted public-private key pair and obtaining a coordinate component through the offline phase protocol and the second random value, and obtaining a private key share component masking value based on its own private key share;

[0632] In the online phase of distributed signature, each of at least t+1 participants performs: receiving a certificate application; signing the message using its own first random value, the mask value of the private key share component and the coordinate component to obtain a signature share.

[0633] The distributed key generation phase, offline phase, and online phase specifically include:

[0634] Distributed key generation phase: Each of the n participants generates a first random value and a second random value, which are exchanged with the other participants after homomorphic encryption. Each participant generates a private key share based on the sum of the collected first and second random values ​​and the secret share generated by the distributed key generation protocol.

[0635] During the offline phase of the distributed signature, each of at least t+1 participants performs the following: updates its own private key share, generates its own third random value and corresponding third random value public key, and broadcasts them;

[0636] In the online phase of the distributed signature, each of the at least t+1 participants performs the following: receiving a certificate application; calculating the total coordinates of the third random value public key after collecting all the third random value public keys, and calculating r of the signature share for the message based on the total coordinates; and calculating s of the signature share for the message based on r and its own third random value and updated private key share. i , thus obtaining the signature share.

[0637] The following describes an embodiment of a computer device of the present application, including:

[0638] processor;

[0639] and a memory storing a program, wherein when the processor executes the program, the following operations are performed:

[0640] Generate respective threshold private key shares through a distributed key generation protocol;

[0641] Generate random values ​​through the offline phase protocol;

[0642] The message is signed based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

[0643] The following describes an embodiment of a storage medium of the present application, which is used to store a program, wherein the program performs the following operations when executed:

[0644] Generate respective threshold private key shares through a distributed key generation protocol;

[0645] Generate random values ​​through the offline phase protocol;

[0646] The message is signed based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

[0647] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0648] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0649] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0650] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not clearly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any particular order.

[0651] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0652] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more blocks in the block diagram.

[0653] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0654] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0655] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0656] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0657] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0658] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0659] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0660] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0661] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A method for implementing a distributed digital certificate, comprising: Each of the n participants generates their own threshold private key share through a distributed key generation protocol; At least t+1 of the n participants each generate a random value through the offline phase protocol; Each of the at least t+1 participants receives the certificate application, signs the application information in the certificate application based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol, and generates a certificate share; After any party obtains at least t+1 certificate shares, the at least t+1 signature shares are aggregated into a total certificate.

2. The method of claim 1, wherein: Each of the n participants acts as a node on the blockchain.

3. The method of claim 1, further comprising: The generated signature share is recorded in the blockchain ledger.

4. According to the method described in claim 1, the n participants also generate a total public key through a distributed key generation protocol; after any party obtains the total certificate and the total public key, the total public key is used to verify the correctness of the total certificate.

5. The method of claim 4, wherein the total public key is stored in a blockchain ledger.

6. The method of claim 4, wherein the master certificate is stored in a blockchain ledger.

7. The method according to claim 1, wherein the distributed key generation phase, the offline phase and the online phase specifically include: Distributed key generation phase: Each of the n participants generates their own private key share through the distributed key generation protocol, and each generates a homomorphically encrypted public-private key pair, and sends the homomorphically encrypted public key to other participants; In the offline phase of the distributed signature, each of at least t+1 participants performs: generating its own first random value and second random value, and also adopting the homomorphic encryption algorithm of the homomorphic encryption public-private key pair and obtaining the coordinate component through the offline phase protocol and the second random value, and obtaining the private key share component masking value based on the respective private key shares; In the online phase of distributed signature, each of at least t+1 participants performs: receiving a certificate application; using its own first random value, private key share component masking value and the coordinate component to sign the application information in the certificate application to obtain a certificate share.

8. The method according to claim 1, wherein the distributed key generation phase, the offline phase and the online phase specifically include: Distributed key generation phase: Each of the n participants generates a first random value and a second random value, and exchanges them with other participants after homomorphic encryption; Each participant generates a private key share based on the collected first random value and the second random value and the sum of the secret shares generated by the distributed key generation protocol; In the offline phase of the distributed signature, each of at least t+1 participants performs: updating its own private key share, generating its own third random value and corresponding third random value public key and broadcasting; In the online phase of the distributed signature, each of the at least t+1 participants performs: receiving the certificate application; calculating the total coordinates of the third random value public key after collecting all the third random value public keys, and calculating r in the signature share for the message based on the total coordinates, and calculating the component s of the signature share for the application information in the certificate application based on r and its own third random value and updated private key share. i , thereby obtaining the certificate share.

9. A method for updating secret key shares in a distributed threshold signature scheme, based on the method described in any one of claims 1 to 8; the first party set before the change Including n participants, the set of second participants after the change Including n′ participants, the threshold before and after the change is changed from t to t′, the method includes: The first party set before the change Combined with the changed second party The third set obtained by intersection Each of at least t+1 participants generates a new random polynomial of degree t′ based on the original private key share component as the secret value; where S is a subset of the participant index, satisfying |S|=t+1; Third Collection Each of the at least t+1 participants generates n′ new secret shares based on the new t′ degree random polynomial generated by itself, retains one of the secret shares, and encrypts and sends the remaining secret shares to the second set Other participants in the Second Party Collection Each participant in the process generates a new private key share based on the local new secret share.

10. The method of claim 9, further comprising: Second Party Collection At least t′+1 participants use their own updated new private key shares to sign the application information in the certificate application to obtain the certificate share.

11. The method of claim 10, further comprising: Any party obtains the total certificate obtained by aggregating the certificate shares obtained using the new private key shares and verifies it using the original total public key.

12. A method for implementing a distributed threshold signature, comprising: Each of the n participants generates their own threshold private key share through a distributed key generation protocol; At least t+1 of the n participants each generate a random value through the offline phase protocol; Each of the at least t+1 participants signs the message based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

13. According to the method of claim 12, after any party obtains at least t+1 signature shares, the at least t+1 signature shares are aggregated into a total signature.

14. According to the method of claim 12, the n participants also generate a total public key through a distributed key generation protocol; after any party obtains the total signature and the total public key, the total public key is used to verify the correctness of the total signature.

15. The method according to claim 12, wherein the distributed key generation phase, the offline phase and the online phase specifically include: Distributed key generation phase: Each of the n participants generates their own private key share through the distributed key generation protocol, and each generates a homomorphically encrypted public-private key pair, and sends the homomorphically encrypted public key to other participants; In the offline phase of the distributed signature, each of at least t+1 participants performs: generating its own first random value and second random value, and also adopting the homomorphic encryption algorithm of the homomorphic encryption public-private key pair and obtaining the coordinate component through the offline phase protocol and the second random value, and obtaining the private key share component masking value based on the respective private key shares; In the online phase of distributed signature, each of at least t+1 participants performs: receiving a certificate application; signing the message using its own first random value, a private key share component masking value and the coordinate component to obtain a signature share.

16. The method according to claim 12, wherein the distributed key generation phase, the offline phase and the online phase specifically include: Distributed key generation phase: Each of the n participants generates a first random value and a second random value, and exchanges them with other participants after homomorphic encryption; Each participant generates a private key share based on the collected first random value and the second random value and the sum of the secret shares generated by the distributed key generation protocol; In the offline phase of the distributed signature, each of at least t+1 participants performs: updating its own private key share, generating its own third random value and corresponding third random value public key and broadcasting; In the online phase of the distributed signature, each of the at least t+1 parties performs: receiving a certificate application; After collecting all the third random value public keys, calculate the total coordinates of the third random value public keys, and calculate r in the signature share for the message based on the total coordinates, and also calculate the component s of the signature share for the message based on r and its own third random value and updated own private key share i , thus obtaining the signature share.

17. A computer device comprising: Processor; and A memory having a program stored therein, wherein when the processor executes the program, the following operations are performed: Generate respective threshold private key shares through a distributed key generation protocol; Generate random values ​​through the offline phase protocol; The message is signed based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

18. A storage medium for storing a program, wherein the program performs the following operations when executed: Generate respective threshold private key shares through a distributed key generation protocol; Generate random values ​​through the offline phase protocol; The message is signed based on the threshold private key share and the random value generated by the offline phase protocol through the online phase protocol to generate a signature share.

Images