Method for generating a share of a secret value

Abstract

A method for verifiable short secret sharing is provided. The method is applied to methods for generating a share of a secret value, signature methods, key generation methods, and one or more information processing apparatus for implementing the aforementioned methods. The verifiable short secret sharing allows introduction of identifiable aborts such that participants that don't follow a protocol can be identified.

Description

[0001] METHOD FOR GENERATING A SHARE OF A SECRET VALUETechnical Field The present invention relates to a method and one or more informationprocessing apparatus configured to perform the method.Background It is often desirable to distribute processing in the context of performingcryptographic operations. Distributed processing refers to the utilization of multiplecomputing resources across a network to perform a cryptographic operation.An advantage of distributed processing relates to the dispersion ofcomputational tasks across multiple nodes in a decentralized manner. When processingis performed like this, the system may become less susceptible to targeted attacks ormalicious participants. For example, the absence of a central server or other central actor removes the opportunity for a protocol to be disrupted by corruption of the central actor. One example of distributed cryptographic processing may be a thresholdsignature scheme. A threshold signature scheme is a special type of multiparty computation that aims to generate a digital signature. A threshold signature assumesthat there are ^ signers, and that any threshold ^ of the N signers can sign a messagebut ^ – 1 or fewer cannot. In a world without quantum computers there are thresholdsignature solutions that are both practical and secure in highly adversarial environments. Examples of pre-quantum threshold signature schemes includeimplementations of e.g., the Schnorr, ECDSA, RSA, or BLS signature schemes. Thesesignature schemes are well developed and include security features such as robustness, identifiable aborts, small round complexity and backward compatibility with existing applications. In a world with sufficiently powerful quantum computers, cryptographic techniques need to be modified because the problems on which pre-quantumcryptographic algorithms are based will become solvable. There are challenges withdesigning threshold signature schemes for post-quantum cryptography that prior works have struggled to address.Other types of distributed processing include key generation for a thresholdsignature scheme or other threshold cryptographic scheme, where it is desired that eachparticipant in the scheme possess a share of a cryptographic key. Summary According to a first aspect of the invention there may be provided a methodinvolving a plurality of participants and performed by one or more informationprocessing apparatus. The method may comprise, for each participant: generating secretshares of a random number for a current participant and for each other participant in the group using a secret sharing scheme whereby a threshold number of secret shares allow recovery of the random number; generating a cryptographic accumulator using the generated secret shares; generating at least one proof using the cryptographic accumulator; and privately sending a respective secret share of the random number, the cryptographic accumulator, and the proof to each other participant. Following receipt of a secret share of the random number, the cryptographic accumulator, and the proof from each participant in the group, the method may further comprise, for each participant: checking that the received secret share is included in the received cryptographic accumulator; checking the at least one proof; and performing at least one of: summing the secret shares of the random number received from each participant and the secret share of a random number generated for the current participant to generate a secret share of an aggregated random number; and identifying a participant that incorrectly generated a secret share based on whether the secret share is included in the cryptographic accumulator and the check of the proof is successful. According to a second aspect there may be provided an information processingapparatus configured to perform a method according to the first aspect of the invention.According to a third aspect there is provided a program that, when executed byan information processing apparatus, causes the information processing apparatus to perform a method according to the first aspect of the invention. According to a fourth aspect there is provided a threshold signature methodperformed by one or more information processing apparatus for generating a signature using a threshold number, T, out of a number, N, or secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the thresholdnumber, T, the method comprising, for each participant, in a first round: sampling arandom value and a noise and generating a commitment that is a sum of the error and the product of a public matrix and the random value; generating a secret share for each participant in the signing set of the sampled random value and generating a secret share for each participant in the signing set of the noise and securely sharing a respective share of the sampled random value and the secure share of the noise with each participant; and sharing a hashed commitment with the other participants in a signingset. In a second round the method comprises: checking that a hashed commitment hasbeen received from each participant in the signing set and a respective share of a sampled random value and noise has been received from each participant in the signing set; and, in a case that all participants have shared a hashed commitment and a respective share of a sampled random value and noise, sharing the commitment with each participant in the signing set. In a third round the method comprises: checking that the received commitments correspond to the hashed commitments; generating an overall commitment based on the received commitments; generating a challenge using a public key, a message and the overall commitment; determining a share of an overall random value by summing received shares of sampled random values; generating a share of an overall response that is a sum of the overall random value and a product ofthe challenge and a shared secret; and sharing the share of an overall response withparticipants in the signing set. The method comprises at least one participant: performing an aggregation round of: obtaining an overall commitment that is a sum of the received commitments; generating the overall response by recovering the overall response from the shares of the overall response; generating a challenge using a public key, a message, and the overall commitment; generating intermediate information that is a difference between a product of the public matrix and the overall response and a product of the challenge and a public key; generating a hint that is a difference between the overall commitment and the intermediate information; and forming a signature from the challenge, the overall response and the hint. Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 is a schematic diagram showing components of an information processing apparatus; Figures 2 to 5 are flowcharts showing steps of a method for sharing a secretvalue; Figure 6 shows steps of a first verifiable short secret sharing method that generates proofs; Figure 7 shows steps of a method of a first verifiable short secret sharing method that verifies proofs; Figures 8 to 10B are flowcharts showing steps of a key generation method;Figure 11 is a flowchart showing steps of a setup method for threshold signatureschemes; Figures 12 to 15 are flowcharts showing steps of a first threshold signature method; Figures 16 to 18 are flowcharts showing steps in a second threshold signaturemethod; Figure 19 shows steps of a method for verifying a signature;Figures 20A to 20D are flowcharts showing steps in a third threshold signature method; Figures 21A to 21C are flowcharts showing steps in an abort identification protocol when an abort occurs in the aggregation stage of the third threshold signature method; Figures 22A to 22E are flowcharts showing steps in a verifiable short secret sharing method that can be used with the third threshold signature method; Figures 23A to 23D show steps of a method of setup for the third threshold signature scheme and the method of a signing protocol for the third threshold signature scheme; Figures 24A to 24E show steps of identifiable abort protocols that can be used with the third threshold signature method; and Figures 25A to 25D show steps of a verifiable short secret method that can be used with the third threshold signature method. Detailed Description Preliminaries The methods described below may be performed on one or more informationprocessing apparatus such as a server, computer, and / or mobile device. Steps of themethods may be performed on user devices associated with different participants.In other implementations all the processing may be performed on a single information processing apparatus and there may be a single user. For example, a user may have a signing key associated with a cryptographic asset, such as an asset on a blockchain. The user may wish to keep the signing key secure and resistant to loss. Accordingly, the user may generate shares of the signing key and store them on different storage devices. In this case, the user may sign a document using the storage devices if the user has access to at least a threshold number of the devices. Similarly, a malicious actor would need access to a threshold number of the storage devices to apply the signature. In some implementations the storage devices may be drives, such as solid- state drives or the like. All steps of the method in this case could be performed on a single information processing apparatus based on information relating to the key shares stored on the storage devices. The description below will describe participants and, in connection with signature schemes, signers. However, the term ‘participant’ or ‘signer’ may be used interchangeably with the term ‘secret share’ because as just described, the method could be performed by a single user in respect of each secret share.Accordingly, the term ‘signer’ or ‘participant’ should not be interpreted as requiring aseparate user or a separate information processing apparatus. Figure 1 is a schematic diagram of components of an example information processing apparatus 1 suitable for use in the signature method. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 10, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processingapparatus 1 comprises a processor 11 such as a cpu, a storage in the form of memory12 such as a solid state drive, a network module 13, a display 14, and a user interface15. The network module may allow the information processing apparatus 1 to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 16. Further components may be provided but are not shown or described. Any of the steps of the subsequently described methods may be performed by computer-readable instructions of one or more programs stored in a storage and executed by a processor on one or more information processing apparatuses. In some implementations of the methods described below, the methods may beperformed by user devices. The user devices may broadcast messages across a networkwhich will be received by each of the other user devices. In some embodiments, allbroadcast messages between the user devices relating the described methods may beaccompanied by a signature identifying the participant sending the message. Furtherany values transmitted by a user device may be encrypted and accompanied by amessage authentication code (MAC). First embodiments The following section describe first embodiments. Some of the teachings could,however, be applied to other embodiments described later in the description. Twothreshold signature methods are described within the first embodiments. The firstembodiments are robust - this is in contrast to the second embodiment, described laterin the description, which is not robust but maintains the property of having anidentifiable abort. Method for generating secret shares of a secret valueFigures 2 to 5 are flow charts showing steps of a method for generating a shareof a secret. The steps of the method are performed by each participant in a group ofparticipants. The method proceeds in four rounds and the steps of each round arecompleted by all participants before the next round is commenced. The method isperformed among a group of N participants, assuming that at most N / 2 participants are dishonest parties. T is a threshold number of the participants required to perform themethod correctly to validly share a secret among the participants.The steps of a first round are shown in Figure 2. In step 20, each participantsamples a short vector, si. In step 21, each participant performs a verifiable short secretsharing method (VSSS), VSSS.Share, which is shown in Figure 6.Referring to Figure 6, in a first step a masking value, y, is sampled, such as froma Gaussian distribution. In step 2, Shamir Secret sharing is performed to generate N secret shares of the masking value, y, and the value to be shared. The value to be shared is denoted x in Figure 6, which describes VSSS.Share in general. The value x corresponds to the sampled short vector, si, in the context of Figure 2. The generationof N secret shares, [[x]], is performed by randomly sampling a polynomial P of orderT-1 that P(0) = x. The secret shares correspond to evaluations of the sampledpolynomial P at a position that corresponds to an identifier or other value associatedwith each participant. The same procedure is performed for the masking value, y, using a polynomial where P(0) = y. The N masking values are paired with the secret shares of the value to be shared, x. In step 3, a Merkel tree, denoted Tree, is generated, with a root, h, and leavescorresponding to each of the pairs of secret shares of the value to be shared, [[x]]i, and shares of the mask values, [[y]]i. In step 5, Merkel proofs are generated to prove that each of [[x]]i, [[y]]i, are inthe Tree. Methods for generating Merkel proofs, proofi, to prove that data values arepresent in the Tree are known and are not described further here. In step 6, an individualproof πi is formed for each participant. The individual proof is formed of both theMerkel proof, proofi, and the share of the mask value, [[y]]ifor that participant. In step 7, a challenge matrix, R, is generated from a distribution of matrices,using a hash of the root of the Merkel tree, h, to make the sample from the distribution.A polynomial that is a proof of shortness of the value to be shared, [[v]] is determinedas: ^^^ = ^. ^^^ + ^^^where [[x]] is the set of secret shares of x and [[y]] is the set of secret shares of y. Accordingly, [[v]] is a set of secret shares of a value, v.An overall proof, π, includes the root of the Merkel tree, h, and the polynomial,[[v]]. In step 10, the process VSSS.Share returns the shares of the secret, [[x]] theoverall proof, π, and the individual proofs, πi.Returning to Figure 2, in step 22, the participant performing the method encryptsthe secret share, [[s]]i, and the individual proof, πi, for each other participant. Theencryption is performed using a symmetric key known only to the participants thatexchange the resulting ciphertext. In step 23, the ciphertexts and the common proof, π, are broadcast along with asignature by the participant sending the ciphertext of the ciphertext, sig. As the proofsintended for each other participant are encrypted under the respective participant’ssymmetric key, this results in a pair-wise exchange of secret shares, [[s]]i, and theindividual proof, πi. The overall proof, π, is also broadcast.A second round of the method of generating a secret share is illustrated in Figure3. In step 30, the ciphertexts received by each participant, after the broadcast in step 23,are decrypted. In particular, the ciphertexts that are encrypted using the participant’ssymmetric key are decrypted by the participant using the symmetric key.In step 31, a method VSSS.Verify is performed. Steps of the methodVSSS.Verify are shown in the flowchart of Figure 7. In step 1 of VSSS.Verify, thecommon proof, π, and individual proofs are obtained. In step 2, the value of the proof of shortness v is recovered by the participantfrom the set of secret shares [[v]] included in the common proof, π. This may be doneby interpolation of the secret shares, such as by use of Lagrange coefficients. In step 3, it is checked that [[x]]i and [[y]]i are in the Merkel tree, Tree byverifying the Merkel proof, proofi. If the secret share and mask value, [[x]]i and [[y]]iare in the Tree, then in step 5 the challenge matrix, R, is calculated using the samedistribution of matrices used in VSSS.Share and the root of the Merkel tree, h. Inparticular, a hash of the root of the Merkel tree, h, is used to make a sample from thedistribution. In step 6, it is checked whether:^^^^ = ^. ^^^^ + ^^^^And that the size of v is smaller than a bound, B. The proof of shortness, v = R.x + y,must be small if x is small with overwhelming probability if the masking value, y, issmall. For example, this applies when the masking value, y, is selected from a suitableGaussian distribution. This check of the shortness of the sampled short vector, x, maybe a security condition for lattice-based protocols. The size of the bound, B, is thereforedetermined according to the circumstances in which the method of generating secretshares of a secret is performed. Assuming that the two checks described above are passed, the methodVSSS.Verify confirms the consistency of the shares being sent and that the sampledvector is short (recalling that again x is standing in for si). As noted above, the shortnessof the vector is relevant for use of this method in Lattice based cryptographic methods, where the vector may need to meet a relevant bound to preserve security of the cryptographic method. Returning to Figure 3, in step 32, a set of complaints is formed. Complaints areraised against any participant whose ciphertext that was broadcast in the first rounddoes not pass the checks described above in connection with VSSS.Verify. Thecomplaint includes the symmetric key used to encrypt the ciphertext and the signatureaccompanying signature of the ciphertext. The complaints generated by each participantare broadcast to the other participants. Figure 4 shows steps performed by each participant in a third round. In step 40,each participant receives any complaints broadcast by other participants in step 32. Each participant has enough information, including the signature and the symmetrickey, to verify whether or not a complaint is valid. The check that the complaint is validuses VSSS.Verify as described above. If the participant finds that the complaint is valid(i.e., the checks described above in connection with VSSS.Verify do not show that thesecret share and proof have been generated correctly), the complained about participantis removed from a list of valid participants. In step 42, each participant broadcasts a listof valid participants, which is the participants that participated in the method and about whom a valid complaint has not been found. Figure 5 shows steps performed by each participant in round 4. Each participant verifies that at least N / 2 of the participants agree on a valid set of participants, S. If this is not true, the method aborts. If there are more than N / 2 participants in the set of valid participants then in step 50, each participant sums the secret shares, si, that they receivedfrom participants in the set of valid participants following broadcast in step 23. The sumis: Each participant will have received different shares of the respective secrets evaluated at a value corresponding to the participant’s identifier or another value associated with the participant. These values when summed together correspond to a secret share of an aggregated secret, s. Accordingly, the method described above achieves distribution of secret shares such that each participant has a secret share of s.If T of the secret shares, [[s]]i, are obtained (in methods, such as will be describedfurther below) then the overall secret, s, may be recovered by interpolation, such as by the use of Lagrange coefficients. Further, because the secret shares can be treated like Reed Soloman codes, if a few of the participants have been dishonest and there are enough honest participants, the participants may still recover the correct overall secret, s. Distributed key generation Afirst application of the method for distributing secret shares described aboveis illustrated in connection with Figures 8 to 10b. This method proceeds in three rounds.As before, each round is completed by all the participants before proceeding to the next round. Referring to Figure 8, in step 80, each participant generates a salt value, salti,which generated by forming a random binary string. Steps 81 to 83 correspond to steps20 to 22 of Figure 2. Accordingly, these steps are not repeated. Step 84 corresponds to step 23 in Figure 2, except that in addition broadcastingthe ciphertexts, the common proof, π, and a signature of the ciphertext, sig, the saltvalue, salti is also broadcast. Figure 9 is a flowchart showing round 2 of the distributed key generationmethod in which checks are performed and complaints are generated. The steps 90 to93 are the same as round 2 of the method for distributing secret shares described in connection with figure 3. Accordingly, description of the steps is not repeated. Figure 10a is a flow chart showing round 3 of the distributed key generationmethod. The steps 100 to 102 are the same as round 3 of the method for distributing secret shares described in connection with figure 4. Accordingly, description of the steps is not repeated. Figure 10b shows further steps of round 3 of the distributed key generationmethod. In step 103, each participant sums the secret shares, si. As described above inconnection with step 50, this generates a share [[s]]i of an aggregated secret, s.In step 104, each participant generates a hashed salt, salt, that is a hash of thesalts received by the participant: Each participant further generates a public salt, a, by hashing the hashed salt,salt: ^= ^(^^^^)In step 105, the public salt, a, is used by the participant to generate a partialpublic key as follows:^^^^ = [^, 1]. ^^^^where 1 is the identity matrix and [[s]]i is the share of the aggregated secret generatedin step 103. The matrix [a,1] may be referred to as the public matrix, A. The calculatedpublic matrix A should be the same for all honest participants. In step 106, the public salt, a, and the partial public key, [[b]]i are broadcast byeach participant. Following receipt of the public matrix A and the partial public keys,each participant can obtain a public key, b, from T or more of the partial public keys byinterpolation, such as by use of Lagrange coefficients. Shamir secret sharing can beunderstood to be a Reed-Soloman code, such that the public key, b, can be recoveredeven if some of the participants behave dishonestly. Accordingly, following completionof the key generation method, each honest participant owns a share [[s]]i of theaggregated secret, s, and the public key, b. Threshold signature methods Digital signatures are a method of ensuring the authenticity and non-repudiation of electronic documents and messages. They are an important component of secure electronic communication and are widely used in applications such as electronic contracts, financial transactions, and email communication. The method for distributing secret shares among a group of participants described above may be used to formulate a threshold signature scheme in which T out of N signers may form a signature, but T-1 or fewer may not. The examples below willbe based around the Raccoon signature scheme (Raccoon - A Side-Channel SecureSignature Scheme, Rafael del Pino et al, specification available fromhttps: / / raccoonfamily.org / ). However, the method for distributing secret sharesdescribed above is applicable to thresholding other signature schemes. For example, themethod may be applied to signatures based on the Fiat-Shamir paradigm or Hash-and-sign paradigm. When applied to other signature schemes the details of how the signatureis formed may vary from implementation-to-implementation. setup Figure 11 is a flowchart showing steps performed prior to performing athreshold signature method. At step 110, the signers in a group are configured withpublic parameters. The public parameters include a uniform public matrix, A, over aring of polynomials, Rq. Rq is a ring of polynomials modulo q. The Ring, R, is definedfor n and q as and Rq is defined as: The matrix, A, has dimensions of k by l and each entry in the matrix is apolynomial of Rq. As the parameters of the ring and the matrix are public, these can bepreconfigured for each signer, broadcast by one signer, or shared in any other way.Referring to Figure 11, the signers perform a key generation process in step 111such that each signer holds a share of a secret, s, which is random over a distributionover Rq. A method for doing this has been described above in connection with Figures8 to 10b. As described above, following completion of step 111, each signer holds apublic key b which is a product of the matrix, A, and the secret, s. The public key mayalso be a further set of values, referred to as vk, which is a set including both the publickey b and the matrix, A.There may be N signers in the group of signers that may participate in thethreshold signature scheme. Accordingly, the secret, s, is in N secret shares, where N isthe number of signers participating in the signature scheme and is greater than or equal to T the threshold number of signers required to generate a signature. According to the key generation method described above, a secret share isgenerated for each signer, represented by index i. The secret shares represent Shamirsecret shares. Accordingly in step 2 of VSSS.Share (step 82), a random polynomial, P,is sampled of degree T-1, where T is the threshold of the number of signers that will be required to complete the threshold signature. The value of the Polynomial, P(0), evaluated at zero is equal to the secret, s. The secret shares are evaluations of the polynomial at positions corresponding to a signer identifier or other value associated with the signer. If T secret shares of the polynomial are known, there are enough points to reconstruct the polynomial of degree T-1. The reconstruction may be performedusing Lagrange polynomials. For i ^ S, where S is the set of signers, we can define: where λi,S is a Lagrange coefficient. A set of evaluation points, E, is defined eachhaving coordinates xi, yi for each of N different values of i (corresponding to the N secretshares). yi= P(xi). In this case Accordingly, during the key generation process, each potential signer generates a respective secret share [[s]]i(equal to yiabove). The secret, s, is not known to any single signer. The setup phase may be performed prior to the time that a signature is required or at a time that the first signature is required. First threshold signature method Athreshold signature method is illustrated in connection with Figures 12 to 15.The first threshold signature method proceeds in four rounds. As before, each round iscompleted by all the participants before proceeding to the next round. Figure 12 is a flowchart showing steps of a first round of the threshold signaturescheme. Steps 120 to 123 are identical to steps 20 to 23 of Figure 2. However, the shortvector, si, will be referred to as a random number, ri, in the signature method below.Accordingly, the description of these steps is not repeated. During these steps therandom number, ri, is sampled at each signer, and proofs are generated and broadcast.Figure 13 is flowchart showing steps of a second round of the thresholdsignature scheme. Steps 130 to 132 are the same as steps 30 to 31 described in connection with Figure 3. Accordingly, the description is not repeated. In these steps,the shares and proofs are decrypted, checked, and complaints are broadcast by thesigners. Figure 14 is a flowchart showing steps of a third round of the threshold signaturescheme. Steps 140 and 141 are the same as steps 40 and 41 of figure 4. In these stepsthe complaints are received, and signers are removed from a list of valid signers if it isshown that their secret shares and proofs do not pass the checks in VSSS.Verify. In step 142, each signer sums the secret shares, si, that is has received. As in step50, this generates a share [[r]]i of an aggregated random number, r.In step 143, each signer generates a partial commitment [[w]]i as follows:^^^^ = ^ . ^^^^Where A is the public matrix made available in the setup phase.In step 144, each signer broadcasts their list of valid signers, validi, and theirpartial commitment, [[w]]i. Figure 15 is a flowchart showing steps of a fourth round of the thresholdsignature method. In step 150, each signer has received the partial commitmentsbroadcast in step 143. Each signer recovers an aggregated commitment, w, from thepartial commitments, which are secret shares, [[w]]i, of the aggregated commitment, w.This may be done by use of Lagrange coefficients to recover a polynomial through T or more of the secret shares and evaluating the polynomial at zero to recover theaggregated commitment, w.In step 151, each signer calculates a challenge, c by taking a hash of the aggregated commitment, w, a message to be signed, msg, and the public key, vk: ^= ^(^, ^^^, ^^)In step 152, a share of a response^^^^is generated as follows: ^^^^ = ^ . ^^^^ + ^^^^where c is the challenge calculated in step 151, ^^^^is the secret share distributed to thesigner during step 111 of the setup, and the share of the overall random number ^^^^was calculated in step 142. The generated share of the response ^^^^ and challenge, c, are broadcast byeach signer. Accordingly, each signer receives a threshold number, T, or more of sharesof the response, ^^^^, and challenges, c, from signers in the signing set, S, of validusers. As the partial commitments were publicly distributed in step 144 in round 3, thecalculated challenge values, c, should be identical for each honest signer.If all signers have behaved honestly, in accordance with the method described above, then each response ^^^^is a valid secret sharing of an overall response, z:^ = ^. ^ + ^Accordingly, the overall response, z, can be recovered by each signer usinginterpolation (such as Lagrange coefficients described above). As long as enoughsigners are honest, a valid overall response may be determined by each signer using theerror-correcting capabilities of Reed-Solomon codes. A threshold signature is generatedand has two values, (c,z) where the challenge, c, was determined in step 151 and shouldhave been generated to have the same value by each signer. The signature scheme is a threshold signature scheme because T signers arerequired by each signer to allow the interpolation to recover the overall response, z,required to form the signature. Verification of the signature will be described further below after a variant on the above-described signature scheme is explained. Second threshold signature methodThe setup phase described in connection with the first threshold signature method applies also to the second threshold signature method and the description will not be repeated. When a threshold signature is to be applied, the signature scheme proceeds inthree rounds illustrated by steps shown in flowcharts in figures 16 to 18. The steps inthese methods are performed by each signer. The steps of each round are completed by each signer in a signing set, S, before the next round is commenced. In the first round, at step S160, each signer samples a short random value r fromthe ring of polynomials. As this is performed by each signer, the random value sampledat signer with index i is denoted ri. In step S161 a polynomial, P, of order T-1 is randomly sampled by each signersuch that P(0) = ri. At this stage, the protocol commits the signer to the randomlyselected polynomial, P. Accordingly, in step 162 each signer computes a proof in theform of a set of commitments wj that is calculated by:^^ = ^ . ^^where A is the matrix defined above and pj are coefficients of the selected polynomial.It is noted that each signer with index i generates a commitment of T polynomialcoefficients corresponding to a polynomial of order T-1. The value of the coefficientpi,0 is equal to the sampled random number ri because evaluation at x = 0 removes allother terms of the polynomial. An evaluation of the polynomial, P, at x may be determined by: Here xj is the j-th power of the value of a point being evaluated. For example,for a simple polynomial P(x) = 3x2, for j=2, pj = 3 and xj = x2. Overall, the set of signersgenerate commitments: ^^,^ = ^ . ^^,^where i is an index representing the commitments generated by each signer, i. In step S163, a hash of the commitments is generated and broadcast by thesigners. The commitment, cmtiis: Figure 17 is a flow chart showing steps of a second round of the second threshold signature scheme. In step 170, each signer broadcasts the commitments, wi,j and a hash of all the hashed commitments (cmti) received after step 163. In step 171, each signer that participated in round 1 is a member of a signingset, S. Each signer in the signing set computes Shamir secret shares of their random value ri using the selected and committed to polynomial Pi. The secret share of therandom number is denoted ^^^^^. The secret share for a signer j in the signing group, S,is the evaluation of the polynomial P at a value x that is a signer identifier or anothervalue associated with the signer j. Accordingly, ^^^^^ is a set of secret shares generatedusing the polynomial, P, for each member of a signing set, s. Note that each signer alsogenerates a secret share of its polynomial, P, for itself using its own signer identifier orother value. Each signer privately sends to each other signer in the signing set the secretshare of their polynomial generated for that signer. Accordingly, each signer in thesigning set also receives a secret share from each of the other signers in the signing set. Figure 18 is a flowchart showing steps in a third round of the second thresholdsignature scheme. In step 180, a check is made to ensure that each signer has behaved consistentlyin connection with the polynomial used in the first round and second round. Inparticular, each signer checks that: Here s is the signer identifier or other value associated with each signer in thesigning set, S. Accordingly, sj is the signer identifier or other value to the power of j.The check above enforces on each signer the commitment made in round 1 to the polynomial P. The check above allows each signer to confirm that each of the secret shares that it received from each other signer is indeed an evaluation of their committedpolynomial at the signer identifier or other value associated with the signer. Thepolynomial coefficients are ‘masked’ by virtue of the product with the matrix, A. In step 181, if the check performed in step 180 failed, a complaint is raised bythe signer and the threshold signature process is aborted. Otherwise, the signaturemethod proceeds to step 182. In step 182, each signer computes:The first term indicates that the signer sums the evaluation of its own share of its randomvalue and the received secret shares of the other random values from the other signers,s, in the signing set, S. The equation above shows that after summing these values, each of the signers has generated a secret share of an overall random number, r. In otherwords, each signer has an evaluation of a polynomial P where P(0) = r. That is ^^^^ isan evaluation of P associated with its signer identifier or other value, for the overallrandom value, r. In step 183, each signer calculates an aggregated commitment, w: Where w is a sum of the commitments for the 0thpower of the sampled polynomials. It is recalled from step 41 that pi,0is equal to the sampled random valueby the signer. Accordingly, ws,0 = A . rs.In step 184, each signer calculates a challenge, c by taking a hash of the aggregated commitment, w, a message to be signed, msg, and the public key, vk: ^= ^(^, ^^^, ^^)In step 185, a share of a response ^^^^ is generated as follows:^^^^ = ^ . ^^^^ + ^^^^where c is the challenge calculated in step 184, ^^^^is the secret share distributed to thesigner during the setup described in connection with Figure 11, and the share of theoverall random number ^^^^ was calculated in step 182.The generated share of the response ^^^^ and challenge, c, are broadcast byeach signer. Accordingly, each signer receives challenges and shares of the responsefrom each other signer in the signing set. If the signing process is successful, each signerhas greater than a threshold number, T, of shares of the response, ^^^^. As thecommitments were publicly distributed in step 170 in the second round, the calculatedchallenge values, c, should be identical from each of the honest signers.If all signers have behaved honestly, in accordance with the method describedabove, then each response ^^^^ is a valid secret sharing of an overall response, z:^ = ^. ^ + ^Accordingly, the overall response, z, can be recovered each signer using interpolation(such as Lagrange coefficients described above). A threshold signature is generated bythat has two values, (c,z) where the challenge, c, was determined in step 184 and shouldhave been generated to have the same value by each signer. The signature scheme is a threshold signature scheme because T signers arerequired to participate to allow each signer to perform interpolation to recover theoverall response, z. Verifying the signature Steps for verifying the signature are shown in Figure 19. A party verifying the signature is assumed to also have a copy of the message, msg, which has been signed and against which the signature is being checked and a copy of the public key, vk. Thehash function, H, is also available to the verifying party. The party verifying thesignature does not need to be (but could be) a member of the group of signers that were involved in generating the signature. To verify the signature in step 190, the verifier calculates ^^: ^^ = ^(^ . ^ − ^ . ^, ^^^, ^^) The value ^^is generated in the same way that the challenge c was generated in step 184 except that the overall commitment is replaced by a difference between i) aproduct of the matrix, A, and the overall response, z and ii) a product of the public key,b, and the challenge, c. The party verifying the signature also checks that the response value, z, in thesignature is short. Checking bounds on the response value is described in further detailin the Raccoon specification document referred to above. If ^^ is equal to the challenge value c, and the response value is short then thesignature is verified. If ^^ is not equal to the challenge value c, or the response value isnot short then the signature is not verified.Second embodiment The methods above describe first embodiments of the invention. The signatureschemes according to the first embodiments are robust (always outputs a validsignature) because of the V3S checks. However, the requirement to conduct V3S proofsat every signing stage means there is a relatively high associated computational cost.The second embodiment of the invention, described here and in the Figures 20Ato 25D, introduces a more efficient 3-round signing protocol. At a high level the overallstructure of the signature scheme remains the same, but the V3S proofs are removed from the signing phase. Instead of identifying a misbehaving participant during the signing phase, the protocol aborts in the case of an error and then later conducts theV3S proofs to identify which participant was responsible for the error. This means thatthe computationally expensive V3S proofs can be deferred and only need to be calculated in the case that an abort occurs. As such, the second embodiment losesrobustness (the scheme sometimes aborts, so does not always output a valid signature)but maintains the property of having an identifiable abort in which a participantresponsible for an abort can be identified. As in the first embodiments, setup and apparatus used for the secondembodiment is described in the Preliminaries section of the detailed description.Note that, because two threshold signature methods were described inconnection with the first embodiments, the second embodiment describes the thirdthreshold signature method. Note also that the acronym VSSS of the first embodiment,short for verifiable short secret sharing, can alternatively written as V3S withoutchanging the meaning of the acronym. In other words, the terms VSSS and V3S can be used interchangeably. Signing protocol Ahigh-level description of the signing protocol of the second embodiment ispresented here. Figures 20A to 20D describe a signing protocol according to the secondembodiment. The signing protocol comprises three rounds, which are described byFigures 20A, 20B and 20C respectively. A signature generation round succeeds thethree rounds of the signing protocol, which is described in Figure 20D. The signingprotocol is performed by participants in a signing set, SS, of size T in a T-out-of-Nsigning scheme, as in the first embodiment, and the steps of each round are completedby all participants before the next round commences. Each member of the signing setis one of the original members for which secret shares were generated [N], i.e. ^^ ⊆[^]. Note that the set [N] has ^ participants (elements).Figure 20A describes the first round of the signing protocol, which is performedby each participant in the signing set. In step 200, each signer ^ ∈ ^^ samples shortvectors ^^ and produces a T-out-of-N Shamir’s secret sharing ^^^ ^ = , andcomputes a commitment ^^ ∶= ^. ^^ + ^ ^^ in step 201. The notation ^^^ ^ = means that^^^ ^ is shorthand for producing secret shares of the vector ^^for each participant in the set [N]. In step 202, each participant broadcasts a hashed commitment cmt^ ≔Hcom(^, ^^) and an encryption of the shares ^^^^^ to the other signers ^ ∈ ^^. Here,H^^^denotes a hash function. Hash functions are well known in the field of cryptography, and any of the hash functions known in the art may be suitable. See the conclusion for more information on hash functions. The encrypted shares are later referred to with the symbol ^ ^ ^ . In the first round, the signer only uses and stores the rest ofshares, associated with participants that aren’t in the signing set, for later use. (Recallthe rest of the shares are for the participants who are in the list of the participants forwhich secret shares were generated [N], but are not in the signing set. More succinctly,the rest of the shares are for the participants in [N] SS.)Figure 20B describes the second round of the signing protocol, which is again performed by each participant in the signing set. In step 203, each participant in thesigning set receives the hashed commitments and encrypted shares from all otherparticipants in the signing set, ^ ∈ ^^. Subsequently, in step 204 each participant in thesigning set opens the hash commitment by sending ^^ in a public message to the otherparticipants in the signing set. The third round of the signing protocol is displayed in Figure 20C. Each signercomputes an aggregated commitment ^ ∶= ∑^ ^^ in step 205, where the ^^ are theshares of the aggregated commitment that are contributed by each signer in the signing set. In step 206, each signer in the signing set then further computes a challengec = Hc(vk, M, w), where H^ is a hash function, vk is a verification key, M is a messageto be signed and ^ is the aggregated commitment. H^ may be the same hash functionas or a different hash function to H^^^.In step 207, each signer uses the challenge to output an individual responsethe individual response is the sum of an aggregated and the product of the challenge ^ and shares of thesecret ^^^^.The signature formation round, which corresponds to the algorithm Agg, isdescribed in Figure 20D. The signature formation round in step 208 comprisescomputing the aggregated commitment ^ ∶= ∑^ ^^ , as previously described andapplying Lagrange reconstruction to the individual responses shared at the end of thethird round to recover an overall response, ^ = ^. ^ ^^ .In step 209, a challenge value, c, an intermediate vector, y, and a hint, h, arecalculated. The challenge is calculated as c = Hc(vk, M, w), where H^ is a hashfunction, vk is a public verification key, M is a message to be signed. The intermediatevector, y, is calculated by calculating ^ = ⌊^^ − Here t is a portionof a public key, ^ = ^^ + ^. A hint value, h, is calculated as ^ ∶= ^ − ^ where, w, is the aggregated commitment and y is the determined intermediate vector. In step 2010, the signature is formed as the combination of the challenge value, the overall response, and the hint (c,z,h). Identifiable abort This section describes how the participant responsible for an abort in the previous section can be identified. There are several different stages where participantsmay abort during signing. A participant ^ may abort (a) in the second signing round ifit receives an invalid encryption for some from party ^, (b) in the third signinground if participant ^ reveals a commitment ^^ in the second round that is inconsistentwith the hashed commitment, cmt^, sent in the first round or in (c) the signatureformation round if the signature subsequently fails verification. No abort occurs in thefirst signing round, other than the trivial case of a user returning an invalid output. If a participant ^ aborts in the second round due to condition (a), the participantwill raise a complaint that it has received an invalid encryption from another participant.The participant ^ can justify aborting by publicly revealing the symmetric key that wasused for the encryption of ^^^^^. Then, other participants can verify whether that theaccused participant ^ sent an incorrect encryption to ^, and a malicious participant ^ canbe identified.An abort in the third round due to condition (b) can be detected by simplylooking at a transcript of the protocol. Each participant will have received both thehashed commitment, cmti, and the subsequent commitment, w. Accordingly each partycan easily check whether an accused participant has sent inconsistent commitments andhashed commitments. The most challenging abort case is (c), and this is where V3S techniques areused . The case of abort identification in case of failure of the signature to verify isdescribed below with reference to an abort protocol illustrated in Figures 21A to 21C.In a first round of the abort protocol, 2T more participants are added to the Tsigners involved in the signing protocol (step 210). It is noted that the 2T extraparticipants are not required for the signing protocol in a case that the signature is successful. The extra participants are only added in the case of an abort case (c) to identify the cause of the abort.This expanded set, comprising 3T total participants, is labelled the identifiableabort set, IAS. In step 211 each signer ^ in the signing set SS runs the extended V3S,described later, on the share of the random value ^^used in the first round of the signing method described in step 200 of Figure 20A. The extended V3S method generatesadditional shares of the sampled short vector to provide to each of the 2T moreparticipants and generates proofs that each share of the sampled short vector is in aMerkle tree. Recall that the signing set is a proper subset of the identifiable abort set.Each signer then sends shares of the random value to every participant ^ inthe identifiable abort set, i.e. ^ ∈ IAS, in step 212. In this step it is assumed the sharesof the secret share sent to those in the signing set, ^^^^^^^^∈^^ , are the same as thoseused in the signing protocol, for example by using the same randomness. The second round of the abort protocol begins in step 213 with each participant^ ∈ ^^^ receiving proofs from each other participant, verifying the proofs, andcomplaining in case of failure. In step 214, the participants ^ in SS further verify thatthe newly obtained shares ^^^^^^^^∈^^are the same as the ones received during thesigning protocol. In step 215 each participant broadcasts their individual contribution^^^^ = ^. ^^^^ + ∑^∈^^ ^^^^^. In the third round of the abort protocol shown in Figure 21C, participants reviewall complaints from the second round (step 216) and can detect any incorrectly shared^^ or ^^ thanks to the extended V3S protocol. The condition ^^^^ = ^. ^^^^ + is not checked by the extended V3S protocol but is instead checked usingReed-Solomon error correction in step 217. The use of Reed-Solomon error correction is possible because the secret shares and shares of the sampled short vectors ^^weregenerated using the Shamir secret sharing scheme. As the number of participants in theidentifiable abort set sufficiently greater than the threshold number of participantsrequired to reconstruct the secret in the original signing set, the secret can still berecovered even if some of the participants, maliciously or otherwise, give incorrectshares. More specifically, oversampling of the polynomial used to generate the sharesallows both the polynomial and incorrect shares that do not fall on the polynomial to be identified. V3S scheme The adapted V3S scheme used in the second embodiment is briefly describedhere. One of the differences between the signature scheme of the first embodiment and the signature scheme of the second embodiment is that the extended V3S is only usedin the second embodiment in the case of an abort, which allows heavy computationassociated with V3S to be deferred to the identification protocol. The V3S comprises atuple of algorithms: V3S.Share, V3S.Prove, V3S.Verify and V3S.Reconstruct, as well as an additional algorithm V3S.ErrorCorrect which uses Reed-Solomon error correction to take shares as input and subsequently output corrected shares. A detailed account of these algorithms is given later in the description. Algorithms for signing protocol This section describes the algorithms Setup and KeyGen, used to set-up thesecond embodiment as well as the signing protocol of the threshold signature schemeof the second embodiment. The Setup and KeyGen algorithms are carried out at thebeginning of a session and could be carried out by one of the group participants or aparty external to the participants that receive secret shares, such as a server on whichthe session is hosted. The Sign algorithms that will now be described are separatelycarried out by each of the participants ^ in the signing set.Throughout the following section, the term ^^^denotes the threshold number of participants needed to perform identifiable abort, where ^^^is between the thresholdnumber of participants needed to reconstruct the signature ^ and the total number ofparticipants ^. As previously, SS denotes the signing set during the protocol, with thenumber of participants in SS greater than or equal to ^. Similarly, IAS represents anextended set of participants for performing the identifiable abort protocol, with thenumber of participants in IAS equalling ^^^. Each signing session is identified by asession identifier sid. Each participant ^ maintains a state st^ to store signer-internalinformation. The internal information corresponding to a session sid is represented by st^[sid]. The Setup algorithm is described with reference to Figure 23A. The Setup algorithm takes place at the beginning of a secret sharing process. The Setup algorithm takes as input a security parameter 1^, ^, ^, and ^^^and outputs public parameters tspar. The public parameters include ^, ^, and ^^^, and a public matrix ^. The securityparameter 1^ refers to a string with ^ characters, all of them equal to 1, and relates tothe difficulty of successfully attacking the system - the larger the value of ^, the moredifficult it is to successfully attack the system.Figure 23A further describes the KeyGen algorithm, which takes the publicparameters tspar as input and, like the Setup algorithm, takes place prior to the signaturegeneration process. Step 1 includes sampling a secret, ^, and a noise, ^, from a Gaussiandistribution over a ring, . Step 2 describes generating a portion of the publicverification key ^ using the secret, the noise, ^, and a public matrix ^. The term “publicmatrix” simply refers to a matrix that anyone can access, i.e. the matrix ^ does not haveto be kept secret. The portion of the public verification key is generated as, ^ = ⌊^^ +^⌋^^where the key has been subjected to bit dropping by ^^bits. Steps 3 to 5 disclose generating symmetric keys, ^^^^,^^^for a symmetricencryption scheme between each pair of participants, i, j, using a helper functionSKE.Keygen(). The helper function SKE.Keygen() refers to a function that generates symmetric keys. Such functions are well known in the art and are not described furtherhere. The output is, for each participant i is a vector of secret key, ^^^^^^. Steps 6 and 7 generate a parameter, ^^^^^,^ , which is subsequently included inpublic information for the IA protocol, inf. A seed is generated for each pair ofparticipants, ^^^^^,^ ∶= ^^^^^,^. The parameter, ^^^,^^^, is a hash of the identity of the pair of participants, the generated symmetric key between the participants, and the seed. Subsequently, a polynomial of degree ^ − 1 is generated in step 9, where the y-intercept of the polynomial is a secret to be shared amongst the participants in the groupof N participants. Shares of the secret are then formed in step 10, where the shares ofthe secret, ^^^^, for a participant ^ are the values of the polynomial ^(^).Step 11 defines the public verification key, vk, to be outputted, which is thepublic parameters, tspar, and the aforementioned portion of the public verification key,^. In step 12 the public information for the IA protocol is generated as described above.In step 13 secret key packages, ski, are generated for each participant, whicheach include a shares of a secret, ^^^ , and the symmetric enc ^^^^ ryption key sk^ . TheKeyGen algorithm outputs the public verification key vk, secret key packages(sk^)^∈[^], and the public information for the IA protocol, inf. It is noted that the secretkey packages are securely transmitted to each respective participant and are not publiclydistributed. The public verification key and public information for the IA protocol are however made available to all participants [N]. The signing algorithms are now described. The signing protocol proceeds inseveral rounds, the first of which, sign1, is described here with reference to Figure 23B.Note that the parsing of the state st^is omitted at the beginning of each round in thesigning protocol for conciseness. Each of the rounds sign1, sign2 and sign3 is performedby each participant ^ in the signing set, where the signing set comprises at least thethreshold number ^ of participants.Step 1 of the first round involves sampling a random value, ^^, and a noise, ^^^, over a ring, ℛ^^. The ring may be of the type described above in connection with thefirst embodiments. Step 2 describes using the random value and the noise to generate acommitment of the random value, wi, the commitment equalling the sum of the noise,^^^, and the product of a public matrix, A, and the random value, ^^. The commitmentis then hashed using a hash function H^^^ to form a hashed commitment, cmt^, in step3. Step 4 describes generating shares of the random value and the noise using the algorithm V3S.Share, which is described in more detail in the section belowAlgorithms for the V3S Scheme. Steps 5 to 8 disclose sharing the hashed commitment,^^^^, and the shares of the random value, ^^^^, with the other participants in a signingset. For sharing, the shares of the random value, ^^^^, are encrypted using thesymmetric encryption keys sk^^,^^^to generate encrypted shares of the random value, ^^^ – note that the encryption keys are symmetric and so sk ^^^ ^^^^,^ = sk^,^ . Each othergroup member receives a copy of the hashed commitment, ^^^^, and a respectiveencrypted share of the random value encrypted with their associated symmetricencryption key. The protocol for the next signing round, sign2, is described here, also with reference to Figure 23B. Step 1 involves checking the signing set: namely, that allsigners are members of the original set of participants, that each participant ^ is in thesigning set and that the number of signers is equal to the threshold number of participants needed to reconstruct the signature. Steps 2 to 6 involve checking that a share of a sampled random value has beenreceived from each participant in the signing set. This is performed by decryptingreceived encrypted shares of the random value received from other signers using thesymmetric encryption key. Step 2 describes parsing the hashed commitments, cmt^,received and the encrypted shares of the random value, ^ ^^ , from the protocol messagesfrom the first signing round from each participant in the signing set. Subsequently, the shares of the random number ^^^^^are decrypted in step 4: if decryption fails in step 5,then the method aborts in step 6. In step 7, the user state st^[sid] is updated with thehashed commitments, cmtj, and shares of the random number ^^^^^ of each participantin the signing set, the commitment ^^, generated by the signer, and the shares of therandom value and noise ^^^^^^and ^^^^^ for each participant ^ in the list of participants[N]. In step 8, in a case that all participants have shared a hashed commitment and arespective share of a sampled random value, the commitment, wi, is shared with eachparticipant in the signing set. The third round of the threshold signature scheme, sign3, is described inconnection with Figure 23C. After the data shared in previous rounds has been parsedin steps 1 and 2, in step 3 it is checked that a given participant, ^, is in the signing setand that the respective received commitment from participant j shared in the secondround corresponds to the hashed commitment, cmtj, shared in the first round. If thecheck passes, in step 4 an overall commitment, ^, is generated based on the receivedcommitments. The overall commitment, w, is generated by summing the receivedcommitments i.e. ^ ∶= where bit dropping has been performed for ^^bits. It is noted that bit dropping in connection with lattice schemes is known (e.g.CRYSTALS-Dilithium). Accordingly, further description of this technique is notprovided.In step 5, a challenge value, c, is generated by hashing the public verificationkey, vk, the message to be signed M and the overall commitment, ^.The next step, step 6, is to determine a share of an overall random value,^^^^, by summing received shares of sampled random values, ^^^^^. This share is then used in step 7 to generate an individual contribution, ^^^^. The individual contribution is a sum of the share of the overall random value, ^^^^and a product of the challenge value,c, from step 5 and a share of the shared secret, ^^^^. In step 8, the user status sti- isupdated. Finally, in step 9 the individual contributions are shared with the participantsin the signing set. The next stage of the protocol is to aggregate the shares to form a signature.This stage, which uses the algorithm Agg, is described herein and with reference to theupper portion of Figure 23D. The first step in Agg is to parse the commitments, wj andthe individual contributions, ^^^^, received form each participant in the signing set.Then, in step 2, the overall commitment, ^, is obtained that is a sum of thereceived commitments, wj. Step 3 describes generating an overall response, z, byrecovering the overall response from the individual contributions by interpolation. Theterms ^^^,^denote the Lagrange coefficients used to recover the overall response, z. In step 4 the challenge value, c, is generated, like in the algorithm Sign3, byhashing the verification key vk, the message to be signed M and the overallcommitment, ^. Step 5 describes generating an intermediate vector, ^, that is adifference between a product of the public matrix, A, and the overall response, z, anda product of the challenge value, c, and the portion of the public verification key, ^.The intermediate vector is subject to bit dropping.Next, in step 6, a hint is generated that is a difference between the overallcommitment, w, and the intermediate vector, ^, of step 5. Finally, in step 7 a signatureis formed from the challenge value, the individual contribution and the hint. The Verify function, also described in Figure 23D, allows the signature to bechecked. The Verify function takes as input the public verification key, vk, the message,M, and the signature, sig, and outputs 1 if the signature is valid and 0 otherwise. Theverification process involves recreating the overall commitment, w, by determining ^∶= ⌊^^ − ^^^ ⋅ ^ ^ . Step 2 then checks that the challenge value is correct instep 3. Step 3 further checks the shortness of the inner product of individual contribution^ and the hint, h, in comparison to a bound ^. As in the first embodiment, the size ofthe bound is determined according to the circumstances in which the method of generating secret shares of a secret is performed. Both checks must pass for the signature to be valid. Algorithms for identifiable abort protocolThe identifiable abort protocols, which run when the signing process describedabove aborts, are now described in detail here and with reference to Figures 24A to 24E. Separate identifiable abort (IA) protocols are defined, one per signing round andone for aggregation to form a signature. If the signing protocol aborts in round n, thenthe n-th protocol is able to detect the malicious user that caused the abort. If n = R + 1, i.e. n is one greater than the total number of rounds, then an abort occurred inaggregation of the signature (i.e. verification of the signature failed). The first roundsof the identifiable abort protocols take as input the verification key vk, the publicinformation for the IA protocol, inf, the set of participants performing the identifiableabort protocol, IAS, a session identifier, sid, the message to be signed, M, and index ^of a signer, a tuple of protocol messages ^pm(^)^ ^ from the n-th round of the signing ^∈^^ protocol, the secret key shares sk^and a user state st^. The first rounds output a protocol message pmia (^) ^,^and an updated state st^. If the first round of the identifiable abort protocol is the only round, it outputs a set of detected malicious signers CS^^^as pmia (^) ^,^. If the identifiable abort protocol for a given round of the signing protocolcomprises more than one round, then the subsequent rounds ^ of the identifiable abortprotocols take as input vk, inf, IAS, sid, M, an index ^ of a signer, a tuple of protocolmessages of the (^ − 1)th round , sk^and a user state st^and outputs a protocol message pmia (^) ^,^ and an updated state st^. Note that undefined terms in thepreceding list have the same meanings as described earlier. If the round ^ is the final round in the IA protocol, then it outputs the set of detected malicious signers as pmia(^^^)^,^. The identifiable abort protocol for the first round of the signing protocolcomprises a single round, described here with reference to Figure 24A. No non-trivialabort occurs in the first round of the signing protocol, Sign1. The IA1,1algorithmtherefore sets the user state for a signing round, sid, to false in step 1, and then in step2 adds to the set of detected malicious signers the participants in the signing set for which the protocol message pm(^) ^ is false. In step 3 the algorithm then returns the protocol identifiable abort message pmia (^) ^,^as the set of detected malicious signers and the updated user state. The identifiable abort protocol for the second stage of the signing protocol comprises two rounds, described here with reference to Figure 24B. The first round of the identifiable abort protocol for the second stage of the signing protocol is described by the algorithm IA2,1. In step 1, the hashed commitment, and encrypted share of therandom value are parsed from the protocol message for each participant in the signing set. Step 2 comprises updating the user state with the protocol messages fromboth the first and second stage of the signing protocol. Steps 3 to 5 involve checkingthat a participant in the identifiable abort set was also in the signing set, setting a givenparticipant’s pmia to null if they were not in the signing set (because participants thatare not in the signing set are not relevant for the signature generation), and then initialising an empty list of complaints for each participant. Steps 6 to 9 comprise decrypting the shares of the secret key and the shares of the random value using thesymmetric encryption scheme SKE.Decrypt. If the share of the random value for agiven participant fails to decrypt then a complaint is added to the list of complaints fora participant that sent an encrypted share of the random value that would not decrypt.The identifiable abort protocol message pmia (^) ^,^is then returned with the list ofcomplaints for each participant and the updated user states in step 10.The second round of the identifiable abort protocol for the second stage of the signing protocol is described by the algorithm IA2,2. Firstly, the protocol messages from the first and second stages of the signing protocol are parsed from the user state in step1. Subsequently, in step 2 the hashed commitments, encrypted shares of the randomvalue ^^^ , list of complaints from the first round protocol message, and the identifiableabort protocol message pmia (^) ^,^ from each participant in the signing set are parsed.Step 3 initialises a set of detected malicious signers. Steps 4 to 8 describe the process of checking the complaints from IA2,1. If the complaints are upheld, i.e. sharesonce again fail to decrypt, then the participant ^ who sent the faulty shares is added tothe evaluating participant’s set of detected malicious signers. If, after evaluation of the complaint messages, a party about whom a complaint was raised is not added to the setof detected malicious signers, any participant for which the complaint message fromthe second round is false is added to the set of detected malicious signers in step 10.Finally, in step 11 the identifiable abort protocol message pmia (^) ^,^is returned with the set of detected malicious signers and the updated user state. The IA protocol for the third stage of the signing protocol comprises one round, described herein with reference to Figure 24C. In step 1, the hashed commitments,encrypted shares of the random value ^ ^^ , and received commitments, ^^, are parsedfrom the protocol messages from the first and second rounds of the signing protocol foreach participant in the signing set. In step 2, the participant ^ adds a participant ^ to theset of detected malicious signers CS^^^if the hash of the shared commitment does not equal the parsed hashed commitment cmt^. If the set of detected malicious signers is still empty after each commitment has been checked, a subsequent check takes place in step 4 which involves adding to the set of detected malicious signers anyparticipant for which a protocol message pm(^) ^ (complaint) is false. This check is similar to one of the checks carried out in both the IA protocol for the first stage of the signing protocol and the IA protocol for the second stage of the signing protocol. In step 5 the identifiable abort protocol message pmia (^) ^,^is returned with the set of detected malicious signers and the updated user state. Figures 24D and 24E shows a logical representation of the IA protocol whenverification of the signature fails, The IA protocol has three rounds. As mentionedabove, this is the most challenging abort case and includes use of the V3S scheme. The first round of the identifiable abort protocol for the aggregation round of the signing protocol is described by the algorithm IA4,1in Figure 24D. The algorithm runs in a case that the aggregated signature does not verify. In step 1, the participants ^in the signing set each parse the share of the random value that was sent to them fromeach other member in the signing set, obtained from the encrypted shares of the random value ^^^ . The participants also parse the shares of the random valueand noise values the participant ^ sent to each other participant thatwere stored in the first round of the signing protocol. These are all parsed from the userstate, sti.In step 3, the user state st^is updated with the protocol message from the firstthree rounds from each participant ^. In step 5, if the participant ^ is not in the signingset then the participant’s identifiable abort protocol message pmia (^) ^,^is returned as empty, along with the updated user state sti. In step 6, the V3S function V3S.Prove provides the overall proof ^^and the individual proofs ^ ^ ^for each participant ^ in the set of participants [N]. Deferring therunning of the computationally-expensive V3S.Prove algorithm to the identifiable abortcase is a feature of the second embodiment, as in the case where no abort occurs duringthe signing protocol there is no requirement to expend computational effort to obtainthe proofs. In steps 7 and 8, the participant ^ loops through each participant ^ in theidentifiable abort set and produces a new encrypted share ^^ ^ , which is formed from anencryption, using the symmetric encryption keys sk ^^^^,^ , of: the shares of a randomvalue ; the noise shares ^^ ^^^^, and the proofs ^^ ^ . The difference between the new shares ^ ^ ^and the previous encrypted share of the random value ^^ ^ is that the new shares additionally contain the proofs ^ ^ ^ and the shares of the noise^^^^^^. The identifiable abort protocol messages pmia (^), which contain the proofs the shares and the updated user state, are shared in step 9. Figure 24D further describes the second stage, IA4,2, of the identifiable abortprotocol for when the abort occurs at the aggregation stage. The first step involves parsing the shares of the random value ^^^^^received in the encrypted shares of the random value ^^^and protocol messages from the three signing rounds ^pm(^)^ ^ , ^^^^^where the ^ are each participants in the signing set, from the user state st^[sid].In step 2, participant ^ further parses the commitments ^^, the proofs ^^ and theshares from the pro (^) tocol messages pm^and the identifiable abort protocol messages pmia (^) ^,^. Once again, the subscript ^ refers to each of the participants in thesigning set SS. A set of complaints is initialised in step 3. Steps 4 to 7 relate to adding a complaint to the newly-initialised list of complaints. The shares of the random value,^^^^^ , noises,^^^^^ ^ and proofs, ^^^are first decrypted in step 5 from the share ^^^. Step 6 is the test of whether a complaint is generated. A complaint can be generated for any of the following reasons: at least one of the shares of the random value, noises or proofs return false; the parsed shares of the random value do not match those previously parsed, or the V3S.Verify algorithm described previously returns false. In any of those cases, a complaint is added to the set of complaints, complaintsi. The next steps in IA4,2 relate to generating values to be used later in theidentifiable abort protocol. In step 8, the overall commitment, w, is generated that is asum of the commitments, ^^, from each participant in the signing set.In step 9, a challenge, c, is generated which is a hash of the public verificationkey, vk, a message to be signed, M, and the overall commitment, w.In step 10, an overall share of a random value ^^^^ is generated by summing theshares of the random values ^^^^^ given to a participant ^ from each other participant inthe signing set shared at the end of the first round IA4,1 and decrypted in step 5.In step 11, an individual response value, ^^^^ , is generated that is the sum of theoverall share of the random value, ^^^^, and the product of the challenge, c, and thesecret share ^^^^.Step 12 and 13 relate to updating the user state with the obtained shares of the random value, the protocol messages from previous signing rounds, and then returning an identifiable abort protocol message that comprises the complaints, the shares of the response and the updated user state. The third stage of the identifiable abort protocol for when the abort occurs at the aggregation stage is described by the algorithm IA4,3in Figure 24E. In step 1, shares ofthe random value ^^^^^ given to a participant i from each other participant in the signingset, protocol messages from the three signing rounds ^pm(^)^ ^ and the identifiable ^^^^^abort protocol message, pmia(^) ^,^, from each participant in the signing set are parsedfrom the user state sti[sid]. The contents of the protocol messages and identifiable abort protocol message are parsed in steps 2 and 3. A set of detected malicious signers is initialised in step 4. Steps 5 to 10 relate to checking the complaints that were generated in theprevious round of the identifiable abort protocol. The participant ^ performing theprotocol cycles through each participant ^ in the signing set, and for each participant ^evaluates each complaint in their set of complaints, complaintsj. For each complaint, instep 7 the shares of a random value ^^^^^, noise, ^^^^ ^ ^^, and proof, ^^ , are decryptedusing the symmetric encryption function SKE.Decrypt from the new shares ^ ^ ^ . In step8, if the participant ^ is in the signing set, then the share of a random value, ^^^^^, isadditionally decrypted from the previous share ^ ^ ^ . Evaluation of these obtained quantities is performed in step 9. In step 9, the symmetric key ^^^^,^^^is checked. If the parameter ^^^^^,^ equals the hashof the identity of the participants, the symmetric key, and the publicly available seed,and any one or more of the following conditions is satisfied, then the complaint isupheld and the participant ^ that is the subject of the complaint is added to participant^’s set of detected malicious signers: -any of ^^^^^ ^^,^^^^ ^ or ^^returns false; -the shares of a random value ^^^^^ and^^^^^do not match, and -V3S.Verify, as described later, returns false.If the set of malicious detected signers is not empty, then the set is returned as theidentifiable abort protocol message pmia (^) ^,^in step 12. Otherwise, in step 13 the response values are error corrected using the algorithm V3S.ErrorCorrect, described later. As a final check, in step 14 it is verified that the response values ^^^^match ^^^^for a participant in the signing set, and that the error-corrected response values^^̂^^ ^ match the non-error-corrected response values ^^^^. If either of these checks fail, thenthe participant ^ is added to participant ^’s set of malicious detected signers.In step 14, the list of detected malicious signers CS^^^and the updated user state sti are returned in the identifiable abort protocol message pmia (^) ^,^. Note that throughoutthe identifiable abort protocol for all stages we assume the share of a random value^^^^^ returns false for a participant ^ who is in the identifiable abort set but not in thesigning set, where ^ is a participant that is in the signing set.Instantiation of the V3S scheme The following section describes the instantiation of the extended V3S schemein more detail. The V3S uses a hash function H^^: {0, 1}∗ → modelled as a random oracle. H^^ generates projection matrices ^ and ^ (describedfurther below) following two distributions ^^and ^^, which are used to prove theshortness of secrets and consistency of aux(x) with the secret shares. Here, aux(x)refers to auxiliary information about the secret ^, and is equal to the overallcommitment ^. The instantiation of the extended V3S is detailed below, in the section“V3S scheme algorithm description”. Note that ^ is considered secret in ^^^^^. The instantiation process further preserves the linearity of Shamir’s secretsharing. As such, for any two valid sharings ^^^ and ^^^ and any ^ ∈ ^^, the valuereconstructed from ^. ^^^ + ^^^ is equal to ^ = ^. ^ + ^ where ^ and ^ arereconstructed from ^^ ^ and ^^ ^. Therefore, the algorithms V3S.Reconstruct andV3S.ErrorCorrect sometimes take as input shares computed by linear operations on the secret, and which are not directly generated by V3S.Share and V3S.Prove. Aproof of consistency of ^ = aux(x) ∶= [^ |^]. ^ mod ^ with the shares isimplemented by adding random projections ^ . ^^^ to the V3S proof, where ^ ∈randomly sampled via H and^×^ ^^ ^ ∈ ^^, the polynomial ring. Sharing the entirety of the polynomials allows participants to verify the computation, and if thedimension of the polynomials ^′ is large enough then it is ensured that the adversary will be detected with overwhelming probability if they provide an incorrectcommitment ^. It is possible to check the consistency of ^ by including ^^^ in theoverall proof ^ instead of ^^^^, or to instead use ^ when ^′ is smaller than ^^, where^^ is one of the dimensions of the projection matrix ^.Algorithms for V3S scheme The algorithms used in the V3S scheme are described in more detail here, with reference to Figures 22A to 22E and Figures 25A to 25D. Figures 22A to 22E are flowcharts that provide an overview of the steps carried out in the algorithms V3S.Share, V3S.Prove, V3S.Verify, V3S.Reconstruct and V3S.ErrorCorrect respectively. Figures 25A to 25D are blocks of pseudocode that describe the algorithms in detail. The algorithm V3S.Share(N, T, x) is described with reference to Figure 22A andFigure 25A. V3S.Share takes place during the first round of the signing protocol and isperformed by each participant ^ in the signing set. In block 221 of Figure 22A and step1 of Figure 25A, the algorithm V3S.Share(N, T, x) takes a secret ^ as input andgenerates a polynomial P of degree ^ − 1 with the y-intercept of the polynomial equalto the secret, i.e. ^(0) = ^. It will be understood that this is only one implementation:in other implementations, the secret can be set to be the value of the polynomial at anychosen point. The y-intercept is chosen here as a matter of convenience. In block 222of Figure 22A and step 2 of Figure 2, shares of a secret are defined as points along thepolynomial. The secret shares may correspond to evaluations of the sampledpolynomial P at a position that corresponds to an identifier or other value associated with each participant, as in the V3S scheme of the first embodiment. In block 223 of Figure 22A and step 3 of Figure 25A, the shares of the secret are shared amongst the users. Figure 22B and Figure 25B describe the algorithm V3S.Prove(^^^). In contrast to the first embodiment, V3S.Prove in the second embodiment takes place only whenan abort during the aggregation stage occurs. The computationally-expensive proofgeneration therefore only occurs in the case that an abort takes place, which is one of the benefits of the second embodiment. V3S.Prove, when called, is performed by eachparticipant ^ in the signing set. In step 1 of Figure 25B a random seed is generated thatis later used to generate leaves of the Merkle tree. In block 224 of Figure 22B and steps 2 to 4 of Figure 25B, the polynomial of the algorithm V3S.Share is reconstructed fromthe received shares of the secret ^^^. The reconstruction of the polynomial can occurvia any suitable technique known in the art, such as Lagrange interpolation. Step 5 ofFigure 25B uses the Chinese Remainder Theorem to change the modulus of the secretshares for use in the shortness proof. In connection with the use of the Chinese Remainder Theorem to change themodulus, the V3S works over two different moduli ^ > ^ such that ^ . ^^^^^ = ^^^^.A larger ^^^^is required by the shortness proof to prevent an adversary from using overflowing mod ^^^^to produce invalid proofs. However, many of the othercomputations can be performed mod ^, where ^ is the modulo used in the rest of thesignature scheme. For this requirement, it is needed to extend secret shares over to secret shares over ^^^^^within V3S.Prove. Formally, the Chinese Remainder Theoremis used to build a PPT algorithm CRT(^^^^^, ^^^^^) → ^^^^^.^^ that lifts the modulusfor two coprime integers ^^, ^^. Here, the term PPT algorithm refers to a probabilisticalgorithm that runs in polynomial time. The Chinese Remainder Theorem is widely used in the art and is not described here as details are not necessary to understand theinvention. Since the V3S functions modulo the composite number ^^^^, it is requiredthat the number of participants ^ is smaller than the smallest factor of ^^^^.Returning to the explanation of V3S.Prove, steps 6 to 8 of V3S.Prove and block225 of Figure 22B describe generating a noise, y, from a Gaussian distribution used forblinding. Step 8 generates shares of that noise ^^^^^^^ from a polynomial. Step 9 ofV3S.Prove and block 226 of Figure 22B disclose the generation of a Merkle tree witha root ℎ, wherein the shares of the secret, ^^^^^^^ ^, and the noise, ^^^^^^^ ^, are leaves,leafi, in the Merkle tree for each participant.Steps 11 and 12 of V3S.Prove denote generating a proof for each leaf in the Merkle tree that said leaf is located in the Merkle tree. Methods of generating a proof for a leaf in a Merkle tree are well known in the art and are not described further here.The secret share, the share of the noise, the seed, and the proof are then stored in anindividual proof ^^for each participant ^.Subsequently, the auxiliary information in the form of a commitment ^ isgenerated as a product of the public matrix, A, and the secure value, x, in step 13. Instep 14, a share of the commitment ^^^ is produced as a product of the public matrix,A, and the secret share ^^^ in step 14.Steps 15 to 18 of Figure 25B and block 227 of Figure 22B describe generatinga sharing ^^^^^^^^and a projection of the commitment ^^^^. In step 15, a pair ofprojection matrices ^ and ^ are selected from a distribution based on a hash of the rootof the Merkle tree, h, and the commitment, w. In step 16, the sharing^^^^^^^^is generated as the sum of the share of the noise, ^^^^^^^, and a product of projection matrix, ^, and the share of the secret,^^^^^^^. The projection of the commitment ^^^^is determined as a product of the projection matrix, ^, and the share of the commitment^^^. In step 18, Challenge polynomials, ^, are formed from the root of the Merkletree, h, the sharing ^^^^^^^^, and the projection of the commitment ^^^^. In step 19,^ and the ^^ belonging to the participants are returned.Next, the algorithm V3S.Verify(^^^^, ^, ^, ^^) is described with reference toFigures 22C and 25C. The algorithm V3S.Verify occurs during the second stage of theidentifiable abort protocol for aborts that occur during aggregation and is performed byeach participant in the signing set. Firstly, the contents of the challenge polynomials ^and individual proofs ^^ are parsed in block 228 of Figure 22C and steps 1 and 2 ofFigure 25C. Then, after the modulus of the secret share, ^^^^^^, has been changed in step3 using the Chinese Remainder Theorem, reconstruction of the share, ^^, and theprojection of the commitment, ^^, is performed from the shares of the share, ^^^^^^^^,and shares of the projection of the commitment, ^^^^^^^^. The reconstructed share,^^, and the projection of the commitment, ^^, are checked in steps 4 to 7 and block 229of Figure 22C. It is checked that the vectors reconstruct correctly. The algorithm isaborted if reconstruction fails. In block 2210 of Figure 22C and steps 8 and 9 of Figure25C, the proofs that the secret shares, ^^^^^^^, and the noises, ^^^^^^^, are in theMerkle tree are checked, and V3S.Verify is aborted if the check fails. Finally, steps 10 to 14 of V3S.Verify and block 2211 of Figure 22C check the secret to be shared is sufficiently short and that the commitment value is valid.Figures 22D and 25D both describe V3S.Reconstruct((^^^^)^∈^. Block 2212 ofFigure 22D and step 1 of V3S.Reconstruct check that the number of participants in thesigning set exceeds the threshold number ^ so that Lagrange interpolation can be usedto reconstruct the polynomial encoding the secret. In block 2213 of Figure 22D and step2 of V3S.Reconstruct, the polynomial is reconstructed if the check of step 1 passes andthe secret, ^^, is returned that is the value of the polynomial at zero. Figure 25D further describes V3S.ErrorCorrect((^^^^)^∈^), in conjunction with Figure 22E. V3S.ErrorCorrect takes place in the third stage of the identifiable abortprotocol for aborts that occurs during aggregation of the signature and is performed byeach participant in the signing set. Block 2214 of Figure 22E and step 1 of V3S.ErrorCorrect check that the number of participants in the signing set exceeds thethreshold number ^, in a similar manner to V3S.Reconstruct. Steps 2 ofV3S.ErrorCorrect and block 2215 of Figure 22E involve interpreting the secret shares as a Reed-Solomon codeword of block length equal to the number of signers in the signing set and message length ^, the threshold number of signers required to produce a signature. Finally, step 3 of V3S.ErrorCorrect and block 2216 of Figure 22E denote generating corrected shares using Reed-Solomon error correction techniques, which are standard techniques well known in the art. Further description of termsThe below tables may be used as an aid for understanding for some of the termsused above. The explanations given in the tables have the purpose of aiding the reader’sunderstanding; the explanations given in the table are not definitions and should not beinterpreted as such. Not all of the terms in the below tables may have been used above, and not all of the terms used above may be in the below tables. Conclusion The methods above use hash functions. The Hash function may, in someexamples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. Auseful characteristic of the above-described methods is that they provide anidentifiable abort. Threshold signature schemes, distributed key generation schemes,and other cryptographic methods can be vulnerable to denial-of-service attacks in whicha malicious or corrupted participant repeatedly causes the method to fail by notcorrectly following the method. Accordingly, the methods described above perform acheck to see that each participant has correctly generated and distributed its secretshares of the random value. If this is not the case, the method may abort or continuewith a reduced number of valid participants. However, the participant that caused themethod to fail can be identified allowing remedial steps to be taken, such as excludingthe participant from further instances of the method. Afurther characteristic of the above-described methods of the first embodimentis that they are robust. If enough users are present in a signing group, as describedabove, the distributed key generation and threshold signature methods may use ReedSoloman error correction to compensate for the presence of dishonest users whenreconstructing values from Shamir secret shares. The above embodiments are to be understood as illustrative examples of theinvention. Further embodiments of the invention are envisaged. The methods of thefirst embodiments above may be performed using vector secrets rather than a scalarsecret, s. This can be done by secret-sharing each coefficient of the vector separately using a distinct polynomial. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims. Further embodiments According to a first further embodiment, there is provided a method for generating a share of a secret value for each of a group of participants, wherein each participant in the group generates a different secret share of a common secret, the method being performed by one or more information processing apparatus and comprising for each participant: generating a random number; generating a polynomial based on the random number; generating secret shares of the random number for a current participant and for each other participant in the group using a Shamir secret sharing scheme whereby a threshold number of secret shares allow recovery of the polynomial and the random number; privately sending a respective secret share of the random number to each participant; following receipt of a secret share of the random number from each participant in the group: summing the secret shares of the random number received from each participant and the secret share of a random number generated for the current participant to generate a secret share of an aggregated random number. The method may further comprise committing each participant to their generated random number. The method may further comprise committing each participant to their generated polynomial. In such methods, committing each participant to the generated random number and generated polynomial comprises generating a proof associated with each secret share of the random number and a signature associated with each the secret share of the random number. Generating a proof may comprise each participant generating a Merkel tree including hashes of the secret shares of the random number generated and hashes of mask values associated with the secret shares of the random number. The proofs may be proofs that the secret shares of the random number are present in the Merkel tree. In some embodiments, the method further comprises receiving the generated proof associated with each secret share of the random number received from each other participant in the group. The method may comprise checking the proof. The method may comprise generating a complaint message in a case that the check of the proof of a received secret share of the random number cannot be verified, wherein the complaint message includes the identity and a signature of the participant from whom the secret share of the random number and proof was received and information to enable other participants to verify that the proof cannot be verified. The method may further comprise generating a proof of the shortness of the random number. The proof of the shortness of the random number may comprise a sum of the mask value with a product of a challenge matrix and the random number. The challenge matrix may be generated by sampling a matrix from a distribution using a root value of the Merkel tree. The method may comprise each recipient receiving the generated proof of the shortness of the random value associated with each secret share of the random number received from each other participant in the group. The method may comprise checking the proof. Checking the proof may comprise checking a size of the proof against a predefined bound value. Privately sending a respective secret share of the random number to each participant may comprise encrypting the secret share of the random number under a respective symmetric encryption key associated with the participant to whom the secret share of the random number is sent. According to a second further embodiment there is provided a method ofdistributed key generation. The method comprises: performing a method according to the first further embodiment; each participant generating and broadcasting a salt value; each participant generating a public salt by combining the received salts; each participant generating a public matrix based on the public salt; each participant generating a share of a public key using the public matrix and the participant’s secret share of the random number; each participant broadcasting the public salt and their share of the public key; each participant recovering the public key based on a threshold number of received shares of public keys, whereby each participant has a share of a secret key that is the secret share of the random number and the public key. According to a third further embodiment there is provided a threshold signaturemethod performed by one or more information processing apparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: performing a method according to the first further embodiment; and each participant: generating a secret share of a response value using a secret share of a secret and the secret share of the aggregated random number; wherein secret shares of the response values from a threshold number of signers can be used to generate a response value that is used to generate a signature. Methods according to the third further embodiment may further compriseperforming the distributed key generation method of the second further embodiment sothat each participant has a secret share of the secret. Methods of the third further embodiment may further comprise generating byeach signer one or more share of a commitment that is a share of a product of a public matrix and the aggregated random number. The participants may broadcast their share of the commitment. The participants may receive shares of commitments from other participants. The participants may generate a commitment that is the product of the public matrix and the aggregated random number. In some embodiments of the threshold signature scheme each participant generates an individual commitment. Following receipt of a secret share of the random number, the participant checks the received secret share of the random number against the individual commitment. In such embodiments, individual commitment generated by each signer may comprise a vector of commitments that is a product of the public matrix, A, and polynomial coefficients of the polynomial generated by the signer. The method may further comprise generating a challenge value based on the commitment, a message to be signed, and the public key, wherein the public key is a product of the public matrix, A, and the secret, s. Generating the secret share of a response value may comprise determining a sum of i) the secret share of an aggregated random number and ii) a product of the challenge value and the secret share of the secret. The secret shares of response values from the threshold number of signers may be interpolated to generate the response value that is used to generate the signature. The signature may be formed of the challenge value and the response value. According to a fourth further embodiment there is provided a method involvinga plurality of participants, performed by one or more information processing apparatus, comprising: for each participant: generating secret shares of a random number for a current participant and for each other participant in the group using a secret sharing scheme whereby a threshold number of secret shares allow recovery of the random number; generating a cryptographic accumulator using the generated secret shares; generating at least one proof using the cryptographic accumulator; privately sending a respective secret share of the random number, the cryptographic accumulator, and the proof to each other participant; following receipt of a secret share of the random number, the cryptographic accumulator, and the proof from each participant in the group: checking that the received secret share is included in the received cryptographic accumulator; checking the at least one proof; and performing at least one of: summing the secret shares of the random number received from each participant and the secret share of a random number generated for the current participant to generate a secret share of an aggregated random number; and identifying a participant that incorrectly generated a secret share based on whether the secret share is included in the cryptographic accumulator and the check of the proof is successful. According to a fifth further embodiment there is provided a threshold signaturemethod performed by one or more information processing apparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: each participant: in a first round: sampling a random value and a noise and generating a commitment of the random value; generating a secret share for each participant in a signing set of the sampled random value and generating a secret share for each participant in the signing set of the noise and securely sharing a respective share of the sampled random value and a respective secure share of the noise with each participant; and sharing a hashed commitment with the other participants in the signing set; in a second round: checking that a hashed commitment has been received from each participant in the signing set and a respective share of a sampled random value and noise has been received from each participant in the signing set; and in a case that all participants have shared a hashed commitment and a respective share of a sampled random value and noise, sharing the commitment with each participant in the signing set; in a third round: checking that the received commitments correspond to the hashed commitments; generating an overall commitment based on the received commitments; generating a challenge using a public key, a message, and the overall commitment; determining a share of an overall random value by summing received shares of sampled random values; generating a share of an overall response; and sharing the share of the overall response with participants in the signing set; at least one participant: performing an aggregation round to form a signature comprising a challenge based on the overall commitment, an overall response generated based on the received shares of the overall response, and a hint; performing a method to verify the signature; and in a case that the signature cannot be verified, performing an abort method to identify a participant that did not correctly perform themethod, wherein the abort method comprises the method of the fourth furtherembodiment. Aborting the threshold signature method may be performed in a case that aparticipant in the signing set does not receive a share of a random value and noise from another participant. In some implementations, aborting the threshold signature method is performedin a case that the received commitment does not match the hashed commitment. The cryptographic accumulator may be a Merkle tree including hashes of thesecret shares of the random number generated and hashes of mask values associatedwith the secret shares of the random number. The method may further compriseprivately sending to each other participant a proof that their respective secret share of the random number is present in the Merkle tree.Each participant may generate a mask value for each secure share of the randomnumber. The mask values may be secret shares of a sampled random number.The at least one proof for each participant may include selecting a challengematrix based on the root of the Merkle tree. The proof may be a sum of a mask valueand the product of the challenge matrix and the secret share of the random number. The at least one proof for each participant may include selecting a projectionmatrix based on the root of the Merkle tree. The proof may be a product of the projectionmatrix and auxiliary information. The auxiliary information may be a product of thepublic matrix and the share of the random value. In some implementations, checking the at least one proof comprises checkingthat the proof is below a threshold size. Acomplaint may be raised in a case that the check of the at least one proofcannot be verified. In some implementations, the abort method comprises: expanding the numberof participants to 3T participants to form an abort identification set. The T participantsin the signing set may send their individual shares of the random value and proofs tothe 3T-1 other participants in the abort identification set. Participants in the abortidentification set may check the proofs from each of the T participants in the signingset and complaining in case of failure. Each of the T participants in the signing set mayverify that the received shares are the same as shares received during signing, andcomplain in case of failure. each participant in the abort identification set may reviewthe complaints to identify a misbehaving party. In some implementations, each participant in the abort identification setbroadcasts their share of the overall response. At least one of the participants may applyReed-Solomon error correction to the shares of the overall response to identify a party in the signing set that did not correctly generate their share of the overall response. The commitment may be a sum of the error and the product of a public matrixand the random value. The share of the overall response may be a sum of the overall random value anda product of the challenge and a shared secret. In some embodiments, forming the signature comprises: obtaining the overall commitment that is a sum of the received commitments; generating the overall response by recovering the overall response from the shares of the overall response; generating a challenge that is a hash of a public key, a message, and the overall commitment; generating intermediate information that is a difference between a product of the public matrix and the overall response and a product of the challenge and a portion of thepublic key; and generating a hint that is a difference between the overall commitmentand the intermediate information. Verifying the signature may comprise: generating a signature derivative that isa product of the public matrix and the aggregated response from the signature minus aproduct of the challenge from the signature and a portion of the public key; generatinga new challenge by taking a hash of: the public key, the message, and the signaturederivative plus the hint from the signature; and comparing the new challenge to thechallenge in the signature to determine if the signature is valid. According to a sixth further embodiment there may be provided a thresholdsignature method performed by one or more information processing apparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: each participant: in a first round: sampling a random value and a noise and generating a commitment that is a sum of the error and the product of a public matrix and the random value; generating a secret share for each participant in the signing set of the sampled random value and generating a secret share for each participant in the signing set of the noise and securely sharing a respective share of the sampled random value and the secure share of the noise with each participant; and sharing a hashed commitment with the other participants in a signing set; in a second round: checking that a hashed commitment has been received from each participant in the signing set and a respective share of a sampled random value and noise has been received from each participant in the signing set; and in a case that all participants have shared a hashed commitment and a respective share of a sampled random value and noise, sharing the commitment with each participant in the signing set; in a third round: checking that the received commitments correspond to the hashed commitments; generating an overall commitment based on the received commitments; generating a challenge using a public key, a message and the overall commitment; determining a share of an overall random value by summing received shares of sampled random values; generating a share of an overall response that is a sum of the overall random value and a product of the challenge and a shared secret; and sharing the share of an overall response with participants in the signing set; at least one participant: performing an aggregation round of: obtaining an overall commitment that is a sum of the received commitments; generating the overall response by recovering the overall response from the shares of the overall response; generating a challenge using a public key, a message, and the overall commitment; generating intermediate information that is a difference between a product of the public matrix and the overall response and a product of the challenge and a public key; generating a hint that is a difference between the overall commitment and the intermediate information; and forming a signature from the challenge, the overall response and the hint. Implementations of the sixth further embodiment may comprise optionalfeatures described in connection with the fourth and fifth further embodiments. According to a seventh further embodiment there may be provided informationprocessing apparatus configured to perform a method according to the fourth, fifth or sixth further embodiments. According to an eighth further embodiment there may be provided a programthat, when executed by an information processing apparatus, causes the information processing apparatus to perform a method according to the fourth, fifth or sixth further embodiment.

[0002] The following clauses form part of the specification. The claims follow these clauses and are labelled as such. 1. A method for generating a share of a secret value for each of a group ofparticipants, wherein each participant in the group generates a different secret share of a common secret, the method being performed by one or more information processing apparatus and comprising for each participant: generating a random number; generating a polynomial based on the random number; generating secret shares of the random number for a current participant and for each other participant in the group using a Shamir secret sharing scheme whereby a threshold number of secret shares allow recovery of the polynomial and the random number; privately sending a respective secret share of the random number to each participant; following receipt of a secret share of the random number from each participant in the group: summing the secret shares of the random number received from each participant and the secret share of a random number generated for the current participant to generate a secret share of an aggregated random number.2. A method according to clause 1, further comprising committing each participantto the generated random number and the generated polynomial. 3. A method according to clause 2, wherein committing each participant to the generated random number and generated polynomial comprises generating a proof associated with each secret share of the random number and a signature associated with each the secret share of the random number.4. A method according to clause 3, wherein generating a proof comprises eachparticipant generating a Merkel tree including hashes of the secret shares of the random number generated and hashes of mask values associated with the secret shares of therandom number, wherein the proofs are proofs that the secret shares of the randomnumber are present in the Merkel tree.5. A method according to clause 3 or clause 4, further comprising receiving thegenerated proof associated with each secret share of the random number received from each other participant in the group, and checking the proof.6. A method according to clause 5, further comprising generating a complaintmessage in a case that the check of the proof of a received secret share of the random number cannot be verified, wherein the complaint message includes the identity and a signature of the participant from whom the secret share of the random number and proof was received and information to enable other participants to verify that the proof cannot be verified.7. A method according to any preceding clause, wherein privately sending arespective secret share of the random number to each participant comprises encryptingthe secret share of the random number under a respective symmetric encryption key associated with the participant to whom the secret share of the random number is sent.8. A method of distributed key generation, comprising:performing a method according to any of clauses 1 to 7; each participant generating and broadcasting a salt value; each participant generating a public salt by combining the received salts; each participant generating a public matrix based on the public salt; each participant generating a share of a public key using the public matrix and the participant’s secret share of the random number; each participant broadcasting the public salt and their share of the public key; each participant recovering the public key based on a threshold number of received shares of public keys, whereby each participant has a share of a secret key that is the secret share of the random number and the public key.9. A threshold signature method performed by one or more information processingapparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: performing a method according to any of clauses 1 to 7; and each participant: generating a secret share of a response value using a secret share of a secret and the secret share of the aggregated random number; wherein secret shares of the response values from a threshold number of signers can be used to generate a response value that is used to generate a signature.10. A method according to clause 9, further comprising performing the distributedkey generation method of clause 8 so that each participant has a secret share of the secret.11. A method according to clause 9, further comprising generating by each signerone or more share of a commitment that is a share of a product of a public matrix the aggregated random number, broadcasting the share of the commitment, receiving shares of commitments from other participants, and generating a commitment that is the product of the public matrix and the aggregated random number.12. A method according to clause 9 when dependent upon clause 2, wherein eachparticipant generates an individual commitment, and, following receipt of a secret shareof the random number, the participant checks the received secret share of the randomnumber against the individual commitment.13. A method according to clause 12, wherein the individual commitment generatedby each signer comprises a vector of commitments that is a product of the public matrix, A, and polynomial coefficients of the polynomial generated by the signer.14. A method according to any of clauses 11 to 13, further comprising generating achallenge value based on the commitment, a message to be signed, and the public key, wherein the public key is a product of the public matrix, A, and the secret, s.15. A method according to clause 14, wherein generating the secret share of aresponse value comprises determining a sum of i) the secret share of an aggregatedrandom number and ii) a product of the challenge value and the secret share of thesecret.16. A method according to any of clauses 9 to 15 wherein the secret shares ofresponse values from the threshold number of signers are interpolated to generate the response value that is used to generate the signature.17. A method according to clause 16, wherein the signature is formed of thechallenge value and the response value.18. An information processing apparatus configured to perform a method accordingto any of clauses 1 to 17.19. A program that, when executed by an information processing apparatus, causesthe information processing apparatus to perform a method according to any of clauses 1 to 17.

Claims

CLAIMS1. A method involving a plurality of participants, performed by one or moreinformation processing apparatus, comprising:for each participant: generating secret shares of a random number for a current participant and for each other participant in the group using a secret sharing scheme whereby a threshold number of secret shares allow recovery of the random number; generating a cryptographic accumulator using the generated secret shares; generating at least one proof using the cryptographic accumulator; privately sending a respective secret share of the random number, the cryptographic accumulator, and the proof to each other participant; following receipt of a secret share of the random number, the cryptographic accumulator, and the proof from each participant in the group: checking that the received secret share is included in the received cryptographic accumulator; checking the at least one proof; andperforming at least one of: summing the secret shares of the random number received from each participant and the secret share of a random number generated for the current participant to generate a secret share of an aggregated random number; andidentifying a participant that incorrectly generated a secret share based on whether the secret share is included in the cryptographic accumulator and the check of the proof is successful.

2. A threshold signature method performed by one or more information processingapparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: each participant: in a first round: sampling a random value and a noise and generating a commitment of the random value; generating a secret share for each participant in a signing set ofthe sampled random value and generating a secret share for each participant in the signing set of the noise and securely sharing a respective share of the sampled random value and a respective secureshare of the noise with each participant; and sharing a hashed commitment with the other participants in the signing set; in a second round: checking that a hashed commitment has been received from each participant in the signing set and a respective share of a sampled random value and noise has been received from each participant in the signingset; andin a case that all participants have shared a hashed commitment and a respective share of a sampled random value and noise, sharing thecommitment with each participant in the signing set; in a third round: checking that the received commitments correspond to the hashed commitments; generating an overall commitment based on the received commitments; generating a challenge using a public key, a message, and theoverall commitment;determining a share of an overall random value by summing received shares of sampled random values; generating a share of an overall response; andsharing the share of the overall response with participants in thesigning set; at least one participant: performing an aggregation round to form a signature comprisinga challenge based on the overall commitment, an overall responsegenerated based on the received shares of the overall response, and a hint; performing a method to verify the signature; and in a case that the signature cannot be verified, performing an abort method to identify a participant that did not correctly perform the method, wherein the abort method comprises the method of claim 1.

3. A method according to claim 2, comprising aborting the threshold signaturemethod in a case that a participant in the signing set does not receive a share of arandom value and noise from another participant.

4. A method according to claim 2 or claim 3, comprising aborting the thresholdsignature method in a case that the received commitment does not match thehashed commitment.

5. A method according to any preceding claim, wherein the cryptographicaccumulator is a Merkle tree including hashes of the secret shares of the random number generated and hashes of mask values associated with the secret shares of the random number, wherein the method further comprises privately sendingto each other participant a proof that their respective secret share of the randomnumber is present in the Merkle tree.

6. A method according to claim 5, wherein each participant generates a mask valuefor each secure share of the random number, wherein the mask values are secret shares of a sampled random number.

7. A method according to claim 5 or claim 6, wherein the at least one proof foreach participant includes selecting a challenge matrix based on the root of the Merkle tree and the proof is a sum of a mask value and the product of the challenge matrix and the secret share of the random number.

8. A method according to any of claims 5 to 7, wherein the at least one proof foreach participant includes selecting a projection matrix based on the root of the Merkle tree and the proof is a product of the projection matrix and auxiliary information, wherein the auxiliary information is a product of the public matrixand the share of the random value.

9. A method according to claim 7, wherein checking the at least one proofcomprises checking that the proof is below a threshold size.

10. A method according to any preceding claim, further raising a complaint in acase that the check of the at least one proof cannot be verified.

11. A method according to any of claims 2 to 10 when dependent upon claim 2,wherein the abort method comprises: expanding the number of participants to 3T participants to form an abortidentification set; the T participants in the signing set sending their individual shares of the randomvalue and proofs to the 3T-1 other participants in the abort identification set;participants in the abort identification set checking the proofs from each of the T participants in the signing set, and complaining in case of failure; each of the T participants in the signing set verifying that the received sharesare the same as shares received during signing, and complaining in case of failure;each participant in the abort identification set reviewing the complaints toidentify a misbehaving party.

12. A method according to claim 11, further comprising:each participant in the abort identification set broadcasting their share of theoverall response; and at least one of the participants applying Reed-Solomon error correction to the shares of the overall response to identify a party in the signing set that did notcorrectly generate their share of the overall response.

13. A method according to any preceding claim wherein the commitment is a sumof the error and the product of a public matrix and the random value.

14. A method according to any preceding claim wherein the share of the overallresponse is a sum of the overall random value and a product of the challenge and a shared secret.

15. A method according to any preceding claim wherein forming the signaturecomprises: obtaining the overall commitment that is a sum of the received commitments; generating the overall response by recovering the overall response from the shares of the overall response; generating a challenge that is a hash of a public key, a message, and the overall commitment; generating intermediate information that is a difference between a product of the public matrix and the overall response and a product of the challenge and a portion of the public key; and generating a hint that is a difference between the overall commitment and the intermediate information.

16. A method according to any preceding claim, wherein verifying the signaturecomprises: generating a signature derivative that is a product of the public matrix and the aggregated response from the signature minus a product of the challenge from the signature and a portion of the public key; generating a new challenge by taking a hash of: the public key, the message, and the signature derivative plus the hint from the signature; and comparing the new challenge to the challenge in the signature to determine if the signature is valid.

17. An information processing apparatus configured to perform a method accordingto any of claims 1 to 12.

18. A program that, when executed by an information processing apparatus, causesthe information processing apparatus to perform a method according to any of claims 1 to 12.

19. A threshold signature method performed by one or more information processingapparatus for generating a signature using a threshold number, T, out of a number, N, of secret shares generated from a secret, s, wherein the number of secret shares, N, is greater than or equal to the threshold number, T, the method comprising: each participant: in a first round: sampling a random value and a noise and generating a commitment that is a sum of the error and the product of a public matrix and the random value; generating a secret share for each participant in the signing set of the sampled random value and generating a secret share for each participant in the signing set of the noise and securely sharing a respective share of the sampled random value and the secure share of the noise with each participant; andsharing a hashed commitment with the other participants in a signing set; in a second round: checking that a hashed commitment has been received from each participant in the signing set and a respective share of a sampled randomvalue and noise has been received from each participant in the signingset; andin a case that all participants have shared a hashed commitmentand a respective share of a sampled random value and noise, sharing thecommitment with each participant in the signing set; in a third round: checking that the received commitments correspond to the hashed commitments; generating an overall commitment based on the received commitments; generating a challenge using a public key, a message and the overall commitment; determining a share of an overall random value by summing received shares of sampled random values; generating a share of an overall response that is a sum of theoverall random value and a product of the challenge and a shared secret; and sharing the share of an overall response with participants in thesigning set; at least one participant: performing an aggregation round of: obtaining an overall commitment that is a sum of the received commitments; generating the overall response by recovering the overallresponse from the shares of the overall response;generating a challenge using a public key, a message, and theoverall commitment;generating intermediate information that is a difference betweena product of the public matrix and the overall response and a product ofthe challenge and a public key; generating a hint that is a difference between the overall commitment and the intermediate information; and forming a signature from the challenge, the overall response andthe hint.

Images