Method for batch verification of ciphertext, and computing device

Abstract

A method for batch verification of ciphertext in a threshold signature, and a device. The threshold signature comprises n participants. The method comprises: each of at least t+1 participants executing: generating l pieces of homomorphic ciphertext, wherein the l pieces of homomorphic ciphertext correspond to l pieces of first plaintext; generating a proof corresponding to the l pieces of homomorphic ciphertext, wherein the proof comprises a first numerical value, the first numerical value is obtained by performing linear computation on the basis of the l pieces of first plaintext and l challenge values, the l challenge values are received from a second participant among the at least t+1 participants, the range of each challenge value is within a first preset range, and the proof is used for verifying whether each piece of first plaintext is within a second preset range; and sending the l pieces of homomorphic ciphertext and the proof to the second participant.

Description

Method and computing device for batch verifying ciphertexts

[0001] This application claims priority to the Chinese Patent Application No. 202410868110.3, filed on June 30, 2024, entitled “Method and computing device for batch verifying ciphertexts”, the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] Embodiments of the present specification belong to the technical field of cryptography, and particularly relate to a method and a computing device for batch verifying ciphertexts. BACKGROUND

[0003] In cryptography, public-key cryptography, also known as asymmetric cryptography, is a type of cryptography that uses a pair of keys, a public key and a private key (denoted as pk-sk, where pk represents public key and sk represents secret key). It is in contrast to symmetric cryptography, which uses only one key. Public-key cryptography includes encryption algorithms and digital signature algorithms. Public-key-private-key cryptography pairs are the cornerstone of modern cryptography security, and many applications are based on pk-sk, such as https (Hypertext Transfer Protocol Secure) application layer encryption transmission protocol and blockchain, etc.

[0004] The private key usually represents the identity of the party that owns the private key, and can only be held by the owner of the private key and cannot be publicly disclosed, while the corresponding public key can be publicly disclosed. A signature using a private key can represent the approval of the private key owner for certain information in the digital world, and the signed information in the protocol message can also represent the behavior of the private key owner. Generally, an owner has a private key, and the owner can use the private key to sign certain information and send it to other parties. After receiving the signature, the receiving party can verify the signature using the corresponding public key. If the verification is successful, the receiving party can confirm that the owner has signed the information and that the signed information has not been tampered with.

[0005] Sometimes, an account needs flexible access control policy, especially when the account is controlled by multiple parties. In some cases, the account needs to be controlled by n participants. In this case, the behavior of the account, such as transferring money, needs to be approved by all n participants. In other cases, the account does not need to be controlled by all n participants, but can be controlled by t+1 participants (t<n, t is also called threshold). This can be achieved by threshold signature. In threshold cryptography, private key information is shared among multiple independent participants. Each private key calculation needs the consent of multiple participants, thereby improving the security of the algorithm. Moreover, when a small number of participants fail or are unavailable, the availability of the private key is not affected. A secure (t, n) threshold cryptographic algorithm should meet the following requirements: (1) any more than t participants can calculate the final signature, exchanged key or plaintext, while t or less than t participants cannot obtain any information about the above results; (2) no information about the private key and the private key share of the participants is leaked during the algorithm execution.

[0006] The pre-processing process is included in the threshold signature process. In the pre-processing process, l pre-signature results can be generated in batches. In order to verify the l homomorphic ciphertexts corresponding to the l pre-signature results, each participant needs to generate l sets of proofs and send them to the participants for verification. The participants who receive the proofs need to verify the plaintext range corresponding to the l homomorphic ciphertexts based on the l sets of proofs respectively. In this process, each participant needs to provide more computing resources and communication resources.

[0007] SUMMARY

[0008] The purpose of the present application is to provide a method for batch verifying ciphertexts to improve the efficiency of verifying ciphertexts.

[0009] The first aspect of the present specification provides a method for batch verifying ciphertexts in threshold signature, wherein the threshold signature includes n participants, and the method comprises:

[0010] Each of at least t+1 participants performs:

[0011] Generating l homomorphic ciphertexts, the l homomorphic ciphertexts corresponding to l first plaintexts;

[0012] Generating proofs corresponding to the l homomorphic ciphertexts, the proofs including first values, the first values being obtained by linear calculation based on the l first plaintexts and l challenge values, the l challenge values being received from a second participant in the at least t+1 participants, the range of each challenge value being within a first preset range, the proofs being used for verifying whether each first plaintext is within a second preset range.

[0013] send the l homomorphic ciphertexts and the proof to the second participant.

[0014] A method for batch verifying ciphertexts is provided in the second aspect of the present specification, which is performed by a first participant, and the method comprises:

[0015] generating l homomorphic ciphertexts, the l homomorphic ciphertexts corresponding to l first plaintexts;

[0016] generating a proof corresponding to the l homomorphic ciphertexts, the proof including a first value, the first value being obtained by linear calculation based on the l first plaintexts and l challenge values, the l challenge values being received from a second participant, each of the challenge values being within a first preset range, the proof being used to verify whether each of the first plaintexts is within a second preset range;

[0017] send the l homomorphic ciphertexts and the proof to the second participant.

[0018] A method for batch verifying ciphertexts is provided in the third aspect of the present specification, which is performed by a second participant, and the method comprises:

[0019] receiving, from a first participant, a proof corresponding to l homomorphic ciphertexts, the l homomorphic ciphertexts corresponding to l first plaintexts, the proof including a first value, the first value being obtained by linear calculation based on the l first plaintexts and l challenge values, the l challenge values being provided by the second participant, each of the challenge values being within a first preset range;

[0020] verifying, based on the proof, the l challenge values and the l homomorphic ciphertexts, whether each of the first plaintexts is within a second preset range.

[0021] A scheme for batch verifying ciphertexts is provided in the embodiments of the present specification, a zero-knowledge proof is obtained by linear calculation based on multiple ciphertexts and multiple challenge values provided by a verifying party by an encrypting party, and the verifying party can perform batch verification on the range of plaintexts corresponding to multiple homomorphic ciphertexts based on the zero-knowledge proof, so that the computing resources and communication resources required by the encrypting party and the verifying party can be greatly reduced. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can also be obtained by those skilled in the art without creative labor.

[0023] Figure 1 is a schematic diagram of distributed threshold key generation in one embodiment of the present specification;

[0024] Figure 2 is a schematic diagram of distributed threshold signature in one embodiment of the present specification;

[0025] Figure 3 is a flow chart of a preprocessing procedure in threshold signature in one embodiment of the present specification;

[0026] Figure 4 is a schematic diagram of verification of multiple pre-signature results in threshold signature in one embodiment of the present specification;

[0027] Figure 5 is a schematic diagram of batch verification of multiple pre-signature results in threshold signature in one embodiment of the present specification;

[0028] Figure 6 is a flow chart of a method of batch verification of ciphertext in threshold signature in one embodiment of the present specification;

[0029] Figure 7 is a flow chart of a method of batch verification of ciphertext in threshold signature in another embodiment of the present specification. DETAILED DESCRIPTION

[0030] In order to make the person skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be described clearly and completely below in combination with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only part of the embodiments of the present specification, rather than all the embodiments. Based on the embodiments in the present specification, all other embodiments obtained by the person skilled in the art without creative labor should belong to the scope of protection of the present specification.

[0031] In order to clearly describe the scheme of batch verification of ciphertext in threshold signature provided by the embodiments of the present specification, the related algorithms involved in threshold signature will be introduced first in the following.

[0032] DKG (Distributed Key Generation) protocol, i.e. distributed key generation protocol, refers to a distributed protocol for generating a set of keys through cooperation among multiple participants participating in the protocol.

[0033] VSS (Verifiable Secret Sharing) protocol, i.e. verifiable secret sharing protocol, is an important theoretical basis of DKG protocol.

[0034] VSS refers to the sharing of a secret data among multiple participants, which can split the secret data into multiple fragments without revealing the secret data itself, and then store one fragment in each participant. After that, when the secret data needs to be restored, all fragments need to be collected to successfully restore the complete secret data.

[0035] VSS protocol was first proposed by Shamir in 1979, which is a polynomial-based secret sharing protocol. VSS protocol is developed from Shamir's Secret Sharing (SSS), so Shamir's Secret Sharing is introduced first.

[0036] Shamir's Secret Sharing includes two stages of secret sharing (or secret distribution) and secret reconstruction, and first needs to be constructed by a dealer a polynomial:

[0037] f(x) = a0 + a1x + a2x 2 +... + anx n x n polynomial (*)

[0038] Where a0 is the secret data to be shared.

[0039] This n-degree polynomial is uniquely determined by a set of coefficients (a0, a1, a2, …, an), which includes n+1 values. In this way, if the n-degree polynomial corresponding curve passes through n+1 different points on the plane, i.e. n+1 different point coordinates (x1, y1), (x2, y2), …, (x n , y n ), (x n , y n+1 ), (x n+1 , y n ) are obtained, then (n+1) equations of (n+1) equations are obtained, and the values of the n+1 coefficients a0, a1, a2, …, an are determined from the equation set, and the polynomial (*) is determined, and finally the value of the secret data a0 can be obtained. The above n+1 different point coordinates (x1, y1), (x2, y2), …, (x n , y n ), (x n+1 , y n+1 ) are n+1 secret fragments.

[0040] Regarding the curve passing through the existing points, the solving process is called polynomial interpolation. There are many ways to achieve polynomial interpolation, and the following introduces a common Lagrange interpolation method. Given an n-degree polynomial *, and the coordinates of the n+1 points (x1, y1), (x2, y2), …, (x n , y n ), (x n+1 , y n+1 ) through which the polynomial corresponds to the curve on the plane, then the polynomial of the n-degree curve can be obtained by Lagrange interpolation as follows:

[0041] Polynomial (*) is actually equivalent to polynomial (**). If x = 0 in polynomial (*), f(0) = a0, that is, the value of secret data a0 can be obtained. Therefore, if x = 0 in polynomial (**), the value of secret data a0 can also be obtained, that is, f(0) = a0.

[0042] For n + 1 points (x1, y1), …, (xn, yn), the above polynomial (**) can also be expressed as: n n n+1 n+1

[0043] Among them, Similarly, for the constant term or secret value, there is

[0044] In summary, n + 1 points on the polynomial can be taken at will, and the n + 1 points are shared among n + 1 participants, for example, each participant obtains the coordinates of a point. Collecting the coordinates of any less than n + 1 points cannot infer the original secret data a0. Only after obtaining all n + 1 points can the value of secret data a0 be restored by reconstructing the polynomial coefficients. In addition, even if the coordinates of any less than n + 1 points are collected, for example, n points, since there are infinite n-degree curves through the n points, the value of the secret data a0 will not be leaked from the probability point of view. The degree n here is also called the degree of the polynomial.

[0045] On this basis, threshold Shamir secret sharing can be realized. For example, t-of-n secret sharing is to share a secret among n participants, and to specify the threshold value of the minimum secret fragment required for recovery to be greater than t, that is, greater than or equal to t + 1. For example, in a transaction involving 4 participants, the threshold value is agreed to be 3, that is, n = 4, t = 2, then greater than or equal to t + 1 = 3 participants provide their own secret fragments to restore the secret, otherwise the secret cannot be restored. Specifically, a polynomial of degree t = 2 can be constructed:

[0046] f(x) = a0 + a1x + a2x 2 Polynomial (***)

[0047] ​​​​The curve corresponding to the 2-degree polynomial can be obtained by 4 different points on the plane, that is, the coordinates of 4 different points (x1, y1), (x2, y2), (x3, y3), (x4, y4) are obtained, and the coordinates of the 4 points are distributed to a participant in the secret sharing stage. Four participants are set as Party1, Party2, Party3, and Party4, so that Party1 has a fragment (x1, y1), Party2 has a fragment (x2, y2), Party3 has a fragment (x3, y3), and Party4 has a fragment (x4, y4). Since the polynomial (**) can be determined by any 3 points on the corresponding curve, when any three participants provide their secret fragments, the polynomial (***), the secret value a0 can be restored in the secret reconstruction stage. Any less than three participants provide their secret fragments, and the polynomial (***), the secret value a0 cannot be restored. The above t is also called the threshold. i (i∈{1,2,3,4}) when any three participants provide their secret fragments, the polynomial (***), the secret value a0 can be restored in the secret reconstruction stage. Any less than three participants provide their secret fragments, and the polynomial (***), the secret value a0 cannot be restored. The above t is also called the threshold.

[0048] In 1999, Rabin et al. proposed an improved protocol called Joint-Feldman. The basic idea of the protocol is to perform n times of Feldman VSS protocol in parallel, where each participant locally generates a random polynomial, and then shares a randomly selected secret value among all participants. Since a commitment of the secret is shared instead of the secret itself, the secret cannot be recovered as long as more than t collusions do not occur. Such a distributed VSS protocol is also called DVSS protocol (Distributed VSS).

[0049] Specifically, taking four participants as an example, assuming that the threshold t = 2, the degree of the polynomial is also t = 2, the decentralized threshold secret sharing, that is, the implementation scheme of Joint-Feldman, includes the following:

[0050] Each P i (Party i is abbreviated as P i , i∈{1,2,3,4}) sets the secret s i0 to be shared, and randomly selects other parameters to generate a t-1 degree polynomial:

[0051] The participant P1 generates a 2-degree polynomial:

[0052] f1(z)=a 10 +a 11 z+a 12 z 2 , where a 10 is the secret s1 set by P1;

[0053] Party P2 generates a 2-degree polynomial:

[0054] f2(z) = a 20 + a 21 z + a 22 z 2 where a 20 is a secret s2 set by P2;

[0055] Party P3 generates a 2-degree polynomial:

[0056] f3(z) = a 30 + a 31 z + a 32 z 2 where a 30 is a secret s3 set by P3;

[0057] Party P4 generates a 2-degree polynomial:

[0058] f4(z) = a 40 + a 41 z + a 42 z 2 where a 40 is a secret s4 set by P4.

[0059] Then, each party P i generates n values on the curve corresponding to its t-degree polynomial and distributes, where still set n = 4, t = 2, n = 1, 2, 3, 4, then:

[0060] Party P1 generates s 11 = f1(1), s 12 = f1(2), s 13 = f1(3), s 14 = f1(4), keeps s 11 itself, and respectively sends s 12 to P2, s 13 to P3, s 14 to P4 after encryption;

[0061] Party P2 generates s 21 = f2(1), s 22 = f2(2), s 23 = f2(3), s 24 = f2(4), keeps s 22 itself, and respectively sends s 21 to P1, s 23 to P3, s 24 to P4 after encryption;

[0062] The participant P3 generates s 31 = f3(1), s 32 = f3(2), s 33 = f3(3), s 34 = f3(4), keeps s by himself 33 and respectively encrypts and sends s 31 to P1, encrypts and sends s 32 to P2, encrypts and sends s 34 to P4;

[0063] The participant P4 generates s 41 = f4(1), s 42 = f4(2), s 43 = f4(3), s 44 = f4(4), keeps s by himself 44 and respectively encrypts and sends s 41 to P1, encrypts and sends s 42 to P2, encrypts and sends s 43 to P3.

[0064] In addition, each participant P i can also generate the public verification parameter corresponding to the polynomial of t-1 degree of himself where k = 0, 1, …, t, and publishes to each participant, specifically:

[0065] The participant P1 generates k = 0, 1, …, t, including broadcasting {A 10 , A 11 , A 12} to P2, P3 and P4;

[0066] The participant P2 generates k = 0, 1, …, t, including broadcasting {A 20 , A 21 , A 22} to P1, P3 and P4;

[0067] The participant P3 generates k = 0, 1, …, t, including broadcasting {A 30 , A 31 , A 32} to P1, P2 and P4;

[0068] The participant P4 generates k = 0, 1, …, t, including broadcasting {A 40 , A41 ,A 42} to P1, P2 and P3.

[0069] Thus, after P1 receives s 21 , it can be verified by {A 20 ,A 21 ,A 22}; after P1 receives s 31 , it can be verified by {A 30 ,A 31 ,A 32}; after P1 receives s 41 , it can be verified by {A 40 ,A 41 ,A 42}; the verification method is similar to the above, and will not be described again.

[0070] Next:

[0071] The participant P1 can calculate the secret share s1 as: s1 = s 11 + s 21 + s 31 + s 41 ;

[0072] The participant P2 can calculate the secret share s2 as: s2 = s 12 + s 22 + s 32 + s 42 ;

[0073] The participant P3 can calculate the secret share s3 as: s3 = s 13 + s 23 + s 33 + s 43 ;

[0074] The participant P4 can calculate the secret share s4 as: s4 = s 14 + s 24 + s 34 + s 44 ;

[0075] Each participant P i can broadcast the secret share s i calculated by itself to other participants. Then, each participant P i can reconstruct the secret s0 after collecting at least t+1 secret shares in {s1, s2, s3, s4}. Here, for t = 2, each participant P i can also reconstruct the secret s0 after collecting at least t+1 = 2+1 = 3 secret shares.

[0076] This is because, the sum of the curves of each participant can be summarized to get the total curve:

[0077] f(z) = f1(z) + f2(z) + f3(z) + f4(z)

[0078] f(z) = (a 10 +a 11 z+a 12 z 2 )+(a 20 +a 21 z+a 22 z 2 )+(a 30 +a 31 z+a 32 z 2 )

[0079] +(a 40 +a 41 z+a 42 z 2 )

[0080] f(z) = (a 10 +a 20 +a 30 +a 40 )+(a 11 +a 21 +a 31 +a 41 )z+(a 12 +a 22 +a 32 +a 42 )z 2

[0081] Polynomial (I)

[0082] Thus:

[0083] s1 = s 11 +s 21 +s 31 +s 41 = f1(1) + f2(1) + f3(1) + f4(1);

[0084] s2 = s 12 +s 22 +s 32 +s 42 = f1(2) + f2(2) + f3(2) + f4(2);

[0085] s3 = s 13 +s 23 +s 33 +s 43=f1(3)+f2(3)+f3(3)+f4(3);

[0086] s4 = s 14 +s 24 +s 34 +s 44 =f1(4)+f2(4)+f3(4)+f4(4);

[0087] For the overall curve f(z), the following relationship exists:

[0088] s1=f1(1)+f2(1)+f3(1)+f4(1)=f(1);

[0089] s2=f1(2)+f2(2)+f3(2)+f4(2)=f(2);

[0090] s3=f1(3)+f2(3)+f3(3)+f4(3)=f(3);

[0091] s4=f1(4)+f2(4)+f3(4)+f4(4)=f(4);

[0092] The secret is s0 = a 10 +a 20 +a 30 +a 40 .

[0093] Thus, any participant P i After collecting at least three of the secret shares s1, s2, s3, and s4, it is equivalent to obtaining at least three points on the curve corresponding to polynomial (Ⅰ), that is, obtaining at least three of the four coordinates (x1=1, y1=s1), (x2=2, y2=s2), (x3=3, y3=s3), and (x4=4, y4=s4), thereby recovering the overall curve f(z). Furthermore, f(0)=a can be calculated. 10 +a 20 +a 30 +a 40 =s0, thus the secret s0 can be obtained.

[0094] Furthermore, by verifying parameter {A 10 A 11 A 12}, {A 20 A 21 A 22}, {A 30 A 31 A 32}, {A 40 A 41 A 42} can also be used for secrets si The legality of s0can be verified, i.e., it can be verified that (0, s i ) is a point on the total curve. Specifically, the legality is judged by verifying whether the following equation is true:

[0095] This is because there is the following relationship:

[0096] Usually, the right side of the polynomial (II) is also set as a public key share, denoted as pub i , i = 1, 2,..., n, for verifying the corresponding private key share.

[0097] As mentioned above, x i = i for each i = 1, 2,..., n. In this way, i can be used as the number of each participant.

[0098] For the verification of the secret s0, i.e., x i = 0, the above formula can be further derived as follows:

[0099] Define 0 0 = 1, and 0 k = 0, k ≠ 0, so the above formula can be further derived as follows:

[0100] It can be seen that based on the polynomial (III), the legality of s0can be verified.

[0101] Moreover, based on the derivation in the above polynomial (III), for verifying the legality of s0, it can be further simplified as:

[0102] Usually, the right side of the polynomial (IV) is also set as the total public key, denoted as pub.

[0103] The above Joint-Feldman protocol can realize distributed secret sharing, i.e., the main content of DKG is completed. The above series of secret sharing implementation schemes from Shamir to threshold Shamir, Feldman VSS protocol, and Joint-Feldman DVSS protocol are a series of secret sharing implementation schemes. In fact, in addition to this series of schemes starting from Shamir secret sharing, there are also schemes based on additive secret sharing (Additive Secret Share), SPDZ (an important protocol in multi-party secure computation, first proposed in 2012), or Chinese remainder theorem, etc., which can also ultimately realize DKG, which is omitted and will not be described here.

[0104] The implementation of the DKG protocol described above can overcome the problem of a single point of failure leading to overall unavailability due to a single entity generating the key, as well as the problem of needing to trust the single point of key generation. However, due to the various participating parties P i The secret share s generated by broadcasting ij ,i,j∈(1,2,…,n),n is the number of participants, and each participant P i They can all calculate their own secret share s i The broadcast is sent to the other participants, so that each participant P... i After collecting at least t+1 secret shares from {s1,s2,s3,s4}, secret s0 can be reconstructed. This results in at least t+1 participants obtaining the finally reconstructed secret s0, thus exposing secret s0 and rendering the overall curve unusable. If a new secret s0 needs to be generated again, the DKG protocol process must be repeated.

[0105] The properties of the DKG protocol, such as thresholds and secret commitments, combined with matching threshold signature algorithms, can be used to construct distributed threshold signature protocols. Blockchain, as a distributed system, extensively uses signature algorithms. Thus, nodes in the blockchain distribute secret shares through DKG, and at least t+1 blockchain nodes use these secret shares as private key shares to sign the information to be signed and broadcast them. Any blockchain node that has collected at least t+1 signature shares can reconstruct the total signature and the total public key using the aforementioned method. This reconstructed total signature can be verified using the total public key, thereby achieving threshold signatures. Furthermore, this approach has the advantage that each blockchain node's own secret share does not need to be broadcast to other nodes, thus avoiding the exposure of its own secret share and private key. Therefore, a secret share generated by a single DKG can be reused multiple times without requiring a separate DKG protocol for each threshold signature.

[0106] The threshold signature mentioned can be, for example, a threshold signature based on the ECDSA signature algorithm. It is understood that the signature algorithm corresponding to the threshold signature in the embodiments of this specification is not limited to the ECDSA signature algorithm, but can be other signature algorithms, such as the SM2 signature algorithm, etc. The following description uses the ECDSA signature algorithm as an example.

[0107] The basic ECDSA signature algorithm includes:

[0108] Alice, the signatory, chooses an elliptic curve E. q (a,b) and base point G, and share this information with the verifier Bob, where q is the modulus.

[0109] Alice in a finite field Choose a private key x and generate a public key X = x·G based on that private key;

[0110] Alice in a finite field Choose a random number k and calculate R = k. -1 ·G, calculate r=f(R), and r≠0; where f(R) can be the x-coordinate of R.

[0111] Alice calculates the digest value h of the message m to be signed using hash, i.e., h = hash(m), and then calculates:

[0112] σ=k(h+x·r)mod q (a)

[0113] Alice generates a signature sig = (r, σ) and sends the message m, the signature sig, and the public key X to the signature verifier Bob.

[0114] Bob uses public key X to verify the received message m and signature sig in the following equation:

[0115] r=f(σ -1 ·h·G+σ -1 ·r·X) formula (b)

[0116] If equation b holds true, the signature is valid; otherwise, the signature is invalid. This is because, from equation (a), we can obtain: k -1 =σ -1 (h+x·r)mod q, which allows us to express R=k -1 ·G and k -1 Substituting r = f(R), we get:

[0117] r = f(R) = f(k) -1 ·G)=f(σ -1 (h+x·r)·G)=f(σ -1 ·h·G+σ -1 ·x·r·G)=f(σ -1 ·h·G+σ -1 ·r·X)

[0118] According to the right side of equation (b), Bob can use σ, r from the received signature, as well as message m and public key X to perform calculations and verify whether the calculation result is equal to r in the signature.

[0119] The basic ECDSA signature algorithm described above can be extended into a threshold signature algorithm. For example, after the DKG process described above, it is possible to achieve the following: n signers P1, P2, ..., P nEach has its own secret share, and has a total public key, wherein the threshold value is t, and t < n. At least t+1 of the n participants each respectively uses its own secret share as a private key share to sign the same information to be signed and broadcast, and any verifier who collects at least t+1 signature shares can recover the total signature and verify the total signature using the total public key, thereby realizing threshold signature.

[0120] In an ECDSA-based distributed threshold signature method, each signing party can generate a threshold private key through a Dealer or Dealer-free threshold Shamir, Feldman or Joint-Feldman protocol, or through other DKG schemes. The implementation results of such DKG schemes are that the participants P i (i∈n) have private key shares ω i Any at least t+1 private key shares correspond to a total private key ω. The DKG can also generate a total public key X. The total public key X and the total private key ω have the relationship: ω·G = X.

[0121] In addition, after the n participants obtain their respective private key shares based on the DKG, they can use their own private key shares to sign the same message to generate signature shares. Any at least t+1 signature shares can be aggregated into a total signature, and the total signature can be verified by the total public key.

[0122] In a related technology, the above relationship can be represented by the distributed threshold key generation of FIG. 1 and the distributed threshold signature of FIG. 2. The distributed threshold signature includes a preprocessing phase and an online signature phase.

[0123] The following first introduces the process of the distributed threshold key generation protocol. In this process, it is assumed that there are n participants, P1, P2, …, P n Through the distributed threshold key generation protocol, each participant P i (i={1, 2, …, n}) can generate its own private key share.

[0124] Specifically, each participant P i can generate a t-degree polynomial f i (z) = a i0 +a i1 z+a i2 z 2 +…+a it z t , wherein a i0 is the secret s i set by P i0 . The threshold here is t, so the degree of the polynomial is also t.

[0125] Let threshold be 2, let total number of participants be 5, i.e. t = 2, n = 5, then there are 5 participants P1, P2, P3, P4, P5, wherein:

[0126] P1 generates a 2-degree (t = 2) polynomial: f1(z) = a 10 +a 11 z+a 12 z 2 , wherein a 10 is a secret s 10 set by P1;

[0127] P2 generates a 2-degree (t = 2) polynomial: f2(z) = a 20 +a 21 z+a 22 z 2 , wherein a 20 is a secret s 20 set by P2;

[0128] P3 generates a 2-degree (t = 2) polynomial: f3(z) = a 30 +a 31 z+a 32 z 2 , wherein a 30 is a secret s 30 set by P3;

[0129] P4 generates a 2-degree (t = 2) polynomial: f4(z) = a 40 +a 41 z+a 42 z 2 , wherein a 40 is a secret s 40 set by P4;

[0130] P5 generates a 2-degree (t = 2) polynomial: f5(z) = a 50 +a 51 z+a 52 z 2 , wherein a 50 is a secret s 50 set by P5;

[0131] Further, each participant P i can generate n secret shares, retains one secret share, and encrypts and sends the remaining secret shares to other participants. For example, participant P i generates n secret shares as coordinates of n points on a curve corresponding to the polynomial of the participant, retains one point coordinate, and encrypts and sends the remaining point coordinates to other participants.

[0132] Specifically, for example:

[0133] P1 generates s 11 = f1(1), s 12 = f1(2), s 13 = f1(3), s 14 = f1(4), s 15 = f1(5), keeps s by itself 11 and respectively encrypts and sends s 12 to P2, encrypts and sends s 13 to P3, encrypts and sends s 14 to P4, encrypts and sends s 15 to P5;

[0134] P2 generates s 21 = f2(1), s 22 = f2(2), s 23 = f2(3), s 24 = f2(4), s 25 = f2(5), keeps s by itself 22 and respectively encrypts and sends s 21 to P1, encrypts and sends s 23 to P3, encrypts and sends s 24 to P4, encrypts and sends s 25 to P5;

[0135] P3 generates s 31 = f3(1), s 32 = f3(2), s 33 = f3(3), s 34 = f3(4), s 35 = f3(5), keeps s by itself 33 and respectively encrypts and sends s 31 to P1, encrypts and sends s 32 to P2, encrypts and sends s 34 to P4, encrypts and sends s 35 to P5;

[0136] P4 generates s 41 = f4(1), s 42 = f4(2), s 43 = f4(3), s 44 = f4(4), s 45 = f4(5), keeps s by itself 44 and respectively encrypts and sends s 41 to P1, encrypts and sends s 42 to P2, encrypts and sends s 43 to P3, encrypts and sends s 45 to P5;

[0137] P5 generates s 51 = f5(1), s 52 = f5(2), s 53 = f5(3), s 54 = f5(4), s 55 = f5(5), s 55 , and sends s 51 encrypted to P1, s 52 encrypted to P2, s 53 encrypted to P3, and s 54 encrypted to P4, respectively.

[0138] Thus:

[0139] P1 has locally the secret shares s 11 , s 21 , s 31 , s 41 , s 51 generated by the different participants.

[0140] P2 has locally the secret shares s 12 , s 22 , s 32 , s 42 , s 52 generated by the different participants.

[0141] P3 has locally the secret shares s 13 , s 23 , s 33 , s 43 , s 53 generated by the different participants.

[0142] P4 has locally the secret shares s 14 , s 24 , s 34 , s 44 , s 54 generated by the different participants.

[0143] P5 has locally the secret shares s 15 , s 25 , s 35 , s 45 , s 55 generated by the different participants.

[0144] Then, each participant P i can combine the secret share s ii it has kept for itself with the secret shares s j it has received from the other participants P ji .After summing, the private key share is obtained. The summing method is, for example, summation, as shown by participant P. i Private key share For example:

[0145] Participant P1 can calculate the private key share s1 as: s1 = s 11 +s 21 +s 31 +s 41 +s 51 ;

[0146] Participant P2 can calculate the private key share s2 as: s2 = s 12 +s 22 +s 32 +s 42 +s 52 ;

[0147] Participant P3 can calculate the private key share s3 as: s3 = s 13 +s 23 +s 33 +s 43 +s 53 ;

[0148] Participant P4 can calculate the private key share s4 as: s4 = s 14 +s 24 +s 34 +s 44 +s 54 ;

[0149] Participant P5 can calculate the private key share s5 as: s5 = s 15 +s 25 +s 35 +s 45 +s 55 .

[0150] Moreover, each participant P i It can also generate the common verification parameter A corresponding to its own t-degree polynomial. ik =a ik G, where k = 0, 1, ..., t, is published to each participant, specifically:

[0151] Participant P1 generates A 1k =a 1k G, k = 0, 1, ..., t = 2, including A 10 =a 10 G = s 10 G, A 11 =a 11 G, A 12 =a 12 G, Broadcast {A}10 ,A 11 ,A 12} to P2, P3, P4 and P5;

[0152] Party P2 generates A 2k = a 2k G, k = 0, 1,..., t = 2, including A 20 = a 20 G = s 20 G, A 21 = a 21 G, A 22 = a 22 G, broadcast {A 20 ,A 21 ,A 22} to P1, P3, P4 and P5;

[0153] Party P3 generates A 3k = a 3k G, k = 0, 1,..., t = 2, including A 30 = a 30 G = s 30 G, A 31 = a 31 G, A 32 = a 32 G, broadcast {A 30 ,A 31 ,A 32} to P1, P2, P4 and P5;

[0154] Party P4 generates A 4k = a 4k G, k = 0, 1,..., t = 2, including A 40 = a 40 G = s 40 G, A 41 = a 41 G, A 42 = a 42 G, broadcast {A 40 ,A 41 ,A 42} to P1, P2, P3 and P5;

[0155] Party P5 generates A 5k = a 5k G, k = 0, 1,..., t = 2, including A 50 = a 50 G = s 50 G, A 51 = a 51 G, A 52 = a 52 G, broadcast {A 50A 51 A 52} to P1, P2, P3 and P4.

[0156] Each participant P i It can also be based on P j The public verification parameter {A j0 A j1 ,…,A jt Verify P j The secret share sent ji For example, this can be verified using the following formula:

[0157] s ji G = A j0 +iA j1 +…+i t A jt

[0158] Specifically:

[0159] Participant P1 through s 21 G = A 20 +A 21 +A 22 Verify s 21 , through s 31 G = A 30 +A 31 +A 32 Verify s 31 , through s 41 G = A 40 +A 21 +A 42 Verify s 41 , through s 51 G = A 50 +A 51 +A 52 Verify s 51 ;

[0160] Participant P2 through s 12 G = A 10 +2A 11 +2 2 A 12 Verify s 12 , through s 32 G = A 30 +2A 31 +2 2 A 32 Verify s 32 , through s 42 G = A 40 +2A 21 +2 2 A 42 Verify s42 , by s 52 G = A 50 + 2A 51 + 2 2 A 52 Verify s 52 ;

[0161] Party P3, by s 13 G = A 10 + 3A 11 + 3 2 A 12 Verify s 13 , by s 23 G = A 30 + 3A 31 + 3 2 A 32 Verify s 23 , by s 43 G = A 40 + 3A 21 + 3 2 A 42 Verify s 43 , by s 53 G = A 50 + 3A 51 + 3 2 A 52 Verify s 53 ;

[0162] Party P4, by s 14 G = A 10 + 4A 11 + 4 2 A 12 Verify s 14 , by s 24 G = A 20 + 4A 21 + 4 2 A 22 Verify s 24 , by s 34 G = A 40 + 4A 21 + 4 2 A 42 Verify s 42 , by s 54 G = A 50 + 4A 51 + 4 2 A 52 Verify s 52 ;

[0163] Party P5, by s 15 G = A 10 + 5A 11 + 52 A 12 verify s 15 , by s 25 G = A 20 + 5A 21 + 5 2 A 22 verify s 25 , by s 35 G = A 30 + 5A 31 + 5 2 A 32 verify s 35 , by s 45 G = A 40 + 5A 41 + 5 2 A 42 verify s 45 ;

[0164] Either party can terminate the agreement if the verification fails.

[0165] On the other hand, each participant P i can compute the total public key X, in a similar way as before, for example, by the following equation:

[0166] As mentioned before, the total public key can be used to verify the total signature after aggregation.

[0167] In addition, in order to resist the attack of malicious adversary, further, each participant P i can generate the hash value of its own secret corresponding public key and broadcast, so that the receiver can verify the correctness of the secret corresponding public key sent by each participant P i , for example:

[0168] P1 computes H1() is a hash algorithm, A 10 = a 10 G is the secret s 10 corresponding public key (obtained by operation on elliptic curve, here is the form of product); P1 can broadcast to other participants, and any receiver receiving can use the to verify the correctness of A 10 , so as to resist the attack of malicious adversary;

[0169] P2 computes H1() is a hash algorithm, A 20 = a 20 G is the secret s 20The corresponding public key (obtained through operations on an elliptic curve, here in product form); P2 can broadcast. To other participating parties, any receiving party receives After that, you can use this Verify A 20 The correctness of the information can thus help resist attacks from malicious adversaries;

[0170] P3 calculation H1() is a hash algorithm, A 30 =a 30 G is a secret. 30 The corresponding public key (obtained through operations on an elliptic curve, here in product form); P3 can broadcast. To other participating parties, any receiving party receives After that, you can use this Verify A 30 The correctness of the information can thus help resist attacks from malicious adversaries;

[0171] P4 calculation H1() is a hash algorithm, A 40 =a 40 G is a secret. 40 The corresponding public key (obtained through operations on an elliptic curve, here in product form); P4 can be broadcast. To other participating parties, any receiving party receives After that, you can use this Verify A 40 The correctness of the information can thus help resist attacks from malicious adversaries;

[0172] P5 calculation H1() is a hash algorithm, A 50 =a 50 G is a secret. 50 The corresponding public key (obtained through operations on an elliptic curve, here in product form); P5 can be broadcast. To other participating parties, any receiving party receives After that, you can use this Verify A 50 The correctness of the information can thus help resist attacks from malicious adversaries;

[0173] In addition, each participant P i It can generate its own public-private key pairs for homomorphic encryption, such as the Paillier public-private key pair (N). i ,sk i ), where sk i For the private key, N icorresponding to the public key. Homomorphic encryption technology can process plaintext data "homomorphically", that is, map plaintext data to a new, secret state, so that only the receiver who has the key can obtain the plaintext data. Paillier homomorphic addition is a widely used public key encryption system in cryptography, proposed by Pascal Paillier in 1999. Its main feature is the additive homomorphism property, which means that given two ciphertexts, the ciphertext of their sum can be calculated without decryption. Specifically, suppose there are two plaintexts m1 and m2, and their Paillier encryption ciphertexts are c1 and c2 respectively. The additive homomorphism property of Paillier can achieve the calculation of the product of c1 and c2 to get a new ciphertext c, which is exactly the ciphertext of the sum of m1 and m2. This homomorphic property can complete some form of calculation on encrypted data without revealing the original data.

[0174] Each participant P i After generating the homomorphic encryption public and private key pair, the public key can be sent to other participants.

[0175] For example, after generating the Paillier encryption public and private key (N1, sk1), the participant P1 broadcasts the homomorphic encryption public key N1 to other participants; after generating the Paillier encryption public and private key (N2, sk2), the participant P2 broadcasts the homomorphic encryption public key N2 to other participants; after generating the Paillier encryption public and private key (N3, sk3), the participant P3 broadcasts the homomorphic encryption public key N3 to other participants; after generating the Paillier encryption public and private key (N4, sk4), the participant P4 broadcasts the homomorphic encryption public key N4 to other participants; after generating the Paillier encryption public and private key (N5, sk5), the participant P5 broadcasts the homomorphic encryption public key N5 to other participants.

[0176] In this way, each participant P i The local can save its own secret, its own private key share, its own homomorphic encryption private key, the total public key and the homomorphic encryption public key of each participant.

[0177] After the above distributed threshold key generation process, there is a total polynomial:

[0178] f(z) = f1(z) + f2(z) + f3(z) + f4(z) + f5(z)

[0179] = a 10 + a 11 z + a 12 z 2 + a 20 + a 21 z + a22 z 2 +a 30 +a 31 z+a 32 z 2 +a 40

[0180] +a 41 z+a 42 z 2 +a 50 +a 51 z+a 52 z 2

[0181] =(a 10 +a 20 +a 30 +a 40 +a 50 )+(a 11 +a 21 +a 31 +a 41 +a 51 )z

[0182] +(a 12 +a 22 +a 32 +a 42 +a 52 )z 2

[0183] As mentioned before, the polynomial corresponds to a total curve and there is the following relationship:

[0184] s1 = f1(1) + f2(1) + f3(1) + f4(1) + f5(1) = f(1);

[0185] s2 = f1(2) + f2(2) + f3(2) + f4(2) + f5(2) = f(2);

[0186] s3 = f1(3) + f2(3) + f3(3) + f4(3) + f5(3) = f(3);

[0187] s4 = f1(4) + f2(4) + f3(4) + f4(4) + f5(4) = f(4);

[0188] s5 = f1(5) + f2(5) + f3(5) + f4(5) + f5(5) = f(5);

[0189] In the aforementioned DKG scheme, each participant P i can calculate the secret share s ibroadcasted to other participants. Then each participant P i After collecting at least t+1 secret shares in set {s1, s2, s3, s4, s5}, the secret s0 can be reconstructed. For example, for threshold t=2, each participant P i After collecting at least 3 secret shares, the secret s0 can also be reconstructed.

[0190] In this embodiment, the purpose is to implement distributed threshold signature, and therefore the secret share s i is not sent to other participants, but is used as a private key share. In this way, the total secret cannot be recovered by any participant or other party after obtaining at least t+1 secret shares, i.e., the total private key cannot be obtained, thereby ensuring that the private key shares obtained by multiple participants after a one-time distributed threshold key generation protocol can be repeatedly used for subsequent distributed threshold signature.

[0191] The following describes the distributed threshold signature process in this embodiment, which can include a preprocessing phase and an online signature phase. The above-mentioned distributed key generation process requires n participants to jointly participate in the protocol process. The following distributed threshold signature process only requires at least t+1 participants to jointly participate in the protocol process. Here, the threshold t=2 is still taken as an example.

[0192] Preprocessing phase: At least t+1 participants generate their own first random value k i and second random value γ i Each participant also uses a homomorphic encryption algorithm and obtains coordinate component r and their own private key share component cover value χ i through the preprocessing phase protocol.

[0193] FIG. 3 is a flowchart of the preprocessing process in the threshold signature in an embodiment, which can specifically include:

[0194] Step S10, t+1 participants, each participant P i calculates Lagrange coefficient and calculates private key share component x i = λ i s i Here, for example, i takes 1, 2, 3, and:

[0195] Participant P1 calculates Lagrange coefficient and calculates private key share component x1= λ1s1;

[0196] Participant P2 calculates Lagrange coefficient and calculates private key share component x2= λ2s2;

[0197] Participant P3 calculates Lagrange coefficient and computes the private key share component x3= l3s3.

[0198] Step S11: Each of the at least t+1 participants generates a first random value and a second random value, and a corresponding first random value homomorphic ciphertext and a second random value public key hash.

[0199] For example, the participant P i i∈[1,t+1] generates a first random value k i and a second random value γ i , and k i , Wherein, in the elliptic curve encryption (ECC), Generally refers to the set of integers modulo q, that is, represents a set consisting of all integers from 0 to q-1, and operations such as addition, multiplication, etc. in it are all under the condition of modulo q. Such a modulo operation guarantees the closure and security of operations within a finite field, and is one of the key factors to ensure the encryption strength in elliptic curve encryption technology. For example, the point addition operation or scalar multiplication operation on the elliptic curve, the coefficients and results of which need to be processed under the condition of modulo q to ensure that the results are still located on the legal elliptic curve.

[0200] On this basis, the participant P i can calculate the first random value homomorphic ciphertext, such as Paillier ciphertext K i =E i (k i ), and calculate the second random value public key hash, such as g i =H1(γ i G), H1() is a hash algorithm, similar to the foregoing. When t+1 is 3 and the participants are P1, P2, P3:

[0201] P1 generates a first random value k1 and a second random value γ1, and calculates the Paillier ciphertext K1=E1(k1) of the first random value, and calculates the second random value public key hash g1=H1(γ1G);

[0202] P2 generates a first random value k2 and a second random value γ2, and calculates the Paillier ciphertext K2=E2(k2) of the first random value, and calculates the second random value public key hash g2=H1(γ2G);

[0203] P3 generates a first random value k3 and a second random value γ3, and calculates the Paillier ciphertext K3=E3(k3) of the first random value, and calculates the second random value public key hash g3=H1(γ3G);

[0204] Further, each of the at least t+1 participants, P iThe generated first random value homomorphic ciphertext can be sent to other participants, such as:

[0205] P1 broadcasts K1 to P2 and P3;

[0206] P2 broadcasts K2 to P1 and P2;

[0207] P3 broadcasts K3 to P1 and P2.

[0208] The aforementioned set of first and second random values ​​can be used to obtain a signature. Each of at least t+1 participants can generate l sets of first and second random values. And k iξ , This can be used to generate l signatures for the same or different messages. Accordingly, each participant bases their signature on k. i,ξ Generate homomorphic ciphertext K i,ξ and K i,ξ Send to each of the other participants in at least t+1 participants.

[0209] Step S12: Participant P who received the broadcast i For P j K sent i,ξ For each K i,ξ Choose two masks β i,j,ξ , This indicates that the range of values ​​for the subscript of this finite field is q to the power of 5, which is a proven range of values ​​with cryptographic security. Mask β i,j,ξ , Generally, it is possible Choose the larger value within the range. Therefore, P i The intermediate ciphertext D can be computed using homomorphic algorithms. i,j,ξ and And send to P j :

[0210] The circles in the two formulas above These represent homomorphic multiplication and homomorphic addition operations, respectively. E j () indicates that the participant P j Homomorphic encryption is performed using the homomorphic public key, where j∈[1,t+1], j≠i, and ξ∈[1,l].

[0211] Specifically:

[0212] P1 receives l K broadcasts from P2. 2,ξ =E2(k 2,ξ After that, for each K 2,ξ Choose two masks β 1,2,ξ , Furthermore, P1 can use a homomorphic algorithm to compute l sets of intermediate ciphertext D. 1,2,ξ and And send it to P2, where:

[0213] Thus, P2 receives D 1,2,ξ =E2(α) 1,2,ξ )and Although P2 has the corresponding Paillier private key e2, k 2,ξ It was also generated by P2, but because it contains the mask β chosen by P1. 1,2,ξ , Due to the masking effect, P2 cannot deduce P1's private key share x1 and random value γ. 1,ξ This completes the information transmission. The following steps are similar and will not be repeated.

[0214] P1 receives l K broadcasts from P3. 3,ξ =E3(k 3,ξ After that, the intermediate ciphertext D can be calculated using a homomorphic algorithm. 1,3,ξ and And send it to P3, where:

[0215] Similarly, P2 receives l K broadcasts from P1. 1,ξ =E1(k 1,ξ After that, the intermediate ciphertext D can be calculated using a homomorphic algorithm. 2,1,ξ and And send it to P1, where:

[0216] P2 receives l K broadcasts from P3. 3,ξ =E3(k 3,ξ After that, the intermediate ciphertext D can be calculated using a homomorphic algorithm. 2,3,ξ and And send it to P3, where:

[0217] Similarly, P3 receives l K broadcasts from P1. 1,ξ =E1(k 1,ξ After that, the intermediate ciphertext D can be calculated using a homomorphic algorithm. 3,1,ξ and And send it to P1, where:

[0218] P3 receives l K broadcasts from P2. 2,ξ =E2(k 2,ξ After that, the intermediate ciphertext D can be calculated using a homomorphic algorithm.3,2,ξ and And send it to P2, where:

[0219] Step S13: Each participant P i Calculate the intermediate value δ i,ξ and private key share component masking value χ i We obtained l sets of preprocessing results.

[0220] Furthermore, each participating party P i For the received l-group intermediate ciphertext D j,i,ξ and Decryption using the corresponding homomorphic encryption private key yields l groups of plaintext α. j,i,ξ , This is called the intermediate plaintext, where: α j,i,ξ =γ j,ξ ·k i,ξ -β j,i,ξ ,

[0221] Therefore, for each ξ∈[1,l], we can base it on the first random value k. i,ξ Second random value γ i,ξ and the intermediate plaintext α j,i,ξ , Calculate the intermediate value δ i,ξ And can be based on private key share x i and the first random value k i,ξ and the intermediate plaintext α j,i,ξ , Calculate the private key share component masking value χ i :

[0222] Here, there are two relations:

[0223] This is because, for each ξ:

[0224] In addition, each participating party P i It is also possible to calculate l second random values ​​γ i,ξ The corresponding random number public key Γ i,ξ =γ i,ξ G, and l δ i,ξ and Γ i,ξ The broadcast is sent to the remaining participants among at least t+1 participants. Each participant P i For each ξ, it can be calculated using the above relation 1:

[0225] It can be seen that this is the same as the form of the ECDSA described above. P i The r ξ can be calculated as follows: ξ f(R ξ ) can be the abscissa of the point R ξ as described above.

[0226] After that, the participant P i may store as the l-group pre-processing result, or the pre-signature result.

[0227] For example:

[0228] P1 can locally save

[0229] Online stage: each of the at least t+1 participants selects an unused group (r ξ , k 1,ξ , δ 1,ξ , χ 1,ξ ) from the l-group pre-processing result for the message m to be signed, wherein each participant uses the same group of pre-processing results corresponding to ξ, uses its own first random value k i,ξ , private key share component masking value χ i,ξ , and the coordinate component r ξ to sign the same message, and obtains at least t+1 number of signature shares σ i,ξ :

[0230] σ i,ξ = k i,ξ H(m) + χ i,ξ r ξ

[0231] wherein H(m) is the hash value of the message m. After that, each participant can broadcast σ i,ξ to other participants.

[0232] In this way, any party obtains at least t+1 number of signature shares, which can be aggregated into a total signature sig = (r ξ , σ ξ ). And the total signature σ ξ can be verified for correctness using the total public key X described above. This is because the form of the formula is consistent with the form in the ECDSA described above.

[0233] It should be first noted that there is the following relationship:

[0234] In this way, the aggregation of at least t+1 number of signature shares into a total signature σ ξ is:

[0235] Here x = s 10 +s 20 +…+s n0 =f(0), so σ here ξ =k ξ ·H(m)+k ξ `x`r ξ This is essentially the same as equation (a) in the aforementioned ECDSA signature algorithm. Therefore, it is obvious that the public key X can be used for verification.

[0236] Furthermore, in step S11 above, each of the participants can also generate l first random value homomorphic ciphertexts K. i,ξ The first zero-knowledge proof Φ i,ξ This is then broadcast to other participants; correspondingly, in S12, each participant receives the first random value homomorphic ciphertext K. i,ξ and the corresponding first zero-knowledge proof Φ i,ξ Then, Φ is proven using this first zero-knowledge proof. i,ξ Verify the corresponding first random value homomorphic ciphertext K i,ξ That is, verify K i,ξ The corresponding plaintext k i,ξ belong This can resist attacks from malicious adversaries. If the verification is successful, the process in this embodiment can continue to the next step; otherwise, it is considered illegal and the process can be terminated.

[0237] Zero-knowledge proofs (ZKPs) refer to proofs that enable a prover to convince a verifier that a statement is true without providing the verifier with any useful information. Specifically, the prover generates a proof σ of a statement using witness information that only they possess. The verifier can verify σ to determine that the prover possesses the witness to the statement, while simultaneously being unable to obtain any information about that witness.

[0238] Furthermore, in S12, each of the participating parties can also generate l second zero-knowledge proofs Φ i,j,ξ And l third zero-knowledge proofs Φ i,j,ξ Used to prove the intermediate ciphertext D i,j,ξ corresponding Zero-knowledge proof Used to prove the intermediate ciphertext corresponding Modulo q 5 The set of integers is from 0 to q. 5- the set of all integers of -1; accordingly, in step S13, each participant receives the intermediate ciphertext D i,j,ξ and the corresponding second zero-knowledge proof Φ i,j,ξ After receiving the corresponding intermediate ciphertext D i,j,ξ and the corresponding second zero-knowledge proof Φ i,j,ξ , each participant verifies the corresponding intermediate ciphertext D and the corresponding third zero-knowledge proof Φ After receiving the corresponding intermediate ciphertext D and the corresponding third zero-knowledge proof Φ This can resist attacks by malicious adversaries. If the verification is passed, the process of the present embodiment can continue the subsequent process, otherwise, it means that it is illegal and the process can be terminated.

[0239] That is, as shown in FIG. 4, corresponding to the above process, each participant P i needs to generate l groups of proofs for verifying l homomorphic ciphertexts corresponding to l pre-signature results respectively, wherein each group of proofs includes: a first zero-knowledge proof Φ i,ξ , at least t second zero-knowledge proofs Φ i,j,ξ corresponding to other at least t participants respectively, and at least t third zero-knowledge proofs Φ corresponding to other at least t participants respectively, and needs to send the l groups of proofs to a verifier, for example, a participant P j . After receiving the l groups of proofs, the participant P j needs to perform verification calculation on each group of proofs. In this process, each participant needs more computing resources and communication resources.

[0240] Therefore, in the present embodiment, a scheme for batch verifying ciphertexts in threshold signature is provided. As shown in FIG. 5, in the present embodiment, one group of proofs can be generated for multiple groups of pre-signature results, and the one group of proofs can be used to batch verify l homomorphic ciphertexts in l preprocessing processes at one time, so that the computing resources and communication resources required by each participant can be greatly reduced. For example, the group of proofs includes: a fourth zero-knowledge proof Φ i , at least t fifth zero-knowledge proofs Φ i,j corresponding to other at least t participants respectively, and at least t sixth zero-knowledge proofs Φ corresponding to other at least t participants respectively, wherein the fourth zero-knowledge proof Φ i can be used to batch verify l homomorphic ciphertexts K i,ξ , the fifth zero-knowledge proof Φ can be used to verify l intermediate ciphertexts D j sent to the participant P i,j,ξPerform batch verification, sixth-knowledge proof It can be used to send to participant P j l intermediate ciphertexts Perform batch verification.

[0241] The following sections describe the above batch verification processes with reference to the flowcharts in Figures 6 and 7.

[0242] Figure 6 is a flowchart of a method for batch verification of ciphertext in a threshold signature according to an embodiment of this specification. This method can be performed between any two of the at least t+1 participants. Participant P is shown in Figure 6. i and participating party P j As an example.

[0243] As shown in Figure 6, in step S601, participant P i Generate homomorphic encryption public-private key pairs (N) i ,sk i In step S603, participant P i Use its homomorphic encryption public key N i Send to participant P j Steps S601 and S603 are described above and will not be repeated here. It is understandable that, due to the involvement of party P... i It is possible that a public-private key pair has been pre-generated, and the public key has been sent to participant P in advance. j Therefore, steps S601 and S603 are not necessary.

[0244] In step S605, participant P i Generate l k i,ξ l homomorphic ciphertexts K i,ξ .

[0245] Specifically, participant P i It can generate l random numbers ρ for homomorphic encryption. i,ξ K can be calculated based on the Paillier homomorphic algorithm as shown in formula (1). i,ξ :

[0246] Among them, each ρ i,ξ Through Obtained by random selection from, Indicates N i Coprime and less than N i The space.

[0247] In step S607, participant P i Given l homomorphic ciphertexts K i,ξ Send to participant P j .

[0248] In step S609, participant P j To participant P i Send l challenge values ​​e ξ That is, e = (e1, e2, ... e) l ).

[0249] Among them, e1, e2, ... e l Each e in ξ By ({0,1}) t ) l The value of t is randomly selected from the range {0,1}. The value of t is predetermined based on the security level. t Let {0, 1} represent all binary sequences of length t. Each sequence consists of t elements, each of which can be either 0 or 1. Therefore, the set {0, 1} is... t It can contain 2 t There are 2 different sequences, which include 0 to 2 t Integers in the range of -1.

[0250] In step S611, participant P i Generate proof Φ i Prove Φ i Including Based on l k i,ξ and l challenge values ​​e ξ The linear calculation is obtained. In step S613, participant P i Will prove Φ i Send to participant P j .

[0251] Prove Φ i This is zero-knowledge proof, assuming If the range is [0, B], then prove Φ i The corresponding assertions include B, {K} i,ξ} ξ∈[l] Participant P i {k i,ξ ,ρ ξ} ξ∈[l] As private data (witness), prove Φ i It can be used to prove each plaintext k i,ξ The range is within [0, B], which means it belongs to

[0252] By based on l k i,ξ and l challenge values ​​e ξ Linear calculation yields Due to the challenge value e ξ The scope is determined, thereby involving party P.j Can be determined Indeed, it is based on l k i,ξ and l challenge values ​​e ξ After performing the preset linear calculation, according to The range and l challenge values ​​e ξ Range proof for each k i,ξ The range, while not revealing each k i,ξ The value of k is thus achieved, thereby enabling the management of each k. i,ξ Zero-knowledge proofs within the range of [the target range].

[0253] Specifically, participant P i The masking value k can be generated using the following formula (2). i,0 Algorithm random number ρ i,0 and the masking value k i,0 Homomorphic ciphertext K i,0 :

[0254] Here, "←$" indicates random selection within the numerical range, and ε is a statistical value that can be set to be greater than or equal to t.

[0255] Afterwards, participant P i Φ can be calculated and proved based on formula (2). i In and As shown in formula (3) below:

[0256] Afterwards, participant P i Proof Φ i Send to participant P j , to be used for performing on each k i,ξ Range verification.

[0257] In one implementation, participant P i It can also be obtained from the participating party P j Receive auxiliary parameters To be used to generate Ring-Pedersen commitment Ct i,ξ .

[0258] Specifically, participant P i Can be generated first Where ξε[l].

[0259] Afterwards, participant P i It can generate l+1 commitment values ​​Ct i,ξ , where ξε[0,l]:

[0260] Participant P iAlso generate proof Φ i In

[0261] In this implementation, participant P i The l+1 commitment values ​​Ct can be... i,ξ and proof Φ i Send to participant P j , to be used for performing on each k i,ξ Range verification. In one implementation, l+1 commitment values ​​Ct can be used. i,ξ As proof Φ i Part of the data.

[0262] In step S615, participant P j Based on proof Φ i l challenge values ​​e ξ and l homomorphic ciphertexts K i,ξ Verify each k i,ξ The range.

[0263] Participant P j Upon receiving proof Φ i Next, we will first verify and prove Φ i k in i * Is the range [0, 2]? ε+t [B] in.

[0264] Afterwards, participant P j We can verify whether the following equation (6) holds true:

[0265] Among them, participant P j Already from participant P i K was received i,0 1 K i,ξ N i , and The values ​​of these parameters are determined by combining them with the values ​​of each e. ξ By substituting the values ​​into the left and right sides of equation (6) respectively, we can determine whether equation (6) is true.

[0266] In cases where equation (6) holds, l can be determined. Based on l ρ i,ξ For l k i,ξ The ciphertext obtained by homomorphic encryption. This is because:

[0267] For the left side of equation (6):

[0268] Assuming that the conditions are met,

[0269] and

[0270] Substituting the two expressions above into the left side of equation (6), we get:

[0271] Assuming the parameter on the right side of equation (6) is defined as in formula (3), substituting formula (3) into the right side of equation (6) yields:

[0272] Clearly, equation (7) and equation (8) are actually equal. Therefore, based on the strong RSA assumption, participant P j Based on proof Φ i If equation (6) is verified to hold, it is equivalent to verifying that the left and right sides of equation (6) satisfy the above assumptions, thus determining l. Based on l ρ i,ξ For l k i,ξ The ciphertext obtained by homomorphic encryption.

[0273] In one implementation, participant P j We can also verify whether the following equation (9) holds true:

[0274] For the left side of equation (9), assuming it satisfies the definition of formula (4), we can obtain the following from formula (4):

[0275] Assuming the right side of equation (9) satisfies the assumptions of formulas (3) and (4), according to formulas (3) and (4), formula (10) is consistent with the right side of equation (9). Therefore, based on the strong RSA assumption, participant P... j Based on proof Φ i Verifying that equation (9) holds is equivalent to verifying that the left and right sides of equation (9) satisfy the above assumptions. Therefore, it can be determined that... With l k i,ξ Correspondingly, therefore, l can be further verified. Based on l ρ i,ξ For l k i,ξ The ciphertext obtained by homomorphic encryption.

[0276] Participant P j After the above verification is passed, based on According to the Forking Lemma, based on The range is [0,2] ε+t B] and each e ξ The range of k can be used to deduce each k i,ξthe range of should be within [-2 ε+t B,2 ε+t B], thereby proving each plaintext k i,ξ belongs to

[0277] In the above verification process, the participant P i provides the proof Φ i to the participant P j , the proof Φ i proves that each k i,ξ is included in the set , and each ρ i,ξ is included in the set , and the participant P j cannot deduce any k i,ξ or ρ i,ξ based on and , thus the proof Φ i possesses zero-knowledge proof property.

[0278] FIG. 7 is a flowchart of a method for batch verifying ciphertexts in a threshold signature according to another embodiment of the present specification, which can be performed between any two participants among the at least t+1 participants, and the participant P i and the participant P j are shown as examples in FIG. 6.

[0279] Referring to FIG. 7, in step S701, the participant P i generates l homomorphic ciphertexts D i,j,ξ .

[0280] Referring to the above description, the participant P i among the at least t+1 participants generates l intermediate ciphertexts D i,j,ξ in the preprocessing phase of the threshold signature:

[0281] In order to generate the l D i,j,ξ , the participant P i first generates l γ i,ξ and l β i,j,ξ , wherein In addition, the participant P i also generates l random numbers ρ i,j,ξ for homomorphic encryption, wherein, wherein, N j is the public key of the participant P j received from the participant P j .

[0282] According to the Paillier algorithm,

[0283] In step S703, participant P i Let l homomorphic ciphertexts D i,j,ξ Send to participant P j .

[0284] In step S705, participant P i Generate proof Φ i,j Prove Φ i,j Includes β * and l β * Based on l-β i,j,ξ and l challenge values ​​e ξ Obtained through linear calculation. Based on the masking value γ i,0,ξ ,e ξ ,γ i,ξ It is obtained through linear calculation. In step S707, participant P... i Will prove Φ i,j Send to participant P j .

[0285] For zero-knowledge proofs Φ i,j Assuming If the range is [0, B2], then its assertions include B, B2, and {K}. j,ξ D i,j,ξ} ξ∈[l] Participant P i Including {γ i,ξ ,β i,j,ξ ,ρ i,j,ξ} ξ∈[l] As private data (witness), prove Φ i,j It can be used to prove each plaintext γ i,ξ The range is within [0, B], which means it belongs to Each plaintext β i,j,ξ The range is within [0, B2], which means it belongs to

[0286] Specifically, participant P i l masking values ​​γ can be generated as shown in formula (11) below. i,0,ξ Algorithm random number ρ i,j,0 and masking value β i,j,0 :

[0287] Then, as shown in formula (12) below, the homomorphic ciphertext D can be generated. i,j,0 :

[0288] Therefore, participant P i β can be calculated as shown in formula (13). * 1 and ρ * The value of Φ is used as proof i,j The data included:

[0289] In order to verify based on the Ring-Pedersen commitment, participant P i It can also generate:

[0290] Where ξε[l]

[0291] Where ξε[l].

[0292] Afterwards, participant P i The following commitment values ​​can be generated:

[0293] Where ξε[l]

[0294] Therefore, participant P i Also generate proof Φ i,j In and

[0295] In this implementation, participant P i The above commitment value and proof Φ can be used i,j Send to participant P j , for use in performing individual γ i,ξ and β i,j,ξ Scope verification. In one implementation, the promisor may also be used as the proof Φ. i,j Part of the data is sent to participant P. j .

[0296] In step S709, participant P j Based on proof Φ i,j 1 homomorphic ciphertext K j,ξ l challenge values ​​e ξ Homomorphic ciphertext D i,j,0 And l homomorphic ciphertexts D i,j,ξ Verify each γ i,ξ and β i,j,ξ The range.

[0297] Participant P j Upon receiving proof Φ i,j Next, we will first verify and prove Φ i,j In whether the range of [0, 2 ε+t B] and verify whether the range of β * is in the range of [0, 2 ε+t B2].

[0298] After that, the participant P j can verify whether the following equation (14) is established:

[0299] where the participant P j has received the value of D i , l D i,j,0 , l K i,j,ξ , l γ j,ξ , β i,0,ξ and ρ * from the participant P * , and whether the equation (14) is established can be determined by substituting these values and the value of each e ξ and the value of N j into the equation (14).

[0300] In the case where the equation (14) is established, similarly to the above equation (6), based on the strong RSA assumption, it can be determined that the l D i,j,ξ is homomorphically encrypted based on K j,ξ , γ i,ξ , β i,j,ξ and ρ i,j,ξ , because:

[0301] For the left side of the equation (14), assuming that D i,j,0 satisfies the definition of the equation (12), D i,j,ξ satisfies the definition in the step S701,

[0302] then it can be obtained that:

[0303] For the right side of the equation (14), assuming that β * and ρ * satisfy the definition of the equation (13), it can be obtained that the above equation (15) is equal to the right side of the equation (14). Therefore, according to the strong RSA assumption, the participant P j in the case where the equation (14) is verified based on the proof Φ i,j to be established, that is, it is equivalent to verify that the left and right sides of the equation (14) satisfy the above assumptions, respectively, so that it can be determined that the l D i,j,ξ is based on K j,ξ , γ i,ξ , β i,j,ξ and ρ i,j,ξObtained by homomorphic encryption.

[0304] In one implementation, participant P j We can also verify whether the following equations (16) and (17) hold true:

[0305] The verification of equations (16) and (17) can be found in the verification process of equation (9) above. Based on the strong RSA hypothesis, participant P... j Based on proof Φ i,j If equation (16) holds, then it is equivalent to verifying that... With l γ i,ξ Correspondingly, if equation (17) holds, it is equivalent to verifying β. * With l β i,j,ξ Therefore, we can further verify l D. i,j,ξ Based on K j,ξ γ i,ξ β i,j,ξ and ρ i,j,ξ The ciphertext obtained by homomorphic encryption.

[0306] Participant P j After the above verification is passed, similarly to the above, based on According to the forking lemma, each γ can be derived. i,ξ The range should be in [-2] ε+t B,2 ε+t Within B], thus proving that each plaintext γ is within a certain error range. i,ξ belong Based on β * =β i,j,0 +∑ ξε[l] e ξ (-β i,j,ξ According to the forking lemma, each β can be derived. i,j,ξ The range should be in [-2] ε+t B2,2 ε+t Within B2], this proves, within a certain error range, that each plaintext β... i,j,ξ belong

[0307] Regarding the above-mentioned proofs of the third zero knowledge Because its corresponding homomorphic ciphertext With the proof of the second zero knowledge Φ i,j,ξ The corresponding homomorphic ciphertext D i,j,ξ Based on the same homomorphic operation, it can therefore be used to verify the homomorphic ciphertext D. i,j,ξIn the same way, based on a plurality of third zero-knowledge proofs to a plurality of homomorphic ciphertexts corresponding plaintexts are batch-verified, which will not be described herein.

[0308] It can be understood that, although the method of batch-verification of ciphertexts is described above by taking a threshold signature as an example, the present specification is not limited thereto.

[0309] The present specification also provides a method of batch-verification of ciphertexts, executed by an encryption party, comprising:

[0310] generating l homomorphic ciphertexts, the l homomorphic ciphertexts corresponding to l first plaintexts;

[0311] generating a proof corresponding to the l homomorphic ciphertexts, the proof including a first numerical value, the first numerical value being obtained by linear calculation based on the l first plaintexts and l challenge values, the l challenge values being received from a verification party, each of the challenge values being within a first preset range, the proof being used to verify whether each of the first plaintexts is within a second preset range;

[0312] sending the l homomorphic ciphertexts and the proof to the verification party.

[0313] After receiving the proof, the verification party can verify whether each of the first plaintexts is within the second preset range based on the proof, the l challenge values and the l homomorphic ciphertexts.

[0314] Specifically, the verification party first verifies whether the first numerical value is within a third preset range, the third preset range corresponding to the second preset range; after verification, the proof, the l challenge values and the l homomorphic ciphertexts are substituted into a preset equation to verify whether the l homomorphic ciphertexts are obtained by homomorphic encryption of the l first plaintexts; in the case of verification, based on the third preset range and the first preset range, it is determined that each of the first plaintexts is within the second preset range.

[0315] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0316] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. The skilled person will also appreciate that, in addition to implementing the controller in pure computer readable program code, it is possible to implement the controller in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. to perform the same functions by logically programming the method steps. Such a controller can therefore be considered to be a hardware component, and the means included therein to perform the various functions can also be considered to be structures within the hardware component. Alternatively, or even additionally, the means to perform the various functions can be considered to be both a software module implementing the method and a structure within a hardware component.

[0317] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not rule out that with the development of future computer technologies, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, electronic mail devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0318] Although the method operational steps are described in the exemplary embodiments or flowcharts, more or fewer operational steps can be included based on conventional or non-creative means. The order in which the steps are listed in the embodiments is only one of the many possible execution orders of the steps, and does not represent the only execution order. In actual device or terminal product execution, the method order shown in the embodiments or the drawings can be executed in sequence or in parallel (for example, in a parallel processor or multi-thread processing environment, or even in a distributed data processing environment). The terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, product or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, method, product or device. Without more limitations, it does not exclude the presence of other same or equivalent elements in the process, method, product or device including the elements. For example, if the first, second, etc. terms are used to represent names, they do not represent any specific order.

[0319] For the convenience of description, the above device is described as various modules described in function. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or modules implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The above described device embodiments are only illustrative, for example, the division of the units is only a logical function division, and actual implementation can have another division method, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the coupling or direct coupling or communication connection between the displayed or discussed each other can be indirect coupling or communication connection between the interfaces, devices or units, and can be electrical, mechanical or other forms.

[0320] The present application is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices produce the device for implementing the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0321] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0322] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0323] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0324] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0325] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage, graphene storage, or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0326] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0327] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0328] The various embodiments described in this specification are described in the context of progressive embodiments, with each embodiment building on the previous one. The same or similar parts between embodiments are cross-referenced as appropriate. Each embodiment focuses on the differences between that embodiment and the previous one. In particular, the system embodiments are described relatively simply, as they are substantially similar to the method embodiments. In the description of the specification, the use of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the particular feature, structure, material or characteristic being described is included in at least one embodiment or example of the specification. Illustrative descriptions of the above terms do not necessarily refer to the same embodiment or example in this specification. Furthermore, the particular features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples. In addition, different embodiments or examples described in this specification, and the features of different embodiments or examples, can be combined and combined by those skilled in the art without contradiction, as appropriate.

[0329] The above only describes the embodiments of the one or more embodiments of the specification, and is not intended to limit the one or more embodiments of the specification. The one or more embodiments of the specification can have various changes and variations for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the specification shall be included in the scope of claims.

Claims

1. A method of batch verifying ciphertexts in a threshold signature, wherein, The threshold signature includes n participants, and the method comprises: Each of at least t+1 participants performs: Generating l homomorphic ciphertexts corresponding to l first plaintexts; Generating a proof corresponding to the l homomorphic ciphertexts, the proof including a first value obtained by linear calculation based on the l first plaintexts and l challenge values received from a second participant in the at least t+1 participants, each of the challenge values being within a first preset range, the proof being used to verify whether each of the first plaintexts is within a second preset range; Sending the l homomorphic ciphertexts and the proof to the second participant; The second participant verifies the range of each of the first plaintexts based on the proof, the l challenge values and the l homomorphic ciphertexts.

2. The method of claim 1, wherein the l homomorphic ciphertexts correspond to l algorithm random numbers, and the proof further includes a second value calculated based on the l algorithm random numbers and the l challenge values.

3. The method of claim 1, further comprising: Each of the n participants generates a homomorphic encryption public-private key pair respectively, and sends a homomorphic encryption public key to other participants.

4. The method of claim 1, the generating the l homomorphic ciphertexts comprising: Each of the at least t+1 participants generates l homomorphic ciphertexts in a preprocessing stage of the distributed threshold signature, the l homomorphic ciphertexts being used to generate l sets of preprocessing results.

5. The method of claim 4, wherein the l homomorphic ciphertexts include l first homomorphic ciphertexts, the l first plaintexts include l first random numbers, and the l first homomorphic ciphertexts are obtained by homomorphic encryption of the l first random numbers based on the l algorithm random numbers respectively.

6. The method of claim 5, each of the at least t+1 participants further performs: generating a first masking value and a second masking value, the first masking value is randomly selected within a third preset range corresponding to the second preset range, and the first value is calculated based on a weighted sum of the first masking value and the l first random numbers. The weight of each first random number is a challenge value corresponding to the first random number; The second masking value is co-prime with the homomorphic encryption public key, and the second value is calculated based on multiplication of the second masking value and a power of the l algorithm random numbers, wherein the exponent of each algorithm random number is a challenge value corresponding to the algorithm random number; The second homomorphic ciphertext of the first masking value is generated by taking the second masking value as a random number in homomorphic encryption, and the proof further includes the second homomorphic ciphertext.

7. The method of claim 6, wherein the second participant verifies the range of each of the first plaintexts based on the proof, the l challenge values and the l homomorphic ciphertexts, comprising: The second participant verifies whether the first value is within the third preset range; After verification, the proof, the l challenge values and the l homomorphic ciphertexts are substituted into a first preset equation for verifying whether the l homomorphic ciphertexts are obtained by homomorphic encryption of the l first plaintexts; In the case of verification, based on the third preset range and the first preset range, it is determined that each of the first plaintexts is within the second preset range. ​ 8. The method of claim 7, wherein each of the at least t+1 participants further performs: receiving an auxiliary parameter from the second participant, generating l+1 committed random numbers, generating l+1 first commitment values based on the auxiliary parameter, with the first masking value and the l first random numbers as l+1 commitment plaintexts; a third value is computed, said third value being a weighted sum of said l+1 committed random numbers, wherein a weight of the 0th committed random number is 1, weights of the 1st to lth committed random numbers are challenge values corresponding to the respective committed random numbers, and the proof further includes the third value and the l+1 first commitment values.

9. The method of claim 8, further comprising: substituting the l challenge values, and the first value, the third value, and the l+1 first commitment values in the proof into a second preset equation to verify whether the first value corresponds to the l first plaintexts.

10. The method of claim 4, wherein each of the at least t+1 participants further performs: receiving l first homomorphic ciphertexts from the second participant, the l first homomorphic ciphertexts being obtained by the second participant homomorphically encrypting l first random numbers based on l algorithm random numbers, respectively, the l homomorphic ciphertexts include l third homomorphic ciphertexts, the l first plaintexts include l third random numbers, the l third homomorphic ciphertexts further correspond to l second random numbers, each of the l third homomorphic ciphertexts being obtained based on a second random number, a first homomorphic ciphertext, and one of l fourth homomorphic ciphertexts obtained by homomorphically encrypting the l third random numbers using a public key of the second participant, respectively; the proof further includes l fourth values obtained by masking the l second random numbers based on l third masking values and the l challenge values, and the proof is further used to verify whether each of the second random numbers is within a fourth preset range, the third masking values being randomly selected within a fifth preset range corresponding to the fourth preset range.

11. The method of claim 10, wherein the fourth value is a value obtained by adding the third masking value and the challenge value and the product of the second random number.

12. The method of claim 10 or 11, further comprising: the second participant verifying whether the first value is within the third preset range and whether each of the fourth values is within the fifth preset range; after verification, substituting the proof, the l challenge values, l first homomorphic ciphertexts, and the l third homomorphic ciphertexts into a third preset equation to verify whether the l third homomorphic ciphertexts are homomorphic ciphertexts corresponding to the l third random numbers and the l second random numbers; in a case of verification, determining that each of the second random numbers is within the second preset range based on the third preset range and the first preset range, and determining that each of the third random numbers is within the fourth preset range based on the fifth preset range and the first preset range.

13. A method for batch verifying ciphertexts, performed by an encryption party, the method comprising: generate l homomorphic ciphertexts corresponding to l first plaintexts; generate a proof corresponding to the l homomorphic ciphertexts, the proof including a first value, the first value being obtained by performing linear calculation based on the l first plaintexts and l challenge values, the l challenge values being received from a verifier, each of the challenge values being within a first preset range, the proof being used to verify whether each of the first plaintexts is within a second preset range; send the l homomorphic ciphertexts and the proof to the verifier.

14. A method for verifying a batch of ciphertexts, implemented by a verifier, the method comprising: receiving, from an encryptor, a proof corresponding to l homomorphic ciphertexts, the l homomorphic ciphertexts corresponding to l first plaintexts, the proof including a first value, the first value being obtained by performing linear calculation based on the l first plaintexts and l challenge values, the l challenge values being provided by the verifier, each of the challenge values being within a first preset range; verifying, based on the proof, the l challenge values and the l homomorphic ciphertexts, whether each of the first plaintexts is within a second preset range.

15. The method of claim 14, wherein verifying, based on the proof, the l challenge values and the l homomorphic ciphertexts, whether each of the first plaintexts is within a second preset range, comprises: verifying whether the first value is within a third preset range, the third preset range corresponding to the second preset range; after verification passes, verifying whether the l homomorphic ciphertexts are obtained by homomorphic encryption on the l first plaintexts by substituting the proof, the l challenge values and the l homomorphic ciphertexts into a preset equation; in a case where verification passes, determining, based on the third preset range and the first preset range, that each of the first plaintexts is within the second preset range.

16. A computing device comprising a memory and a processor, the memory storing executable code, and the processor implementing the method of any one of claims 13-15 when executing the executable code.

Images