Threshold signature methods

Abstract

Threshold signature methods are described in which, when generating the threshold signature, a random value is sampled. Each signer generates masks for each signer in a signing set, wherein the sum of the masks is equal to a predetermined number. The masks for each signer are summed with the random value to generate an overall random value. The overall random value is used to generate an individual contribution that is contribution to a threshold signature generated based on the signer's secret share masked by the overall random value. During an aggregation step, the individual contributions are combined to generate the threshold signature whereby the contribution of the masks is eliminated.

Description

[0001]THRESHOLD SIGNATURE METHODS Technical Field The present invention relates to threshold signature methods and one or moreinformation processing apparatus for applying such methods. Background Recently there has been a National Institute of Standards and Technology(NIST) call for threshold schemes including signatures and encryption schemes. Athreshold signature scheme is a special type of multiparty computation that aims togenerate a digital signature. A threshold signature assumes that there are ^ signers, andthat any threshold ^ of the N signers can sign a message but ^ − 1 cannot. In a worldwithout quantum computers there are threshold signature solutions that are bothpractical and secure in highly adversarial environments. Examples of pre-quantumthreshold signature schemes include implementations of e.g. the Schnorr, ECDSA, RSA, or BLS signature schemes. These signature schemes are well developed and include security features such as robustness, identifiable aborts, small roundcomplexity, and backward compatibility with existing applications.In a world with sufficiently powerful quantum computers, cryptographic techniques need to be modified because the problems on which pre-quantum cryptographic algorithms are based will become solvable. There is a need for improved techniques for generating threshold signatures, which techniques may be applicable to both post-quantum and classical signature schemes. Summary According to a first aspect of the present invention, there is provided a threshold signature method performed by an information processing apparatus associated with a signer that has a secret share for generating a threshold signature, the method comprising: sampling a random value; generating masks corresponding to each signer in a signing set including the current signer, wherein the sum of the masks is equal to a predetermined number; summing the sampled random value and the mask for the current signer to generate a masked random value; deleting the random value and the share for the current signer; sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signer in the signing set; generating an overall random value by summing the masked random value and the received masks; using the overall random value to generate an individual contribution that is contribution to a threshold signature generated based on the signer’s secret share masked by the overall random value; wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated. In some implementations the predetermined number is zero. In suchimplementations, when the individual contributions are summed, the contribution of the overall random values formed by the masks is zero. In other implementations, the predetermined number is not zero. In suchimplementations, when the individual contributions are summed, the predeterminednumber is subtracted to remove the contribution to the overall random value formed by the masks. Sending a respective generated mask to each other signer using a secure channel may comprise communicating using an out-of-band communication channel. In some embodiments, sending a respective generated mask to each other signer using a secure channel comprises encrypting each mask for a destination signer in the signing set using a public key of a public key encryption mechanism. The mask may be encrypted by: sampling a nonce; extending the nonce to generate an extended nonce; encrypting the mask by XOR with the extended nonce to generate an encrypted mask; and encrypting the nonce with a public key of the destination signer. Generating masks by a signer may comprise randomly sampling masks for each other signer and setting the negative of the total of the randomly sampled masks to be sent to other signers as the value of the share for the signer. In such cases, the sum of the shares for the signer and each other signer is zero. Generating masks by a signer may comprise generating random seedsassociated with each other signer, generating masks from the seeds using a pseudo- random number generator, and setting the negative of the total of the masks to be sentto each other signer as the value of the mask for the signer. In such implementations,the sum of the masks for the signer and each other signer is zero. The seeds may bestrings having a length that is shorter than the length of each of the masks. The individual contribution may take the form of sum of the overall randomvalue and a product of the Lagrange coefficient, the secret share, and a challenge thatis generated based on a hash of the message. The method may further comprise sending a commitment that commits thesigner to the sampled random value. The commitment may be formed by hashing astring that depends upon the sampled random value. The method may be performed byeach of a threshold number of signers in a signing set. The signing set may comprise atleast a threshold number of signers required to generate a threshold signature. The method may further comprise combining the individual contributions of a threshold number of signers to generate an overall contribution. The overallcontribution may form part of the threshold signature.Sampling the random value, generating the masks, summing the sampled random value and the mask for the current signer, deleting the random value and the share for the current signer, and sending a respective generated mask to each othersigner may happen in a first round or pre-processing stage of the method.Receiving masks from each other signer in the signing set, generating an overall random value, and using the overall random value to generate an individual contribution may occur in a subsequent round of the method. In addition to deleting the random value and the share for the current signer, thesigner may delete the masks for all other signers after they have been sent using thesecure channel. According to a second aspect of the invention there may be provided information processing apparatus comprising a processor and a memory, wherein the memory stores instructions that, when executed by the information processing apparatus, cause the information processing apparatus to perform a method comprising: sampling a random value from a distribution; generating masks corresponding to each signer in a signer set including the current signer, wherein the sum of the masks is equal to a predetermined number; summing the sampled random value and the mask for the current signer to generate a masked random value; deleting the random value and the share for the current signer; sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signers in the signing set; generating an overall random value by summing the masked random value and the received masks; using the overall random value to generate an individual contribution that is contribution to the signature generated based on the signer’s secret share masked by the overall random value; wherein during an aggregation step, the individual contributions from a plurality of signers are combined to generate the threshold signature whereby the contribution of the masks is eliminated. According to a third aspect of the invention there may be provided, a programthat, when executed on an information processing apparatus, cause the information processing apparatus to perform a method according to the first aspect of the invention. Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 is a schematic diagram of components of an information processingapparatus; Figure 2 is a figure illustrating steps of a three-round post-quantum threshold signature scheme; Figure 3 is a figure illustrating a further step of the three-round post-quantum threshold signature scheme; Figure 4 is a figure illustrating steps of a three-round classical threshold signature scheme; Figures 5 is a figure illustrating generation of the signature generated by thethree-round classical threshold signature scheme of Figure 4; Figure 6 is a figure illustrating verification of the signature shown in figure 5; and Figures 7 and 8 are figures showing steps of a two-round post-quantum threshold signature scheme. Detailed Description Digital signatures are a method of ensuring the authenticity and non-repudiation of electronic documents and messages. They are an important component of secure electronic communication and are widely used in applications such as electronic contracts, financial transactions, and email communication. The use of digital signatures offers several advantages over traditional paper-based signatures. First, they provide a higher level of security, as it is much moredifficult to forge a digital signature than a handwritten signature. Second, they provide a greater level of assurance regarding the authenticity and integrity of the signeddocument or message, as any changes made to the original document will result in adifferent signature and thus an invalid signature. Typically, digital signatures may be verified by anyone with access to the signer's public key, the message to which the signature was applied, and the signature. Threshold signature schemes based on lattice assumptions and classical signature assumptions will be described below. The post-quantum threshold signature schemes assume that the ModuleLearning with Errors (MLWE) problem, the Module Short Integer Solution (MSIS)problem, and variants thereof are hard to solve.Preliminaries The signature schemes and encryption / decryption scheme described below may be performed on one or more information processing apparatus such as a server, computer, and / or mobile device. A central actor will be described below. The central actor may be a separate information processing apparatus, such as a server or cloud service, and other steps of the signature scheme may be performed on user devices associated with different signers in the signature scheme. In one example a group of signers in a group may wish to be able to sign a message as long as a threshold numberT of the signers in the group contribute to the signature process. The signers mayparticipate in the signature scheme using separate user devices. This applies similarly to a threshold decryption scheme, where each decrypting party may use a separate user device. In other implementations all the processing may be performed on a single information processing apparatus and there may be a single user. For example, a user may have a signing key associated with a cryptographic asset, such as an asset on a blockchain. The user may wish to keep the signing key secure and resistant to loss. Accordingly, the user may generate shares of the signing key and store them on different storage devices. In this case, the user may sign a document using the storage devices as long as the user has access to at least a threshold number of the devices. Similarly, a malicious actor would need access to a threshold number of the storage devices to apply the signature. In some implementations the storage devices may be drives, such as solid- state drives or the like. All steps of the method in this case could be performed on a single information processing apparatus based on information relating to the key shares stored on the storage devices. The description below will describe potential signers. However, the term ‘potential signer’ or ‘signer’ may be used interchangeably with the term ‘secret share’ because as just described, the method could be performed by a single user in respect of each secret share. Accordingly, the term ‘signer’ should not be interpreted as requiring a separate user or a separate information processing apparatus. Figure 1 is a schematic diagram of components of an example information processing apparatus 1 suitable for use in the embodiments described below. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 10, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processing apparatus 1 comprises a processor 11, a storage in the form of memory 12, a network module 13, a display 14, and a user interface 15. The network module may allow the information processing apparatus 1 to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 16. Further components may be provided but are not shown or described. The information processing apparatus may take the form of, among other things, a cloud infrastructure, a server, and IoT device, or a portable or wearable computer. Any of the steps of the subsequently described methods may be performed bycomputer-readable instructions of one or more programs stored in a non-transitorystorage and executed by a processor on one or more information processing apparatuses. First embodiment Figure 2 illustrates steps of a threshold signature method. The method isperformed by a set of N signers, T of which are required to complete a thresholdsignature. Before the signature method begins, each of the N signers is provided with asecret key, ski. In some implementations, the secret keys may be generated by a central actor (e.g. an application on a server or cloud) and the keys are distributed to the Nusers. In other implementations, the secret keys may be distributed on a peer-to-peerbasis with one of the group of N users generating the secret keys and distributing them.In this case, the member of the group of users may be referred to as the central actor. Inmore complicated implementations, the keys may be generated and distributed using multi-party computation techniques. For the purposes of this description, we assumethat there is a central actor which may be a central server / cloud or one or more of the Nsigners. The central actor generates a uniform matrix, A, over a ring of polynomials, Rq.Rq is a ring of polynomials modulo q. The Ring, R, is defined for n and q asand Rq is defined as:The matrix, A, has dimensions of k by l and each entry in the matrix is a polynomial ofThe central actor generates a secret, s, from a distribution D. D is a distributionover Rq. The central actor uses Linear Shamir Secret Sharing to generate N secret shares,si. In accordance with this method, a polynomial, P, with degree T-1, is generated overRq. T is the threshold number of shares required to perform the signature. The thresholdnumber of shares, T, may be considered, in some examples, to be the number of active signers required to generate the signature. The polynomial at zero is equal to the selected secret s i.e. P(0) = s. The Shamir Secret sharing generates N secret shares from the polynomial, P.The value N is the number of secret shares to be generated where N is greater than orequal to T the threshold number of secret shares required to complete the signatureprocess. The N secret shares are provided to a signing set of potential signers.Reconstruction of the polynomial P will be performed later. The reconstructionis performed using Lagrange polynomials. For i ^ SS, we define:^ ^ where LSS,i is a Lagrange coefficient. A set of evaluation points, E, is defined eachhaving coordinates xi, si for each of N different values of i (corresponding to the N secretshares). si = P(xi) In this case: .^^ Accordingly, during the key generation process, each potential signer receives a respective secret share ski= si. The lattice, A, is made available as a public parameter. The preliminaries just described are shown at the top of Figure 2 in a first portion201. The following three sections illustrate steps of a three-round threshold signature scheme. In some implementations each round will be time limited such that each of a threshold number of active signers (hereinafter ‘signers’) of the N potential signers should complete the specified steps within the time limit. If the threshold number of signers do not complete the required steps for a round within the time limit, the signature method may be aborted. In a first round, each signer generates and makes available a commitment, cmti, and a mask, Δ^,^. In a second round, each signer makes available an LWE commitment, wi. In a third round, each signer makes available a response zi. The central actor can then generate a signed message based on the available information. At the end of each round the signers may check that the round has been completed before initiating steps in the subsequent round. In the first round, shown in portion 202 of Figure 2, each signer samples a smallephemeral randomness riand a small noise (or error), ^^^. Each sample is taken from a distribution across Rq. ALearning with Errors (LWE) commitment, wi, is generated based on the latticeA generated in the previously described key generation phase and the generated smallephemeral randomness, ri, and small noise (error), ^^^, generated by the signer. The LWE commitment, wi, is the sum of the small noise (error), ^^^and a product of the uniform matrix, A, and the generated small ephemeral randomness, ri. Ahash commitment, cmti, is generated. Each signer generates a hash using afunction Hcom based on the identifiers of members of the signing set, SS, a message tobe signed, M, and the generated LWE commitment, wi. The Hash function H is labelled‘com’ to distinguish from other hash functions. The Hash function may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. Next a mask Δ^,^ is generated from a function ‘ZeroShare()’. ZeroShare isapplied to members of a signing set, SS, which may be any subset of the N signers thatare involved in generating a threshold signature. The function ZeroShare is configuredsuch that on summation of masks generated by the function ZeroShare for the subset,SS, formed of N or fewer signers, the sum outputs 0. As will be apparent from itsconstruction below, all the generated masks (shares of zero) need to be summed for the sum to be equal to zero. 0 In other words, ZeroShare outputs an additive sharing of the value 0. One wayto generate such a share is to randomly sample (Δ^)^∈^^ / {^} and set Δ^ Δ^where the notation j ^ SS / {i} indicates that j is an element of the signing set excluding the signer, i, who is generating the ZeroShare. To express this another way, each signergenerates random values for the mask for every other user and then sets the negativesum of those values as their own mask. When all the masks (zero shares) over thesigning set (including the signer who is generating the zero shares) are summed thevalue will by construction be zero. Amore memory efficient method could be to sample random seeds(^^^^^)^∈^^ / {^} , generate Δ^ = ^^^(^^^^^) through a pseudorandom numbergenerator PRG (e.g. SHA) and to . Here, if each seed, randj (abinary string), is shorter than Δ^ ∈ ℛ^^there may be an overall memory saving depending on the implementation. Following the generation of the masks, a masked ephemeral randomness, ^^,^ isgenerated as a sum of the ephemeral randomness ri and the mask Δ^,^that is the maskvalue that the signer generated for itself.The commitment, cmti, and mask, Δ^,^, of each signer are made available. Thecommitments are made publicly available (i.e. available to all members of the signingset SS) whereas the masks are sent by a secure channel to each other party. Accordingly,each signer only receives the masks that were generated for it. The manner by which the mask is sent securely to each other party may vary from implementation-to-implementation but could include use of an out-of-bandcommunication channel, encryption using the receiving parties public key in a publickey infrastructure, or any other known mechanism for securely transmitting to aparticular signer. In one efficient implementation, the signers in the signing set are part of a publickey infrastructure and the signer sending the mask may sample a random nonce andencrypt it using a destination signer’s public key to generate a nonce ciphertext.^^ ← ^^^. ^^^(^^^, ^^^^^)The nonce is then extended to have the same length as the mask Δ^,^using a pseudo-random number generator, G. The mask can then be encrypted by XOR withthe extended nonce to generate a mask ciphertext ctotp (one-time pad):^^^^^ = ∆^,^ ^ ^ (^^^^^, ^, ^)G can be instantiated using standard cryptographic hash functions such as SHA.The signer i sends the nonce ciphertext and the mask ciphertext (ct, ctotp) to thedestination signer. The destination signer can decrypt the nonce ciphertext using itsprivate key, extend the nonce using the same pseudo-random number generator G, andrecover the mask by XOR between the extended nonce and the encrypted mask. Each signer also receives from other signers in the signing set, SS,corresponding mask values that were generated in a similar way. In other words, eachsigner generates masks using the ZeroShare function and each signer receives a maskfrom each other signer. Each signer deletes their ephemeral randomness, ri, and the masks that theygenerated once they have been sent. This is referred to as deleting the values from thesigner’s state in Figure 2. In a second round of the three-round signature scheme, shown in the thirdportion 203 of Figure 2, each signer has securely received masks from each other signerin the signing set as noted above. Each signer generates an overall randomness, ^^, by adding the maskedephemeral randomness, ^^,^ , to the sum of the received mask values. This step isillustrated in the second round in the implementation of the first embodiment. In other implementations, this step may be performed in the third round. A further check is made to ensure that the contributions from the first round are complete. If the commitments from the first round are complete, each signer shares theirLWE commitment, wi, generated in the first round in a second contribution, contrib2.This may be shared generally (i.e. made public to the signing set) and does not need tobe sent using a secure channel to each device separately. Of course, the communication may be secure within the group of signers. The bottom portion 204 of Figure 2 shows the third round of the signaturemethod. Initially it is checked that the first and second rounds were successfullycompleted with contributions received from each of the signers. Each signer calculates an aggregated commitment, w, which is obtained bysumming, across the signers in the signing set, the LWE commitments, wi, madeavailable at the end of the second round. The aggregated commitment, w, may be subjected to bit dropping in accordance with the techniques described in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pinoet al, 7th Feb 2024, EUROCRYPT 2024. The bit dropping is optional and may serveseveral purposes. The dropping of bits serves to make the commitment shorter and thus the resulting signature shorter and also serves to improve the resistance of the scheme from direct forgery attacks by hiding the ephemeral randomness in the aggregated commitment, w. The bit dropping is similar to the bit dropping technique that is usedin connection with CRYSTALS-Dilithium and is not described here in detail.Each signer calculates a global challenge, c, that is a hash of the public key, vk, the message, M, and the aggregated commitment, w. Although not shown, the hash function used is Hraccoon. The Hash function H is labelled ‘raccoon’ to distinguish from other hash functions, such as the earlier ‘com’ hash function. Further details of the hash function are given further below. Each signer generates an individual contribution zi. The individualcontribution is the sum of two components. The first component is a product of theglobal challenge, c, the signer’s Lagrange coefficient, LSS,i, and the signer’s secretshare, si. The second component is the overall ephemeral randomness, ^^ , that wasgenerated in the second round.Each signer makes available their individual contribution, zj, to the other signers. Figure 3 illustrates steps of a combine method performed by a central actor. Thecentral actor obtains the LWE commitments, wi, and individual contributions, zi,generated by the signers, i. The central actor also obtains the public key, vk = (A,t),generated in the preliminaries shown in the first portion 201 of Figure 2. Here it is noted that t = As + e. The central actor generates an aggregated commitment, w. This step is the sameas was performed by each of the signers in the third round described above. The aggregated commitment, w, is obtained by summing, across the signers, the LWE commitments, wi, made available at the end of the second round. The aggregatedcommitment may be subjected to bit dropping as mentioned above.The central actor generates an aggregated response, z, by summing each of theindividual contributions, zi, made available at the end of the third round.The central actor then generates a global challenge, c. The global challenge, c,is generated by hashing the public key, vk, the message to be signed, M, and thecalculated aggregate commitment, w. The hash is generated using a function Hraccoon.The Hash function Hc is labelled ‘raccoon’ to distinguish from other hash functions,such as the earlier ‘com’ hash function used to generate the commitment. The Hashfunction may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. In a further example, SHAKE described in NISTpublication FIPS PUB 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions may be used. The Hash functions Hcom and Hraccoon should preferably be different, at least in the parameters used. The selection of different hash functions has the effect of domain separation and may improve the security of the signature scheme. Anoisy commitment, y, is generated by the central actor. The noisycommitment, y, is generated from the difference of two components. The firstcomponent is a product of the uniform matrix, A, and the aggregated response, z. The second component is a product of the global challenge c, and t = As + e generated in the preliminaries. The calculated difference is subjected to bit shifting to multiply thevalue by two to the power ʋt. The noisy commitment may then subject to bit droppingas mentioned above. Ahint, h, is generated by the combine method. The hint is a difference betweenthe aggregated commitment, w, and the noisy commitment, y. The signature of the message, M, is provided. The signature includes threecomponents: the global challenge, c, the aggregated response, z, and the hint, h. Public parameter ʋt is referred to above. These are again described in moredetail in Threshold Raccoon: Practical Threshold Signatures from Standard LatticeAssumptions, Del Pino et al, 7th Feb 2024, EUROCRYPT 2024. In general, it isdesirable to maximise the value of ʋt in order to drop more bits. This has the beneficial effect of shortening the bit sizes. However, security of the scheme against direct forgery attack decreases with increased ʋt. Accordingly, while different values of ʋt can be selected, in some examples, they may be chosen as follows:T is the threshold number of users as identified above, σW is the standarddeviation of the distribution used to select the error when generating the public key, andc is the global challenge. In a typical implementation, around 80% of the bits may bedropped when generating the noisy commitment, y.After forming the threshold signature a further party, who may or may not be amember of the signing set, can verify the signature. The party verifying the signature isassumed to also have a copy of the message, M, which has been signed and againstwhich the signature is being checked. The party also has a copy of the public key, vk.Other public parameters described above, including ʋt , and the hash function, Hraccoon,are also available to the verifying party. The signature can be verified by checking that:^^ = ^(^^, ^, ^^ − ^. ^ + ℎ)^^ = ^If ^^is equal to the challenge value c, the signature is verified. If ^^is not equalto the challenge value c the signature is not verified.In other words, a signature derived value is a product of the uniform matrix, A,and the aggregated response, z, minus a product of the global challenge, c, and t = As+ e from the public key. The signature derived value may be subjected to bit droppingof ʋW bits (not shown) and has the hint, h, added to it. A new challenge value, ^^, iscalculated by taking a hash of: the public key, the message, and the signature derived value after bit dropping and addition of the hint. A further check is performed to see that a vector formed of a concatenation of the aggregated response, z, and the hint, h, is shorter than, B. The shortness of the vectorrelates to the module short integer solution (M-SIS) problem. B is the two-norm boundon the signature and is set larger than zero and less than q (recalling from above thatthe uniform matrix is a set of polynomials of modulo q). B should be set to a largeenough value for the M-SIS problem to allow the signer to realistically find a signature.On the other hand, B should be set small enough to provide security with respect to theM-SIS problem. More information may be found in Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions, Del Pino et al, 7thFeb 2024,EUROCRYPT 2024. Further details on setting a suitable value of B may be found, forexample, in Chitchanok Chuengsatiansup, Thomas Prest, Damien Stehlé, AlexandreWallet, and Keita Xagawa. ModFalcon: Compact signatures based on module-NTRU lattices, ASIA ACCS 20, pages 853 to866. In one example: In which l, k, q are defined in the Module Short Integer Solution problem. q isthe modulo of the Ring, k and l are dimensions of the Ring. n is the order of polynomialsof the Ring (see definition above). The parameter "β" is related to an algorithm calledBKZ (block Korkine-Zolotarev). An approach to solve MSIS is via the BKZ algorithm.β is a parameter of the BKZ algorithm. The success probability and the running time of BKZ are both increasing functions of β. Accordingly, the equation above guarantees that BKZ can only succeed with reasonable probability if β is set large enough. Accordingly, β can be set so that the running time required for BKZ to break the security of the signature scheme is too large to be tractable and the value B can be determined accordingly. Afeature of the above method is that the overall ephemeral randomness, ^^, isgenerated at each signer based on a sum of the ephemeral randomness, ri, which is beingmasked, and the received masks (zero shares) and the mask (zero share) generated bythe signer for itself. When the aggregated response, z, is generated in the combinemethod, all the masks are combined. By virtue of the masks being shares of zero, whenthey are added together they sum to zero leaving the sum of the ephemeral randomness,ri, of each signer. By using this technique, if a state of a signer leaks, the masked or the overall ephemeral randomness, ^^, do not leak secret parametersof the threshold signature method. Accordingly, the masks add a layer of security known as adaptive security. Adaptive security provides security even againstadversaries that can arbitrarily chose which signers to corrupt after observing all thecommunication channels. Second embodiment The ZeroShare technique was described above in connection with a post- quantum threshold signature scheme. However, the technique is more generallyapplicable and may be used with classical threshold signature schemes as well.Figure 4 is a diagram showing steps of a classical threshold signature scheme. As before we assume that there are N signers, T of which are required to generatea signature. We also assume that there is a central actor which may be a centralserver / cloud or one of the N signers as described above.In a preliminary stage 401 a value a is sampled and a public key vk is generated,ga, where a is the value of a secret key, sk. The value g is made a public parameter.In the following, letters indicated with a lower case (e.g., a, z) are over a ring(ℤp, +, X), the values indicated by upper case letters and the verification key (e.g., R,vk) are over a “multiplicative” group (G, x). The central actor uses Linear Shamir Secret Sharing to generate N secret shares,ai. In accordance with this method, a polynomial, P, with degree T-1, is generated over^^. T is the threshold number of shares required to perform the signature. The thresholdnumber of shares, T, may be considered, in some examples, to be the number of active signers required to generate the signature. The polynomial at zero is equal to theselected secret a i.e. P(0) = a.The Shamir Secret sharing generates N secret shares from the polynomial, P.The value N is the number of secret shares to be generated where N is greater than orequal to T the threshold number of secret shares required to complete the signatureprocess. The N secret shares are provided to a set of potential signers.Reconstruction of the polynomial P will be performed later. The reconstructionis performed using Lagrange polynomials. For i ^ SS, we define:^where LSS,iis a Lagrange coefficient. A set of evaluation points, E, is defined eachhaving coordinates xi, si for each of N different values of i (corresponding to the N secretshares). ai = P(xi) In this case ^= ^ ^^^,^ . ^^^∈^^ Accordingly, during the key generation process, each potential signer receives a respective secret share ski = ai. In a first round of the signature scheme shown in portion 402 of Figure 4, eachsigner samples an ephemeral randomness, ri.Each signer generates a nonce, Ri, that is the public parameter, g, to the power of the ephemeral randomness, ri. A commitment, cmti, is generated that is a hash of the identities of parties in a signing set, the message, M, and the nonce, Ri. As with the first embodiment, the hash function is designated Hcom to distinguish it from other hash functions used. The hash function may be a hash function such as BLAKE or SHA. Next a mask Δ^,^ is generated from a function ‘ZeroShare()’. As with the firstembodiment, the function ZeroShare is configured such that on summation of masksgenerated using ZeroShare over the signing set, SS, formed of N or fewer signers, itoutputs 0. 0 In other words, ZeroShare outputs an additive sharing of the value 0. The method for generating masks (zero shares) described in the first embodiment are equally applicable to the second embodiment and the description is not repeated. A masked ephemeral ^^,^is generated as a sum of the ephemeralrandomness ri and the mask Δ^,^ that is the mask value that the signer generates for itself. The commitment, cmti, and mask, Δ^,^, of each signer are made available. Thecommitments are made generally available (made public to the signing set) whereas themasks are sent by a secure channel to each other party. How the mask is sent securelyto each other party may vary from implementation-to-implementation but could include use of an alternative communication channel, encryption using the receiving parties public key or other known mechanism for securely transmitting to a particular signer. The techniques for secure communication described in connection with the first embodiment are equally applicable to the second embodiment. Each signer also receives from other signers in the signing set, SS,corresponding mask values that were generated in a similar way. In other words, eachsigner generates masks using the ZeroShare function and each signer receives a maskfrom each other signer. Each signer deletes their ephemeral randomness, ri, and the masks generated using ZeroShare. This is referred to as deleting the values from the signer’s state in Figure 4. In a second round of the three-round signature scheme, shown in the thirdportion 403 of Figure 4, each signer has securely received masks from each other signerin the signing set as noted above. Each signer generates an overall randomness, ^^ , by adding the maskedephemeral ^^,^, to the sum of the received mask values. A further check is made to ensure that the contributions from the first round are complete. If the commitments from the first round are complete, each signer shares theirnonce, Ri, generated in the first round in a second contribution, contrib2. This may beshared generally and does not need to be sent using a secure channel to each device separately. Of course, the communication may be secure within the group of signers. The bottom portion 404 of Figure 4 shows the third round of the signaturemethod. Initially it is checked that the first and second rounds were successfully completed with contributions received from each of the signers. Each signer calculates an aggregated nonce, R, which is obtained by forming aproduct, across the signers, of the nonces, Ri, made available at the end of the secondround. Each signer calculates a global challenge, c, that is a hash of the public key, vk, the message, M, and the aggregated nonce, R. Although not shown, the hash function used is Hclass. The Hash function H is labelled ‘class’ to distinguish from other hashfunctions, such as the earlier ‘com’ hash function used to generate the commitment.Each signer generates an individual contribution zi. The individual contributionis the sum of two components. The first component is a product of the global challenge,c, the signer’s Lagrange coefficient, LSS,i, and the signer’s secret share, ai. The second component is the overall ephemeral randomness, ^^, that was generated in the second round. Each signer makes available their individual contribution, zj, to the other signers. Figure 5 shows steps of an aggregation phase performed by a central actor. The individual contributions shared in the third round are summed to generate an overallcontribution, z. The nonces shared in the second round are multiplied together togenerate an overall nonce, R. The signature is formed of the overall nonce and theoverall contribution (z, R).Figure 6 shows steps of a method for verifying the signature. The signature may be verified by any party regardless of whether they are a member of the signing set. Theparty generates a challenge, c, by taking a hash of the public key, vk, the message, M,and the overall nonce, R. The hash function, H, and public key, vk, are known to theverifying party because these are made available as public parameters. The message,M, is known because the signature is being checked against the message.The signature is checked by checking the equality: ^^ = ^^^ × ^where g and the public key, vk, are public parameters. If the equality holds true then the signature is verified. Third embodiment The first and second embodiments relate to three-round signature schemes. Thethird embodiment relates to a two-round signature scheme. Figures 7 to 8 illustrate atwo-round threshold signature scheme in which the commitments take the form of avector and can be generated in a pre-processing process before a single stage signatureprocess. Figure 7 is a figure illustrating three processes: a setup process (Setup),a key generation process (KeyGen), and a pre-processing process (PP). The Setup process starts in step 1 by defining a polynomial Ring, A. The polynomial ring is of the same type as described in the first embodiment. In step 2, parameters of the polynomial ring and the signature scheme are denoted tspar. The object tspar includes details of the polynomial ring A, the numberN is a number of users, and the number T of signers required to complete a signature.In step 3, tspar is made available to all members of the signer group and thecentral actor. The central actor is defined as for the first two embodiments.In the key generation process, KeyGen, the parameters of tspar are parsed in step 1. In step 2, the central actor generates a secret, s, from a distribution Dt. Dt is a Gaussian distribution over Rq. Accordingly, s is a sampled polynomial modulo q. Similarly, a small error, e, that is small relative to the lattice of the ring A such that t will be close to a polynomial in the polynomial Ring A. In step 3, t is defined as the learning with errors (LWE) problem t = 2. (As+e).In the particular example shown, the LWE problem includes a multiple 2. However, in other implementations this term may be varied. The LWE problem is subject to bit dropping by an amount ʋt. In steps 4 to 6 Shamir secret sharing is performed to generate a secret share, si,for each user of N users. The polynomial is of degree T-1 such that T secret shares areenough to reconstruct a polynomial P. The value of the polynomial P at 0 is equal to 2 times the secret, s. In step 7, a public key, vk, is defined which is the parameters of the polynomial ring and signature scheme, tspar, and the LWE problem, t. In step 8, a secret key, ski, is defined for each user in the signer group. The secretkey, ski, is the secret share, si, for the user.In step 9, the public key is made available. Each user receives a respective secret key, ski. The secret keys are not made publicly available or available to other users in the signer group. Accordingly, each user only receives their secret share, si. The preprocessing (PP) process is performed by at least each user in a signing set of T users. The steps of the PP process do not require use of the message to be signed, M. Accordingly, the PP process may be performed as an offline process prior to signature in the Sign process. In step 1 of the PP process, the user parses the public key, vk, to obtain tspar and the LWE problem, t. In step 2, the user parses tspar to obtain the ring A, the number of users N and the threshold number of users T. In steps 3 to 5, a number, rep, of commitment values indicated by index b aregenerated by each user. rep is a number that is selected such that |^|^^^^^ ≥ 2^. Theparameter λ is selected according to the number of bits of desired level of security.Accordingly, for 128-bit security, λ is set to 128.^ is a set of signed monomials, × [^]. In asubsequent signing step, random weights β will be generated that are elements of the set of monomials. Accordingly, rep, is a number of individual commitments, wi,b, that are generated and rep is selected to ensure a large enough range of possible random weights and hence to the security of the scheme. In step 4, rep randomness, ri,b, and associated errors, e′i,b are sampled using aGaussian distribution. In step 5, each user generates individual commitments wi,b, which are a product of the randomness and the polynomial Ring, A, plus the error. The individual commitments, wi,b, are concatenated into an individual commitment vector,^^^^^⃑ , in step 6. The rep randomness values, ri,b, also form a rep randomness vector.In step 7, a is generated from a function ‘ZeroShare()’. As with thefirst and second embodiment, the function ZeroShare is configured such that onsumming of masks generated by ZeroShare over any subset of the signing set, SS,formed of N or fewer signers, it outputs 0. 0 Techniques for generating a mask have been described in connection with thefirst and second embodiments are applicable and will not be repeated here.The rep randomness vector, ri,b, has the mask value Δ^,^,^ that the signer hascreated for themselves added to it to generate a masked rep randomness vector, ^^,^,^ .The original rep randomness vector, ri,b, and the mask value Δ^,^ are then deleted.The individual commitment vector is set as a token ppsid,i. The individual commitment vector and the masked rep generated randomness, ^^,^,^, form a state stsid. The token and state are returned from the preprocessing process. In step 11, the masks, Δ^,^ , are sent by a secure channel to each other party. Theoptions for securely sending the masks discussed in the first and second embodiment are applicable and are not repeated here. Figure 8 shows steps of a signature process, Sign, performed by each signer andan aggregation process, Agg, that may be performed by the central actor, and a signatureverification process, Verify, performed by a party receiving the signature. The Sign process is performed by each signer in a signing set, SS, of at least Tusers. The user first parses the secret key, ski, in step 1. In step 2, the user parses the state, stsid. Step 3 includes a series of checks and identifies that the Sign process is performed by users in a signing set, SS, that is a subset of the set of N user devices. Theindex i is used to indicate each user in the signing set, SS. The state is checked to ensurethat each user in the signing set has performed the pre-processing method. In step 4, the user device obtains the individual commitment vectors from the tokens from other users in the signing set. In step 5, a commitment, ctnt, is generated that is a concatenation of a sessionid, the identity of users in the signing set, the message to be signed, M, and the individual commitment vectors of all users in the signing set. In step 6 a series of rep random weights, βb having index b, are generated using a random oracle, such as a Hash function, G. G, which maps, {0, 1}∗→ {1}×^rep−1is used to aggregate the individual commitments into one commitment. In the preprocessing process each user outputs rep commitments and G is used in steps 9 and 10 to aggregate them. The hash function G may be a hash function of the type that appears in Fiat-Shamir based signatures, such as CRYSTALS-Dilithium and Schnorr signatures. The hash function G takes the public key, vk, and the commitment, ctnt, as inputs. Steps 9 and 10 aggregate the commitments. In step 9, the rep components of each individual commitment vector are summed together using the random weights generated in step 9 to generate an aggregated commitment per user, wj. The aggregated commitments per user are then summed over the users in the signing set in step 10 to generate an overall commitment, w. The overall commitment, w, is subject to bit dropping by ʋw bits. In step 11, an overall randomness ^^,^is generated as the sum of the maskedrandomness, ^^,^,^ and the received masks that were sent via a secure channel.In step 12, a challenge, c, is generated using a hash function, H. The hash function H is different from hash function G. The hash functions may be derived from a single hash function using appropriate domain separation. The challenge is generated by taking a hash of the public key, vk, the message, M, and the overall commitment, w. In step 13, an individual contribution, zi, is generated. The individualcontribution is formed as a sum of two terms. The first term is a product of thechallenge, c, a Lagrange coefficient, Lss,i, associated with the device and the secretshared stored by the device, si. The second term is a sum over b of the random weights,βb, and the overall randomness, ^^,^.In step 14, the state, stsid, is set to null. In step 15, an individual signature contribution, ^^^^^^,^,is returned by each user. The individual signature contribution comprises the overall commitment, w, and the individual contribution, zi. The aggregation process, Agg, shown in Figure 8 is a combine operation performed by the central actor. In step 1, the central actor obtains the public key, vk = (tspar,t), generated in the key generation phase. Here it is noted that t = 2.(As + e). In step 2, tspar is parsed to retrieve the polynomial ring, A, the number of users, N, and the threshold number of users for signature, T. At step 3, the individual signature contributions, ^^^^^^,^, are parsed to retrieve the overall commitment, w, and the individual contribution, zi. At step 4, the central actor generates a final commitment, w. The final commitment, w, is obtained by summing, across the signers, the overall commitments, wi, included in the individual signature contributions. The final commitment is subjected to bit dropping in accordance with a parameter, ʋW, which is a parameter that is made openly available to signers using the signature method. At step 5, the central actor generates an aggregated response, z, by summing the individual contributions, zi. At step 6, the central actor generates a global challenge, c. The global challenge, c, is generated by hashing the public key, vk, the message to be signed, M, and the total commitment, w, calculated in step 4. The central actor generates the hash using a function H. The Hash function may, in some examples, be selected from the four recommended hash functions in NIST special publication 800-185: SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and Parallel Hash. In a further example,SHAKE described in NIST publication FIPS PUB 202: SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions may be used. In step 7, a noisy commitment, y, is generated by the central actor. The noisy commitment is generated from the difference of two components. The first component is a product of the polynomial ring, A, and the aggregated response, z. The second component is a product of the global challenge c, calculated in step 6, and t = 2.(As + e) generated in the key generation phase. The calculated difference is subjected to bit shifting to multiply the value by two to the power ʋt. This is a renormalization to allow for bit dropping. The noisy commitment is then subject to bit dropping by ʋWbits. Bothʋt and ʋW are public parameters.At step 8, a hint, h, is generated by the central actor. The hint is a difference between the total commitment, w, and the noisy commitment, y. At step 9, the signature of the message, M, is provided. The signature includes three components: the global challenge, c, the aggregated response, z, and the hint, h. Public parameters ʋt and ʋW are referred to above and may be generated asdescribed in Threshold Raccoon: Practical Threshold Signatures from Standard LatticeAssumptions, Del Pino et al, 7thFeb 2024.As the signature generated by the third embodiment is the same as that generatedin the first embodiment, the verify process shown in Figure 8 is the same as thatpreviously described. The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. For example, the techniques are equally applicable to a classical two-round threshold signature scheme such as a two-round Schnorr threshold signature (coined FROST in FROST: Flexible round-optimized Schnorr threshold signatures, Chelsea Komlo and Ian Goldberg, SAC 2020, volume 12804 of LNCS, pages 34–65. Springer, Heidelberg, October 2020). The described embodiments are based on the case where the masks are sharesof the value zero. It will be apparent that the methods could be modified to provide ashare of another predetermined number, which could be a public parameter, and that the predetermined number could then be subtracted in the aggregation phase. This is a simple variation of the techniques described above. The case in which the masks sum to zero is preferred because it is not necessary to include the extra step of subtracting the predetermined number. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

CLAIMS1. A threshold signature method performed by an information processingapparatus associated with a signer that has a secret share for generating a thresholdsignature, the method comprising:sampling a random value;generating masks corresponding to each signer in a signing set including thecurrent signer, wherein the sum of the masks is equal to a predetermined number;summing the sampled random value and the mask for the current signer togenerate a masked random value; deleting the random value and the share for the current signer;sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signer in the signing set;generating an overall random value by summing the masked random value andthe received masks; using the overall random value to generate an individual contribution that iscontribution to a threshold signature generated based on the signer’s secret sharemasked by the overall random value; wherein during an aggregation step, the individual contributions from a pluralityof signers are combined to generate the threshold signature whereby the contribution ofthe masks is eliminated.

2. A method according to claim 1, wherein the predetermined number is zero andwherein when the individual contributions are summed, the contribution of the overallrandom values formed by the masks is zero.

3. A method according to claim 1, wherein the predetermined number is not zero,wherein when the individual contributions are summed, the predetermined number issubtracted to remove the contribution to the overall random value formed by the masks.

4. A method according to any preceding claim, wherein sending a respectivegenerated mask to each other signer using a secure channel comprises communicating using an out-of-band communication channel.

5. A mask according to any preceding claim, wherein sending a respectivegenerated mask to each other signer using a secure channel comprises encrypting eachmask for a destination signer in the signing set using a public key of a public keyencryption mechanism.

6. A method according to claim 5, wherein the mask is encrypted by:sampling a nonce; extending the nonce to generate an extended nonce;encrypting the mask by XOR with the extended nonce to generate an encryptedmask; andencrypting the nonce with a public key of the destination signer.

7. A method according to any preceding claim, wherein generating masks by asigner comprises randomly sampling masks for each other signer and setting thenegative of the total of the randomly sampled masks to be sent to other signers as thevalue of the share for the signer, whereby the sum of the shares for the signer and each other signer is zero.

8. A method according to any of claims 1 to 6, wherein generating masks by asigner comprises generating random seeds associated with each other signer, generatingmasks from the seeds using a pseudo-random number generator, and setting thenegative of the total of the masks to be sent to each other signer as the value of the maskfor the signer, whereby the sum of the masks for the signer and each other signer iszero.

9. A method according to claim 8, wherein the seeds are strings having a lengththat is shorter than the length of each of the masks.

10. A method according to any preceding claim wherein the individual contributiontakes the form of sum of the overall random value and a product of the Lagrangecoefficient, the secret share, and a challenge that is generated based on a hash of the message.

11. A method according to any preceding claim, wherein sampling the randomvalue, generating the masks, summing the sampled random value and the mask for thecurrent signer, deleting the random value and the share for the current signer, andsending a respective generated mask to each other signer happen in a first round or pre-processing stage of the method.

12. A method according to claim 11, wherein the receiving masks from each othersigner in the signing set, generating an overall random value, and using the overallrandom value to generate an individual contribution occur in a subsequent round of themethod.

13. A method according to any preceding claim, wherein in addition to deleting therandom value and the share for the current signer, the signer deletes the masks for allother signers after they have been sent using the secure channel.

14. An information processing apparatus comprising a processor and a memory,wherein the memory stores instructions that, when executed by the informationprocessing apparatus, cause the information processing apparatus to perform a methodcomprising: sampling a random value from a distribution; generating masks corresponding to each signer in a signer set including thecurrent signer, wherein the sum of the masks is equal to a predetermined number; summing the sampled random value and the mask for the current signer togenerate a masked random value; deleting the random value and the share for the current signer;sending a respective generated mask to each other signer using a secure channel; receiving masks from each other signers in the signing set;generating an overall random value by summing the masked random value andthe received masks; using the overall random value to generate an individual contribution that iscontribution to the signature generated based on the signer’s secret share masked by the overall random value; wherein during an aggregation step, the individual contributions from a pluralityof signers are combined to generate the threshold signature whereby the contribution ofthe masks is eliminated.

15. A program that, when executed on an information processing apparatus, causethe information processing apparatus to perform a method according to any of claims 1

Images