Systems and methods for presignature and signature generation

Abstract

Some embodiments are directed to a system and methods for presignature and signature generation, the system comprising a plurality of signing devices and a coordinating system. Each signing device stores a share of each of multiple private keys, and is configured to compute one or more presignatures, independent of the multiple private keys; locally store the one or more presignatures; upon receiving from the coordinating system a selection for a private key, generate a share of a signature for a message, using a presignature out of the one or more presignatures computed and stored in the presigning phase; and to send the generated share of the signature for the message to the coordinating system. The coordinating system is configured to send the selection for a private key to one or more of the signing devices, and combine the generated shares of the signature for the message into a signature.

Description

[0001]SYSTEMS AND METHODS FOR PRESIGNATURE AND SIGNATURE GENERATION TECHNICAL FIELD The presently disclosed subject matter relates to a system for presignature and signature generation. The presently disclosed subject matter further relates to a signing device, and a coordinating system. The presently disclosed subject matter further relates to a presignature and signature generation method for a signing device, and a signature generation method for a coordinating system. The presently disclosed subject matter further relates to a non-transitory computer readable medium comprising datarepresenting instructions, which, when executed by a processor system, cause theprocessor system to perform a presignature and signature generation method for a signing device. The presently disclosed subject matter further relates to a non-transitory computerreadable medium comprising data representing instructions, which, when executed by aprocessor system, cause the processor system to perform a signature generation methodfor a coordinating system. The presently disclosed subject matter further relates to a non-transitory computer readable medium storing one or more presignatures. BACKGROUND Threshold Elliptic Curve Digital Signature Algorithm (ECDSA) signatures are needed in several settings which require a high level of security. In these thresholdprotocols for ECDSA, private keys are shared by a plurality of signers, say ^ signingdevices ^^, … , ^^, who together are able to run an interactive protocol to generatesignatures for those private keys. In the so-called honest-majority setting, the systemshould remain secure even against an adversary who may corrupt any number ^ < ^ / 2of the signing devices. There exist several protocols for generating threshold ECDSA signatures: see, for example, Damgård et al. (2022): Fast threshold ECDSA with honest majority, Pettit (2021): Efficient threshold-optimal ECDSA, Dalskov et al. (2020): Securing DNSSEC keys via threshold ECDSA from generic MPC, Gągol et al. (2020): Threshold ECDSA for decentralized asset custody. The existing schemes employ several techniques to enforce security against malicious behavior in an honest-majority setting. Unfortunately, the existing schemes only consider a single execution of thesigning and presigning protocols, as well as signing devices holding shares of only asingle key. There is a need to improve systems for generating threshold ECDSAsignatures in an honest-majority setting, so that a setting where signing devices holdshares of multiple private keys is considered. It would be advantageous to have an improved signing and presigningprotocol for a setting in which signing devices holding shares corresponding to multiplekeys. SUMMARY An improved signing and presigning protocol is described in the accompanying claims, the protocol supporting batch generation of presignatures in asetting in which signing devices hold shares corresponding to multiple keys, where thepresignatures generated by those signing devices may be used for any one of the multiplekeys: so, key-independent presignature generation in a network of signing devices holding shares for multiple keys. In an embodiment of the system for presignature and signature generation, the system may comprise a plurality of signing devices and a coordinating system, wherein each of the plurality of signing devices stores a share of each of multiple private keys. A presigning phase may comprise computing one or more presignatures by the plurality of signing devices. The presignatures may comprise an intermediate value in generating a signature for a message, wherein the presignature is independent of themessage to be signed. Each of the plurality of signing devices may, in the presigningphase, compute one or more presignatures independent of the multiple private keys whichare shared by the signing devices: e.g., not using the private key shares they store. As aresult of the presigning phase, batch generation of presignatures may take place. In asigning phase following the presigning phase, signing may be done non-interactivelyusing only one of the generated presignatures when a message to be signed is known. Itmay be chosen to use each presignature only once, in order to ensure a high security level. For example, a presignature, which may be used in a threshold ECDSAsetting, may correspond to a share of an inverse of a random integer ^, wherein ^ is a function that depends on the exact signature scheme which is used, and ^is a generator of a multiplicative group used in the exact setting. The usage ofpresignatures may reduce the amount of computations in the threshold ECDSA setting byat least 10%, more preferably at least 20%. To initiate and coordinate the execution of the different phases of the protocol among the various signing devices, a coordinating system may be used. The coordinating system may be distinct from the signing devices. The coordinating system may hold the public keys which are associated with the private keys shared by the signing devices. The coordinating system may determine and communicate a selection for a private key, a selection of a presignature, and / or which messages get signed by the signing devices. In accordance with a first aspect of the invention, a system is provided for presignature and signature generation, wherein the system comprises a plurality of signing devices and a coordinating system, wherein each of the plurality of signing devices stores a share of each of multiple private keys, wherein- each of the plurality of signing devices comprises one or more processors and oneor more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for -in a presigning phase,- computing one or more presignatures, independent of themultiple private keys, and -locally storing the one or more presignatures,and -in a signing phase, upon receiving from the coordinating system aselection for a private key out of the multiple private keys, -generating a share of a signature for a message, using apresignature out of the one or more presignatures computed and stored in the presigning phase, and -sending the generated share of the signature for themessage to the coordinating system, and -the coordinating system comprises one or more processors and one ormore storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for -sending the selection for a private key to one or more of the signingdevices,- upon receiving the generated shares of the signature for a messagefrom one or more of the plurality of signing devices, combining the generatedshares of the signature for the message into a signature. In accordance with a further aspect of the invention, a signing device is provided, storing a share of each of multiple private keys, which comprises one or more processors and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for -in a presigning phase,- computing one or more presignatures independent of the multiple privatekeys, and -locally storing the one or more presignatures,and -in a signing phase, upon receiving from a coordinating system a selectionfor a private key out of the multiple private keys, -generating a share of a signature for a message, using a presignature outof the one or more presignatures computed and stored in the presigning phase, and -sending the generated share of the signature for the message to thecoordinating system. In accordance with a further aspect of the invention, a coordinating system is provided, comprising one or more processors and one or more storage devices, storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for -sending a selection for a private key out of multiple private keys to one ormore of a plurality of signing devices,- upon receiving generated shares of a signature for a message from one ormore of the plurality of signing devices, combining the generated shares of the signaturefor the message into the signature. In accordance with a further aspect of the invention, a presignature and signature generation method for a signing device is provided, the signing device storing a share of each of multiple private keys, the method comprising -in a presigning phase,- computing one or more presignatures, independent of the multiple privatekeys, and -locally storing the one or more presignatures, and -in a signing phase, upon receiving from a coordinating system a selectionfor a private key out of the multiple private keys, -generating a share of a signature for a message, using a presignature outof the one or more presignatures computed and stored in the presigning phase, and -sending the generated share of the signature for the message to thecoordinating system. In accordance with a further aspect of the invention, a signature generation method for a coordinating system is provided, comprising -sending a selection for a private key out of multiple private keys to one ormore of a plurality of signing devices,- upon receiving generated shares of a signature for a message from one ormore of the plurality of signing devices, combining the generated shares of the signaturefor the message into the signature. In accordance with a further aspect of the invention, a non-transitory computer readable medium comprising data representing instructions, which when executed by a processor system, cause the processor system to perform a presignature and signature generation method for a signing device as described in this specification. In accordance with a further aspect of the invention, a non-transitory computer readable medium is provided comprising data representing instructions, which when executed by a processor system, cause the processor system to perform a signature generation method for a coordinating system as described in this specification. In accordance with a further aspect of the invention, a non-transitory computer readable medium is provided storing one or more presignatures, the one or more presignatures being computed by a signing device, the signing device storing a share of each of multiple private keys, the signing device being configured to compute the one or more presignatures, independent of the multiple private keys, the signing device being further configured to locally store the one or more presignatures. Several advantages are associated with the system for presignature and signature generation. The above measures allow a large number of presignatures to be generated by the plurality of signing devices in this multi-party signing protocol at better amortizedcost. Additionally, these measures support a setting where signing devices hold shares ofmultiple private keys; the presignatures generated by the signing devices can be used for any of the multiple keys, as the presignatures are computed independently of the multipleprivate keys. A signing protocol as discussed herein can be used in an honest-majoritysetting of threshold ECDSA. Optionally, the coordinating system may be configured to send the message to be signed, or possibly a hash of the message to be signed, and / or a selection of apresignature out of the one or more presignatures to one or more of the plurality of signingdevices; for example, to each of the signing devices. Optionally, the coordinating systemmay send a message to be signed, and / or a selection of a presignature out of the one ormore presignatures to one or more of the plurality of signing devices directly, after whichthe one or more of the plurality of signing devices may forward the message to be signed,and / or the selection of a presignature out of the one or more presignatures to the othersigning devices out of the plurality of signing devices, creating a forwarding systemfollowing a tree structure. The signing devices may then receive from the coordinatingsystem the message to be signed, or the hash of the message to be signed, and / or theselection for the presignature. Optionally, the presignature which is used to generate a share of a signature issecurely erased from the signing device after being used. Securely erasing a presignatureimproves the overall security of the presignature and signature generation system.Optionally, the coordinating system, which stores at least one public key corresponding to the multiple private keys, may be further configured to, after combiningthe generated shares of the signature for the message into the final signature, verify thesignature using a public key that corresponds to the selected private key. This verificationimproves the security of the system. The coordinating system need not communicatedirectly with any signing device for the verification.Optionally, each of the plurality of signing devices may communicate withone or more other signing devices and / or the coordinating system during the presigningphase. A signing device need not communicate directly with other signing devices or thecoordinating system, but instead may communicate through a communicating device, which can be another signing device or an external device. This configuration allows for intermediaries and additional services without burdening the signing devices or coordinating system. Optionally, the system may further designate one or more of the signingdevices to a set of the signing devices. A designated device may comprise acommunicating device as discussed above. Instead of a trusted dealer or a complexprotocol as in the prior art, the designated device may choose a cryptographic key, e.g., auniform key and send it via a private channel to each signing device in the set for whichit has been designated. The signing devices for which the designated device is designatedmay be configured to receive the key, and may further be configured to generate sharesof a zero value and / or a random value using the received key. This is more efficient andstill as secure as in the prior art, as the key may be chosen uniformly and independentlyof the other keys, shared correctly among the appropriate signing devices.The system for presignature and signature generation may be an electronicsystem. The signing devices and the coordinating system may comprise electronicdevices; they may comprise a computer. The methods for signature and presignature generation as described hereinmay be applied in a wide range of practical applications, such as whenever high-securitysigning may be needed. The methods as described herein may be implemented on devices,such as cryptographic devices. A signing device as described above may be acryptographic device. A coordinating system as described above may be comprised inone or more cryptographic devices. The cryptographic devices may be electronic devices.For example, they may be computers. They may be mobile electronic devices, e.g., amobile phone, a smart card. The cryptographic devices may be consumer electronics, e.g.,a set-top box, a television. It may be an electronic device, in particular a computer. An embodiment of the methods may be implemented on a computer as a computer-implemented method or in dedicated hardware, or in a combination of both.Executable code for an embodiment of the method may be stored on a computer programproduct. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, and online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computerreadable medium for performing an embodiment of the method when said programproduct is executed on a computer. It may be able to carry out the methods mentionedabove. It may be a mobile electronic device, e.g., a smartphone. On a computer, the methods may be implemented as new software, or a new software feature of some existing software application. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer-readable medium for performing an embodiment of the method when said program product is executed on a computer. In an embodiment, a computer program may comprise computer program code adapted to perform all or part of the phases of an embodiment of the method, whenthe computer program is run a computer. Preferably, the computer program may beembodied on a computer-readable medium. The embodiments as mentioned above are described in the accompanyingclaims. Further, specific embodiments are set forth in the dependent claims. BRIEF DESCRIPTION OF DRAWINGS Further details, aspects, and embodiments will be described, by way ofexample only, with reference to the drawings. Elements in the figures are illustrated forsimplicity and clarity and have not necessarily been drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals. In the drawings, Figure 1a schematically shows an example of an embodiment of a signing device, Figure 1b schematically shows an example of an embodiment of a coordinating system, Figures 1c-1f schematically shows examples of embodiments of a system forpresignature and signature generation or parts thereof, Figure 2 schematically shows an example of a sequence diagram for a system for presignature and signature generation, Figure 3a schematically shows an example of an embodiment of a signing device with a key storage, Figure 3b schematically shows an example of an embodiment of a coordinating system connected to a signing device, Figure 4a schematically shows an example of an embodiment of apresignature and signature generation method for a signing device, Figure 4b schematically shows an example of an embodiment of a signaturegeneration method for a coordinating system, Figure 5a schematically shows a computer readable medium having a writable part comprising a computer program according to an embodiment, Figure 5b schematically shows a representation of a processor system according to an embodiment. Reference signs list The following list of references and abbreviations corresponds to Figures 1-8b, and is provided for facilitating the interpretation of the drawings and shall not be construed as limiting the claims.100 system for presignature and signature generation110, 110.1-6 signing devices111 processor112 storage device113 communication interface114 computations115 presignature116, 116.1-3 share of signatures117 signature120 coordinating system121 processor122 storage device123 communication interface124 message to be signed125 selection for a private key126 selection for a presignature130 designated device140 other signing devices141 private key shares142 key storage143 public key144 key storage150 computer network200 sequence diagram for a system for presignature and signaturegeneration201 performing computations202 sharing a result of the computations with one or more designateddevices203 forwarding a result of the computations204 locally storing another result of the computations205 sending a selection for a private key out of the multiple private keys,and optionally a message to be signed and / or a selection for a presignature206 generating a share of a signature207 sending the generated share of the signature208 combining generated shares of the signature into the signature209 verifying the signature using a public key210 presigning phase220 signing phase400 presignature and signature generation method for a signing device401 receiving from a coordinating system a selection for a private keyout of the multiple private keys500 signature generation method for a coordinating system501 receiving generated shares of a signature for a message from one ormore of a plurality of signing devices1000, 1001 a computer-readable medium1010 a writable part1020 a computer program1110 integrated circuit(s)1120 a processing unit1122 a memory1124 a dedicated integrated circuit1126 a communication element1130 an interconnect1140 a processor system DESCRIPTION OF EMBODIMENTS While the presently disclosed subject matter is susceptible of embodiment inmany different forms, there are shown in the drawings and will herein be described indetail one or more specific embodiments, with the understanding that the presentdisclosure is to be considered as exemplary of the principles of the presently disclosedsubject matter and not intended to limit it to the specific embodiments shown and described. In the following, for the sake of understanding, elements of embodiments aredescribed in operation. However, it will be apparent that the respective elements arearranged to perform the functions being described as performed by them.Further, the subject matter that is presently disclosed is not limited to theembodiments only, but also includes every other combination of features described hereinor recited in mutually different dependent claims. Figure 1a schematically shows an example of an embodiment of a signingdevice 110. Figure 1b schematically shows an example of an embodiment of acoordinating system 120. Signing device 110 and coordinating system 120 may be part of a system 100 for presignature and signature generation, further illustrated in Figures 1c-1e. These figures schematically show examples of embodiments of the system 100 for presignature and signature generation and its parts. Signing device 110 may compute and locally store one or more presignatures,independent of private keys, and generate and send shares of signatures for messagesusing a computed and stored presignature. Coordinating system 120 may send a selectionfor a private key to signing devices and combine received generated shares of a signatureinto a final signature. Signing device 110 may communicate internally in a point-to-pointnetwork model. While a broadcasting mode is possible, it is not needed. Signing devices 110 may comprise a processor system 111 comprising one ormore processors, one or more storage devices 112, and a communication interface 113.Coordinating system 120 may comprise a processor system 121 comprising one or moreprocessors, one or more storage devices 122, and a communication interface 123. Storagedevice 122 may comprise a memory. The memory may store instructions that, whenexecuted by processor system 111, cause processor system 111 to perform operations forexecuting a method. The communication interfaces 113 and / or 123 may be selected from variousalternatives. For example, the interface may be a network interface to a local or wide areanetwork, e.g., the Internet, a storage interface to an internal or external data storage, anapplication interface (API), etc. Storage devices 112 and / or 122 may be, e.g., electronic storage, magneticstorage, etc. The storage may comprise local storage, e.g., a local hard drive or electronicmemory. Storage 112 and 122 may comprise non-local storage, e.g., cloud storage. In thelatter case, storage 112 and 122 may comprise a storage interface to the non-local storage.Storage may comprise multiple discrete sub-storages together making up storage 112,122. Storage may comprise a volatile writable part, say a RAM, a non-volatile writablepart, e.g., Flash, a non-volatile non-writable part, e.g., ROM.Storage 112 and 122 may comprise non-transitory storage. For example,storage 112 and 122 may store data in the presence of power such as a volatile memorydevice, e.g., a Random Access Memory (RAM). For example, storage 112 and 122 may store data in the presence of power as well as outside the presence of power such as anon-volatile memory device, e.g., Flash memory. Memory 120 may comprise a non-volatile non-writable part, e.g., ROM, e.g., storing part of the software. Devices 110 and 120 may communicate internally, with each other, with other devices, external storage, input devices, output devices, and / or one or more biometric sensors over a computer network. The computer network may be an internet, an intranet,a LAN, a WLAN, etc. The computer network may be the Internet. The devices 110 and120 may comprise a connection interface which may be arranged to communicate within system 100 or outside of system 100 as needed. For example, the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, ZigBee, a cellularantenna, 4G or 5G antenna.The communication interfaces 113 may be used to send or receive data, e.g., digital data, e.g., messages to be signed, selections for private keys and / or presignatures,and signature shares for messages to be signed. The communication interface 123 may beused to send or receive digital data, e.g., messages to be signed, selections for private keysand / or presignatures, and signature shares for messages to be signed, and / or signatures. The communication interface 123 may be used to communicate with other server devices, e.g., external server devices with which signatures may be shared; then the coordinating system 120 may be further configured to send a combined signature to an external service interface via the communication interface 123.The execution of device 110 and / or system 120 and / or system 100 may beimplemented in a processor system. The devices 110 and 120 and / or system 100 maycomprise functional units to implement aspects of embodiments. The functional units may be part of the processor system. For example, functional units shown herein may be wholly or partially implemented in computer instructions that are stored in a storage ofthe device and executable by the processor system. Devices 110 and 120 may beconnected through a signing server, e.g., via the Internet. The processor system may comprise one or more processor circuits, e.g., microprocessors, CPUs, GPUs, etc. Devices 110 and 120 and / or system 100 may comprise multiple processors. A processor circuit may be implemented in a distributedfashion, e.g., as multiple sub-processor circuits. For example, devices 110 and 120 and / orsystem 100 may use cloud computing via a computer network 150, e.g., a cloud server.Typically, signing device 110 and coordinating system 120 each comprise amicroprocessor executing appropriate software stored at the device; for example, thatsoftware may have been downloaded and / or stored in a corresponding memory, e.g., avolatile memory such as RAM or a non-volatile memory such as Flash.Instead of using software to implement a function, the devices 110 and / or 120and / or system 100 may, in whole or in part, be implemented in programmable logic, e.g.,as field-programmable gate array (FPGA). The devices may be implemented, in whole orin part, as a so-called application-specific integrated circuit (ASIC), e.g., an integratedcircuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog,VHDL, etc. In particular, signing device 110 and coordinating system 120 and / or system100 may comprise circuits, e.g., for cryptographic processing, and / or arithmetic processing. In hybrid embodiments, functional units are implemented partially inhardware, e.g., as coprocessors, e.g., cryptographic coprocessors, and partially in software stored and executed on the device. Figures 1c, 1d and 1e schematically show examples of embodiments of asystem 100 for presignature and signature generation. System 100 typically comprises aplurality of signing devices 110: shown are five signing devices 110.1-110.5 in Figures1c and 1d, and six signing devices 110.1-110.6 in Figures 1e and 1f, but it may be morethan six. The signing devices may be according to an embodiment, for example, asdescribed by Figure 1a. System 100 for presignature and signature generation may comprise multiple coordinating systems; shown is one coordinating system 120, but itmay be more than one. The coordinating system may be according to an embodiment, forexample, as described by Figure 1b. Each out of the plurality of signing devices 110 maybe configured to communicate with one or more of the plurality of signing devices 110.For example, as shown in Figure 1c by the connecting edges between the signing devices110.1-5, each out of the plurality of signing devices 110.1-5 may be configured tocommunicate with each of the other signing devices: signing device 110.1 may communicate with all of 110.2-110.5, signing device 110.2 may communicate with all of 110.1, 110.3-110.5, signing device 110.3 may communicate with all of 110.1, 110.2, 110.4 and 110.5, signing device 110.4 may communicate with all of 110.1-3 and 110.5, and signing device 110.5 may communicate with all of 110.1-110.4. Optionally, anysubgroup of signing devices 110 may only communicate inside the subgroup: e.g., signingdevices 110.1, 110.2, 110.5 may communicate only with each other, and not with signingdevices 110.3, 110.4 and 110.6; and signing devices 110.3, 110.4 and 110.6 maycommunicate only with each other, and not with signing devices 110.1, 110.2 and 110.5. All of signing devices 110, 110.1-110.6 may communicate with coordinatingsystem 120, as shown in Figure 1c-e by the connecting edges between the signing devices110.1-5 and coordinating system 120. Optionally, any subgroup of signing devices 110may communicate with coordinating system 120. As shown in Figure 1d, signing devices110 may be connected through a network 150, as shown by the connecting edges between signing devices 110 and network 150. The network may be a computer network 150, e.g.,the Internet. Network 150 may comprise additional elements, e.g., a router, a hub, etc.The communication interface may be used to send or receive data. System 100 may be connected to a cloud storage system, to which multiple systems such as system 100 maybe connected as well. This may illustrate an option of uploading, storing, sharing, anddownloading data. One or more signing devices 110.5, 110.6 out of the plurality of signingdevices 110.1-6 may additionally be designated devices 130, as is shown in Figure 1e.Designated devices 130 may be designated to a set of the signing devices 110. Forexample, designated device 110.5 may be designated to a set of signing devices 110.1,110.2, and designated device 110.6 may be designated to a set of signing devices 110.3,110.4. The one or more designated devices 130 may be configured to obtain a key. Theone or more designated devices 130 may be configured to send the key to each signingdevice out of the designated set of signing devices. For example, designated device 110.5 may be configured to obtain a key and send the key to signing device 110.1 and signing device 110.2; and designated device 110.6 may be configured to obtain a key and send the key to signing device 110.3 and signing device 110.4. Each of the plurality of signingdevices 110.1-110.6 may further be configured to receive a key from a device 130designated to a set of signing devices 110 comprising the signing device 110. For example, signing device 110.1 and signing device 110.2 may be configured to receive a key from designated device 110.5; and signing device 110.3 and signing device 110.4 may be configured to receive a key from designated device 110.6. Each of the pluralityof signing devices 110.1-110.6 may further be configured to generate shares of a zerovalue, and / or shares of a random value, using the received key.A signing system comprising a plurality of signing devices 110 may beconfigured to create key shares via a distributed key generation protocol, or receive keyshares from a trusted party, configured distribute key shares to signing devices 110.Signing devices 110 may comprise key storages for storing a key share. A plurality of keyshares may be distributed to the plurality of signing devices 110. Key shares may be created by an external key generating device, and / or distributed by an external keydistributing device. Signing device 110 may store a key share of the plurality of key sharesin a key storage. The one or more processors of a signing device 110 may retrieve a keyshare. The storage of a signing device 110 may correspond to a threshold signaturescheme. The signing devices 110 and coordinating system 120 may be according to anembodiment. Figure 1f shows an example of an embodiment of a system 100 forpresignature and signature generation. Shown are signing devices 110.1, 110.2, 110.3, 110.4, 110.5 and 110.6, and a coordinating system 120. Signing devices 110.3 and / or 110.6 may be designated devices 130 as discussed above. Designated device 110.3 maybe designated to a set of signing devices 110.1 and 110.2, and / or designated device 110.6may be designated to a set of signing devices 110.4 and 110.5. Designated device 110.3may communicate with signing devices 110.1 and 110.2, for example send a key tosigning devices 110.1 and 110.2 as discussed above; designated device 110.6 maycommunicate with signing devices 110.4 and 110.5 as discussed above. System 100 maycomprise a plurality of signing devices, of which signing devices 110.1, 110.2, 110.3,110.4, 110.5 and 110.6 are shown, coordinating system 120. Each of the plurality ofsigning devices 110.1-6 may be further configured to communicate with one or more of the plurality of signing devices 110.1-6; optional edges between signing devices 110.1-6 are not shown in Figure 1f. Each of the plurality of signing devices 110.1-6 may store a share of each ofmultiple private keys. The multiple private key shares may be generated as discussedabove. Each of the plurality of signing devices 110 may be configured to, in a presigningphase, compute one or more presignatures 115. Each of the plurality of signing devices110 may be configured to perform computations 114. The performed computations 114may result in one or more presignatures 115. The one or more presignatures 115 may bestored on signing devices 110 in a storage 112. Computing the one or more presignaturethen happens independently of the multiple private keys. Signing devices 110 may locallystore the one or more presignatures 115 in storage 112.Coordinating system 120 may be configured to send a selection 125 for aprivate key out of the multiple private keys to one or more of the plurality of signingdevices 110. One or more of the plurality of signing devices 110 may be configured toreceive selection 125 for a private key out of the multiple private keys from coordinatingsystem 120. Coordinating system 120 may optionally further be configured toadditionally send to one or more of the signing devices 110 a message 124 to be signed.The message to be signed 124 may also be sent to one or more of signing devices 110 ina different manner, e.g., externally, via a communicating device or communicationinterface. Coordinating system 120 may optionally further be configured to additionallysend to one or more of signing devices 110 a selection 126 for a presignature 115 out ofthe one or more presignatures 115. Selection 126 for a presignature 115 out of the one ormore presignatures 115 may also be sent to one or more of signing devices 110 in adifferent manner, e.g., externally, e.g., via a communicating device and / orcommunication interface. One or more of the plurality of signing devices 110, mayfurther be configured to receive from coordinating system 120 message 124 to be signed,and / or selection 126 for presignature 115 out of one or more presignatures 115 to use, orto receive message 124 to be signed, and / or selection 126 for presignature 115 out of one or more presignatures 115 to use in a different manner, e.g., externally, e.g., from a communicating device and / or communication interface. One or more of the plurality of signing devices 110 may be configured to, ina signing phase, upon receiving from coordinating system 120 selection 125 for a privatekey out of the multiple private keys, generate a share 116, 116.1, 116.2, 116.3, 116.4,116.5, 116.6 of a signature 117 for message 124 to be signed. Signing devices 110 maygenerate share 116 of signature 117 using presignature 115 out of the one or morepresignatures 115, which has been computed and stored by signing devices 110 in thepresigning phase. Signing devices 110 may be configured to send generated share 116 ofsignature 117 for message 124 to coordinating system 120. Coordinating system 120 maybe configured to receive generated shares 116.1-6 of signature 117 for message 124 fromone or more of the plurality of signing devices 110. Coordinating system 120 may beconfigured to, upon receiving generated shares 116.1-6 of signature 117 for message 124from one or more of the plurality of signing devices 110, combine generated shares 116.1-6 of signature 117 for message 124 into signature 117. Presignatures 115 which are usedto generate shares 116.1-6 of signature 117 may be securely erased from signing device110.1-6 after being used to generate shares 116.1-6 of signature 117. Signing devices 110may be configured to securely erase presignature 115 after using presignature 115 togenerate shares 116 of signature 117. Coordinating system 120 may store at least onepublic key corresponding to the multiple private keys, and may further be configured to,after combining generated shares 116.1-6 of signature 117 for message 124 into thesignature 117 for message 124, verify signature 117 using a public key out of the at least one public key corresponding to the selected private key 125 of the multiple private keys. Each of the plurality of signing devices 110 in system 100 may be configuredto, in the presigning phase, perform computations 114 resulting in a plurality of presignatures 115, wherein each of the plurality of presignatures 115 is independent of the multiple private keys, enabling batch presignature generation. Identifying the devices with an integer, e.g., ^, for convenience, each device ^of the plurality of signing devices 110 in system 100 may be further configured to, duringthe computing of the one or more presignatures 115, generate a message ^^^,^corresponding to a share ^^,^ of an integer ^^, using a generator ^ of a mathematical group,and send the generated message ^^^,^to another signing device 110 out of the plurality ofsigning devices 110. Each ^ of the plurality of signing devices 110 in system 100 mayfurther be configured to generate a share ^′^,^of an inverse of the random integer ^^, and store the generated share ^′^,^of the inverse of the random integer ^^as part of the one or more presignatures 115. Furthermore, each of the plurality of signing devices 110 in system 100 mayfurther be configured to, during the computing of the one or more presignatures 115, generate one or more multiplication triples. A multiplication triple comprises shares of two random integers, and a share of the product of the two random integers. Each of the plurality of signing devices 110 in system 100 may further be configured to generate a share of an inverse of a random integer from one or more of the multiplication triples.Each of the multiplication triples may comprise shares (^^,^ , ^^,^) of randomintegers (^^ , ^^), as well as a share (^^,^) of a product (^^ = ^^ ⋅ ^^) of the random integers(^^, ^^).Furthermore, each ^ of the plurality of signing devices 110 may be furtherconfigured to send the share ^^,^ of the product ^^ = ^^ ⋅ ^^ of the random integers ^^ , ^^to one or more other signing devices (140) out of the plurality of signing devices (110).Each ^ of the plurality of signing devices 110 may be further configured to generate ashare the inverse of the random integer ^^ corresponding to amultiplication triple out of the multiplication triples and an interpolation^^ of the sent shares ^^,^ of the products ^^ = ^^ ⋅ ^^ of the random integers ^^ , ^^ by theplurality of signing devices 110. In what follows, an honest-majority protocol for batch ECDSA signatures isdescribed. The protocol is a threshold protocol for ECDSA, where multiple ECDSAprivate keys may be shared by ^ signing devices ^^, … , ^^, wherein ^ may be, forexample, larger than 5. The signing devices 110 may run an interactive protocol to signmessages using the private keys. In the execution of the threshold protocols, the signing devices ^^, … , ^^ maycommunicate via a synchronous network, in which each pair of signing devices may beconnected by a point-to-point secure channel, so a private and authenticated channel. The number ^ may be taken to be ^ = 2^ + 1; however, to a person skilled inthe art it is clear that the protocols may be suitably adapted for any ^, ^ satisfying thehonest-majority case of ^ < ^ / 2.The key generation may be done in several ways, as discussed above. The ^signing devices may hold shares of the private keys. The shares may be secret shares, e.g.,Sharmir secret shares, e.g., (^ + 1)-out-of-^ Shamir secret shares of the one or moreprivate keys ^(^), … , . Signing device ^^ may hold the ^ th share ^(^), … , ^(ℓ)^^of each of the private keys. A coordinating system, also called ‘coordinator’, may initiate a signingprocess among the ^ signing devices, as discussed above. The coordinating system maybe distinct from the signing devices; however, any of the signing devices may play therole of the coordinator in any execution, and / or there could be multiple coordinators,including the case where there may be a different coordinator for each public key. Whena coordinator may initiate execution of the protocol to sign a message using the ^ th privatekey, the coordinator may know the corresponding ^ th public key.The threshold ECDSA protocol may be designed to have a presigning phase,or preprocessing phase, for batch generation of presignatures. Following the presigning phase, signing may be done non-interactively using one of those presignatures when a message to be signed is known. The coordinator may initiate execution of the different phases of the protocol, e.g., the presigning phase and / or the signing phase. To initiate computation of ^ presignatures, the coordinator may send amessage, e.g., (presign, ^) to one or more of the ^ signing devices. For example, thecoordinator may send a message to initiate computation of presignatures to each of the signing devices. In response, the signing devices may execute a protocol at the end of which(if the execution is not aborted) they each may output a collection of ^ presignatures.To initiate computation of a signature on a hashed message ℎ to be signedusing the private key associated with public key ^, the coordinator may send to eachsigning device ^^ an index indicating which presignature to use, the hashed message ℎ,and an index identifying which key share to use. The construction of signing protocols as presented here is described in amodular fashion. In what follows, a general framework for constructing an honest-majority threshold ECDSA protocol is presented. The framework is based on afunctionality for for random secret sharing, and a functionality ℱ^,^^^^^^^for generatingmultiplication triples, e.g., Beaver multiplication triples. The functionality may in turn be based on ℱ^^^,^^. Also, a functionality ℱ^,^^^^^^may be realized for performing so- called weak multiplication of shared values. A protocol for ℱ^,^^^^^^^may involve a batch verification check of multiplication triples. These functionalities may be implemented in part using known techniques, and in part by novel protocols set out herein. For example, the functionality may be realized using existing techniques for pseudorandom secret sharing. In an embodiment, an implementation of ℱ^^^,^^is shown allowing a setting without broadcast or trusted setup,e.g., via allowing the signing devices to set up the shared keys themselves, without adealer, and without any additional rounds for commitments or complaint resolution and without a broadcast channel. In the following notation, ^ denotes a group of prime order ^, with generator^. The field with ^ elements is denoted by and ℤ∗^ denotes ℤ^\{0}. Further, [^] ={1, … , ^} and ^ denotes a computational security parameter. Lastly, ^ ← ^ denotes auniform selection of ^ from a finite set ^.Each ^ of the plurality of signing devices 110 in system 100 may be furtherconfigured to, during the computing of the one or more presignatures 115, generate amessage ^^^,^ corresponding to a share ^^,^ of an integer ^^, using a generator ^ of thegroup, and send the generated message ^^^,^ to another signing device 110 out of theplurality of signing devices 110. Each ^ of the plurality of signing devices 110 in system100 may further be configured to generate a share ^′^,^of an inverse of the random integer^^, and store the generated share ^^,^′ of the inverse of the random integer ^^ as part ofthe one or more presignatures 115. Furthermore, each of the plurality of signing devices 110 in system 100 mayfurther be configured to, during the computing of the one or more presignatures 115, generate one or more multiplication triples, wherein each of the one or moremultiplication triples may comprise shares of one or more random integers. Each of theplurality of signing devices 110 in system 100 may further be configured to generate ashare of an inverse of a random integer from one or more of the multiplication triples.Each (^^,^ , ^^,^ , ^^,^) of the multiplication triples comprises shares (^^,^ , ^^,^) of integers(^^, ^^), as well as a share (^^,^) of the product (^^ = ^^ ⋅ ^^) of the integers (^^ , ^^).Furthermore, each ^ of the plurality of signing devices 110 may be furtherconfigured to send the share ^^,^ of the product ^^ = ^^ ⋅ ^^ of the random integers ^^ , ^^to one or more other signing devices (140) out of the plurality of signing devices (110).Each ^ of the plurality of signing devices 110 may be further configured to generate ashare of the inverse of the random integer ^^ corresponding to amultiplication triple (^^,^ , ^^,^ , ^^,^) out of the multiplication triples and an interpolation^^ of the sent shares ^^,^ of the products ^^ = ^^ ⋅ ^^ of the random integers ^^ , ^^ by theplurality of signing devices 110.Figure 2 schematically shows an example of a sequence diagram 200 for asystem for presignature and signature generation. Figure 2 shows a signing device 110and a coordinating system 120, and one or more signing devices 140 which may bedifferent from signing device 110. For example, these devices and systems could be asdescribed with reference to Figures 1a-1f. Signing devices 110 and 140 and coordinatingsystem 120 may be configured to communicate with each other over an authenticated channel, such as HTTPS, and, optionally, also a confidential channel. The system thus includes a plurality of signing devices, including signing device 110 and 140. The system manages multiple private keys, while it is avoided that any one of the signing devices has access to a full private key. Accordingly, each of the plurality ofsigning devices stores a share of each of multiple private keys. For example, each privatekey may be divided into multiple shares, equal to the number of signing devices, and onedifferent share of each private key may be stored at each signing device. There are various ways to do this. For example, a private key may be taken as input by a trusted dealer who generates secret shares and sends each share to a respective signing device. Or, themultiple private key shares may result from a distributed key generation protocol executedby the signing devices themselves. Each of the plurality of signing devices is configured to communicate with one or more of the plurality of signing devices, possibly through a communicating channel. Sequence diagram 200 comprises a presigning phase 210 and a signing phase 220. In an embodiment, signing device 110 may be configured to, in presigning phase 210, perform computations 114 in an action 201 of performing computations.Computations 114 may result in one or more presignatures 115. Part of computations 114may comprise a result which may be shared by signing device 110 with other signing device 140, e.g., via a communicating channel, which may be configured to receive the result from signing device 110. The result may comprise presignature 115. In a message202 signing device 110 may share the result of computations 114 with signing device 140The other signing device 140 may be configured to receive the result from signing device110. In an analogous manner, signing device 140 may share a result from thecomputations signing device 140 performs with signing device 110 in a message 203.Signing device 110 may be configured to locally store one or more presignature 115which may result from the computations 114.For example, in an embodiment, during the presigning phase 210, one or morepresignatures 115 are computed. The presignatures are independent of the multipleprivate keys. This is advantageous, since it allows precomputation to be done before it isknown for which of the multiple private keys a signature needs to be computed. In an embodiment, a presignature corresponds to a pair of integers: ^^^^and wherein ^ is a function that depends on the exact signature scheme used. Thecomputations are performed in a finite ring, e.g., the integers modulo a modulus, e.g., a prime modulus. For example, the plurality of signing devices, e.g., device 110 and 140, maytogether generate ^^^ corresponding to an integer ^^, using a generator ^ of themultiplicative group. Here ^ runs over the number of presignatures that are beinggenerated. The integer ^^ is not known to the signing devices; instead, each signing devicemay have a share ^^,^ of the integer ^^. Here ^ is an integer that runs over the signingdevices. For example, device ^ has the shares ^^,^ for all ^.For example, the signing devices may share the message ^^^,^to the other signing devices, from which the value ^^^, and subsequently, ^ , may be computed. The signing devices further precompute a share ^^,^′ of an inverse of therandom integer ^^. The signing device may store as part of a presignature at least thegenerated share ^^,^′ of the inverse of the random integer ^^ In other words, for each presignature an integer ^ becomes available at thesigning devices in two ways, blinded in two different ways, as ^^and as one share of ^^^; both are insufficient to recover the number k. But they can be used as a precomputation for computing a signature. Note that neither integer depends on any of the private keys. To generate shares of the inverse of ^^, without access to ^^, an interesting trick may be employed. The signing devices perform a protocol to jointly generate one ormore multiplication triples, e.g., one multiplication triple for each presignature. Amultiplication triple comprises three integers, one of which is the multiplication of theother two; however, the signing devices only obtain a share of each of the three integersin a multiplication triple. Using a multiplication triple, a share of an inverse of a shared integer can becomputed.For example, a multiplication triple may comprise random integers (^^ , ^^, ^^)wherein ^^ = ^^ ⋅ ^^. The signing devices receive a share of each of these numbers:integers , ^^,^ , ^^,^), wherein ^ identifies the signing device and ^ is an index in theprecomputed presignatures. The presignature devices can now proceed as follows: -send the share ^^,^ of the product (^^ = ^^ ⋅ ^^) of the random integers(^^, ^^) to one or more other signing devices 140 out of the plurality of signing devices,and -generate a share of the inverse of the random integer ^^corresponding to a multiplication triple , ^^,^ , ^^,^) out of the multiplication triplesan interpolation ^^ of the sent shares ^^,^ of the products ^^ = ^^ ⋅ ^^ of the randomintegers ^^, ^^ by the plurality of signing devices.The devices can further compute ^^^ = ^^^^and send this to the other signingdevices. From this each signing device can compute ^^ = ^^^. If desired, one can furtherprecompute ^^ = ^(^^).Various protocols exist for shared generating of multiplication triples, though below a particular advantageous protocol is described. In an embodiment, in presigning phase 210 the signing device furthercomputes for each presignature shares of a zero value. The zero value is useful forblinding during the signing phase, and may be stored as part of the presignature. Variousprotocols exist for shared generation of shares of zero, though below a particularadvantageous protocol is described. The generated presignature is stored locally at the signing device. In signing phase 220, coordinating system 120 may be configured to send a selection for a private key out of the multiple private keys, and optionally a message to be signed and / or a selection for a presignature, in a message 205. In response, signing device 110 may be configured to generate a share 116 of a signature 117 in an action 206 of generating share 116 of signature 117. Signing device 110 may be configured to send generated share 116 of signature 117 in a message 207 of sending generated share 116 of signature 117. In response, coordinating system 120 may be configured to receive generated share 116 of signature 117 from signing device 110. Coordinating system 120 may be configured to combine generated shares 116 of signature 117 into signature 117 in an action 208 of combining generated shares 116 of signature 117 into signature 117. Coordinating may further optionally be configured to verify signature 117 using a public key in an action 209 of verifying signature 117. For example, in an embodiment, during signing phase 220. The coordinatingsystem 120 may send 205 the selection 125 for a private key to one or more of the pluralityof signing devices. Coordinating system 120 may send the selection for a private key to each of the plurality of signing devices. Typically, coordinating system 120 will additionally send 205 to the plurality of signing devices the message 124 to be signed, typically in the form of a hash value. It is also possible that the signing devices receive the message to be signed from another source. Note that during generation of the presignatures this information is not needed since each presignature can be used for any one of the private keys. The signing devices may be configured to use a predetermined one of the available presignatures. For example, the presignatures may be stored in order, and all of the signing devices may take the next available one. This reduces communication overhead between the devices. Alternatively, coordinating system 120 may be configured to additionally send 205 to the plurality of signing devices a selection 126 for a presignature 115 out of the one or more presignatures 115. For example, the presignatures may be saved together with an identifier. The identifier may be shared with the coordinating device. The signing devices use the presignature and the hash to generate 206 a share 116 of a signature 117 for a message 124, using a presignature 115 out of the one or more presignatures computed 201 and stored 204 in the presigning phase 210. The generatedshares 116 are sent to the coordinating system 120, which can then reconstruct thesignature from them. The shares generated by the signing device may include, e.g., additively, a share of zero, to further obfuscate the information. Such an addition has no impact on the final signature. A signing device preferably securely erases a presignature after using it to generate a signature share. Secure erasing does not allow un-deleting of the information. After combining 208 the generated shares 116 of the signature 117 for themessage 124 into the signature 117 for the message 124. Signature 117 is verified 209, e.g., by the coordinating device, using a public key 143 out of the at least one public key 143 corresponding to the selected private key 125 of the multiple private keys. The public keys may be stored at the coordination device or retrieved from a key library.Figure 3a schematically shows an example of an embodiment of a signingdevice 110 with a key storage 142, e.g., in secure hardware. Key storage 142 may storeprivate key shares 141. Private key shares 141 may be associated with an asymmetric key pair, where the asymmetric key pair may comprise a private key and a public key 143. Figure 3b schematically shows an example of an embodiment of a signingdevice 110 which is connected to a coordinating system 120 with a key storage 144. Keystorage 144 may store public keys 143 associated to private key shares 141. Signingdevice 110 may be configured to connect to coordinating system 120 via communicationinterface 113. Below various further embodiments are discussed. In particular, an honest-majority threshold signing protocol is described, supporting batch generation of presignatures, in particular supporting ECDSA. Embodiments support multiple signingdevices, each holding shares of multiple private keys. Furthermore, batch presignaturegeneration is supported, in which signing devices simultaneously generate a number ofpresignatures at better amortized cost. It is an aim that the presignatures generated bythose signing devices to be usable for any one of those keys.Notation. ^ is a group of prime order ^, with generator ^. The field with ^elements is denoted by and ℤ∗^ = ℤ^\{0}. We let [^] = {1, … , ^}, and let ^ be acomputational security parameter. We let ^ ← ^ denote uniform selection of ^ from finiteset ^. Lagrange interpolation. If ^ ∈ ℤ^[^] is a polynomial of degree at most ^,then it is determined by its values on any ^ + 1 distinct points. Thus, for any ^ ∈ ℤ^ and^ ⊂ ℤ^ of size ^ + 1, there are efficiently computable Lagrange coefficients {^^^,^}^∈^suchthat any ^ ⊂ ℤ^ of size ^ + 1 and any we let When |^| ≥ ^ + 1, we can verify whether values {^^}^∈^ (with ^^ ∈ ℤ^) areconsistent with a degree-^ polynomial ^ (e.g., whether there exists a polynomial ^ ofdegree at most ^ such that ^(^) = ^^ for all ^ ∈ ^) by letting ^′ ⊆ ^ be an arbitrary subsetof size ^ + 1 and checking that for all ^ ∈ ^\^′.Overloading notation, for |^| ≥ ^ + 1 we let interpolate^(^, ^, {^^}^∈^) be the functionthat returns ⊥ if the {^^ }^∈^ are not consistent with a degree-^ polynomial, and otherwisereturns interpolate^(^, ^′, {^^}^∈^^) (for an arbitrary ^′ ⊆ ^ of size ^ + 1). (Note that when|^| = ^ + 1, any values {^^}^∈^ are consistent.)We further overload notation by allowing for interpolation “in the exponent.” 1and any with ^^ ∈ ^, we Note that if we let ^^ = log^^^ for all ^, thenlog^interpolate^(^, ^, {^^}^∈^) = interpolate^(^, ^, {^^}^∈^). For |^| ≥ ^ + 1, we canverify whether values {^^}^∈^ are consistent with a degree-^ polynomial in the naturalway, and define interpolate^(^, ^, {^^}^∈^) in a manner exactly analogous to above.Shamir secret sharing. The (^ + 1)-out-of-^ Shamir secret sharing of avalue ^ ∈ ℤ works by setting ^^: = ^, choosing ^^, … , ^^ ← defining the^(^) = ∑^ ^ ^^ ∈ of degree at most ^, and outputting the shares ^^(1), … , ^^ = ^(^). We denote this by (^^, … , ^^) ← ^^^(^). The value of ^ at any pointcan be derived from any set of ^ + 1 of the shares using Lagrange interpolation; inparticular, this allows for reconstructing the secret ^ = ^(0) from any ^ + 1 shares.ECDSA. For our purposes, the ECDSA signature scheme works as follows.To sign a hashed message ℎ ∈ ℤ^ with private key ^ ∈ ℤ^ , the signer chooses ^ ← ℤ∗^,sets ^: = ^^, and computes ^: = ^(^) ∈ ℤ^ for a publicly known function ^. It thencomputes ^: = ^^^ ⋅ (ℎ + ^^) mod ^ and, if ^ > ^ / 2, sets ^: = ^ − ^. Note we preferablysignature normalization is done to prevent malleability attacks. It outputs the signature(^, ^). Signature (^, ^) on hashed message ℎ with respect to public key ^ is verified bychecking that 0 < ^ < ^ / 2 and ^(^^⋅^^^ ⋅^^⋅^^^ )= ^. We denote such signatureverification by ^^^^^(ℎ, (^, ^)).Multiple ECDSA private keys may be shared by ^ signing devices ^^, … , ^^.The signing devices 110 may run an interactive protocol to sign messages using theprivate keys. An adversary, who may corrupt up to ^ < ^ / 2 of the signing devices, shouldbe unable to forge a signature under any key on any other message. For ease of exposition,we may let ^ ⊂ [^] denote the indices of the corrupted signing devices, and let ℋ =[^]\^ be the indices of the honest signing devices; although of course the identity of thehonest and corrupted signing devices are not known in a real implementationIn the execution of the threshold protocols, the signing devices ^^, … , ^^, maycommunicate via a synchronous network, in which each pair of signing devices may beconnected by a point-to-point secure channel, so a private and authenticated channel.The number ^ may be taken to be ^ = 2^ + 1; however, to a person skilled inthe art it may be clear that the protocols may be suitably adapted for any ^, ^ satisfyingthe honest-majority case of ^ < ^ / 2.The key generation may be done in several ways, as discussed above. The ^signing devices may hold shares of the private keys. The shares may be secret shares, e.g.,Sharmir secret shares, e.g., (^ + 1)-out-of-^ Shamir secret shares of the one or moreprivate keys ^(^), … , . Signing device ^^ may hold the ^ th share ^(^), … , ^(ℓ)^^of each of the private keys. A coordinating system, also called ‘coordinator’, may initiate a signingprocess among the ^ signing devices, as discussed above. The coordinator may be distinctfrom the signing devices; however, any of the signing devices may play the role of thecoordinator in any execution, and / or there could be multiple coordinators, including the case where there may be a different coordinator for each public key. When a coordinatormay initiate execution of the protocol to sign a message using the ^ th private key, thecoordinator may know the corresponding ^ th public key.The threshold ECDSA protocol may be designed to have a presigning phase, or preprocessing phase, for batch generation of presignatures. Following the presigning phase, signing may be done non-interactively using one of those presignatures when amessage to be signed is known. It may be chosen to use each presignature only once, e.g.,for security reasons. The coordinator may initiate execution of the different phases of the protocol, e.g., the presigning phase and / or the signing phase. To initiate computation of ^ presignatures, the coordinator may send amessage, e.g., (presign, ^) to one or more of the ^ signing devices. For example, thecoordinator may send the message to each of the ^ signing devices.In response, the signing devices may execute a protocol at the end of which(if the execution is not aborted) they each may output a collection of ^ tuples.To initiate computation of a signature on a hashed message ℎ to be signedusing the private key associated with public key ^, the coordinator may send to one ormore of the signing devices ^^, for example, to each of the signing devices, an indexindicating which presignature to use, the hashed message ℎ, and an index identifyingwhich key share to use. It may be chosen to provide one or more signing devices, forexample, to each of the signing devices, with the corresponding key share as input, insteadof an index identifying which key share to use.Whenever the signing devices may execute the described signing protocol,they may each hold the same hashed message ℎ, use key shares for the private keyassociated with public key ^ (thus, the key shares used by the signing devices to form avalid (^ + 1)-out-of-^ sharing of log^ ℎ, use the same presignature, and never reuse apresignature. The semi-honest coordinator as described above may enforce all of these aspects. Below is a description of protocol . The protocol uses protocol and ℱ^^^,^^^^^. ℱ^^^,^^ is a protocol for random secret sharing with the folowing functionality. Init : On input ^^^^ from at least one signing device, and optionally from amajority of the signing devices, send initialized to all signing devices. Each of thefollowing can then be called at most once. Rand : On input (^^^^, ^) send a share to ^^ of a random numberto at least a majority of the signing devices. Zero : On input (^^^^, ^) send {^^,^}^∈[^] to ^^ of zero to at least a majorityof the signing devices. ℱ^^^,^^^^^is a protocol for batch generation of multiplication triples with the following functinoality. Receive (^^^^^^, ^) from a signing device, or from at least a majority of thesigning devices send {(^^,^ , to ^^. Wherein the ^^,^ , ^^,^ , ^^,^ are shares ofintegers ^^, ^^, ^^, with ^^ ^^ = ^^.Various protocols for the generation of multiplication triples are known, e.g.,Beaver triples. Π^^,^^^^^: General framework for computing ECDSA signatures. Presigning: On input (^^^^^^^, ^), each signing device ^^ does:1. Send ^^^^ to ℱ^^^,^^. 2. Call ℱ ^,^^^^ on input (^^^^, ^), and let {^^,^}^∈[^] be the result.3. Call ℱ ^,^^^^^^^ on input (^^^^^^, ^). If the result is abort then abort;otherwise, let { [^] be the result.4. For ^ ∈ [^], send ^^,^ and ^^,^: = ^^^,^to all other signing devices.5. Let ^^: = interpolate^(0, [^], {^^,^}^∈[^]) and ^^: =interpolate^(0, [^], {^^,^}^∈[^]) for all ^ ∈ [^]. If ^^ ∈ {⊥ ,0} or ^^ =⊥ forsome ^, abort. Otherwise, for ^ ∈ [^] set ^′ : = ^ ^^^,^ ^ ⋅ and ^^: =^(^^). Store the tuples and send completed to thecoordinator. If the coordinator receives completed from all signing devices, it outputscompleted; otherwise it outputs abort. Note that in step 4 communication can be reducedat the expense of an additional round by having each ^^ send ^^,^ , ^^,^ to a designateddevice, who then reconstructs and sends those values to all signing devices. Thisaffects the security proofs only slightly. Signing: On input (^^^^, ^, ℎ, ^^), each signing device ^^ does:1. Set ^^: = ^′^,^ ⋅ (ℎ + ^^ ⋅ ^^) + ^^,^. Send (^^, ^^) to the coordinator. Delete(^^, ^^,^ , ^′^,^).The coordinator, who holds input (^^^^, ^, ℎ, ^), then does:1. Let {(^^, ^^)}^∈[^] be the messages received. If some signing device sendsnothing, output abort. Let ^: = ^^. If ^^ for some ^, output abort.2. Set ^: = interpolate^^(0, [^], {^^,^}^∈[^]); if ^ > ^ / 2, set ^: = ^ − ^. If^^^^^(ℎ, (^, ^)) ≠ 1, output abort; else output (^, ^).It can be mathematically proven that for any t < n / 2, protocol Π^^,^^^^^t-securely realizes reactive functionality model. The functionality may be based on ℱ^,^. Also, a functionality ℱ ^,^ ^^^ ^^^^^may be realized for performing weak multiplication of shared values. A protocol for ℱ^,^^^^^^^may involve a batch verification check of multiplication triples, e.g., randommultiplication triples, which may be based on known work, which is optimized, e.g., mademore efficient, for the current setting. The functionality may be realized existing techniques for pseudorandom secret sharing, which may also be optimized for asetting without broadcast or trusted setup, e.g., via allowing the signing devices to set upthe shared keys themselves, without a dealer, and without any additional rounds for commitments or complaint resolution and without a broadcast channel. The functionality ℱ^,^^^^^^may be realized using standard techniques. Realizing ^ ^,^ ^^^^^^ Below a possible embodiment of ℱ^^^,^^^^^is provided. In the constructionsigning devices multiply a number of secret-shared values using a weak multiplicationsubroutine that preserves privacy of inputs and outputs but allows the adversary to introduce an arbitrary additive shift in the result. For example, see functionality The signing devices additionally share a random value ^, and for each multiplication ofshared values ^, ^ to give output ^^ they also compute shares of ^^, ^^, and ^^^ usingthe same weak multiplication protocol. At the end of the computation, the signing devicesperform a probabilistic check using ^ fresh random values to verify that the adversaryhas not introduced an additive shift in any of the multiplications. In the context of ECDSA it suffices to securely generate multiplication triplesduring a preprocessing phase. We observe that it is enough to generate 2^ + 2 randomvalues and perform 3^ weak multiplications. To generate ^ multiplication triples withconventional methods would involve generating 3^ + 1 random values and performing4^ weak multiplications.ℱ^^,^^^^^Functionality for (weak) multiplication secure up to additive attacks. Receive {(^^,^ , ^^,^)}^∈[^] from the signing devices. For ^ ∈ [^] send to ^^, wherein the corresponding integers ^^ , ^^, ^^ form a multiplication triple.The protocol realizing ℱ^^^,^^^^^based on. ℱ^,^ ^^^^^can be realizedusing standard techniques. Before turning to the full proof of security for protocol Π^^^,^^^^^,we provide some intuition. In the protocol, signing devices first generate shares ofuniform values and ^ , ^, and ^ are defined similarly. They then use to compute shares (where ^^ is supposed to equal ^^ ⋅ ^^), {^^}^∈[^] (where ^^ is supposed to^ ⋅ ^^), and {^^}^∈[^] (where ^^ is supposed to equal ^^ ⋅ ^^). Finally, they reconstruct ^and ^, and publicly reveal If all signing devices behave honestly, then ^^ = ^^^ ⋅ ^^ = ^^^ for all ^ andso ^ = 0. The more interesting case is when the adversary exploits the weakmultiplication functionality to give incorrect output by using a nonzero shift. Π^,^Realizing ℱ^^^,^^^^^in the, ℱ^^,^^^^^}-hybrid On input (^^^^^^, ^), each signing device ^^ does:1. Send2. Call ℱ ^,^^^^ on input (^^^^, 2^ + 2). Denote the first 2^ results by the final two results by ^^, ^^ .3. Call inputs {(^^,^, ^^,^)}^∈[^] and {(^^, ^^,^)}^∈[^]. If the resultis ^^^^^, abort; else, let {^^,^}^∈[^]and respectively, be the results. 4. Call with inputs {(^^,^ , . If the result is ^^^^^, abort; else,let the result. 5. Send ^^, ^^ to all signing devices. If some signing device does not send avalue, abort; else, let ^: = interpolate^(0, [^], {^^}^∈[^]) and ^: =interpolate^(0, [^], {^^}^∈[^]). If ^ =⊥ or ^ =⊥, abort.6. Compute ^^ = ^ ⋅ ^^,^) ⋅ ^^and send it to all signing devices. If some signing device does not send a value, abort; else, let ^: =interpolate^(0, [^], {^^}^∈[^]). If ^ 0, abort; otherwise, output{(^^,^ , ^^,^ , ^^,^)}^∈[^].It can mathematically be proven that for any t < n / 2, protocol Π^,^^^^^^^t-securely realizes correct functionality in the {ℱ^,^, ℱ^,^ ^^^ ^^^^^}-hybrid model. Pseudorandom Secret Sharing To realize ℱ^^^^and ℱ^^^^, it is possible to rely on pseudorandom secretsharing (PRSS). We begin by describing how to realize ℱ^^^^. For ^ ≤ ^, let ^^^^,^denote the collection of all subsets of [^] of size ^ − ^. For ^ ∈ ^^^^,^, let ^^ ∈ ℤ^[^] bethe polynomial of degree at most ^ such that Let {0,1}^ × {0,1}∗ → ℤ^ be a pseudorandom function. Assume there arekeys {^^}^∈^^^^,^ such that each signing device ^^ holds {^^}^∈^. Then signing devicescan non-interactively generate a (^ + 1)-out-of-^ sharing of a secret indexed by ^ byhaving each ^^compute the share To see that this gives a valid (^ + 1)-out-of-^ Shamir sharing, define thepolynomial that has degree at most ^. Then observe that for ^ ∈ [^] it holds that The value defined by these shares is is uniform and independent of the other keys, then for any set ^ of ^corrupted signing devices and any distinct values ^^, …, the shared values ^^(0), … arejointly pseudorandom, even conditioned on the view of the corrupted signing devices. We remark that this holds regardless of how the {^^}^^ℋare chosen (so long as is independent of the other keys). This can be extended to generate a random (2^ + 1)-out-of-^ sharing of 0,something referred to as pseudorandom zero sharing (PRZS). Assume keys {^^}^∈^^^^,^distributed as before. Now, a signing device ^^ can compute a 0-sharing indexed by ^ as (where “∥” denotes concatenation). These shares correspond to points on the polynomial which has degree at most 2^ and satisfies ^(0) = 0. If ^ℋ is uniform andindependent of the other keys as above, it can be verified that (even given the view of anadversary corrupting up to ^ signing devices) the shares {^^ ^ }^∈ℋare uniform subject tothe constraint that In prior work on PRSS / PRZS, it is assumed that a trusted dealer chooses keys and distributes them to the appropriate signing devices, or else a complex protocol is run to securely establish those keys. We observe that neither of these are necessary, and itsuffices to have a designated device ^∗^ for each set ^ ∈ ^^^^,^ (say, ^∗^ = ^^ where ^ isthe smallest index in ^) choose a uniform key ^^ ∈ {0,1}^and send it (via privatechannel) to each ^^ with ^ ∈ ^. (If some ^^, ^ ∈ ^, does not receive anything from ^^∗, it sets ^^to a default value.) At a high level, this is still secure since • The key ^ℋwill be chosen uniformly and independently of the other keys, shared correctly, among the honest signing devices, and unknown to the adversary.• For any set ^ ∈ ^^^^,^ that contains a corrupted signing device, theadversary anyway learns ^^even if a trusted dealer distributes keys. •If the designated device for some subset ^ is corrupted, that signing devicecan send different keys ^^ to different signing devices in ^. Nevertheless, for PRSS theshares computed by the honest signing devices are uniform and independent (evenconditioned on the view of the adversary) and hence define some random shared value;for PRZS the shares computed by the honest signing devices are uniform and independentsubject to a linear constraint (that depends on the view of the corrupted signing devices) as required by the functionality. for pseudorandom secret sharing. For every set ^ ∈ ^^^^,^ do:(a) Let ^∗^ be a designated device with ^∗^ ∈ {^^}^∈^.(b) ^∗^ chooses ^^ ← {0,1}^and sends ^^(via secure channel) to {^^}^∈^. (c) Each signing device ^^ lets ^^ ^ be the key it received from ^^∗for set ^. (If ^^∗sends no value for ^^, then ^ ^ ^ sets ^^: = 0^.)On input (^^^^, ^), each signing device ^^ does:(a) For ^ ∈ [^], set (b) Output {^^,^}^∈[^]. On input (^^^^, ^), each signing device ^^ does:(a) For ^ ∈ [^], set ^^(^). (b) Output {^^,^}^∈[^]. As written, the protocol can be used for only one execution of ^^^^ and oneexecution of ^^^^ per invocation of ^^^^. However, it is possible to rely on a singleinvocation of ^^^^ for arbitrarily many executions of ^^^^ / ^^^^. For example, one mayuse domain separation for the underlying calls to the pseudorandom function Ψ. Withina single protocol this can be done use distinct identifiers for different calls to ^^^^ / ^^^^; across executions this can be done by relying on a random session id that is assumed notto repeat. It can be mathematically proven that Ψ is a pseudorandom function, thenprotocol PRSS^,^t-securely realizes ℱ^ Realizing Weak Multiplication Here we show how to realize ℱ^^,^^^^^based Note that a broadcast channel is not needed. hybrid model. device ^^ does:1. Send ^^^^ to ℱ^^^,^^. 2. Call ℱ^,^^^^ on input (^^^^, ^). Denote the result by .3. Call on input (^^^^, ^). Denote the result by {^^,^}^∈[^].4. For ^ ∈ [^] compute send ^^,^ to allsigning devices. If some signing device does not send a value, abort.5. For ^ ∈ [^], compute ^^: = interpolate^(0, [^], {^^,^}^∈[^]) and output It can be mathematically proven that protocol Π^,^^^^^^t-securely realizes ℱ^,^in the ℱ^,^^^^^^ ^^^-hybrid model. Figure 4a schematically shows an example of an embodiment of apresignature and signature generation method 400 for a signing device 110 storing a share141 of each of multiple private keys. Method 400 may comprise, in a presigning phase210, a step 201 of computing one or more presignatures 115, independent of the multipleprivate keys. Method 400 may optionally comprise, in presigning phase 210, a step 202of sharing a result of the computations 114 with one or more other signing devices 140.The result of the computations which may be shared may comprise the one or morepresignatures 115. Method 400 may further comprise, in presigning phase 210, a step 204of locally storing the one or more presignatures 115. Method 400 may further comprise,in a signing phase 220, a step 401 of receiving from a coordinating system 120 a selection125 for a private key out of the multiple private keys. Method 400 may further comprise,in signing phase 220, a step 206 of generating a share 116 of a signature 117 for a message124, using a presignature 115 out of the one or more presignatures 115 computed andstored in steps 201 and 204 of presigning phase 210. Method 400 may further comprise,in signing phase 220, a step 207 of sending the generated share 116 of signature 117 formessage 124 to a coordinating system 120. Figure 4b schematically shows an example of an embodiment of a signaturegeneration method 500 for a coordinating system 120. Method 500 may comprise, as partof a signing phase 220, a step 205 of sending a selection 125 for a private key out of multiple private keys to each of a plurality of signing devices 110. Method 500 may comprise, as part of a signing phase 220, a step 501 of receiving generated shares 116.1,116.2, 116.3 of a signature 117 for a message 124 from one or more of the plurality ofsigning devices 110. Method 500 may comprise, as part of a signing phase 220, a step208 of combining generated shares 116.1, 116.2, 116.3 of signature 117 for message 124into the eventual signature 117. Many different ways of executing method 400 and / or method 500 are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be performed in the shown order, but the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of method 400 and / or method 500 such as described herein, or may be unrelated to method 400 and / or method 500. For example, some steps may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started. Embodiments of method 400 and / or method 500 may be executed usingsoftware, which comprises instructions for causing a processor system to perform method 400 and / or method 500, or the steps taking place in phases 210 and / or 220 of method 400 and / or method 500. Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and / or for remote usage on a server. Embodiments of method 400 and / or method 500 may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array, to perform method 400 and / or method 500. It will be appreciated that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the presently disclosed subject matter into practice. The program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiment of the method. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods 400 and / or 500 set forth. These instructions may be subdivided into subroutines and / or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the devices, units, and / or parts of at least one of the systems and / or products set forth. Method 400 and / or method 500 may be a computer-implemented method. For example, accessing and sharing the training data, and / or receiving other input data may be done using a communication interface, e.g., an electronic interface, a network interface, a memory interface, etc. For example, storing or retrieving training parameters may be done from an electronic storage, e.g., a memory, a hard drive, etc. For example,adjusting stored parameters may be done using an electronic computing device, e.g., acomputer. Figure 5a schematically shows a computer readable medium 1000 having awritable part 1010, and a computer readable medium 1001 also having a writable part. Computer readable medium 1000 is shown in the form of an optically readable medium. Computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. Computer readable medium 1000 and 1001 may store data 1020 wherein the data may indicate instructions, which when executed by a processor system, cause a processor system to perform an embodiment of method 400 and / or method 500. Computer readable medium 1000, 1001 may also be configured to store one or morepresignatures 115 computed by a signing device 110, wherein signing device 110 may beconfigured to store a share 141 of each of multiple private keys, to compute the one or more presignatures 115 independent of the multiple private keys, and to locally store the one or more presignatures 115 on computer-readable medium 1000, 1001. Data 1020 may comprise a computer program 1020 according to an embodiment, The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and maybe non-recordable or recordable. The computer program 1020 may comprise instructionsfor causing a processor system to perform an embodiment of method 400 and / or method500, or to store one or more presignatures 115 as discussed above. Figure 5b schematically shows a schematic representation of a processorsystem 1140 according to an embodiment. The processor system comprises one or moreintegrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown. Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method 700 according to an embodiment and / or implement its modules or units. Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only. Circuit 1110 may comprise a communication element 1126, e.g., an antenna, connectors or both, and the like. Circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via an interconnect 1130, say a bus. The processor system 1140 may be arranged for contact and / or contact-less communication, using an antenna and / or connectors, respectively. For example, in an embodiment, processor system 1140 may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7processor, ARM Cortex-R8, etc. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software. While system 1140 is shown as including one of each described component, the various components may be duplicated in various embodiments. For example, the processing unit 1120 may include multiple microprocessors that are configured to independently execute the methods described herein or are configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein. Further, where the system 1140 is implemented in a cloud computing system, the various hardware components may belong to separate physical systems. For example, the processor 1120 may include a firstprocessor in a first server and a second processor in a second server.The following numbered clauses represent advantageous embodiments. Clause 1. A system (100) for presignature and signature generation, thesystem (100) comprising a plurality of signing devices (110) and a coordinating system(120), wherein each of the plurality of signing devices (110) stores a share (141) of eachof multiple private keys, wherein -each of the plurality of signing devices (110) comprises one or moreprocessors (111) and one or more storage devices (112) storing instructions that, when executed by the one or more processors (111), cause the one or more processors (111) to perform operations for -in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and -locally storing (204) the one or more presignatures (115),and -in a signing phase (220), upon receiving from the coordinating system(120) a selection (125) for a private key out of the multiple private keys, -generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115) computed (201) and stored (204) in the presigning phase (210), and -sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120), and -the coordinating system (120) comprises one or more processors (121) andone or more storage devices (122) storing instructions that, when executed by the one or more processors (121), cause the one or more processors (121) to perform operations for -sending (205) the selection (125) for a private key to one or more of thesigning devices (110), -upon receiving the generated shares (116, 116.1, 116.2, 116.3) of thesignature (117) for a message (124) from one or more of the signing devices (110), combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for the message (124) into a signature (117). For example, the coordinating system may send the selection (125) for aprivate key to each of the plurality of signing devices (110). For example, the coordinatingsystem may receive the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for a message (124) from each of the plurality of signing devices (110). Clause 2. A system (100) according to Clause 1, wherein each of the pluralityof signing devices (110) is configured to, in the presigning phase (210), performcomputations (114) resulting in a plurality of presignatures (115), each of the plurality of presignatures (115) being independent of the multiple private keys. Clause 3. A system (100) according to any of the preceding clauses, wherein- the coordinating system (120) is configured to additionally send (205) toone or more of the plurality of signing devices (110) the message (124) to be signed and / ora selection (126) for a presignature (115) out of the one or more presignatures (115), and -one or more of the plurality of signing devices (110) is configured toreceive from the coordinating system (120) -the message (124) to be signed, and / or- a selection (126) for the presignature (115) out of the one or morepresignatures (115) to use. For example, the coordinating system (120) may be configured to send (205)to each of the signing devices (110) the message (124) to be signed and / or a selection(126) for a presignature (115) out of the one or more presignatures (115). For example,each of the signing devices (110) may be configured to receive from the coordinatingsystem (120) the message (124) to be signed, and / or a selection (126) for the presignature(115) out of the one or more presignatures (115) to use. Clause 4. A system (100) according to any of the preceding clauses, whereinthe presignature (115) out of the one or more presignatures (115) which is used to generate (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) is securely erased from thesigning device (110) after being used to generate (206) the share (116, 116.1, 116.2,116.3) of the signature (117). Clause 5. A system (100) according to any of the preceding clauses, whereineach of the plurality of signing devices (110) is further configured to- communicate with one or more of the plurality of signing devices (110).Clause 6. The system (100) according to any of the preceding clauses, whereineach (^) of the plurality of signing devices (110) is further configured, during thecomputing (201) of the one or more presignatures (115), to -generate a message (^^^,^) corresponding to a share of an integer (^^),using a generator (^) of a group, and send the generated message (^^^,^) to another signing device (140) out of the plurality of signing devices (110), -generate a share of an inverse of the random integer (^^), and store(204) the generated share the inverse of the random integer (^^) as part of the one or more presignatures (115). Clause 7. The system (100) according to any of the preceding clauses, whereineach of the plurality of signing devices (110) is further configured to, during thecomputing (201) of the one or more presignatures (115), -generate one or more multiplication triples, wherein each of the one ormore multiplication triples comprises shares of one or more random integers, -generate a share of an inverse of a random integer from one or more of themultiplication triples. Clause 8. The system (100) according to Clause 7, wherein each(^^,^ , ^^,^ , ^^,^) of the multiplication triples comprises shares (^^,^ , ^^,^) of random integers(^^, ^^), as well as a share (^^,^) of a product (^^ = ^^ ⋅ ^^) of the random integers (^^, ^^),and each (^) of the plurality of signing devices (110) is further configured to- send the share (^^,^) of the product (^^ = ^^ ⋅ ^^) of the random integers(^^, ^^) to one or more other signing devices (140) out of the plurality of signing devices(110), and -generate a share of the inverse of the random integer(^^) corresponding to a multiplication triple (^^,^ , ^^,^ , ^^,^) out of the multiplication triplesand an interpolation (^^) of the sent shares (^^,^) of the products (^^ = ^^ ⋅ ^^) of therandom integers (^^, ^^) by the plurality of signing devices (110).Clause 9. The system (100) according to Clause 7 or 8, wherein each (^) ofthe plurality of signing devices (110) is configured to generate a plurality of multiplicationtriples, the generating comprising -generating shares of uniform values (^^, ^^) and shares of further uniformvalues (^, ^),- generating shares of products (^^ = ^^ ⋅ ^^) of the uniform values (^^ , ^^),shares of further products (^^ = ^ ⋅ ^^) of the uniform values (^^) and the further uniformvalues (^), and shares of third products (^^ = ⋅ ^^) of the further products and theuniform values (^^), -sharing the shares of the further uniform values (^, ^) with each of theplurality of signing devices (110), -upon receiving the generated shares of the further uniform values (^, ^)from each of the plurality of signing devices (110), generating shares of an expression(^ the expression comprising the generated shares of the thirdproducts (^^ = ^^ ⋅ ^^), the generated shares of the products (^^ = ^^ ⋅ ^^), and thegenerated shares of the further uniform values (^, ^), sharing the shares of the expression^ with each of the plurality of signing devices (110), and verifying if the expression ^equals zero, -outputting the generated shares of the uniform values (^^ , ^^) and thegenerated shares of the products (^^ = ^^ ⋅ ^^) of the uniform values (^^ , ^^) as thegenerated multiplication triples Clause 10. The system (100) according to any of the preceding clauses,wherein the coordinating system (120) stores at least one public key (143) correspondingto the multiple private keys and is further configured to- after combining (208) the generated shares (116, 116.1, 116.2, 116.3) ofthe signature (117) for the message (124) into the signature (117) for the message (124), verify (209) the signature (117) using a public key (143) out of the at least one public key (143) corresponding to the selected private key (125) of the multiple private keys. Clause 11. The system (100) according to any of the preceding clauses,wherein the presigning phase (210) further comprises generating and locally storing shares of a zero value, and wherein generating (206) the share (116, 116.1, 116.2, 116.3) of the signature (117) for a message (124) in the signing phase (220) comprises adding a generated share of the zero value. Clause 12. The system (100) according to any of the preceding clauses, furthercomprising -one or more devices (130) designated to a set of the signing devices (110),wherein each of the one or more devices (130) is configured to -obtain a key, and- send the key to each signing device (110) out of the designated set ofsigning devices (110). Clause 13. The system (100) according to Clause 12, wherein each of theplurality of signing devices (110) is further configured to- receive a key from a device (130) designated to a set of signing devices(110) comprising the signing device (110),- generate shares of a zero value using the received key.Clause 14. The system (100) according to Clause 12 or Clause 13, whereineach of the plurality of signing devices (110) is further configured to- receive a key from a device (130) designated to a set of signing devices(110) comprising the signing device, (110)- generate shares of a random value using the received key.Clause 15. The system (100) according to any of the preceding clauses,wherein the multiple private keys result from a distributed key generation protocol. Clause 16. A signing device (110), storing a share (141) of each of multipleprivate keys, which comprises one or more processors (111) and one or more storage devices (112) storing instructions that, when executed by the one or more processors (111), cause the one or more processors (111) to perform operations for -in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and -locally storing (204) the one or more presignatures (115),and -in a signing phase (220), upon receiving from a coordinating system (120)a selection (125) for a private key out of the multiple private keys, -generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115) computed (201) and stored (204) in the presigning phase (210), and -sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120). Clause 17. A coordinating system (120), comprising one or more processors(121) and one or more storage devices (122), storing instructions that, when executed by the one or more processors (121), cause the one or more processors (121) to perform operations for- sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving generated shares (116, 116.1, 116.2, 116.3) of a signature(117) for a message (124) from one or more of the signing devices (110), combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for the message (124) into the signature (117). For example, the coordinating system (120) may be configured to send aselection (125) for a private key out of multiple private keys to each of the plurality ofsigning devices (110). For example, each of the plurality of signing devices (110) may beconfigured to generate shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message(124) and / or send the generated shares (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), and / or the coordinating system (120) may be configured to receivegenerated shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message (124) from each of the signing devices (110). Clause 18. A presignature and signature generation method (400) for a signingdevice (110), the signing device (110) storing a share (141) of each of multiple privatekeys, the method (400) comprising -in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and -locally storing (204) the one or more presignatures (115),and -in a signing phase (220), upon receiving (401) from a coordinating system(120) a selection (125) for a private key out of the multiple private keys, -generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115) computed (201) and stored (204) in the presigning phase (210), and -sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120). Clause 19. A signature generation method (500) for a coordinating system(120), comprising -sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving (501) generated shares (116, 116.1, 116.2, 116.3) of asignature (117) for a message (124) from one or more of the signing devices (110),combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for the message (124) into the signature (117). For example, the coordinating system (120) may be configured to send aselection (125) for a private key out of multiple private keys to each of the plurality ofsigning devices (110). For example, each of the plurality of signing devices (110) may beconfigured to generate shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message(124) and / or send the generated shares (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), and / or the coordinating system (120) may be configured to receivegenerated shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message (124) from each of the signing devices (110). Clause 20. A non-transitory computer readable medium (1000, 1001)comprising data representing instructions, which when executed by a processor system (1140), cause the processor system (1140) to perform a presignature and signaturegeneration method (400) for a signing device (110), the signing device (110) storing ashare (141) of each of multiple private keys, the method (400) comprising -in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and -locally storing (204) the one or more presignatures (115),and -in a signing phase (220), upon receiving (401) from a coordinating system(120) a selection (125) for a private key out of the multiple private keys, -generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115) computed (201) and stored (204) in the presigning phase (210), and -sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120). Clause 21. A non-transitory computer readable medium (1000, 1001)comprising data representing instructions, which when executed by a processor system (1140), cause the processor system (1140) to perform a signature generation method (500) for a coordinating system (120), the method (500) comprising- sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving (501) generated shares (116, 116.1, 116.2, 116.3) of asignature (117) for a message (124) from one or more of the signing devices (110),combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for the message (124) into the signature (117). For example, the coordinating system (120) may be configured to send aselection (125) for a private key out of multiple private keys to each of the plurality ofsigning devices (110). For example, each of the plurality of signing devices (110) may beconfigured to generate shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message(124) and / or send the generated shares (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), and / or the coordinating system (120) may be configured to receivegenerated shares (116, 116.1, 116.2, 116.3) of a signature (117) for a message (124) from each of the signing devices (110). Clause 22. A non-transitory computer readable medium (1000, 1001) storingone or more presignatures (115), the one or more presignatures (115) being computed(201) by a signing device (110), the signing device (110) storing a share (141) of each ofmultiple private keys, the signing device (110) being configured to compute (201) the oneor more presignatures (115), independent of the multiple private keys, the signing device(110) being further configured to locally store (204) the one or more presignatures (115).It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb ‘comprise’ and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article ‘a’ or ‘an’ preceding an element does not exclude the presence of a plurality of such elements. Expressions such as “at least one of” when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, “at least one of A, B, and C” should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In the device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Claims

CLAIMS Claim 1. A system (100) for presignature and signature generation, the system (100)comprising a plurality of signing devices (110) and a coordinating system (120), whereineach of the plurality of signing devices (110) stores a share (141) of each of multipleprivate keys, wherein- each of the plurality of signing devices (110) comprises one or moreprocessors (111) and one or more storage devices (112) storing instructions that, whenexecuted by the one or more processors (111), cause the one or more processors (111) toperform operations for- in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and- locally storing (204) the one or more presignatures (115),and- in a signing phase (220), upon receiving from the coordinating system(120) a selection (125) for a private key out of the multiple private keys,- generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115)computed (201) and stored (204) in the presigning phase (210), and- sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120),and- the coordinating system (120) comprises one or more processors (121) andone or more storage devices (122) storing instructions that, when executed by the one ormore processors (121), cause the one or more processors (121) to perform operations for- sending (205) the selection (125) for a private key to one or more of thesigning devices (110),- upon receiving the generated shares (116, 116.1, 116.2, 116.3) of thesignature (117) for a message (124) from one or more of the signing devices (110),combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117)for the message (124) into a signature (117).Claim 2. A system (100) according to Claim 1, wherein each of the plurality of signingdevices (110) is configured to, in the presigning phase (210), perform computations (114)resulting in a plurality of presignatures (115), each of the plurality of presignatures (115)being independent of the multiple private keys.Claim 3. A system (100) according to Claim 1, wherein- the coordinating system (120) is configured to additionally send (205) toone or more of the plurality of signing devices (110) the message (124) to be signed and / ora selection (126) for a presignature (115) out of the one or more presignatures (115), and- one or more of the plurality of signing devices (110) is configured toreceive from the coordinating system (120)- the message (124) to be signed, and / or- a selection (126) for the presignature (115) out of the one or morepresignatures (115) to use.Claim 4. A system (100) according to Claim 1, wherein the presignature (115) out of theone or more presignatures (115) which is used to generate (206) a share (116, 116.1,116.2, 116.3) of a signature (117) is securely erased from the signing device (110) afterbeing used to generate (206) the share (116, 116.1, 116.2, 116.3) of the signature (117).Claim 5. A system (100) according to Claim 1, wherein each of the plurality of signingdevices (110) is further configured to- communicate with one or more of the plurality of signing devices (110).Claim 6. The system (100) according to Claim 1, wherein each (^) of the plurality ofsigning devices (110) is further configured, during the computing (201) of the one or morepresignatures (115), to- generate a message (^^^,^) corresponding to a shareof an integer (^^),using a generator (^) of a group, and send the generated message (^^^,^) to another signingdevice (140) out of the plurality of signing devices (110),- generate a share (^^,^′) of an inverse of the random integer (^^), and store(204) the generated share (^^,^′) of the inverse of the random integer (^^) as part of theone or more presignatures (115).Claim 7. The system (100) according to Claim 1, wherein each of the plurality of signingdevices (110) is further configured to, during the computing (201) of the one or morepresignatures (115),- generate one or more multiplication triples, wherein each of the one ormore multiplication triples comprises shares of one or more random integers,- generate a share of an inverse of a random integer from one or more of themultiplication triples.Claim 8. The system (100) according to Claim 7, wherein each (^^,^ , ^^,^ , ^^,^) of themultiplication triples comprises shares (^^,^, ^^,^) of random integers (^^ , ^^), as well as ashare (^^,^) of a product (^^ = ^^ ⋅ ^^) of the random integers (^^ , ^^), and each (^) of theplurality of signing devices (110) is further configured to- send the share (^^,^) of the product (^^ = ^^ ⋅ ^^) of the random integers(^^, ^^) to one or more other signing devices (140) out of the plurality of signing devices(110), and- generate a shareof the inverse of the random integer(^^) corresponding to a multiplication triple (^^,^ , ^^,^ , ^^,^) out of the multiplication triplesand an interpolation (^^) of the sent shares (^^,^) of the products (^^ = ^^ ⋅ ^^) of therandom integers (^^, ^^) by the plurality of signing devices (110).Claim 9. The system (100) according to Claim 7, wherein each (^) of the plurality ofsigning devices (110) is configured to generate a plurality of multiplication triples, thegenerating comprising- generating shares of uniform values (^^ , ^^) and shares of further uniformvalues (^, ^),- generating shares of products (^^ = ^^ ⋅ ^^) of the uniform values (^^, ^^),shares of further products (^^ = ^ ⋅ ^^) of the uniform values (^^) and the further uniformvalues (^), and shares of third products (^ =⋅ ^^) of the further products anduniform values (^^),- sharing the shares of the further uniform values (^, ^) with each of theplurality of signing devices (110),- upon receiving the generated shares of the further uniform values (^, ^)from each of the plurality of signing devices (110), generating shares of an expression(^ = ∑ ^ (^^ − ^ ⋅ ^^)^^ ), the expression comprising the generated shares of the thirdproducts (^^ = ^^ ⋅ ^^), the generated shares of the products (^^ = ^^ ⋅ ^^), and thegenerated shares of the further uniform values (^, ^), sharing the shares of the expression^ with each of the plurality of signing devices (110), and verifying if the expression ^equals zero,- outputting the generated shares of the uniform values (^^, ^^) and thegenerated shares of the products (^^ = ^^ ⋅ ^^) of the uniform values (^^ , ^^) as thegenerated multiplication triplesClaim 10. The system (100) according to Claim 1, wherein the coordinating system (120)stores at least one public key (143) corresponding to the multiple private keys and isfurther configured to- after combining (208) the generated shares (116, 116.1, 116.2, 116.3) ofthe signature (117) for the message (124) into the signature (117) for the message (124),verify (209) the signature (117) using a public key (143) out of the at least one public key(143) corresponding to the selected private key (125) of the multiple private keys.Claim 11. The system (100) according to Claim 1, wherein the presigning phase (210)further comprises generating and locally storing shares of a zero value, and whereingenerating (206) the share (116, 116.1, 116.2, 116.3) of the signature (117) for a message(124) in the signing phase (220) comprises adding a generated share of the zero value.Claim 12. The system (100) according to Claim 1, further comprising- one or more devices (130) designated to a set of the signing devices (110),wherein each of the one or more devices (130) is configured to- obtain a key, and- send the key to each signing device (110) out of the designated set ofsigning devices (110).Claim 13. The system (100) according to Claim 12, wherein each of the plurality ofsigning devices (110) is further configured to- receive a key from a device (130) designated to a set of signing devices(110) comprising the signing device (110),- generate shares of a zero value using the received key.Claim 14. The system (100) according to Claim 12, wherein each of the plurality ofsigning devices (110) is further configured to- receive a key from a device (130) designated to a set of signing devices(110) comprising the signing device, (110)- generate shares of a random value using the received key.Claim 15. The system (100) according to Claim 1, wherein the multiple private keys resultfrom a distributed key generation protocol.Claim 16. A signing device (110), storing a share (141) of each of multiple private keys,which comprises one or more processors (111) and one or more storage devices (112)storing instructions that, when executed by the one or more processors (111), cause theone or more processors (111) to perform operations for- in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and- locally storing (204) the one or more presignatures (115),and- in a signing phase (220), upon receiving from a coordinating system (120)a selection (125) for a private key out of the multiple private keys,- generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115)computed (201) and stored (204) in the presigning phase (210), and- sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120).Claim 17. A coordinating system (120), comprising one or more processors (121) and oneor more storage devices (122), storing instructions that, when executed by the one or moreprocessors (121), cause the one or more processors (121) to perform operations for- sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving generated shares (116, 116.1, 116.2, 116.3) of a signature(117) for a message (124) from one or more of the signing devices (110), combining (208)the generated shares (116, 116.1, 116.2, 116.3) of the signature (117) for the message(124) into the signature (117).Claim 18. A presignature and signature generation method (400) for a signing device(110), the signing device (110) storing a share (141) of each of multiple private keys, themethod (400) comprising- in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and- locally storing (204) the one or more presignatures (115),and- in a signing phase (220), upon receiving (401) from a coordinating system(120) a selection (125) for a private key out of the multiple private keys,- generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115)computed (201) and stored (204) in the presigning phase (210), and- sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120).Claim 19. A signature generation method (500) for a coordinating system (120),comprising- sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving (501) generated shares (116, 116.1, 116.2, 116.3) of asignature (117) for a message (124) from one or more of the signing devices (110),combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117)for the message (124) into the signature (117).Claim 20. A non-transitory computer readable medium (1000, 1001) comprising datarepresenting instructions, which when executed by a processor system (1140), cause theprocessor system (1140) to perform a presignature and signature generation method (400)for a signing device (110), the signing device (110) storing a share (141) of each ofmultiple private keys, the method (400) comprising- in a presigning phase (210),- computing (201) one or more presignatures (115), independent of themultiple private keys, and- locally storing (204) the one or more presignatures (115),and- in a signing phase (220), upon receiving (401) from a coordinating system(120) a selection (125) for a private key out of the multiple private keys,- generating (206) a share (116, 116.1, 116.2, 116.3) of a signature (117) fora message (124), using a presignature (115) out of the one or more presignatures (115)computed (201) and stored (204) in the presigning phase (210), and- sending (207) the generated share (116, 116.1, 116.2, 116.3) of thesignature (117) for the message (124) to the coordinating system (120).Claim 21. A non-transitory computer readable medium (1000, 1001) comprising datarepresenting instructions, which when executed by a processor system (1140), cause theprocessor system (1140) to perform a signature generation method (500) for acoordinating system (120), the method (500) comprising- sending (205) a selection (125) for a private key out of multiple privatekeys to one or more of a plurality of signing devices (110),- upon receiving (501) generated shares (116, 116.1, 116.2, 116.3) of asignature (117) for a message (124) from one or more of the signing devices (110),combining (208) the generated shares (116, 116.1, 116.2, 116.3) of the signature (117)for the message (124) into the signature (117).Claim 22. A non-transitory computer readable medium (1000, 1001) storing one or morepresignatures (115), the one or more presignatures (115) being computed (201) by asigning device (110), the signing device (110) storing a share (141) of each of multipleprivate keys, the signing device (110) being configured to compute (201) the one or morepresignatures (115), independent of the multiple private keys, the signing device (110)being further configured to locally store (204) the one or more presignatures (115).

Images