A threshold cryptographic method

Abstract

A threshold cryptographic method, an apparatus, and a non-transitory computer readable storage medium is provided. The method may comprise: generating Formula (I) subgroups, where N is the number of parties in the group and T is a threshold number of parties required to form a valid signature, each subgroup comprising N − T + 1 parties, each subgroup comprising a different set of parties to each of the other subgroups; generating Formula (II) shares S 1 of a secret key S, each share S 1 corresponding to a respective subgroup; and distributing copies of each of the shares S 1 to each of the parties in the respective subgroup, wherein the shares S 1 can be combined to form the secret key S. The apparatus may be configured to perform the aforementioned method. The non-transitory computer-readable storage medium may be configured to hold machine-readable code which, when executed on a computer, may cause the computer to perform the aforementioned method.

Description

[0001] 1 1101.P033

[0002] A THRESHOLD CRYPTOGRAPHIC METHOD

[0003] Technical Field

[0004] The present invention relates to a threshold cryptographic method, an information processing apparatus, and a non-transitory computer-readable storage medium. More particularly, the invention may relate to lattice-based cryptographic methods.

[0005] Background

[0006] A threshold signature scheme is a specific type of multiparty computation scheme that distributes a signing key across N devices so that any subset of T devices may interact to jointly sign a message, but strictly less than T cannot. While there exist several efficient secure threshold signature scheme constructions based on RSA, ECDSA and Schnorr algorithms, upcoming post quantum standards, Dilithium, SPHINCS+ and Falcon are difficult to thresholdize. Building efficient threshold signature schemes based on post-quantum assumptions has remained a largely open problem until recently. Threshold signature schemes may use large amounts of bandwidth to generate signatures. It is therefore desired to provide a lattice-based threshold signature scheme that uses reduced bandwidth.

[0007] Summary

[0008] According to a first aspect of the present invention, there is provided a threshold cryptographic method for a group of parties, the method comprising: generating where N is the number of parties in the group and T is a threshold number of parties required to form a valid signature, each subgroup comprising N — T + 1 parties, each subgroup comprising a different set of parties to

[0009] N1each of the other subgroups; generating yr-1yyN-T+1y shares szof a secret key s, each share Sj corresponding to a respective subgroup; and distributing copies of each of the shares Sj to each of the parties in the respective subgroup, wherein the shares Sj can be combined to form the secret key s. The method may further comprise combining the 2 1101.P033

[0010] N1shares S / to form the secret key s. Generating(-T-1-)!(-w-r+1-)!subgroups, each with shares s may provide a way of sharing a secret key s such that a threshold number of parties T may be able to combine their shares to obtain the secret key s, but any number of parties fewer than T may not be able to combine to obtain the secret key s.

[0011] N1

[0012] Generating yr-1yyN-T+1y shares szof a secret key s may comprise each party sampling a seed. Each party may share the seed with each other party in the group. The parties may combine the seeds to generate a global seed. A party may generate N1

[0013] - — — - - shares s, of the secret key s from the global seed.

[0014] (r-i . N-T+i .1 J°

[0015] Each party sharing the seed to each other party in the group may comprise: for each party: generating a commitment of the seed; sharing the seed and the commitment of the seed with each other party in the group; receiving each other seed and commitment of the corresponding seed from each other party in the group; and verifying each of the seeds by comparing the seed to the corresponding commitment of the seed.

[0016] The shares szmay be generated by a party in the corresponding subgroup whose identity is determined according to a criteria relating to identifiers of the parties in the subgroup.

[0017] Distributing copies of each of the shares sImay further comprise distributing a public share brto each other party in the group. Subsequently each other party in the subgroup may verify the shares Sj by comparing the shares Sj to the corresponding public shares bj. In some implementations, the shares Sj may be combinable to form the secret key s by summing the shares Sj. The shares Sj may be combinable to form the secret key by multiplying the shares Sj together, by concatenating the shares, or in any other way. The threshold cryptographic method may be for use in at least one of a threshold signature scheme and a threshold decryption scheme. Threshold signature schemes and threshold decryption schemes are more secure than non-threshold schemes because an adversary would have to gain control of at least the threshold number of parties T to be able to determine the secret s. The group signature in a threshold signature scheme may be lattice-based. Lattice-based threshold signature schemes may be secure against an adversary using a quantum computer or a classical computer. 3 1101.P033

[0018] The method may further comprise, in some implementations, in a first round: each party in a signing set generating a sample; and each party in the signing set distributing a commitment of the sample to each other party in the signing set; in a second round: each party in the signing set distributing the sample to each other party in the signing set; in a third round: each party in the signing set verifying the commitments of the samples from each other party in the signing set; generating a global commitment from the samples; generating a global challenge from a message and the global commitment; each party in the signing set generating an individual response using the shares szheld by that party; and each party in the signing set distributing their individual response to each other party in the signing set; and in a combining round: aggregating the individual responses to generate an aggregated response; and generating a signature using the global challenge and the aggregated response. Sending a message with a signature may provide additional security. Generating a signature using the threshold secret sharing method may provide a latticebased threshold signature scheme using short vectors, which can reduce the bandwidth required to securely send a message.

[0019] The method may further comprise generating a hint value. The method may further comprise, during a verification of the signature, verifying the shortness of the aggregated response by comparing the aggregated response to a bound value. Comparing the aggregated response to a bound value may comprise comparing a length of a concatenation of the aggregated response and the hint to a bound value. The method may abort if the verification fails. Comparing the length of the aggregated response to the bound value may provide an additional check for adversaries. The method may yet further comprise, during verification of the signature, verifying the global challenge by comparing the global challenge to a hash of the message and the global sample. The method may abort if the verification fails. Comparing the global challenge to the hash of the message and the global sample may provide an additional check for adversaries. In the case the method is aborted, the adversary may be identified and removed, preventing the method from aborting in future.

[0020] Generating an individual response using the shares szmay comprise, for each party in the signing set: determining a set of the shares sz; forming a partial share sart 4 1101.P033 using the set of shares; and calculating the individual response value based on the partial share. Forming a partial share sartusing the set of shares may comprise each party summing the determined set of shares sIto form the partial share sart. The sample of each device may be based on a product of a public matrix and a first value, the first value sampled from a distribution.

[0021] In some implementations, the threshold cryptographic method may use rejection sampling to mask the distribution from which the first value is sampled. The method may further comprise: calculating a ratio / z(z) / M / r(r), wherein / Z(z) is a target distribution for z, z is the individual response, / r(r) is a distribution from which the first value r is generated, and M is a constant; substituting the minimum value of the ratio and 1 into a distribution; and outputting the response if the output of the distribution is not equal to zero. The distribution may be a Bernoulli distribution.

[0022] In other implementations, the threshold cryptographic method may use noise flooding. The sample of each device may be based on a sum of a noise and a product of a public matrix and a first value. Bit dropping may be used throughout the method to minimise bandwidth used.

[0023] The shares may be generated to be short enough to meet at least one of a bound check during a verification of the signature and to allow the product of the challenge and a share to hide the share during rejection sampling. The generated shares may be short with overwhelming probability by construction of a distribution used to generate the shares. The shares may be generated so that the individual responses are short enough to satisfy criteria of a problem associated with finding short vectors in lattices.

[0024] The method may be a Fiat-Shamir with aborts signature scheme. The method may be a Fiat-Shamir with aborts signature scheme that is compatible with the use of threshold signatures.

[0025] In a second embodiment, there may be provided an apparatus comprising storage and a processor, the apparatus configured to perform the method of the first embodiment.

[0026] In a third embodiment, there may be provided a non-transitory computer- readable storage medium, the storage medium configured to hold machine-readable 5 1101.P033 code, which, when executed on a computer, causes the computer to perform the method of the first embodiment.

[0027] Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings.

[0028] Brief Description of the Drawings

[0029] Figure 1 is a schematic diagram showing components of an information processing apparatus;

[0030] Figure 2 is a flow chart showing a distributed key generation method with short secrets;

[0031] Figure 3 illustrates steps of distributed key generation method with short secrets;

[0032] Figure 4 illustrates steps of a first round of a distributed key generation method with short secrets;

[0033] Figure 5 illustrates steps of a second round of the distributed key generation method with short secrets;

[0034] Figure 6 illustrates steps of a third round of the distributed key generation method with short secrets;

[0035] Figure 7 illustrates steps of a fourth round of the distributed key generation method with short secrets;

[0036] Figure 8 illustrates a function for use in the distributed key generation method with short secrets;

[0037] Figure 9 depicts steps of a first round of a first threshold signature scheme;

[0038] Figure 10 depicts steps of a second round of the first threshold signature scheme;

[0039] Figure 11 depicts steps of a third round of the first threshold signature scheme;

[0040] Figure 12 depicts steps of a signature generation process for the first threshold signature scheme;

[0041] Figures 13 and 14 depicts steps for verifying a signature generated by the first threshold signature scheme;

[0042] Figure 15 is a table showing parameters for use in the first threshold signature scheme; 6 1101.P033

[0043] Figure 16 depicts steps of a first and a second round of a second threshold signature scheme;

[0044] Figure 17 depicts steps of a third round of the second threshold signature scheme;

[0045] Figure 18 depicts steps of a signature generation process of the second threshold signature scheme; and

[0046] Figure 19 depicts steps for performing rejection sampling as part of the second threshold signature scheme.

[0047] Detailed Description

[0048] The description below presents methods of securely sharing a secret, and threshold signature schemes that use the methods of securely sharing a secret.

[0049] Preliminaries

[0050] The threshold signature scheme described below may be performed on one or more information processing apparatus such as a server, computer, and / or mobile device. In one example a group of signers in a group may wish to be able to sign a message as long as a threshold number T of the signers in the group contribute to the signature process. The signers may participate in the signature scheme using separate user devices.

[0051] In other implementations all the processing may be performed on a single information processing apparatus and there may be a single user. For example, a user may have a signing key associated with a cryptographic asset, such as an asset on a blockchain. The user may wish to keep the signing key secure and resistant to loss. Accordingly, the user may generate shares of the signing key and store them on different storage devices. In this case, the user may sign a document using the storage devices as long as the user has access to at least a threshold number of the devices. Similarly, a malicious actor would need access to a threshold number of the storage devices to apply the signature. In some implementations the storage devices may be drives, such as solid- state drives or the like. All steps of the method in this case could be performed on a single information processing apparatus based on information relating to the key shares stored on the storage devices. The description below will describe potential signers. 7 1101.P033

[0052] However, the term ‘potential signer’ or ‘signer’ may be used interchangeably with the term ‘secret share’ because as just described, the method could be performed by a single user in respect of each secret share. Accordingly, the term ‘signer’ should not be interpreted as requiring a separate user or a separate information processing apparatus.

[0053] Figure 1 is a schematic diagram of components of an example information processing apparatus 1 suitable for use in the embodiments described below. The diagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 10, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The information processing apparatus 1 comprises a processor 11, a storage in the form of memory 12, a network module 13, a display 14, and a user interface 15. The network module may allow the information processing apparatus 1 to communicate over a network such as a Wi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 16. Further components may be provided but are not shown or described. Any of the steps of the subsequently described methods may be performed by computer-readable instructions of one or more programs stored in a storage and executed by a processor on one or more information processing apparatuses. The program may be stored on a non-transitory computer readable storage medium.

[0054] The method is performed over a public matrix, A, over a ring of polynomials, R. R is a ring of polynomials modulo d. The ring, R, is defined as

[0055] Z[x]

[0056] Jt — . xd+ 1 and Rqis defined as: 8 1101.P033

[0057] The methods below on the assumption that Hint Module Learning with Errors problem is hard to solve. The problem is defined over For more details, see, for example, Thomas Espitau, Guilhem Niot, and Thomas Prest. Flood and submerse: Distributed key generation and robust threshold signature from lattices. In Leonid Reyzin and Douglas Stebila, editors, CRYPTO 2024, Part VII, volume 14926 of LNCS, pages 425-458. Springer, Cham, August 2024.

[0058] The matrix, A E qXl, has dimensions of k by I and each entry in the matrix is a polynomial of Rq.

[0059] First distributed key generation protocol

[0060] A first distributed key generation protocol is described here. The method uses a protocol Keygen between N participants. The method generates a public key, vk, an auxiliary key, ak, and a partial private key sk;, for each participant, composed of a pool of shares st. The public key may sometimes alternatively be referred to using the symbol pk. Each of the parties may be labelled with an identifier, which may be a number that corresponds to their index i in the group.

[0061] Figure 2 is a flowchart showing steps of a distributed key generation (DKG) scheme that distributes short secrets. The DKG scheme may take place at a trusted device, such as a central actor or server. Alternatively, the DKG scheme may be distributed across parties, which is described in more detail later. The steps of this DKG scheme are also illustrated in more detail in Figure 3. In step 20 of Figure 2 and step 1 of Figure 3, each party samples a seed. The seed, seed; <- {0,l]K, may be a binary string of length K, where K is a security parameter. Each party then sends to other parties a hashed commitment that is a hash of their sampled seed, cmt; := Hcmt(seed;).

[0062] In a second round, at step 21, after each party has committed to their seed, each party z reveals their seed, seed;.

[0063] In a third round, at step 22, each party checks the received seeds against the hashed commitments from the first round. If the seeds match the hashed commitments, each party computes an overall seed, seed = Hseed(seed;);£[W], by hashing or using another one-way function on the received seeds. Each party generates (Figure 3, step 2) 9 1101.P033 a public matrix, A = ExpandA(seed), using a generator function and the overall seed, such as a pseudo-random function.

[0064] In step 4 of Figure 3, the parties sample secrets Sj <- T>s+lfrom a distribution T> for each party in each set of parties I. The sets I are sets of cardinality N — T + 1. The sets I include all different sets of cardinality N — T + 1 that it is possible to form within the group of N parties. The sets I may alternatively be referred to as subgroups. The distribution T> is selected so that the sampled secrets will be short below a threshold size J?! with very high likelihood. More specifically, each party samples secrets for each set I of cardinality N — T + 1 for which that party is a member of the set and has the largest identity in the set (for an identity i, i = max ( / )). In other words, a single party in each set of cardinality N — T + 1 that can be formed for the group of N users generates secrets for that set.

[0065] In step 5 of Figure 3, the party generating the secrets also computes a partial public key bj = [A / ] ■ Sj using the public matrix, A, and the secrets, sz. Here I is the identity matrix. The secrets szmay alternatively be referred to as shares Sj. In step 23 of Figure 2, the parties that generate secrets for one or more sets send the secrets Sj for the set over a private channel to all parties in the set j G I. The party publishes a commitment of the public key that it generated for the set, cmtj := Hcmt(£?,) , for each public key, bj, of each set. The commitment cmtj may alternatively be referred to as the subgroup commitment cmtj.

[0066] Finally, in a fourth round at step 24, all the parties reveal the bj they generated in the previous round. The parties also verify the consistency of the Sj they received with the hashes cmtj, in case of inconsistency, they complain against the party that sent the secrets and commitment of the public key, i.e. they reveal the value they received so that the inconsistency can be publicly verified. The parties also check the shortness of the received secrets, which should be assured by sampling from the distribution T>.

[0067] The results of the short distributed key generation, Figure 3 steps 9 to 11, are a key aggregation that consists in choosing as public key vk := b ■= ,i , and the auxiliary key, ak, that is the set of all the partial keys ak := In case there were complaints in the last round, aggregation verifies them and in case they are valid, 10 1101.P033 malicious parties are identified. A distributed key generation secret is a sum of the secrets across the sets, i.e. s = S / si-

[0068] Second distributed key generation protocol

[0069] The section below describes a second distributed key generation protocol. It is possible to distribute generation of the secret key by having one party in each I sample the corresponding share Sj. It is possible to additionally implement identifiable aborts within the distributed key generation protocol by including shortness checks and consistency verifications of the partial public key reconstructions. The identifiable abort property means that, in the case the method aborts due to an error, the party that caused the error can be identified. As in the first distributed key generation protocol, the second distributed key generation protocol takes place in a group of N parties. Each party in the group may be labelled with an identifier, which may be a number that corresponds to their index i in the group.

[0070] At a high level, the steps of the protocol may be summarised as:

[0071] 1. In a first round, each party i in the group samples a seed, seed; . Each party i then distributes their seed to each other party in the group using a hashed commitment.

[0072] 2. In a second round, each party i reveals their corresponding seed, seed;.

[0073] 3. In a third round, each party i computes a hash of a concatenation of each of the seeds. Each party then uses the output of the hash to generate a public matrix. Then, the party compares its identifier to each of the other parties in the sets I. If a party has the highest value identifier in a set, that party samples shares Sj for that set (recall that each set is of cardinality N — T + 1). That party uses the shares to compute a corresponding partial public key bj = [A I] • sj. The shares Sj are sent over a private channel to each of the parties j in the set I. A public commitment cmtj = cmtlbj) is sent publicly for each partial public key bj.

[0074] 4. In a fourth round, each party reveals the partial public keys bj that they sampled in the third round. The parties also verify the consistency of the Sj they received with the corresponding public commitments cmtj. In a case 11 1101.P033 that a party finds an inconsistency, the party raises a complaint against the party that send the inconsistent commitment. The inconsistency can then be publicly verified by the other parties in the group. This provides the property of identifiable abort.

[0075] Key aggregation may involve generating a public key vk = b = Auxiliary information is also sent. The auxiliary information may be the set of all the partial keys aux In the case one or more parties finds an inconsistency, key aggregation identifies the inconsistencies. If the complaints are found to be upheld, malicious parties can be identified.

[0076] A more detailed description of the second DKG protocol is provided here with reference to Figures 4 to 7. Figure 4 describes a first round of the DKG protocol. In the first round, the algorithm ShareKeygen! is performed. The algorithm ShareKeygen! takes as input a state st; of the party performing the algorithm. The steps of Figure 4 are performed by each of the parties in the group. In step 1, a seed seed; is sampled from a distribution.

[0077] In step 2, a state st; of the party is updated with the sampled seeds.

[0078] In step 3, a commitment is generated. The commitment is a hash of the seed. In other words, cmt; = Hcmt(seed;). Here, cmt; represents the commitment, seed; represents the seed and Hcmtrepresents the hash function. Hash functions are well known in the art and so are not described further here.

[0079] In step 4, the commitment cmt; is returned as part of a public state pm^. The subscript 1 indicates that the public state is the public state after the first round, and the superscript i indicates that the public state is the public state of party i. In contrast to the state st;, which is an internal state, the public state pm, is available to each of the parties in the group. At the end of the first round, the commitments are distributed to each of the parties in the group.

[0080] Figure 5 describes the second round of the key generation protocol. In the second round, each party reveals its seed, seed;. In the second round, the algorithm ShareKeygen2is performed. The algorithm ShareKeygen2takes as input st; and pm- The steps of ShareKeygen2are performed by each of the parties in the group. In step 1 of Figure 5, the seed seed; is fetched from the state st;. In step 2, the state st; is updated 12 1101.P033 to include the public state pn^ of each of the parties in the group after the first round. In step 3, the public state pm^ is defined as seed; for each party i. At the end of the second round, the seeds are distributed to each of the parties in the group.

[0081] Figure 6 describes the third round of the key generation protocol. In the third round, the algorithm ShareKeygen3is performed. The algorithm ShareKeygen3takes as input st; and pm2. The steps of ShareKeygen3are performed by each of the parties in the group. In step 1 of Figure 6, the public state pmxis fetched from the state st;. Step 2 involves parsing the commitments (cmty) . for each of the parties from the public state pmrStep 2 also involves parsing the seeds (seedy) , for each of the parties from the public state pm2. Steps 3 to 5 involve checking whether the commitments cmty correspond to the seeds, seedy, that were revealed in round 2. The check proceeds by comparing the value of the commitment cmty to a hash of the seed, seedy, for each party j in the group, and aborting if the checks fail. The abort message contains the identity of the party whose commitment and hash did not match. In equation form, the algorithm ShareKeygen3aborts if cmty A Hcmt(seedy).

[0082] In step 6, each of the parties calculates an aggregated seed. The aggregated seed is calculated by hashing a concatenation of each of the seeds seedy. In equation form, seed = Hseed((seedy) . Here, seed is the aggregated seed, seedy refers to each of the seeds from the parties j, and Hseedis a hash function. The hash function Hseedmay be the same as the hash function Hcmtmentioned earlier, or the hash function Hseedmay be different to the hash function Hcmt. The aggregated seed is then used in step 7 to generate a public matrix A.

[0083] Steps 8 to 14 describe generating and sharing the shares szand the partial public keys bj. In step 8, messages msgS; are initialised as an empty set. Step 9 provides the conditions in which steps 10 to 14 are performed. The steps 10 to 14 are performed for each subgroup I of cardinality N — T + 1 for which the party i has the highest value identifier in the group. In other words, the steps 10 to 14 are performed by a party i if i = max ( / ). In step 10, a share Sj is sampled from a distribution. The distribution may be a Gaussian distribution of dimension k + I, where k and I are the dimensions of the public matrix A. The standard deviation of the distribution may be labelled as as. The 13 1101.P033 shares szare then used to generate the partial public keys b In equation form, b, = [ / ] • Sj. Here, bj is the partial public key, A is the public matrix, I is an identity matrix and Sj is the share. The square bracket notation indicates that the public matrix and the identity matrix are concatenated, which provides additional security by increasing the dimensions of the matrix allowing for a larger share that contains more random values. Step 12 involves generating a subgroup commitment cmt[ which is a hash of the partial public key bj. In equation form, cmtj = Hcrnt(£? / ). Here, cmtj is the subgroup commitment, bj is the partial public key and Hcmtis a hash function. Then, in steps 13 and 14 the shares Sj are encrypted and added to the messages msgSj, which are to be sent to each of the other parties j in the subgroup I.

[0084] In step 15, the state st; is updated with the aggregated seed and the shares for each of the subgroups I. In step 16, the public state pm3is updated with the messages msgS; and each of the subgroup commitments cmtj. At the end of the third round the messages, msgS;, are sent to the respective parties, i.

[0085] Figure 7 describes the fourth round of the key generation protocol. In the third round, the algorithm ShareKeygen4is performed. The algorithm ShareKeygen4takes as input st; and pm3. The steps of ShareKeygen4are performed by each of the parties in the group. In step 1 of Figure 7, the aggregated seed and the each of the shares Sj are parsed from the state st;. In step 2, the messages msgsyand subgroup commitments cmt; are parsed from the public state pm3. Parsing of all the subgroup commitments that correspond to those carried out by the party in a given subgroup with the highest value identifier takes place. In step 3, the aggregated seed is recalculated in the same way as the aggregated seed is calculated in step 6 of ShareKeygen3. The aggregated seed is calculated by hashing a concatenation of each of the seeds seed;. Step 4 involves calculating the public matrix A in the same manner as the public matrix A is calculated in step 7 of ShareKeygen3.

[0086] Steps 5 to 10 describe the process of verifying the generation of the shares. In step 5, a list of complaints for each party i is initialised as an empty list. Step 6 describes the conditions in which steps 7 to 10 take place. Steps 7 to 10 are performed, for each subgroup I, if the party does not have the highest value identifier in the subgroup. This is so that the parties in the subgroup which did not generate the shares Sj are able to 14 1101.P033 verify whether the shares szwere generated correctly in ShareKeygen3. Step 7 involves decrypting the shares szfrom the message msgsmaXQ). The message msgsmax(I) is received from the party in the subgroup I with the highest value identifier, i.e. the party that generated the shares Sj. Accordingly, the message msgsmax(I) contains the encrypted shares Sj. In step 8, the partial public key is calculated from the share Sj in a similar manner to step 11 of ShareKeygen3. As before, the partial public key bj is generated from the share Sj as bj = [A / ] • Sj. Step 9 is a verification step and comprises two tests. The first test is a test of the shortness of the share sz. The share szis compared to a bound value r / 1. If the share exceeds the length of the bound value, the party that generated the share is added to the list of complaints, complaints;, in step 10. The second test is a test of the subgroup commitment cmtj. It is checked whether the subgroup commitment cmtj is equal to a hash of the partial public key bj. If the check fails, in other words if cmtj then the party that generated the corresponding share is added to the list of complaints, complaints;, in step 10.

[0087] In step 11, the list of complaints, complaints;, and the partial public keys bj are returned as the public state pm^. Note that, throughout the protocol, aborts due to parsing errors are possible: if an unexpected message is received, parties abort and report the sender as malicious.

[0088] The key generation protocol described above has generated and distributed a set of shares sz, which may be used as portions of a secret key and corresponding partial public keys bj, which may be used as portions of a public key. The checks in step 9 of ShareKeygen4mean the protocol has the identifiable abort property.

[0089] To understand how this distributed key generation works intuitively, note that if you have at least T parties, then you must have a party that is a member of every set. Accordingly, a sum can be formed collectively that will be a complete sum of the sets of secrets. On the other hand, if you have fewer than T parties, you do not have enough parties to have a member of each of the possible sets of cardinality N — T + 1. Accordingly, with fewer than T parties, it is impossible to reconstruct the distributed key generation secret.

[0090] Figure 8 illustrates steps of an algorithm:

[0091] RepL Recover(act) -> {0, I]5I XS2X ...XSW 15 1101.P033

[0092] This algorithm provides coefficients for reconstruction of the secret or public key from individual shares for any given set ‘act’ of at least T parties.

[0093] Steps 1 to 4 illustrate that for each set I of cardinality N — T + 1 if a device identity within the group, z, is the largest identity that is both in the set, I, and the group act of parties performing the threshold method, then the value I= 1. Otherwise, as shown in steps 5 and 6, for all other parties, = 0. Intuitively this allows parties within the group of parties performing the threshold method, act, to have a coefficient to allow the secret or partial public key from each set to be added only once when forming a partial secret or partial public key. When threshold method is completed, the partial secrets or partial public keys should sum to the overall key as described above in connection with Figures 2 and 3.

[0094] Accordingly, during the key generation process, each potential signer receives a pool of secret shares sk; associated with the sets that the signer is a member of.

[0095] First threshold signature method

[0096] The public key for the threshold signature scheme (which is different from that of the distributed key generation described above), vk, takes a form of A, A • s + e. The matrix, A, and the public key, vk, are made publicly available parameters.

[0097] A threshold signature method that proceeds in three rounds will now be described. In some implementations each round will be time limited such that each of a threshold number of active signers (hereinafter ‘signers’) of the N potential signers should complete the specified steps within the time limit. If the threshold number of signers do not complete the required steps for a round within the time limit, the threshold signature method may be aborted. In a first round, each signer generates and makes available a commitment, cmtj. In a second round, each signer makes available an LWE commitment, wL. In a third round, each signer makes available a response zt. A central actor or one of the participants can then generate a signed message based on the available information as will be described in connection with Figure 12. Each round may be completed sequentially to maintain security of the signature scheme. At the end of each round the signers may check that the round has been completed before initiating steps in the subsequent round. 16 1101.P033

[0098] Figure 9 is a schematic diagram showing steps performed by each signer during a first round of the threshold signature scheme. The inputs to the first round are a state of the signer, st;, a session identifier, sid, an identifier of a group of signers, act, and a message to be signed, msg.

[0099] In step 2, each signer identified by subscript, i, samples two random vectors, rt, e'i. The values are sampled from Gaussian distributions T> over the ring. In step 3, an LWE commitment, wt, is determined as a sum of the second random vector and a product of the first random vector and the public matrix, A:

[0100] W := A • Vi + e'i

[0101] The commitments wLmay alternatively be referred to as samples to distinguish them from the hash commitments, described below. In step 4, the session state, st;, at each signer is updated to include the generated commitment, wband the sampled random values rtand e'.

[0102] In step 5 a hash commitment, cmt;, is calculated that is a hash (or other oneway function) of the public key, the identity of the signer, i, and the commitment, wt: cmt; = Hcmt(vk, i, W;)

[0103] The hash commitment is shared with other signers as a public message, pmt, at the end of the first round.

[0104] Figure 10 is a schematic diagram showing steps of a second round of the threshold signature scheme.

[0105] At the start of the second round each signer should have received the commitments from public messages, pmt, distributed by the other signers in a signing set at the end of the first round. Each signer reads their previously generated LWE commitment, wt, from their state and sends the LWE commitment to each other signer in a signing set as a second public message, pm2, at the end of the second round.

[0106] Figure 11 shows a third round of the threshold signature scheme performed by each signer in a signing set. Steps 1 and 2 relate to reading the signer state and checking 17 1101.P033 that the previous rounds have been completed. In step 3, the received LWE commitments, wt, are parsed and in steps 4 and 5 the received LWE commitments are checked against the hash commitments, cmty, sent in the first round. If the shown hash of the LWE commitments, wt, don’t match the hash commitments sent in the first round, then the method is aborted.

[0107] In step 7, an aggregated commitment w is generated by summing the received LWE commitments, wt.

[0108] In step 8, a challenge value, c, is calculated as a hash of the public key, a message to be signed and the aggregated commitment, w c = Hc(vk, msg, w)

[0109] Step 9 the coefficients for recovery of the secret, vi uare generated. This step is performed using the function Recover (Repl. Recover) of the distributed key agreement discussed above in connection with Figure 8.

[0110] In step 10, an individual response ztis determined as a sum of the first random value, rt, and a product of the coefficients for recovery, vi u, and the set of secrets, Si [u], for each pool of secrets 5). This causes each signer to contribute secrets from the sets I of which it is a member and has the highest identifier, i. This may be expressed follows:

[0111] In step 11, each signer distributes their generated individual response as a third public message, pm3.

[0112] A signature generation round, Combine, is performed by one or more signers within the signing set and is described with reference to Figure 12.

[0113] In step 1, a signer parses the commitments, wt, and individual responses, z;, received from the second and third public messages during the earlier rounds. 18 1101.P033

[0114] In step 2, an overall contribution, w, is determined by summing the received commitments, across the signing set, act.

[0115] In step 3, an overall challenge, c, is determined by hashing the public key, vk, the message, msg, and the overall contribution, w: c := Hc(vk, msg, w)

[0116] In steps 4 to 6, a PartialVerify algorithm is performed. The PartialVerify algorithm checks the consistency of each individual response, z;, with the corresponding commitment, wt, and with the partial signing key '

[0117] Si [u] + 6; [u] as explained in more detail below.

[0118] The PartialVerify algorithm is shown in Figure 13. In step 1 the partial keys are retrieved from the auxiliary key, which was made public during the distributed key generation process. In step 2, the coefficients for the parties in the threshold signature set, act, are determined using the Recover algorithm described above.

[0119] In step 5 a partial overall public key, ftart, is calculated for each party in the signing set, act, as a sum over the product of the partial keys bt[u] and the recovery coefficients.

[0120] In step 6, for each party, the method calculates a partial signature that is a product of the public matrix, A, and the individual response, z;, less a product of the overall challenge, c, and the partial overall public key, bart, and less the commitment, wL. If the size of a vector product of the received partial response, zt. and the partial signature, jj. is greater than a threshold B^'dthen the partial signature and partial response are declared invalid.

[0121] Returning to Figure 12, if the PartialVerify check is completed successfully, in step 7 and an aggregated response, z, is generated by summing the received partial responses, zt.

[0122] In step 8, an intermediate vector, u, is calculated as follows: 19 1101.P033 where vband vware a number of bits dropped and are given in the set of parameters listed below. These are public parameters.

[0123] In step 9, a hint, h is determined as the difference between the overall commitment, w, and the intermediate vector, u.

[0124] In step 10, an overall signature is returned that is the overall challenge, c, the aggregated response, z, and the hint, h.

[0125] A method of verifying the signature is illustrated in Figure 14. In step 1, the signature is parsed.

[0126] In step 2, the intermediate vector, u, is calculated as before:

[0127] An overall commitment, w, is calculated as the sum of the intermediate value, u, and the hint, h.

[0128] The signature is determined to be verified if a hash of the public key, vk, the message, msg, and the overall commitment, w, is equal to the overall challenge, c. A further check is performed to ensure that the norm of an inner product of the aggregated response and the hint is less than a threshold value:

[0129] ||z, 2VwIi|| < B2where B2= N • B2nd• vb.

[0130] Parameters for this method are shown in Figure 15. The top two rows in the tables are valid for any 1 < T < N < Nmax. The bottom row of parameters is only valid for N < 16. We recall that A G qXl. The value w in Figure 15 indicates the norm of the challenge value, c. K is a security parameter. The security parameter is selectable depending on the implementation. For example, K may be selected to be less than or equal to at least one of: 128, 256 and 512.. The values asand <Jsharearevariances of distributions used to sample a secret value and secret shares in the distributed key generation. These values may be selected and determined in dependence upon the key generation scheme used. aris the variance of a distribution used to sample random values in the first round of the threshold signature scheme. The parameters shown in 20 1101.P033

[0131] Figure 15 may also be used with the second threshold signature scheme, shown in Figure 16 to 18.

[0132] Rejection sampling

[0133] The method described above provides security to the secret using a technique known as noise flooding. Noise flooding comprises masking the secret with a noise so that information about the underlying distribution of the secret is not leaked when the signature scheme is carried out. In some implementations, the secret may be hidden using rejection sampling. An embodiment using rejection sampling, and at least some of the differences to the embodiment above, is described here and with reference to Figures 16 to 19.

[0134] A first difference can be seen in the algorithm ShareSign-L, as shown in Figure

[0135] 16. The sample wt, instead of being calculated as wL= A • rt+ e' as in the first embodiment, is calculated as a product of the public matrix A and the first value Fj. In other words, wL= A • rt. Here, wLis the sample, A is the public matrix and rtis the first value. The term e' is omitted because rejection sampling is being used in this embodiment, instead of the noise flooding of the previous embodiment.

[0136] A second difference can be seen in the algorithm ShareSign3as shown in Figure

[0137] 17. In step 11 of ShareSign3, partial shares sartare calculated. The partial shares sartare a sum of the shares Sj for which a party i has the highest value identifier. This prevents double counting of the shares Sj when each party in the signing set later contributes shares to sum together and recover the secret key for the signing process. Then, in step 12 the partial shares sartare input into an algorithm Rej, which performs rejection sampling. The terms that are inputted into the algorithm Rej are a product of the challenge c and the partial shares sart, distributions / zand / r, the first value rtand a constant value M associated with the rejection sampling. The value of the constant is associated with the probability that the algorithm Rej fails, and can be adjusted accordingly in advance of the protocol beginning.

[0138] A description of the algorithm Rej is provided here. The algorithm Rej is provided in Figure 19. The algorithm Rej takes as input terms v, which in this case takes 21 1101.P033 the value of the product of the challenge c and the partial shares sart, the distributions %zand Xr, and the constant value M.

[0139] In step 1, a value r is sampled from the distribution xr• The distribution Xr may be a Gaussian distribution. In step 2, a response z is calculated as a sum of v, which is equal to c ■ sart, and the value r. In other words, z = v + r. Here, z is the response, v is the product of the challenge c and the partial share sart, and r may be sampled from the same distribution Xrasthe values rLthat were used earlier to generate the commitments in ShareSigm.

[0140] Step 3 defines a term b as b = 1))- Here, B represents a Bernoulli distribution. In this context, the Bernoulli distribution takes a value p as input, where p takes a value between 0 and 1, and outputs 1 with probability p and outputs 0 with probability 1 — p. If b is equal to zero then the response z is output as an error symbol and the sample is rejected (steps 4 and 5). Otherwise, the response z is returned in step 6 i.e. the sample is accepted. Rejection sampling can be used to map a distribution v + / r, which depends on the secret, to a distribution / zthat does not depend on the secret. In this way, information about the secret is obscured.

[0141] Second threshold signature method

[0142] Figure 16 shows functions Recover, ShareSign!, and ShareSign2of a second three-round threshold signature scheme. The second threshold signature scheme commences after one of the above-described distributed key generation schemes has been completed.

[0143] The function Recover in Figure 16 performs the same function as RepL Recover described above in connection with Figure 8. Accordingly, description of this function is not repeated.

[0144] The function ShareSigHi in Figure 16 is a schematic diagram showing steps performed by each signer during a first round of the second threshold signature scheme. The inputs to the first round are a state of the signer, st;, an identifier of a signer, i, a public key, vk, and the signing key of the signer, skj. 22 1101.P033

[0145] In step 1, each signer identified by subscript, i, samples a vector, rt. The value is sampled from Gaussian distributions Xr+k overthe ring. In step 2, an LWE commitment, wt, is determined as a product of the vector rtand the public matrix, A:

[0146] Wt := A ■ r(

[0147] The commitments wLmay alternatively be referred to as samples to distinguish them from the hash commitments, described below. In step 3, the session state, st;, at each signer is updated to include the generated commitment, wband the sampled random value rt.

[0148] In step 4 a hash commitment, cmtj, is calculated that is a hash (or other oneway function) of the public key, the identity of the signer, i, and the commitment, wt: cmt; = Hcmt(vk, i, W;)

[0149] The hash commitment is shared with other signers as a public message, pmt, at the end of the first round.

[0150] The function ShareSign2in Figure 16 shows steps of a second round of the threshold signature scheme.

[0151] At the start of the second round each signer should have received the commitments from public messages, pmt, distributed by the other signers in a signing set at the end of the first round. Each signer reads their previously generated LWE commitment, Wj, from their state and sends the LWE commitment to each other signer in a signing set as a second public message, pm2, at the end of the second round.

[0152] Figure 17 shows ShareSigm, a third round of the threshold signature scheme performed by each signer in a signing set. Steps 1 and 2 relate to reading the signer state and checking that the previous rounds have been completed. In step 3, the received LWE commitments, wt, are parsed and in steps 4 and 5 the received LWE commitments are checked against the hash commitments, cmty, sent in the first round. If shown hash of the LWE commitments, wt, don’t match the hash commitments sent in the first round, then the method is aborted. 23 1101.P033

[0153] In step 8, an aggregated commitment w is generated by summing the received LWE commitments, wt.

[0154] In step 9, a challenge value, c, is calculated as a hash of the public key, a message to be signed and the aggregated commitment, w c = Hc(vk, msg, w)

[0155] Step 10 the coefficients m for recovery of the secret are generated. This step is performed using the function Recover of the distributed key agreement discussed above.

[0156] In step 11, partial secrets spartare generated by summing the shares identified by the coefficients m. These are the secret shares that the signer has from the sets in the distributed key generation that it is contributing to the overall signature. In other words, -part

[0157] In step 12, an individual response ztis determined by rejection sampling as described above in connection with the function Rej. In particular, an individual response ztis generated by each party i as:

[0158] Zt Rej(

[0159] In steps 13 and 14, if the sample was rejected, the method is aborted. In other words, the described signature scheme does not always generate a signature. The signature scheme fails with a frequency determined by the rejection sampling in step 12.

[0160] In step 15, if an individual response ztwas successfully generated, the response is separated into the first I most significant bits, z*, and the remaining k most significant bits, z .

[0161] In step 16 each signer distributes the two parts of their generated individual response as a third public message, pm3.

[0162] A signature generation round, Combine, is shown in Figure 18 and is performed by one or more signers within the signing set. 24 1101.P033

[0163] In step 1, a signer parses the commitments, wt, and most significant bits of the individual responses, z\, received from the second and third public messages during the earlier rounds.

[0164] In step 2, an overall contribution, w, is determined by summing the received commitments, across the signing set, act.

[0165] In step 3, an overall challenge, c, is determined by hashing the public key, vk, the message, msg, and the overall contribution, w: c := Hc(vk, msg, w)

[0166] In step 4, an overall commitment is generated as a sum of the most significant bits of the individual responses, z*:

[0167] In step 5, an intermediate vector, u, is calculated as follows: where vband vware a number of bits dropped and are given in the set of parameters listed shown in connection with the first threshold signature method. These are public parameters.

[0168] In step 6, a hint, h is determined as the difference between the overall commitment, w, and the intermediate vector, u.

[0169] In step 7, an overall signature is returned that is the overall challenge, c, the aggregated response, z, and the hint, h.

[0170] A method of verifying the signature is also illustrated in Figure 18. The Verify function is the same as that described in connection with Verify shown in Figure 14 and the description is not repeated. 25 1101.P033

[0171] The above embodiments are to be understood as illustrative examples of the invention. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

1. 26 1101.P033CLAIMS1. A threshold cryptographic method for a group of parties, the method comprising:N1generating yr-1yyN-T+1y subgroups, where N is the number of parties in the group and L is a threshold number of parties required to form a valid signature, each subgroup comprising N — T + 1 parties, each subgroup comprising a different set of parties to each of the other subgroups;N1generating - — — - - shares s, of a secret key s, each share s,corresponding to a respective subgroup; and distributing copies of each of the shares Sj to each of the parties in the respective subgroup, wherein the shares Sj can be combined to form the secret key s2. The method of claim 1, wherein the shares Sj can be combined to form the secret key s by summing the shares Sj.N]3. The method of any preceding claim, wherein generating yr-1yyN-T+1y shares szof a secret key s comprises: each party sampling a seed; each party sharing the seed with each other party in the group; combining the seeds to generate a global seed; andN1generating yr-1yyN-T+1y shares szof the secret key s from the global seed.

4. The method of claim 3, wherein each party sharing the seed to each other party in the group comprises: for each party: generating a commitment of the seed; sharing the seed and the commitment of the seed with each other party in the group;27 1101.P033 receiving each other seed and commitment of the corresponding seed from each other party in the group; and verifying each of the seeds by comparing the seed to the corresponding commitment of the seed.

5. The method of any preceding claim, wherein the shares szare generated by a party in the corresponding subgroup whose identity is determined according to a criteria relating to identifiers of the parties in the subgroup.

6. The method of any preceding claim, wherein distributing copies of each of the shares szfurther comprises distributing a public share bj to each other party in the group, and then each other party in the subgroup verifying the shares Sj by comparing the shares Sj to the corresponding public shares bj.

7. The method of any preceding claim, wherein the threshold cryptographic method is used in at least one of a threshold signature scheme and a threshold decryption scheme.

8. The method of any preceding claim, further comprising: in a first round: each party in a signing set generating a sample; and each party in the signing set distributing a commitment of the sample to each other party in the signing set; in a second round: each party in the signing set distributing the sample to each other party in the signing set; in a third round: each party in the signing set verifying the commitments of the samples from each other party in the signing set; generating a global commitment from the samples; generating a global challenge from a message and the global commitment;28 1101.P033 each party in the signing set generating an individual response using shares szheld by that party; and each party in the signing set distributing their individual response to each other party in the signing set; and in a combining round: aggregating the individual responses to generate an aggregated response; and generating a signature using the global challenge and the aggregated response.

9. The method of claim 8, further comprising, during a verification of the signature, verifying the shortness of the aggregated response by comparing the aggregated response to a bound value.

10. The method of claim 9, wherein comparing the aggregated response to a bound value comprises comparing a length of a concatenation of the aggregated response and the hint to a bound value.

11. The method of any of claims 8 to 10, further comprising, during verification of the signature, verifying the global challenge by comparing the global challenge to a hash of the message and the global sample.

12. The method of any of claims 8 to 11, wherein generating an individual response using the shares szcomprises, for each party in the signing set: determining a set of the shares S , forming a partial share sartusing the set of shares; and calculating the individual response value based on the partial share.

13. The method of claim 12, wherein forming a partial share sartusing the set of shares comprises each party summing the determined set of shares szto form the partial share sart.29 1101.P03314. The method of any of claims 8 to 13, wherein the sample of each device is based on a product of a public matrix and a first value, the first value sampled from a distribution.

15. The method of claim 14, wherein the threshold cryptographic method uses rejection sampling to mask the distribution from which the first value is sampled.

16. The method of claim 15, the method further comprising: calculating a ratio / Z(z) / M / r(r), wherein / Z(z) is a target distribution for z, z is the individual response, / r(r) is a distribution from which the first value r is generated, and M is a constant; substituting the minimum value of the ratio and 1 into a distribution; and outputting the response if the output of the distribution is not equal to zero.

17. The method of any of claims 8 to 13, wherein the sample of each device is based on a sum of a noise and a product of a public matrix and a first value.

18. The method of any of claims 8 to 17, wherein the shares are generated to be short enough to meet at least one of a bound check during a verification of the signature and to allow the product of the challenge and a share to hide the share during rejection sampling.

19. An apparatus comprising storage and a processor, the apparatus configured to perform the method of any of claims 1 to 18.

20. A non-transitory computer-readable storage medium, the storage medium configured to hold machine-readable code which, when executed on a computer, causes the computer to perform the method of any of claims 1 to 18.

Images