Cold Wallet Digital Signature Generation With Distributed Key Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature systems face challenges in balancing high security with easy user access, as cold wallets provide strong security but are difficult to access, while centralized systems are vulnerable to user behavior and require communication networks, introducing risks.
Innovation Solution
A method and system that distributes a private signature key among multiple nodes in a cold wallet, generating pre-signatures that are transmitted to pre-signature nodes for partial signature creation, allowing easy access while maintaining air-gapped security by preventing data entry into the cold wallet.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cold wallet is used to store private signature keys in an air-gapped system, then security level is improved, but ease of operation deteriorates
Solution Approach 1:
The private signature key is segmented into multiple shares distributed across different nodes in the cold wallet system. This segmentation allows the system to maintain air-gapped security while enabling access through distributed participation, resolving the contradiction between security and ease of operation.
Solution Approach 2:
A trusted key management service acts as an intermediary between users and the cold wallet system. This intermediary enables users to access signature capabilities without directly interacting with the air-gapped cold wallet, thus maintaining security while improving ease of operation.
2Ease of operation
If private signature keys are stored locally on user hardware, then ease of operation is improved, but reliability deteriorates
Solution Approach 1:
The private signature key is divided into multiple shares stored in the cold wallet rather than kept locally on user hardware. This segmentation removes the single point of failure while still allowing users to access signature capabilities through the distributed system.
Solution Approach 2:
The cold wallet system with distributed key shares acts as an intermediary that provides signature generation without requiring users to store or directly access the complete private key, thus improving security while maintaining ease of operation.
3Ease of operation
If a trusted key management service is used to store private signature keys, then ease of operation is improved, but reliability deteriorates
Solution Approach 1:
The key management service only holds public key information and coordination data, not the complete private signature key. The private key is segmented and stored in the air-gapped cold wallet, distributing trust and improving security while maintaining service accessibility.
Solution Approach 2:
The system moves from a single centralized key storage model to a distributed multi-dimensional architecture where key shares are stored in air-gapped cold wallet nodes, and the key management service operates in a separate coordination dimension, thus improving both security and accessibility.
4Ease of operation
If data is transmitted into the air-gapped cold wallet system to perform signatures, then ease of operation is improved, but reliability deteriorates
Solution Approach 1:
The message to be signed is extracted from the external environment and processed outside the air-gapped system. Only public key information and signature requests leave the cold wallet, while the private key shares remain isolated, thus maintaining security while enabling signature operations.
Solution Approach 2:
The trusted key management service acts as an intermediary that receives signature requests from users, coordinates with the cold wallet nodes, and facilitates the signing process without requiring direct data transmission into the air-gapped system, thus maintaining security while improving ease of operation.
Data Source
AI summary
A method and a system for providing a digital signature are disclosed. A private signature key is distributed among two or more nodes of a cold wallet. Each node of the cold wallet generates a pre-signature, based on its share(s) of the private signature key, and transmits the pre-signature to one of two or more pre-signature nodes. A signing application requests a signature and transmits a message to be signed to each of the pre-signature nodes. In response to receiving the request for a signature and the message to be signed, each pre-signature node generates a partial signature, based on its pre-signature and on the message to be signed. Each pre-signature node transmits its partial signature to the signing application, and the signing application computes a digital signature from the partial signatures.