TWI799286B - Random number generation system for threshold signature scheme and method thereof - Google Patents

Abstract

A random number generation system for threshold signature scheme (TSS) and method thereof is disclosed. By providing a first Boolean circuit and a second Boolean circuit as the garbled circuit for two hosts to input a plurality of input parameters and jointly to perform secure multi-party computation, so as to the two hosts each obtain a first evaluation value of the first Boolean circuit and a second evaluation value of the second Boolean circuit, and calculating a random value for TSS respectively, and then broadcasting the product of the random number and the base point of each host for verifying whether the input parameters of both parties are correct and whether the results obtained by the garbled circuit are the same, so as to determine that the calculated random number conforms to a request for comments (RFC) 6979 standard, so that the signature generated based on the random number can be used to generate a layer2 private key without revealing the original private key. The mechanism is help to improve the availability of signatures.

Description

Random Number Generation System and Method for Threshold Signature

The invention relates to a random number generating system and method thereof, in particular to a threshold type signature random number generating system and method thereof.

In recent years, with the popularization and vigorous development of blockchain, various transaction technologies based on blockchain have sprung up like mushrooms. In order to strengthen the security of transactions, some manufacturers have proposed to use multi-party joint signature (or signature ) method to generate a signature without restoring the private key to avoid the problem that the signature may be forged due to the leakage of the private key.

Generally speaking, the signature of the traditional Elliptic Curve Digital Signature Algorithm (ECDSA) is used in the process of generating the signature through the method defined in the Request for Comments (RFC) 6979 standard Random number k, this random number k is generated by the process defined by RFC 6979 by a private key and a message using a function (eg: HMAC-SHA256). However, since the original ECDSA signature method does not force the random number k to be generated in a defined way, without restoring the private key, when using N users to jointly execute ECDSA, usually use their own random number k. Select random number k _i to generate random number k and satisfy "k=k ₁ +...+k _n ", in this case, random number k does not conform to the value calculated by the method defined in RFC 6979 , which will cause problems in the case where Ethereum needs to generate the second layer (Layer 2) private key, for example, when generating the second layer private key, the generated ECDSA signature will be used as a seed (Seed), and then generate the second-level private key with an algorithm based on this seed, but the signature generated by using the random number k generated in a way not defined by RFC 6979 cannot ensure the generation of the second-level private key without leakage The original private key problem.

To sum up, it can be seen that the previous technology has long had the problem of poor compliance of the random numbers of threshold signatures without restoring the private key. Therefore, it is necessary to propose improved technical means to solve this problem. a question.

The invention discloses a random number generation system and method for a threshold signature.

First of all, the present invention discloses a random number generation system for a threshold signature, which includes: two hosts, namely the first host and the second host, the first host has a secret d ₁ , an X coordinate x ₁ and a level value n ₁ , the second host has secret d ₂ , X coordinate x ₂ and level value n ₂ , and the secret d ₁ , the X coordinate x ₁ , the level value n ₁ , the secret d ₂ , the X coordinate x ₂ and the level value n ₂ satisfy the following formula to be equal to the private key d: "d=B(x ₁ ,n ₁ )* d ₁ +B(x ₂ ,n ₂ )* d ₂ ", where B( x _i , _ni ) represent the Birkhoff coefficient (Birkhoff coefficient), and i is 1 or 2, and each host includes: a confusion module, a generation module, a first calculation module, and a second calculation module group, verification module and validation module. Among them, the confusion module is used to establish the first Bollinger circuit and the second Bollinger circuit as a confusing circuit, and the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1, parameter v2, parameter r1, parameter r2, parameter n, and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Bollinger circuit allows input of parameter v1, parameter v2, and parameter r1 and parameter r2 and output the second evaluation value, the calculation formula of the first evaluation value is "RFC6979(d,m)+r1+r2 mod n", the calculation formula of the second evaluation value is "d+r1+ r2", where the value of RFC6979(d,m) is the same as the random number k generated according to the private key d and message m, the parameter n is the number of given elliptic curve groups, and the calculation formula of the parameter v1 is "B( x ₁ ,n ₁ )d ₁ mod n", the calculation formula of parameter v2 is "B(x ₂ ,n ₂ )d ₂ mod n"; the generation module is used to generate random A random number is used as a parameter r1 and a first hash value is disclosed, and when the host is a second host, a random random number is generated as a parameter r2 and a second hash value is disclosed, wherein the calculation formula of the first hash value is " H(r1 * G)", the calculation formula of the second hash value is "H(r2 * G)", H represents the hash function, G is the base point (Base Point) of the elliptic curve group; the first calculation module is connected to generate module and confusion module, when the host is the first host, use its own parameter v1, parameter r1 and message m to input to the first Bollinger circuit, and when the host is the second host, use its own Parameter v2 and parameter r2 are input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the second host can obtain the first evaluation value and calculate the k2 value according to the first Bollinger circuit. The calculation formula of the k2 value is "k2=(m2-2 * r2)/2 mod n", where m2 is the first evaluation value obtained by the second host, and the first host and the second host use the same parameter v1, parameter v2, parameter r1 and The parameter r2 jointly executes the second Bollinger circuit to obtain the second evaluation value, and discloses the first public value. The calculation formula of the first public value is "r1 * G"; the second calculation module is connected to the generation module and the confusion A module for inputting its own parameter v2, parameter r2 and message m to the first Bollinger circuit when the host is the second host, and using its own parameter v1 when the host is the first host and the parameter r1 are input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the first host can obtain the first evaluation value and calculate the value of k1 according to the first Bollinger circuit. The formula for the value of k1 is "k1 =(m1-2 * r1)/2 mod n", where m1 is the first evaluation value obtained by the first host, and the first host and the second host use the same parameter v1, parameter v2, parameter r1 and parameter r2 Jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the second public value, the calculation formula of the second public value is "r2 * G"; the verification module is connected to the first calculation module and the second calculation module The module is used to verify whether the private key d, parameter r1, parameter r2, first public value, second public value and public key P satisfy the following formula: (d+r1+r2)* G=P+r1 * G + r2 * G, when satisfied, the first host and the second host then execute the Secure Validation Protocol to verify whether the first evaluation values obtained by the two parties in the first Bollinger circuit are the same; and when the verification result is At the same time, the first host uses the k1 value as the random number used when it performs the threshold signature, and the second host uses the k2 value as the random number it uses when it executes the threshold signature.

Next, the present invention discloses a random number generation method of a threshold signature, the steps of which include: (A) the first host has secret d ₁ , X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , X The coordinate x ₂ and the level value n ₂ , and the secret d ₁ , the X coordinate x ₁ , the level value n ₁ , the secret d ₂ , the X coordinate x ₂ and the level value n ₂ satisfy the following formula to be equal to the private key d: "d =B(x ₁ ,n ₁ )* d ₁ +B(x ₂ ,n ₂ )* d ₂ ”, where B(x _i ,n _i ) represents the Burkhoff coefficient, and i is 1 or 2; (B) Both the first host and the second host provide the first Bollinger circuit and the second Bollinger circuit as confusing circuits, the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1 and parameter v2 , parameter r1, parameter r2, parameter n, and message m, and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Boolean circuit allows input of parameter v1, parameter v2, and parameter r1 and parameter r2 and output the second evaluation value, the calculation formula of the first evaluation value is "RFC6979(d,m)+r1+r2 mod n", the calculation formula of the second evaluation value is "d+r1+ r2", where the value of "RFC6979(d,m)" is the same as the random number k generated according to the private key d and message m, the parameter n is the number of given elliptic curve groups, and the expression of the parameter v1 is " B(x ₁ ,n ₁ )d ₁ mod n", the calculation formula of parameter v2 is "B(x ₂ ,n ₂ )d ₂ mod n"; (C) the first host generates a random random number as parameter r1 and The first hash value is disclosed, and the second host generates a random random number as parameter r2 and discloses the second hash value, wherein the calculation formula of the first hash value is "H(r1 * G)", and the calculation formula of the second hash value It is "H(r2 * G)", H represents the hash function, G is the base point of the elliptic curve group; (D) the first host uses its own parameter v1, parameter r1 and message m, and the second host uses its own parameter v2 Execute the first Bollinger circuit together with the parameter r2, so that the second host can obtain the first evaluation value and calculate the k2 value according to the first Bollinger circuit. The calculation formula of the k2 value is as follows: k2=(m2-2 * r2)/2 mod n, where m2 is the first evaluation value obtained by the second host, and the first host and the second host use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second Evaluation value, and disclose the first public value, the calculation formula of the first public value is "r1 * G"; (E) The second host uses its own parameter v2, parameter r2 and message m and the first host uses its own The parameters v1 and r1 jointly execute the first Bollinger circuit, so that the first host can obtain the first evaluation value and calculate the k1 value according to the first Bollinger circuit. The calculation formula of the k1 value is as follows: k1=(m1-2 * r1) /2 mod n, where m1 is the first evaluation value obtained by the first host, and the first host and the second host use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain The second evaluation value, and disclose the second public value, the calculation formula of the second public value is "r2 * G"; (F) Both the first host and the second host verify the private key d, parameter r1, parameter r2, Whether the first public value, the second public value, and the public key P satisfy the following calculation formula: (d+r1+r2)* G=P+r1 * G+r2 * G, when satisfied, the first host and the second host Then execute the Secure Validation Protocol to verify whether the first evaluation values obtained by both parties in the first Bollinger circuit are the same; (G) when the verification results are the same, the first host uses the k1 value as its own execution threshold The random number used when signing, and the random number used when the second host uses the k2 value as its own threshold signature. Wherein, step (D) and step (E) are allowed to be executed at the same time.

The system and method disclosed in the present invention are as above, and the difference from the prior art is that the present invention provides the first Bollinger circuit and the second Bollinger circuit as a confusing circuit for two hosts to input multiple input parameters and jointly execute security Multi-party calculation, so that the two hosts can respectively obtain the first evaluation value of the first Bollinger circuit and the second evaluation value of the second Bollinger circuit, and respectively calculate the random value used for the threshold signature, and then broadcast to each host The product of the random random number and the base point is used to verify whether the input parameters of both parties are correct and whether the results obtained through the confusion circuit are the same, and then determine that the calculated random value conforms to the RFC 6979 standard, so that the signature generated based on this random value It can be used to generate the second layer private key without revealing the original private key.

Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the usability of the signature.

100a, 100b: host

110: Confusion Module

120: Generate modules

130: The first computing module

140: Second computing module

150: Verification module

160: Confirm the module

310: The first Bollinger circuit

320: Second Bollinger circuit

Step 210: A first host has a secret d ₁ , an X coordinate x ₁ and a level value n ₁ , and a second host has a secret d ₂ , an X coordinate x ₂ and a level value n ₂ , and the The secret d ₁ , the X coordinate x ₁ , the level value n ₁ , the secret d ₂ , the X coordinate x ₂ and the level value n ₂ satisfy the following formula to be equal to a private key d: d=B(x ₁ ,n ₁ )* d ₁ +B(x ₂ ,n ₂ )* d ₂ , where B( _xi ,n _i ) represents the Birkhoff coefficient, and i is 1 or 2

Step 220: provide a first Bollinger circuit and a second Bollinger circuit as a confusing circuit, the first Bollinger circuit allows input of multiple input parameters, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and output a first evaluation value, each of the input parameters is allowed to bring in a set of bit values, the second Boolean circuit allows input of the parameters v1, the Parameter v2, the parameter r1 and the parameter r2 and output a second evaluation value, the calculation formula of the first evaluation value is RFC6979(d, m)+r1+r2 mod n, the calculation formula of the second evaluation value is d+r1+r2, wherein, the value of RFC6979(d, m) is the same as a random number k generated according to the private key d and a message m, the parameter n is the number of given elliptic curve groups, the The calculation formula of the parameter v1 is B(x ₁ ,n ₁ )d ₁ mod n, and the calculation formula of the parameter v2 is B(x ₂ ,n ₂ )d ₂ mod n

Step 230: The first host generates a random random number as the parameter r1 and discloses a first hash value, the second host generates a random random number as the parameter r2 and discloses a second hash value, wherein the first The calculation formula of the hash value is H(r1 * G), the calculation formula of the second hash value is H(r2 * G), H represents the hash function, and G is the base point of the elliptic curve group (Base Point)

Step 240: The first host uses its own parameter v1, the parameter r1, and the message m and the second host uses its own parameter v2 and the parameter r2 to jointly execute the first Bollinger circuit, so that the second host The first evaluation value is obtained according to the first Bollinger circuit and a k2 value is calculated. The calculation formula of the k2 value is as follows: k2=(m2-2*r2)/2 mod n, wherein, m2 is obtained by the second host The first evaluation value, the first host and the second host then use the same parameter v1, the parameter v2, the parameter r1 and the parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value , and disclose a first public value, the formula of the first public value is r1 * G

Step 250: The second host uses its own parameter v2, the parameter r2 and the message m to execute the first Bollinger circuit with the first host using its own parameter v1 and the parameter r1, so that the first host The first evaluation value is obtained according to the first Bollinger circuit and a k1 value is calculated. The calculation formula of the k1 value is as follows: k1=(m1-2*r1)/2 mod n, wherein, m1 is obtained by the first host The first evaluation value, the first host and the second host then use the same parameter v1, the parameter v2, the parameter r1 and the parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value , and disclose a second public value, the calculation formula of the second public value is r2 * G

Step 260: Both the first host and the second host verify whether the private key d, the parameter r1, the parameter r2, the first public value, the second public value, and a public key P satisfy the following formula: ( d+r1+r2)*G=P+r1*G+r2*G, When satisfied, the first host and the second host execute a Secure Validation Protocol (Secure Validation Protocol) to verify whether the first evaluation value obtained by the two parties in the first Bollinger circuit is the same

Step 270: When the verification results are the same, the first host uses the k1 value as the random number used when it performs the threshold signature, and the second host uses the k2 value as the random number used when it executes the threshold signature. random number

Fig. 1 is a system block diagram of the random number generating system of the threshold type signature of the present invention.

Fig. 2A to Fig. 2C are method flow charts of the random number generation method of the threshold type signature of the present invention.

Fig. 3 is a schematic diagram of an obfuscation circuit applying the present invention.

The implementation of the present invention will be described in detail below in conjunction with the drawings and examples, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

First of all, before explaining the random number generation system and method of the threshold signature disclosed in the present invention, the purpose of the present invention will be described first. The purpose of the present invention is to avoid restoring private Key-based, so that when each host executes ECDSA together, the random number used to generate the signature must conform to the generation method defined by RFC 6979, so that the generated signature can be applied in an environment such as: zero-knowledge rollup (ZK-Rollups) It is used to generate the second-level private key, and the original private key will not be disclosed.

The random number generation system and method of the threshold-type signature of the present invention will be further described below in conjunction with the drawings. Please refer to "Fig. 1" first. "Fig. 1" is the first random number generation system of the threshold-type signature of the present invention. A system block diagram of an embodiment, the system includes: two hosts (100a, 100b), respectively the first host 100a and the second host 100b, the first host 100a has a secret d ₁ , an X coordinate x ₁ and a level value (Rank) n ₁ , the second host 100b has secret d ₂ , X coordinate x ₂ and rank value n ₂ , and secret d1, X coordinate x1, rank value n1, secret d2, X coordinate x2 and rank value n2 The biped following operation formula is equal to the private key d: "d=B(x ₁ ,n ₁ )*d ₁ +B(x ₂ ,n ₂ )*d ₂ "; and.

Wherein, B( _xi ,n _i ) represents the Berkhoff coefficient, and i is 1 or 2, and each host (100a, 100b) includes: confusion module 110, generation module 120, first calculation The module 130 , the second calculation module 140 , the verification module 150 and the confirmation module 160 . Wherein, the confusion module 110 is used to establish a first Bollinger circuit and a second Bollinger circuit as a confusing circuit, and the first Bollinger circuit allows input of multiple input parameters, and the input parameters include parameter v1, parameter v2, Parameter r1, parameter r2, parameter n and message m and output the first evaluation value, each of the input parameters is allowed to bring in a set of bit values, and the second Boolean circuit allows input of parameter v1, parameter v2, parameter r1 and parameter r2 and output the second evaluation value, the calculation formula of the first evaluation value is "RFC6979(d,m)+r1+r2 mod n", the calculation formula of the second evaluation value is "d+r1 +r2", where the value of RFC6979 (d, m) is the same as the random number k generated according to the private key d and message m, the parameter n is the number of given elliptic curve groups, and the message m is the message The hash value of m, the calculation formula of the parameter v1 is "B(x ₁ ,n ₁ )d ₁ mod n", the calculation formula of the parameter v2 is "B(x ₂ ,n ₂ )d ₂ mod n" . Specifically, the confusion circuit is essentially a Boolean circuit (Boolean circuit), which uses the Boolean circuit's view constructor to perform calculations, so that participants can calculate the answer for a certain value without knowing that the participants The specific number entered in the function, the secure multi-party calculation in the confusing circuit can be realized by means of a circuit. In practical implementation, the first Bollinger circuit and the second Bollinger circuit can implement at least one of AND operation (AND) and exclusive OR operation (XOR) to realize confusion circuit and secure multi-party computation (Multi-Party Computation) , MPC), and has a plurality of input lines (Wire) to input the input parameters, the set of bit values brought by each input parameter is a value of 256 bits, taking six input parameters as an example, the total Enter six 256-bit values. The first Bollinger circuit is a logic circuit satisfying the condition "MPCRFC6979(v1,v2,r1,r2,n,m)=RFC6979(d,m)+r1+r2 mod n", and the second Bollinger circuit It is a logic circuit satisfying the condition "ModAdd(v1, v2, r1, r2)=d+r1+r2". Wherein, "MPCRFC6979(v1, v2, r1, r2, n, m)" represents the first Bollinger circuit, and "ModAdd(v1, v2, r1, r2)" represents the second Bollinger circuit. In addition, the random number k is generated based on the RFC 6979 standard with the private key d and the message m, combined with a hash-based message authentication code (Hash-based Message Authentication Code, HMAC) and a hash algorithm, but in fact, the first host 100a and Neither the second host 100b knows the value of the random number k.

The generation module 120 is used to generate a random random number as the parameter r1 and disclose the first hash value when the host (100a, 100b) is the first host 100a, and to disclose the first hash value when the host (100a, 100b) is the second In the case of the host 100b, a random random number is generated as a parameter r2 and a second hash value is disclosed, wherein the calculation formula of the first hash value is "H(r1 * G)", and the calculation formula of the second hash value is "H(r2 * G)", G is the base point of the elliptic curve group.

The first calculation module 130 is connected to the generation module 120 and the confusion module 110. When the host (100a, 100b) is the first host 100a, use its own parameter v1, parameter r1 and message m to input to the first Bollinger circuit, and when the host (100a, 100b) is the second host 100b, use its own parameter v2 and parameter r2 to input to the first Bollinger circuit, to jointly execute the first Bollinger circuit, so that the second host according to The first Bollinger circuit obtains the first evaluation value and calculates the value of k2, the formula of the k2 value is k2=(m2-2*r2)/2 mod n, wherein, m2 is the first evaluation obtained by the second host 100b Value, the first host 100a and the second host 100b use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the first public value, the first public value The calculation formula of a public value is "r1 * G". In actual implementation, the first public value may be disclosed in a broadcast manner.

The second calculation module 140 is connected to the generation module 120 and the confusion module 110, so that when the host (100a, 100b) is the second host 100b, it uses its own parameter v2, parameter r2 and message m to input to the first Bollinger circuit, and when the host (100a, 100b) is the first host 100a, use its own parameter v1 and parameter r1 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the first The host obtains the first evaluation value according to the first Bollinger circuit and calculates the value of k1. The formula for the value of k1 is k1=(m1-2*r1)/2 mod n, where m1 is the first evaluation value obtained by the first host 100a. Evaluation value, the first host 100a and the second host 100b use the same parameter v1, parameter v2, parameter r1, and parameter r2 to jointly execute the second distribution The forest circuit obtains a second evaluation value, and discloses a second public value, and the calculation formula of the second public value is "r2 * G". Likewise, in actual implementation, the second public value may be disclosed in a broadcast manner.

The verification module 150 is connected to the first calculation module 130 and the second calculation module 140 to verify whether the private key d, parameter r1, parameter r2, first public value, second public value and public key P satisfy the formula " (d+r1+r2)* G=P+r1 * G+r2 * G", when satisfied, the first host 100a and the second host 100b execute the security verification protocol to verify the two parties obtained in the first Bollinger circuit whether the first evaluation value of is the same. In actual implementation, when the verification results are different, the verification module 150 will drive the hosts (100a, 100b) to regenerate the k1 and k2 values until the verification results are the same, that is, the first host 100a will regenerate For the k1 value, the second host 100b will regenerate the k2 value.

The confirmation module 160 is connected to the verification module 150, so that when the verification results are the same, the first host 100a uses the k1 value as the random number used when performing the threshold signature, and the second host 100b uses the k2 value as the self-execution The random number used for threshold signature. In this way, the random numbers k1 and k2 used in the threshold signature can be obtained, while meeting the values calculated by the random number generation method defined in RFC 6979, so that when neither party knows the real random number k Next, make "k=k1+k2" and only the first host 100a knows the value of k1, and only the second host 100b knows the value of k2, and then use the values of k1 and k2 to generate an ECDSA signature conforming to the definition of RFC 6979.

In particular, it should be noted that in actual implementation, the modules described in the present invention can be implemented in various ways, including software, hardware or any combination thereof. For example, in some implementations, each module can use software and hardware or one of them. In addition, the present invention can also be realized partially or completely based on hardware. For example, one or more modules in the system can be implemented through integrated circuit chips, system Single chip (System on Chip, SoC), complex programmable logic device (Complex Programmable Logic Device, CPLD), field programmable logic gate array (Field Programmable Gate Array, FPGA) etc. to achieve. The present invention can be a system, method and/or computer program. The computer program may include a computer-readable storage medium loaded with computer-readable program instructions for causing a processor to implement various aspects of the present invention, the computer-readable storage medium may be a tangible and equipment. A computer readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer-readable storage media include hard disks, random access memory, read-only memory, flash memory, optical disks, floppy disks, and any suitable combination of the foregoing. As used herein, computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (for example, optical signals through fiber optic cables), or transmitted electrical signals. In addition, the computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing/processing device, or downloaded over a network, such as the Internet, a local area network, a wide area network, and/or a wireless network to an external computer device or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, hubs and/or gateways. The network card or network interface in each computing/processing device receives computer-readable program instructions from the network, and forwards the computer-readable program instructions for storage in computer-readable storage media in each computing/processing device middle. The computer program instructions for performing the operations of the present invention may be assembly language instructions, instruction set architecture instructions, machine instructions, machine-related instructions, micro instructions, firmware instructions, or source code or object code written in any combination of one or more programming languages (Object Code), the programming language includes object-oriented programming language, such as: Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby and PHP, etc., as well as conventional programs Procedural programming language, such as: C language or similar programming language. The computer program instructions can be completely executed on the computer, partially executed on the computer, or Execute as a stand-alone piece of software, partly on the client computer and partly on the remote computer, or entirely on the remote computer or server.

Please refer to "Fig. 2A" to "Fig. 2C". "Fig. 2A" to "Fig. 2C" are the method flow chart of the first embodiment of the random number generation method of the threshold type signature of the present invention, and the steps include : The first host has secret d ₁ , X coordinate x ₁ and level value n ₁ , the second host has secret d ₂ , X coordinate x ₂ and level value n ₂ , and secret d ₁ , X coordinate x ₁ , level value n _1. Secret d ₂ , X coordinate x ₂ and level value n ₂ satisfy the following formula to be equal to private key d: d=B(x ₁ ,n ₁ )* d ₁ +B(x ₂ ,n ₂ )* d ₂ , wherein, B( _xi , _ni ) represents the Birkhoff coefficient, and i is 1 or 2 (step 210); provide the first Bollinger circuit and the second Bollinger circuit as a confusing circuit, the first Bollinger circuit A Bollinger circuit allows multiple input parameters to be input. The input parameters include parameter v1, parameter v2, parameter r1, parameter r2, parameter n and message m and output the first evaluation value. Each of the input parameters is allowed to be brought in A set of bit values, the second Bollinger circuit allows input of parameter v1, parameter v2, parameter r1 and parameter r2 and outputs a second evaluation value, the calculation formula of the first evaluation value is "RFC6979(d, m) +r1+r2 mod n", the calculation formula of the second evaluation value is "d+r1+r2", wherein, the value of RFC6979 (d, m) and the random number k generated according to the private key d and the message m Same, the parameter n is the number of given elliptic curve groups, the calculation formula of the parameter v1 is "B(x ₁ ,n ₁ )d ₁ mod n", the calculation formula of the parameter v2 is "B(x ₂ ,n ₂ ) d ₂ mod n" (step 220); the first host generates a random random number as parameter r1 and discloses the first hash value, and the second host generates random random number as parameter r2 and discloses the second hash value, wherein the first The calculation formula of the hash value is "H(r1 * G)", the calculation formula of the second hash value is "H(r2 * G)", H represents the hash function, and G is the base point of the elliptic curve group (Base Point) ( Step 230); the first host uses its own parameter v1, parameter r1 and message m and the second host uses its own parameter v2 and parameter r2 to jointly execute the first Bollinger circuit, so that the second host can obtain the first Bollinger circuit according to the first Bollinger circuit. an evaluation value and calculate the k2 value, the calculation formula of the k2 value is "k2=(m2-2*r2)/2 mod n", wherein, m2 is the first evaluation value obtained by the second host 100b, and the first host 100a and the second host 100b use the same parameter v1, parameter v2, parameter r1 and parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the first public value, the calculation formula of the first public value is "r1 * G" (step 240); the second host uses its own parameter v2, parameter r2 and message m to execute the first Bollinger circuit with the first host using its own parameter v1 and parameter r1, so that the first host 100a Obtain the first evaluation value and calculate the value of k1 according to the first Bollinger circuit. The calculation formula of the value of k1 is "k1=(m1-2 * r1)/2 mod n", which is used by the first host 100a and the second host 100b The same parameter v1, parameter v2, parameter r1 and parameter r2 jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose the second public value, the calculation formula of the second public value is "r2 * G" ( Step 250); the first host 100a and the second host 100b verify whether the private key d, parameter r1, parameter r2, first public value, second public value and public key P satisfy the formula "(d+r1+r2) * G=P+r1 * G+r2 * G", when satisfied, the first host 100a and the second host 100b execute the security verification protocol to verify whether the first evaluation values obtained by the two parties in the first Bollinger circuit are the same (step 260); and when the verification result is the same, the first host 100a uses the k1 value as the random number used when performing the threshold signature, and the second host 100b uses the k2 value as the random number used when performing the threshold signature itself random number (step 270). Wherein, step 240 and step 250 are allowed to be executed at the same time. Through the above steps, the first Bollinger circuit and the second Bollinger circuit can be provided as a confusing circuit for the two hosts to input multiple input parameters and jointly perform secure multi-party calculations, so that the two hosts can each obtain the first Bollinger circuit The first evaluation value of the circuit and the second evaluation value of the second Bollinger circuit, and respectively calculate the random value used for the threshold signature, and then broadcast the product of the random number and the base point of each host to verify both parties Whether the input parameters are correct and whether the results obtained through the obfuscation circuit are the same, and then determine that the calculated random value conforms to the RFC 6979 standard, so that the signature generated based on this random value can be used to generate the second-level private key without leaking the original private key.

The following description will be made in the form of an embodiment in conjunction with "Fig. 3", where "Fig. 3" is a schematic diagram of an obfuscation circuit applying the present invention. In practice, the confusion circuit of the present invention includes a first Bollinger circuit 310 and a second Bollinger circuit 320 . Wherein, the first Bollinger circuit 310 provides input lines to input parameters v1 (namely: "B(x ₁ ,n ₁ )d ₁ mod n"), parameters v2 (namely: "B(x ₂ ,n ₂ )d ₂ mod n"), parameter r1 (namely: the random number randomly selected by the first host 100a), parameter r2 (ie: the random number randomly selected by the second host 100b), parameter n (namely: the number of given elliptic curve groups ) and message m, which can be expressed as "MPCEdDSA(v1,v2,r1,r2,n,m)", and output the first evaluation value "RFC6979(d,m)+r1+r2 mod n" where, "RFC6979( d,m)" is basically composed of the hash function "H(d∥m∥other filling information)" as the base, and the symbol "∥" represents concatenation, for example: "A∥B" represents "A" and " The series connection of "B" is "AB", "AA∥BB" means "AA" and "BB" in series are "AABB"; the second Bollinger circuit 320 provides input lines to input parameters v1, parameters v2, parameters r1 and parameters r2, can be expressed as "ModAdd(v1, v2, r1, r2)", and output the second evaluation value "d+r1+r2". When establishing the above-mentioned first Bollinger circuit 310, at least one of "and operation (AND)" and "exclusive or operation (XOR)" can be used to satisfy the condition "MPCEdDSA(v1, v2, r1, r2, n, m)=RFC6979(d,m)+r1+r2 mod n" logic circuit, and when building the second Bollinger circuit 320, it also uses "and operation (AND)" and "exclusive or operation (XOR) "At least one of the structures satisfies the condition "ModAdd(v1, v2, r1, r2) = d+r1+r2" logic circuit. It should be noted that in the same signature, the parameters v1, v2, r1 and r2 input by the first Bollinger circuit 310 are also the parameters v1, v2, Parameter r1 and parameter r2, and each signature will reselect parameter r1 and parameter r2.

In summary, it can be seen that the difference between the present invention and the prior art lies in that by providing the first Bollinger circuit and the second Bollinger circuit as confusing circuits for two hosts to input multiple input parameters and jointly execute secure multi-party calculations, Make the two hosts respectively obtain the first evaluation value and the second evaluation value of the first Bollinger circuit The second evaluation value of the Bollinger circuit, and calculate the respective random value for the threshold signature, and then broadcast the product of the random random number and the base point of each host to verify whether the input parameters of both parties are correct and pass the confusion circuit Whether the results obtained are the same, and then determine that the calculated random value conforms to the RFC 6979 standard, so that the signature generated based on this random value can be used to generate the second-level private key without revealing the original private key. By this technical means The problems existing in the prior art can be solved, and then the technical effect of improving the usability of the signature can be achieved.

Although the present invention is disclosed above with the aforementioned embodiments, it is not intended to limit the present invention. Any person familiar with similar skills may make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be subject to what is defined in the scope of patent application attached to this specification.

100a, 100b: host

110: Confusion Module

120: Generate modules

130: The first computing module

140: Second computing module

150: Verification module

160: Confirm the module

Claims (10)

A random number generation system for a threshold signature, the system includes: two hosts, respectively a first host and a second host, the first host has a secret d ₁ , an X coordinate x ₁ and a level value n ₁ , the second host has a secret d ₂ , an X coordinate x ₂ and a level value n ₂ , and the secret d ₁ , the X coordinate x ₁ , the level value n ₁ , the secret d ₂ , the X The coordinate x ₂ and the level value n ₂ satisfy the following formula to be equal to a private key d: d=B(x ₁ ,n ₁ )*d ₁ +B(x ₂ ,n ₂ )*d ₂ , where, B ( _xi ,n _i ) represent the Birkhoff coefficient (Birkhoff coefficient), and i is 1 or 2, and each host includes: an obfuscation module for establishing a first Boolean as an obfuscation circuit circuit and a second Bollinger circuit, the first Bollinger circuit allows multiple input parameters to be input, and the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m And output a first evaluation value, each of the input parameters is allowed to bring in a set of bit values, the second Bollinger circuit allows input of the parameter v1, the parameter v2, the parameter r1 and the parameter r2 and outputs a The second evaluation value, the calculation formula of the first evaluation value is RFC6979(d, m)+r1+r2 mod n, the calculation formula of the second evaluation value is d+r1+r2, wherein, RFC6979(d, The value of m) is the same as a random number k generated according to the private key d and a message m, the parameter n is the number of given elliptic curve groups, and the calculation formula of the parameter v1 is B(x ₁ ,n ₁ )d ₁ mod n, the calculation formula of the parameter v2 is B(x ₂ ,n ₂ )d ₂ mod n; a generation module, used to generate random random numbers as the first host when the host is the first host The parameter r1 also discloses a first hash value, and when the host is the second host, generates a random random number as the parameter r2 and discloses a second hash value, wherein the calculation formula of the first hash value is H(r1*G), the operational formula of the second hash value is H(r2*G), H represents the hash function, and G is the base point (Base Point) of the elliptic curve group; a first calculation module, connected The generation module and the obfuscation module, when the host is the first host, use their own parameter v1, the parameter r1 and the message m to input to the first Bollinger circuit, and when the host is When the second host uses its own parameters v2 and r2 to input to the first Bollinger circuit to jointly execute the first Bollinger circuit, so that the second host can obtain the The first evaluation value and calculate a k2 value, the calculation formula of the k2 value is k2=(m2-2*r2)/2 mod n, wherein, m2 is the first evaluation value obtained by the second host, and the first The host and the second host then use the same parameter v1, the parameter v2, the parameter r1, and the parameter r2 to jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a first public value, the The calculation formula of the first public value is r1 * G; a second calculation module, connected to the generation module and the confusion module, is used to use its own parameters v2, v2, when the host is the second host The parameter r2 and the message m are input to the first Bollinger circuit, and when the host is the first host, the parameter v1 and the parameter r1 are input to the first Bollinger circuit for common Executing the first Bollinger circuit, so that the first host obtains the first evaluation value according to the first Bollinger circuit and calculates a k1 value, the calculation formula of the k1 value is k1=(m1-2*r1)/2 mod n, wherein, m1 is the first evaluation value obtained by the first host, and the first host and the second host use the same parameter v1, the parameter v2, the parameter r1, and the parameter r2 to jointly execute the The second Bollinger circuit obtains the second evaluation value, and discloses a second public value, the calculation formula of the second public value is r2 * G; a verification module, connected to the first calculation module and the second Calculation module for verifying whether the private key d, the parameter r1, the parameter r2, the first public value, the second public value and a public key P satisfy the following formula: (d+r1+r2)* G=P+r1 * G+r2 * G, when satisfied, the first host and the second host execute a Secure Validation Protocol (Secure Validation Protocol) to verify the two parties obtained in the first Bollinger circuit Whether the first evaluation values are the same; and a confirmation module connected to the verification module, so that when the verification results are the same, the first host uses the k1 value as a random number used when it executes the threshold signature, and The second host uses the k2 value as a random number used when it performs threshold signature. The random number generation system of the threshold signature as in claim 1, wherein the first Bollinger circuit and the second Bollinger circuit are at least one of AND operation (AND) and exclusive OR operation (XOR) Implement confusing circuits and secure multi-party computation (Multi-Party Computation, MPC), and have multiple input lines (Wire) To input the input parameters, the group of bit values brought by each input parameter is a value of 256 bits, and the first Bollinger circuit is a logic circuit satisfying the following conditions: MPCRFC6979 (v1, v2, r1 ,r2,n,m)=RFC6979(d,m)+r1+r2 mod n, the second Bollinger circuit is a logic circuit satisfying the following conditions: ModAdd(v1,v2,r1,r2)=d+r1 +r2. For example, the random number generation system of threshold signature in claim 1, wherein the first host and the second host do not restore the private key d and do not know the random number k when performing threshold signature, Satisfy the following condition: k1+k2=RFC6979(d,m). For example, the random number generation system of the threshold signature in claim item 1, wherein the random number k is based on the RFC 6979 standard with the private key d and the message m, combined with a hash-based message authentication code (Hash-based Message Authentication Code, HMAC) And hash algorithm generation. A random number generation system for a threshold signature as in claim 1, wherein the verification module drives the host to regenerate the k1 value and the k2 value when the verification result is different until the verification result is the same. A random number generation method for a threshold signature, the steps of which include: (A) a first host has a secret d ₁ , an X coordinate x ₁ and a level value n ₁ , and a second host has a secret d ₂ , an X coordinate x ₂ and a level value n ₂ , and the secret d ₁ , the X coordinate x ₁ , the level value n ₁ , the secret d ₂ , the X coordinate x ₂ and the level value n ₂ satisfy the following operations The formula is equal to a private key d: d=B(x ₁ ,n ₁ )* d ₁ +B(x ₂ ,n ₂ )* d ₂ , where B( _xi ,n _i ) represents Berkhoff coefficient (Birkhoff coefficient), and i is 1 or 2; (B) the first host and the second host provide a first Bollinger circuit and a second Bollinger circuit as a confusion circuit, the first Bollinger The circuit allows multiple input parameters to be input, the input parameters include a parameter v1, a parameter v2, a parameter r1, a parameter r2, a parameter n and a message m and output a first evaluation value, each of the input parameters A set of bit values are allowed to be brought in respectively. The second Bollinger circuit allows input of the parameter v1, the parameter v2, the parameter r1, and the parameter r2 and outputs a second evaluation value. The calculation formula of the first evaluation value is RFC6979(d,m)+r1+r2 mod n, the calculation formula of the second evaluation value is d+r1+r2, wherein, the value of RFC6979(d,m) is based on the private key d and a message m The generated random number k is the same, the parameter n is the number of given elliptic curve groups, the formula of the parameter v1 is B(x ₁ ,n ₁ )d ₁ mod n, the formula of the parameter v2 is B (x ₂ ,n ₂ )d ₂ mod n; (C) the first host generates a random random number as the parameter r1 and discloses a first hash value, the second host generates a random random number as the parameter r2 and A second hash value is disclosed, wherein the calculation formula of the first hash value is H(r1 * G), the calculation formula of the second hash value is H(r2 * G), H represents a hash function, and G is an ellipse The base point of the curve group (Base Point); (D) the first host uses its own parameter v1, the parameter r1 and the message m and the second host uses its own parameter v2 and the parameter r2 to jointly execute the first Bollinger circuit, so that the second host obtains the first evaluation value according to the first Bollinger circuit and calculates a k2 value, the calculation formula of the k2 value is as follows: k2=(m2-2*r2)/2 mod n, Wherein, m2 is the first evaluation value obtained by the second host, and the first host and the second host use the same parameter v1, the parameter v2, the parameter r1, and the parameter r2 to jointly execute the second distribution The forest circuit obtains the second evaluation value, and discloses a first public value, the calculation formula of the first public value is r1 * G; (E) the second host uses its own parameter v2, the parameter r2 and the The message m and the first host use the parameter v1 and the parameter r1 to jointly execute the first Bollinger circuit, so that the first host obtains the first evaluation value and calculates a k1 value according to the first Bollinger circuit, The calculation formula of the k1 value is as follows: k1=(m1-2*r1)/2 mod n, wherein, m1 is the first evaluation value obtained by the first host, and the first host and the second host use the same The parameter v1, the parameter v2, the parameter r1 and the parameter r2 jointly execute the second Bollinger circuit to obtain the second evaluation value, and disclose a second public value, and the calculation formula of the second public value is r2 * G; (F) Both the first host and the second host verify whether the private key d, the parameter r1, the parameter r2, the first public value, the second public value and a public key P satisfy the following operations Formula: (d+r1+r2)* G=P+r1 * G+r2 * G, when satisfied, the first host and the second host execute a security verification protocol (Secure Validation Protocol) to verify that both parties are in Whether the first evaluation value obtained by the first Bollinger circuit is the same; and (G) when the verification result is the same, the first host uses the k1 value as a random number used when performing threshold signature, and The second host takes the k2 value as a random number used when it executes the threshold signature; wherein, step (D) and step (E) are allowed to be executed at the same time. The random number generation method of a threshold signature as in claim 6, wherein the first Bollinger circuit and the second Bollinger circuit are at least one of AND operation (AND) and exclusive OR operation (XOR) Realize confusion circuit and secure multi-party computation (Multi-Party Computation, MPC), and have multiple input wires (Wire) to input the input parameters, and the group bit value brought by each input parameter is 256 bits value, the first Bollinger circuit is a logic circuit that satisfies the following conditions: MPCRFC6979(v1,v2,r1,r2,n,m)=RFC6979(d,m)+r1+r2 mod n, the second A Bollinger circuit is a logic circuit that satisfies the following condition: ModAdd(v1,v2,r1,r2)=d+r1+r2. For example, the method for generating a random number of a threshold signature in claim 6, wherein the first host and the second host do not restore the private key d and do not know the random number k when executing the threshold signature, Satisfy the following condition: k1+k2=RFC6979(d,m). For example, the random number generation method of the threshold-type signature in claim item 6, wherein the random number k is based on the RFC 6979 standard, using the private key d and the message m together with a hash-based message authentication code (Hash-based Message Authentication Code, HMAC) And hash algorithm generation. For example, the method for generating random numbers of threshold-type signatures in claim item 6, wherein when the verification results are different, re-execute steps (B) to (F) to regenerate the k1 value and the k2 value until the verification results are the same until.

Images