Generating shared private keys

1 . A computer-implemented method of generating shares of private keys, wherein the method is performed by a first participant of a group of participants and comprises:

obtaining a first seed share, wherein each other participant has a respective seed share;

inputting at least the first seed share to a cryptographic hash function and executing the cryptographic hash function on at least the first seed share to generate a first component of a first data item, wherein each other participant has a respective data item;

obtaining the respective data items generated by the other participants;

generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first data item and the respective data items generated by the other participants, and wherein each other participant has a respective master private key share of the shared master private key; and

generating one or more first private key shares based on the first master private key share, wherein each first private key share is a share of a respective shared private key;

generating a hierarchical deterministic key structure of private key shares, wherein the one or more first private key shares generated based on the first master private key share are respective parent private key shares, and/or respective child private key shares, wherein each parent private key share of a given level in the key structure is a parent to one or more child private key shares in a subsequent level in the key structure;

generating a first parent chain code share of a first parent private key share, the first parent private key share being a share of a first parent private key;

obtaining a respective parent chain code share from each other participant;

generating a common chain code based on each parent chain code share; and

obtaining a first parent public key corresponding to the first private key, wherein one or more first child key shares are generated based on a respective first term and a respective second term, wherein the respective first term is generated based on the first parent private key share, and wherein the respective second term is generated by inputting into a hash function at least i) the first parent public key, ii) a respective index of the respective first child private key share, and iii) the common chain code.

2 . The method of claim 1 , wherein the inputting of at least the first seed share to the hash function comprises inputting at least the first seed share to a HMAC function to generate a first HMAC value, and wherein the first data item is a first part of the first HMAC value.

3 . The method of claim 1 , wherein the first master private key share is generated by performing a secret sharing scheme to generate a share of a first secret, wherein the first secret is the master private key.

4 . The method of claim 1 , comprising obtaining one or more auxiliary private keys, and wherein each of the one or more first private key shares is generated based on the first master private key share and a respective one of the one or more auxiliary private keys.

5 . The method of claim 4 , comprising generating a first auxiliary master private key, and wherein each of the one or more auxiliary private keys is generated based on the first auxiliary master private key.

6 . The method of claim 5 , comprising obtaining a common seed value, wherein each other participant has the same common seed value, and wherein the first auxiliary master private key is generated based on the common seed value.

7 . The method of claim 6 , wherein generating the common seed value comprises:

performing a secret sharing scheme to generate a first share of a second secret, wherein the second secret is a second private key;

generating a first combined share based on the first master private key share and the first secret share of the second private key;

obtaining at least a predetermined number of other combined shares, wherein each other combined share is generated by another participant and is based on a respective share of the master private key and a respective share of the second private key; and

generating the common seed based on the first combined share and at least the predetermined number of other combined shares.

8 . The method of claim 6 , wherein generating the first auxiliary master private key comprises inputting the common seed value to a hash function.

9 . The method of claim 8 , wherein inputting the common seed to the hash function comprises inputting the common seed to a HMAC function to generate a second HMAC value, and wherein the first master private key share is a first component of the second HMAC value.

10 . The method of claim 1 , wherein each first child private key share is generated based on a respective parent private key share, wherein each first child private key share is generated based on a respective first term and a respective second term, wherein the respective first term is generated based on the respective parent private key share, and wherein the respective second term is generated by inputting into a hash function at least i) the respective parent private key share or corresponding public key, and ii) a respective index of the respective first child private key share.

11 . The method of claim 10 , comprising for each first child private key share, generating a respective parent chain code share of the respective parent private key share, wherein the respective second term is generated by inputting into the hash function iii) a first master chain code share.

12 . The method of claim 10 , wherein the hash function is a HMAC function.

13 . The method of claim 1 , comprising performing a signing phase of a digital signature scheme, wherein said performing comprises:

obtaining a message; and

generating a first signature share based on the message and one of the first private key shares.

14 . The method of claim 13 , wherein the message comprises at least part of a blockchain transaction.

15 . A computing device comprising:

memory comprising one or more memory units; and

processing apparatus comprising one or more processing units, wherein the memory stores code arranged to run on the processing apparatus, the code being configured so as when run on the processing apparatus, the processing apparatus performs method of generating shares of private keys, wherein the method is performed by a first participant of a group of participants and comprises:

obtaining a first seed share, wherein each other participant has a respective seed share;

inputting at least the first seed share to a cryptographic hash function to generate a first component of a first data item and executing the cryptographic hash function on at least the first seed share, wherein each other participant has a respective data item;

obtaining the respective data items generated by the other participants;

generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first data item and the respective data items generated by the other participants, and wherein each other participant has a respective master private key share; and

generating one or more first private key shares based on the first master private key share, wherein each first private key share is a share of a respective shared private key;

generating a hierarchical deterministic key structure of private key shares, wherein the one or more first private key shares generated based on the first master private key share are respective parent private key shares, and/or respective child private key shares, wherein each parent private key share of a given level in the key structure is a parent to one or more child private key shares in a subsequent level in the key structure;

generating a first parent chain code share of a first parent private key share, the first parent private key share being a share of a first parent private key;

obtaining a respective parent chain code share from each other participant; and

generating a common chain code based on each parent chain code share;

obtaining a first parent public key corresponding to the first private key, wherein one or more first child key shares are generated based on a respective first term and a respective second term, wherein the respective first term is generated based on the first parent private key share, and wherein the respective second term is generated by inputting into a hash function at least i) the first parent public key, ii) a respective index of the respective first child private key share, and iii) the common chain code.

16 . A non-transitory computer-readable storage medium, comprising a computer program configured so as, when run on one or more processors, the one or more processors perform a method of generating shares of private keys, wherein the method is performed by a first participant of a group of participants and comprises:

obtaining a first seed share, wherein each other participant has a respective seed share;

inputting at least the first seed share to a cryptographic hash function and executing the cryptographic hash function on at least the first seed share to generate a first component of a first data item, wherein each other participant has a respective data item;

obtaining the respective data items generated by the other participants

generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first data item and the respective data item generated by the other participants, and wherein each other participant has a respective master private key share; and

generating one or more first private key shares based on the first master private key share, wherein each first private key share is a share of a respective shared private key;

generating a hierarchical deterministic key structure of private key shares, wherein the one or more first private key shares generated based on the first master private key share are respective parent private key shares, and/or respective child private key shares, wherein each parent private key share of a given level in the key structure is a parent to one or more child private key shares in a subsequent level in the key structure;

generating a first parent chain code share of a first parent private key share, the first parent private key share being a share of a first parent private key;

obtaining a respective parent chain code share from each other participant; and

generating a common chain code based on each parent chain code share;

obtaining a first parent public key corresponding to the first private key, wherein one or more first child key shares are generated based on a respective first term and a respective second term, wherein the respective first term is generated based on the first parent private key share, and wherein the respective second term is generated by inputting into a hash function at least i) the first parent public key, ii) a respective index of the respective first child private key share, and iii) the common chain code.