Digital signature generation using a cold wallet
A method and a system for providing a digital signature are disclosed. A private signature key is distributed among two or more nodes of a cold wallet. Each node of the cold wallet generates a pre-signature, based on its share(s) of the private signature key, and transmits the pre-signature to one of two or more pre-signature nodes. A signing application requests a signature and transmits a message to be signed to each of the pre-signature nodes. In response to receiving the request for a signature and the message to be signed, each pre-signature node generates a partial signature, based on its pre-signature and on the message to be signed. Each pre-signature node transmits its partial signature to the signing application, and the signing application computes a digital signature from the partial signatures.
1. A method for providing a digital signature, the method comprising the steps of:
receiving by two or more nodes of a cold wallet, one or more shares of a private signature key, each node of the cold wallet thereby being in the possession of the one or more shares of the private signature key, and none of the nodes of the cold wallet being in the possession of all shares of the private signature key;
generating by each node of the cold wallet a pre-signature, based on its share(s) of the private signature key, and transmitting the pre-signature to one of two or more pre-signature nodes, in such a manner that each pre-signature node receives a pre-signature from only one of the nodes of the cold wallet;
requesting by a signing application a signature and transmitting a message to be signed to each of the pre-signature nodes;
in response to receiving the request for a signature and the message to be signed, generating by each pre-signature node a partial signature, based on its pre-signature and on the message to be signed;
transmitting by each pre-signature node its partial signature to the signing application; and
in response to receiving the partial signatures from each pre-signature node, computing by the signing application a digital signature from the received partial signatures;
wherein the step of each node of the cold wallet transmitting the pre-signature to one of the pre-signature nodes is performed using a one-way communication channel.
2. The method according to claim 1 , further comprising the step of each of the pre-signature nodes deleting the pre-signature after the step of generating a partial signature and before the step of transmitting the partial signature.
3. The method according to claim 1 , wherein the step of receiving a private signature key is performed by the nodes of the cold wallet generating the private signature key by means of a multi-party computation protocol.
4. The method according to claim 1 , wherein each node of the cold wallet generates the pre-signature as part of a batch comprising two or more pre-signatures.
5. The method according to claim 1 , wherein at least the steps of receiving a private signature key, generating pre-signatures and transmitting the pre-signatures to the pre-signature nodes are performed as pre-processing steps prior to the step of the signing application requesting a signature.
6. The method according to claim 1 , wherein the step of each node of the cold wallet generating a pre-signature, based on its share(s) of the private signature key, and transmitting the pre-signature to one of two or more pre-signature nodes is initiated by the pre-signature nodes in response to receipt of a request for a signature from the signing application.
7. The method according to claim 1 , wherein the step of each pre-signature node generating a partial signature is performed without internal communication among the pre-signature nodes.
8. The method according to claim 1 , further comprising the step of authorizing the request for a signature from the signing application.
9. The method according to claim 1 , wherein the nodes of the cold wallet fulfil a threshold condition, t, and the pre-signature nodes fulfil a threshold condition, t′, where t′≥t.
10. The method according to claim 1 , further comprising the steps of:
at least some of the nodes of the cold wallet generating one or more additional pre-signature shares, encrypting the additional pre-signature share(s), and transmitting the encrypted additional pre-signature share(s) to one or more of the pre-signature nodes along with the pre-signatures; and
each pre-signature node which has received an encrypted additional pre-signature share transmitting the encrypted additional pre-signature share to the signing application along with the partial signature;
wherein the step of the signing application computing a digital signature comprises the steps of:
the signing application decrypting the received encrypted additional pre-signature share(s);
the signing application generating an additional pre-signature, based on the decrypted additional pre-signature share(s), and generating an additional partial signature based on the additional pre-signature and on the message to be signed; and
the signing application computing the digital signature from the partial signatures received from the pre-signature nodes and the generated additional partial signature.
11. The method according to claim 10 , wherein the step of generating one or more additional pre-signature shares is performed by each of the nodes of the cold wallet generating an additional pre-signature share and encrypting the additional pre-signature share.
12. The method according to claim 10 , wherein the step of generating one or more additional pre-signature shares is performed by at least two of the nodes of the cold wallet applying a multi-party computation protocol.
13. The method according to claim 10 , wherein the additional pre-signature shares are encrypted and decrypted by means of symmetric encryption keys shared between the respective nodes of the cold wallet and the signing application.
14. The method according to claim 1 , wherein the pre-signatures are generated within the cold wallet, in such a manner that no data enters the cold wallet and no shares of the private signature key leaves the cold wallet.
15. The method according to claim 1 , wherein the cold wallet is air-gapped during the method.
16. The method according to claim 1 , wherein the one-way communication channel comprises a visual output.