Generating digital signature shares
A computer-implemented method of generating a respective signature share of a digital signature for signing a message, wherein the method is performed by a first participant of the group and comprises: obtaining at least the threshold number of respective participant indexes, wherein the obtained respective participant indexes comprises a first participant index associated with the first participant; generating a private key index, wherein the private key index is generated based on a hash of a combination of the obtained respective participant indexes; generating a second common private key of the first hierarchical key structure; and generating a first signature share of the digital signature.
1 . A computer-implemented method of generating a respective signature share of a digital signature for signing a message, wherein each participant of a group of participants has i) a respective private key share of a shared private key, wherein the shared private key can only be generated with at least a threshold number of respective private key shares, ii) a respective ephemeral private key share of a shared ephemeral private key, iii) a first co-ordinate of an ephemeral public key corresponding to the shared ephemeral private key, and iv) a first common private key of a first hierarchical key structure, wherein each participant is associated with a respective participant index, and wherein the method is performed by a first participant of the group and comprises:
obtaining at least a threshold number of respective participant indexes, wherein the obtained respective participant indexes comprises a first participant index associated with the first participant;
generating a private key index, wherein the private key index is generated based on a hash of a combination of the obtained respective participant indexes;
generating a second common private key of the first hierarchical key structure, wherein the second common private key is generated based on the first common private key and a first hash value, wherein the first hash value is generated by inputting at least a) the first common private key or a corresponding public key, and b) the private key index into a hash function; and
generating a first signature share of the digital signature, wherein the first signature shared is generated based on a first ephemeral key share of the shared ephemeral private key, the message, the second common private key, the first co-ordinate of the ephemeral public key, and a first private key share of the shared private key.
2 . The method of claim 1 , wherein each participant has v) a respective share of a message-independent component, MIC, of the respective signature share, wherein each respective share of the MIC is generated based on the respective ephemeral private key share, the respective private key share and the first co-ordinate of the ephemeral public key, and wherein the first signature share is based on a first share of the MIC.
3 . The method of claim 1 , wherein the first participant is a coordinating party, and wherein the method comprises:
obtaining, from respective participants, at least the threshold number of respective signature shares of the digital signature, wherein said obtaining of the respective signature shares comprises said generating of the first signature share of the digital signature; and
generating the digital signature based on at least the obtained threshold number of respective signature shares.
4 . The method of claim 1 , comprising:
making the first signature share of the digital signature available to a coordinating party for generating the digital signature based on at least the threshold number of respective signature shares of the digital signature generated by respective participants.
5 . The method of claim 4 , wherein said obtaining of at least the threshold number of respective participant indexes comprises obtaining some of all of the respective participant indexes from the coordinating party.
6 . The method of claim 1 , wherein said obtaining of at least the threshold number of respective participant indexes comprises obtaining at least some of the respective participant indexes from the respective participants.
7 . The method of claim 1 , wherein the hash function is a HMAC function.
8 . The method of claim 7 , wherein the first common private key is associated with a first chain code, and wherein the first hash value is generated by inputting at least the first chain code, the first common private key, the private key index into the HMAC function.
9 . The method of claim 7 , wherein the first hash value is a first part of a result of inputting at least the first common private key and the private key index into the HMAC function.
10 . The method of claim 1 , wherein the first common private key is a master private key of the first hierarchal key structure.
11 . The method of claim 1 , wherein the first common private key is a private key of the first hierarchical key structure other than a master private key.
12 . The method of claim 1 , comprising:
obtaining an indication of which private key of the first hierarchical key structure is to be used as the first common private key.
13 . The method of claim 1 , wherein the first private key share of the shared private key is generated by:
obtaining a first seed share, wherein each other participant has a respective seed share;
generating a first master private key share of a shared master private key, wherein the first master private key share is generated based on the first seed share and the respective seed share of each other participant, and wherein each other participant has a respective master private key share, and wherein the first private key share is the first master private key share or one of one or more auxiliary private key shares generated based on the first master private key share.
14 . The method of claim 13 , wherein the first master private key share and each of the one or more auxiliary private key shares are arranged in a second hierarchical key structure, wherein the one or more auxiliary private key shares are respective parent private key shares, and/or respective child private key shares, wherein each parent private key share of a given level in the second hierarchical key structure is a parent to one or more child private key shares in a subsequent level in the second hierarchical key structure, and wherein the first private key share occupies a same position in the second hierarchical key structure as the second common private key in the first hierarchical key structure.
15 . The method of claim 1 , wherein each participant has a public key corresponding to the shared private key, and wherein the method comprises:
generating a second public key corresponding to the second common private key; and
generating a target public key for verifying the digital signature, wherein the target public key is generated based on the public key corresponding to the shared private key and the second public key corresponding to the second common private key.
16 . The method of claim 15 , comprising:
sending, to a verifying party, the target public key for verifying the digital signature.
17 . The method of claim 1 , comprising:
sending, to a verifying party, proof that the private key index used to generate the second common private key was generated based on the first participant index associated with the first participant, thereby proving that the first participant generated a signature share of the digital signature.
18 . The method of claim 1 , wherein the message comprises at least part of a blockchain transaction.
19 . Computer equipment comprising:
memory comprising one or more memory units; and
processing apparatus comprising one or more processing units, wherein the memory stores code arranged to run on the processing apparatus, the code being configured so as when run on the processing apparatus the processing apparatus is configured to perform a method of generating a respective signature share of a digital signature for signing a message, wherein each participant of a group of participants has i) a respective private key share of a shared private key, wherein the shared private key can only be generated with at least a threshold number of respective private key shares, ii) a respective ephemeral private key share of a shared ephemeral private key, iii) a first co-ordinate of an ephemeral public key corresponding to the shared ephemeral private key, and iv) a first common private key of a first hierarchical key structure, wherein each participant is associated with a respective participant index, and wherein the method is performed by a first participant of the group and comprises:
obtaining at least a threshold number of respective participant indexes, wherein the obtained respective participant indexes comprises a first participant index associated with the first participant;
generating a private key index, wherein the private key index is generated based on a hash of a combination of the obtained respective participant indexes;
generating a second common private key of the first hierarchical key structure, wherein the second common private key is generated based on the first common private key and a first hash value, wherein the first hash value is generated by inputting at least a) the first common private key or a corresponding public key, and b) the private key index into a hash function; and
generating a first signature share of the digital signature, wherein the first signature share is generated based on a first ephemeral key share of the shared ephemeral private key, the message, the second common private key, the first co-ordinate of the ephemeral public key, and a first private key share of the shared private key.
20 . A computer program embodied on non-transitory computer-readable storage media and configured so as, when run on one or more processors, to perform a method of generating a respective signature share of a digital signature for signing a message, wherein each participant of a group of participants has i) a respective private key share of a shared private key, wherein the shared private key can only be generated with at least a threshold number of respective private key shares, ii) a respective ephemeral private key share of a shared ephemeral private key, iii) a first co-ordinate of an ephemeral public key corresponding to the shared ephemeral private key, and iv) a first common private key of a first hierarchical key structure, wherein each participant is associated with a respective participant index, and wherein the method is performed by a first participant of the group and comprises:
obtaining at least a threshold number of respective participant indexes, wherein the obtained respective participant indexes comprises a first participant index associated with the first participant;
generating a private key index, wherein the private key index is generated based on a hash of a combination of the obtained respective participant indexes;
generating a second common private key of the first hierarchical key structure, wherein the second common private key is generated based on the first common private key and a first hash value, wherein the first hash value is generated by inputting at least a) the first common private key or a corresponding public key, and b) the private key index into a hash function; and
generating a first signature share of the digital signature, wherein the first signature share is generated based on a first ephemeral key share of the shared ephemeral private key, the message, the second common private key, the first co-ordinate of the ephemeral public key, and a first private key share of the shared private key.