ABSTRACT
Abstract
Described herein is a method and system for digital signing by utilizing Elliptic Curve Digital Signature Algorithm (ECDSA) with a group generator of an elliptic-curve group of order q, and an elliptic curve point Q. The method may be configured to receive a digital message and associated with a request from a third-party in order to sign the digital message. The system designed to sign such messages may comprise two parties denoted P 1 and P 2 configured to conduct a multiparty signing procedure by utilizing ECDSA. The digital signing procedure may follow preliminary steps configured to set the system with the necessary conditions for the multiparty signing procedure. Such preliminary steps may set the parties P 1 , and P 2 , in accordance with the configuration defined herein.
Description
CROSS REFERENCE TO RELATED APPLICATIONS
This application claims priority to U.S. Provisional Patent Application Ser. No. 62/516,113 filed Jun. 7, 2017, which is hereby incorporated herein by reference in its entirety and for all purposes.
FIELD OF THE INVENTION
The invention generally relates to the field of cryptography and digital signing processes, more specifically to the usage of Elliptic Curve Digital Signature Algorithm for multiparty digital signing.
BACKGROUND OF THE INVENTION
Threshold cryptography can be used where multiple signatures are needed to generate a signature, and likewise where highly confidential documents should only be decrypted and viewed by a quorum. Furthermore, threshold cryptography can be used to provide a high level of key protection. This is achieved by sharing the key on multiple devices (or between multiple users) and carrying out private-key operations via a secure protocol that reveals nothing but the output. This provides key protection since an adversary needs to breach multiple devices in order to obtain the key. Threshold cryptography is of practical use, as can be seen by the fact that a number of startup companies are now deploying threshold cryptography for the purpose of key protection. One example use is due to the fact that Elliptic Curve Digital Signature Algorithm (ECDSA) signing is used in Bitcoin, and the theft of a signing key can be immediately translated into concrete financial loss. Bitcoin has a multi-signature solution built in, which is based on using multiple distinct signing keys rather than a threshold signing scheme. Nevertheless, a more general solution is obtained via threshold cryptography. Fast threshold cryptography protocols exist for a wide variety of problems, including RSA signing and decryption, ElGamal and ECIES encryption, Schnorr signatures, Cramer-Shoup, and more. Despite being a widely-used standard, DSA/ECDSA with distributed key shares has resisted attempts at constructing efficient protocols for threshold signing. This is due to the difficulties to calculate the curve points x 1 and y 1 without knowing the parameter k utilized to calculate the points with G, the generator of the elliptic curve.
SUMMARY OF THE INVENTION
The present invention discloses a method and system for digital signing by utilizing ECDSA with a group generator of an elliptic-curve group of order q, and an elliptic curve point Q. The method disclosed in the present invention can be configure to receive a digital message and associated with a request from a third-party in order to sign the digital message. The system designed to sign such messages may comprise two parties denoted P 1 and P 2 configured to conduct a multiparty signing procedure by utilizing ECDSA. The digital signing procedure may follow some preliminary steps configured to set the system with the necessary conditions for the multiparty signing procedure. Such preliminary steps may set the parties P 1 , and P 2 , with the following configuration:
P 1 may hold a first random share set to compute a first point on said elliptic curve, an elliptic curve point Q on the elliptic curve, a public key and a private key of an additively homomorphic encryption scheme, and a group generator of an elliptic-curve group of order q to compute elliptic curve points. P 2 may hold: a second random share, set to generate a second point on said elliptic curve, said elliptic curve point Q on said elliptic curve, said public key, and a ciphertext created by encrypting said first random share with said public key, group generator of an elliptic-curve group of order q to compute elliptic curve points.
The parties P 1 and P 2 may also be configured to perform the preliminary steps configured to set the system wherein, the first random share was not exposed to P 2 in a nonencrypted format during the signing process, and the second random share was not exposed to P 1 in a nonencrypted format during the signing process. In some case, P 1 and P 2 may also be configured to creating a hash value of the digital message with one hash function by P 1 , and creating a hash value of the digital message with said one hash function by P 2 .
According to possible embodiments of the present invention, once the message and the request are received from a third party, the parties P 1 and P 2 which may be configured according to the preliminary steps, may conduct the digital signing procedure by performing the following: P 1 can choose a random value K 1 , and utilize the group generator and the random value K 1 to compute an elliptic curve point R 1 on the elliptic. Then P 1 can send the elliptic curve point R 1 to P 2 . Similarly, P 2 can choose a random value K 2 and utilizes the group generator and the random value K 2 to compute an elliptic curve point R 2 on the elliptic. Then, P 2 can utilize R 1 and K 2 to compute an elliptic curve point R on said elliptic curve. Then, P 2 can choose a random value and utilize an additive homomorphic scheme with the public key to computes a value C which may comprise: the hash value of the digital message, first random share, second random share, k 1 , k 2 and the random value, wherein value C is encrypted with said public key. After the encryption of the value C, P 2 can send the encrypted value C to P 1 . Then, P 1 can decrypt the encrypted value C with the private key, and then, utilize the content in value C, the elliptic curve point R 1 , and the random value K 1 to produce a digital signature of the digital message. Once the digital signature of the digital message is computed, P 1 can send it to the third-party who requested the signing procedure.
The system disclosed in the present invention may comprises two parties configured to receive requests for digital signing procedures. The requests for digital. signing may arrive to the system from third-party entities, such as servers operating overt the internet, computerize device configured to provide such requests, and the like. In some cases, the parties P 1 and P 2 may comprise software application for managing the cryptographic processes in the system. In some embodiments of the present invention the parties P 1 and P 2 . may be configured with a key storage media designed to store keys, secrets utilized in the security process, key shares, and the like.
BRIEF DESCRIPTION OF THE DRAWINGS
Some embodiments of the invention are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of embodiments of the invention. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments of the invention may be practiced.
In the drawings:
FIG. 1A discloses a method denoted KeyGen_ 1 for choosing random shares between two parties P 1 and P 2 and verifying that P 1 and P 2 behave honestly, according to exemplary embodiments of the present invention;
FIG. 1B discloses a method denoted KeyGen_ 2 for generating a distributed key between two parties P 1 and P 2 under the assumption that one of P 1 and P 2 may behave dishonestly, using the random shares generated in KeyGen_ 1 , by using an additively homomorphic encryption scheme, according to the exemplary embodiments of the present invention;
FIG. 2 discloses a procedure denoted Sign(M) for digital signing by utilizing a key distributed between two parties P 1 and P 2 , under the assumption that one of P 1 and P 2 may behave dishonestly, according to exemplary embodiments of the present invention;
FIG. 3 discloses a method for multiparty digital signing by utilizing ECDSA based on using a signing key distributed between two parties according to exemplary embodiments of the present invention, and;
FIG. 4 discloses a system designed to perform a multiparty digital signing by utilizing ECDSA based on using a signing key distributed between two parties, according to exemplary embodiments of the present invention.
DETAILED DESCRIPTION OF THE INVENTION
The present invention discloses a method and system for multiparty digital signing by utilizing Elliptic Curve Digital Signature Algorithm (ECDSA) based on signing keys, distributed between two parties, denoted as P 1 and P 2 . The method and system disclosed in the present invention may be configured to conduct a multiparty signing procedure with preliminary steps comprising: a step for choosing random shares between two parties P 1 and P 2 ensuring that they behave honestly, and a step for generating the distributed signing keys between P 1 and P 2 . The preliminary steps may be conducted by the parties P 1 and P 2 , wherein said parties utilize a zero-knowledge proof of a knowledge of the shares the parties hold. The parties P 1 and P 2 can be configured to generate an elliptic curve point Q such that Q=x·G, wherein G is the generator point of an Elliptic-curve group of order q. In some cases, the computations performed by P 1 and P 2 in the method disclosed at the present invention may utilize operators that are homomorphic properties provided by the encryption scheme, which are known to a person who has ordinary skills in the art.
FIG. 1A discloses a method denoted KeyGen_ 1 for choosing random shares between two parties P 1 and P 2 and verifying that P 1 and P 2 behave honestly, according to exemplary embodiments of the present invention. In step 103 P 1 chooses a random x 1 âZ q and computes Q 1 =x 1 ·G, where G is the generator point of an Elliptic-curve group of order q, and Z q is defined as the multiplicative group of integers modulo q. In step 105 P 1 generates a zero-knowledge proof (denoted as ZKP) of knowledge of the Discrete Log of Q 1 which is equal to x 1 . In some embodiments of the present invention, the parties P 1 and P 2 may utilize a non-interactive zero-knowledge proof which requires a proof generation performed by one party such as P 1 , or P 2 , and verification performed by the other party. In some other cases, the parties may utilize an interactive zero-knowledge proof. In some cases, this zero-knowledge proof may be the Schnorr protocol, known to a person who has ordinary skills in the art. In step 107 P 1 sends P 2 a commitment of Q 1 and the proof. The proof may be the proof resultant in step 105 above. In some cases, the commitment sent by P 1 may be a non-interactive commitment given by one party to the other. For example, such a commitment can be the hash value resultant on Q 1 and the proof, and a random string generated or received by P 1 . Such a commitment is opened by P 1 sending Q 1 and the proof and the random string to P 2 , and P 2 can verify that the commitment was correct by re-computing the hash and comparing to the commitment hash value. In step 110 P 2 chooses a random x 2 âZ q and computes Q 2 =x 2 ·G, where G is the generator point of an Elliptic-curve group of order q. In step 112 P 2 generates a ZKP of knowledge of the Discrete Log of Q 2 which is equal to x 2 . In step 114 P 2 sends to P 1 the value Q 2 and the proof resultant in step 112 above. In step 117 P 1 receives the proof from P 2 . In step 123 P 1 verifies that the proof received from P 2 is correct using the verification procedure specified for the proof. Such verification procedures can be defined by a person who has ordinary skills in the art. In case the proof is not correct, P 1 performs step 121 and aborts. In other cases, P 1 can continue to step 125 of the method and open the commitment to Q 1 and the proof. If the commitment is computed as described above as a hash value, then it is opened by sending Q 1 and the proof and the random string to P 2 . In step 127 P 2 receives the value Q 1 and the proof. In step 129 P 2 verifies that the proof of the ZKP associated with Q 1 is correct, and that the commitment is correct. Thus, in case either the proof or the commitment are not corrected, P 2 performs the step 121 of the method and aborts.
FIG. 1B discloses a method denoted KeyGen_ 2 for generating a distributed key between two honest parties P 1 and P 2 , using the random shares generated in KeyGen_ 1 , by using an additively homomorphic encryption scheme, according to the exemplary embodiments of the present invention. In step 131 P 1 holds a share x 1 in Z q where Q 1 =x 1 ·G and G is the generator point of an Elliptic-curve group Q of order q. P 2 also holds a share x 2 in Z q where Q 2 =x 2 ·G and G is the generator point of the same Elliptic-curve group Q of order q. In step 135 P 1 generates a public key denoted pk and a private key denoted sk for the public key of an additively homomorphic encryption scheme. The homomorphic encryption scheme may support addition of ciphertexts and multiplication by a scalar. The additively homomorphic encryption scheme can be used by any implementation of additively homomorphic encryption scheme known to a person who has ordinary skills in the art. Such an exemplary implementation may be an implementation of lattice-based schemes, such as Regev's implementation of lattice-based schemes. In some cases, the Paillier encryption scheme can be used for the same purpose.
Once P 1 holds the public key pk, a parameter denoted C key can be computed such that C key =Enc pk (x 1 ), wherein Enc pk ( ) is the encryption process utilizing the public key pk. In step 140 P 1 generates a ZKP to prove that N, defined as N=pk is a valid RSA modulus which is also a proof that the public key pk was correctly generated. In step 145 P 1 generates a ZKP of knowledge to prove that C key is an encryption of the unique x 1 such that Q 1 =x 1 ·G. Such zero-knowledge proofs can be designed using standard techniques known to any person who has ordinary skills in the art. In step 150 P 1 sends the proof resultant of the process in step 140 which proved that N is a valid RSA modulus, and the proof resultant of the process in step 145 which proved that C key is an encryption of the unique x 1 such that Q 1 =x 1 ·G, to P 2 . In step 153 P 2 receives the proofs sent at step 153 . In step 155 P 2 v
CROSS REFERENCE TO RELATED APPLICATIONS
This application claims priority to U.S. Provisional Patent Application Ser. No. 62/516,113 filed Jun. 7, 2017, which is hereby incorporated herein by reference in its entirety and for all purposes.
FIELD OF THE INVENTION
The invention generally relates to the field of cryptography and digital signing processes, more specifically to the usage of Elliptic Curve Digital Signature Algorithm for multiparty digital signing.
BACKGROUND OF THE INVENTION
Threshold cryptography can be used where multiple signatures are needed to generate a signature, and likewise where highly confidential documents should only be decrypted and viewed by a quorum. Furthermore, threshold cryptography can be used to provide a high level of key protection. This is achieved by sharing the key on multiple devices (or between multiple users) and carrying out private-key operations via a secure protocol that reveals nothing but the output. This provides key protection since an adversary needs to breach multiple devices in order to obtain the key. Threshold cryptography is of practical use, as can be seen by the fact that a number of startup companies are now deploying threshold cryptography for the purpose of key protection. One example use is due to the fact that Elliptic Curve Digital Signature Algorithm (ECDSA) signing is used in Bitcoin, and the theft of a signing key can be immediately translated into concrete financial loss. Bitcoin has a multi-signature solution built in, which is based on using multiple distinct signing keys rather than a threshold signing scheme. Nevertheless, a more general solution is obtained via threshold cryptography. Fast threshold cryptography protocols exist for a wide variety of problems, including RSA signing and decryption, ElGamal and ECIES encryption, Schnorr signatures, Cramer-Shoup, and more. Despite being a widely-used standard, DSA/ECDSA with distributed key shares has resisted attempts at constructing efficient protocols for threshold signing. This is due to the difficulties to calculate the curve points x 1 and y 1 without knowing the parameter k utilized to calculate the points with G, the generator of the elliptic curve.
SUMMARY OF THE INVENTION
The present invention discloses a method and system for digital signing by utilizing ECDSA with a group generator of an elliptic-curve group of order q, and an elliptic curve point Q. The method disclosed in the present invention can be configure to receive a digital message and associated with a request from a third-party in order to sign the digital message. The system designed to sign such messages may comprise two parties denoted P 1 and P 2 configured to conduct a multiparty signing procedure by utilizing ECDSA. The digital signing procedure may follow some preliminary steps configured to set the system with the necessary conditions for the multiparty signing procedure. Such preliminary steps may set the parties P 1 , and P 2 , with the following configuration:
P 1 may hold a first random share set to compute a first point on said elliptic curve, an elliptic curve point Q on the elliptic curve, a public key and a private key of an additively homomorphic encryption scheme, and a group generator of an elliptic-curve group of order q to compute elliptic curve points. P 2 may hold: a second random share, set to generate a second point on said elliptic curve, said elliptic curve point Q on said elliptic curve, said public key, and a ciphertext created by encrypting said first random share with said public key, group generator of an elliptic-curve group of order q to compute elliptic curve points.
The parties P 1 and P 2 may also be configured to perform the preliminary steps configured to set the system wherein, the first random share was not exposed to P 2 in a nonencrypted format during the signing process, and the second random share was not exposed to P 1 in a nonencrypted format during the signing process. In some case, P 1 and P 2 may also be configured to creating a hash value of the digital message with one hash function by P 1 , and creating a hash value of the digital message with said one hash function by P 2 .
According to possible embodiments of the present invention, once the message and the request are received from a third party, the parties P 1 and P 2 which may be configured according to the preliminary steps, may conduct the digital signing procedure by performing the following: P 1 can choose a random value K 1 , and utilize the group generator and the random value K 1 to compute an elliptic curve point R 1 on the elliptic. Then P 1 can send the elliptic curve point R 1 to P 2 . Similarly, P 2 can choose a random value K 2 and utilizes the group generator and the random value K 2 to compute an elliptic curve point R 2 on the elliptic. Then, P 2 can utilize R 1 and K 2 to compute an elliptic curve point R on said elliptic curve. Then, P 2 can choose a random value and utilize an additive homomorphic scheme with the public key to computes a value C which may comprise: the hash value of the digital message, first random share, second random share, k 1 , k 2 and the random value, wherein value C is encrypted with said public key. After the encryption of the value C, P 2 can send the encrypted value C to P 1 . Then, P 1 can decrypt the encrypted value C with the private key, and then, utilize the content in value C, the elliptic curve point R 1 , and the random value K 1 to produce a digital signature of the digital message. Once the digital signature of the digital message is computed, P 1 can send it to the third-party who requested the signing procedure.
The system disclosed in the present invention may comprises two parties configured to receive requests for digital signing procedures. The requests for digital. signing may arrive to the system from third-party entities, such as servers operating overt the internet, computerize device configured to provide such requests, and the like. In some cases, the parties P 1 and P 2 may comprise software application for managing the cryptographic processes in the system. In some embodiments of the present invention the parties P 1 and P 2 . may be configured with a key storage media designed to store keys, secrets utilized in the security process, key shares, and the like.
BRIEF DESCRIPTION OF THE DRAWINGS
Some embodiments of the invention are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of embodiments of the invention. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments of the invention may be practiced.
In the drawings:
FIG. 1A discloses a method denoted KeyGen_ 1 for choosing random shares between two parties P 1 and P 2 and verifying that P 1 and P 2 behave honestly, according to exemplary embodiments of the present invention;
FIG. 1B discloses a method denoted KeyGen_ 2 for generating a distributed key between two parties P 1 and P 2 under the assumption that one of P 1 and P 2 may behave dishonestly, using the random shares generated in KeyGen_ 1 , by using an additively homomorphic encryption scheme, according to the exemplary embodiments of the present invention;
FIG. 2 discloses a procedure denoted Sign(M) for digital signing by utilizing a key distributed between two parties P 1 and P 2 , under the assumption that one of P 1 and P 2 may behave dishonestly, according to exemplary embodiments of the present invention;
FIG. 3 discloses a method for multiparty digital signing by utilizing ECDSA based on using a signing key distributed between two parties according to exemplary embodiments of the present invention, and;
FIG. 4 discloses a system designed to perform a multiparty digital signing by utilizing ECDSA based on using a signing key distributed between two parties, according to exemplary embodiments of the present invention.
DETAILED DESCRIPTION OF THE INVENTION
The present invention discloses a method and system for multiparty digital signing by utilizing Elliptic Curve Digital Signature Algorithm (ECDSA) based on signing keys, distributed between two parties, denoted as P 1 and P 2 . The method and system disclosed in the present invention may be configured to conduct a multiparty signing procedure with preliminary steps comprising: a step for choosing random shares between two parties P 1 and P 2 ensuring that they behave honestly, and a step for generating the distributed signing keys between P 1 and P 2 . The preliminary steps may be conducted by the parties P 1 and P 2 , wherein said parties utilize a zero-knowledge proof of a knowledge of the shares the parties hold. The parties P 1 and P 2 can be configured to generate an elliptic curve point Q such that Q=x·G, wherein G is the generator point of an Elliptic-curve group of order q. In some cases, the computations performed by P 1 and P 2 in the method disclosed at the present invention may utilize operators that are homomorphic properties provided by the encryption scheme, which are known to a person who has ordinary skills in the art.
FIG. 1A discloses a method denoted KeyGen_ 1 for choosing random shares between two parties P 1 and P 2 and verifying that P 1 and P 2 behave honestly, according to exemplary embodiments of the present invention. In step 103 P 1 chooses a random x 1 âZ q and computes Q 1 =x 1 ·G, where G is the generator point of an Elliptic-curve group of order q, and Z q is defined as the multiplicative group of integers modulo q. In step 105 P 1 generates a zero-knowledge proof (denoted as ZKP) of knowledge of the Discrete Log of Q 1 which is equal to x 1 . In some embodiments of the present invention, the parties P 1 and P 2 may utilize a non-interactive zero-knowledge proof which requires a proof generation performed by one party such as P 1 , or P 2 , and verification performed by the other party. In some other cases, the parties may utilize an interactive zero-knowledge proof. In some cases, this zero-knowledge proof may be the Schnorr protocol, known to a person who has ordinary skills in the art. In step 107 P 1 sends P 2 a commitment of Q 1 and the proof. The proof may be the proof resultant in step 105 above. In some cases, the commitment sent by P 1 may be a non-interactive commitment given by one party to the other. For example, such a commitment can be the hash value resultant on Q 1 and the proof, and a random string generated or received by P 1 . Such a commitment is opened by P 1 sending Q 1 and the proof and the random string to P 2 , and P 2 can verify that the commitment was correct by re-computing the hash and comparing to the commitment hash value. In step 110 P 2 chooses a random x 2 âZ q and computes Q 2 =x 2 ·G, where G is the generator point of an Elliptic-curve group of order q. In step 112 P 2 generates a ZKP of knowledge of the Discrete Log of Q 2 which is equal to x 2 . In step 114 P 2 sends to P 1 the value Q 2 and the proof resultant in step 112 above. In step 117 P 1 receives the proof from P 2 . In step 123 P 1 verifies that the proof received from P 2 is correct using the verification procedure specified for the proof. Such verification procedures can be defined by a person who has ordinary skills in the art. In case the proof is not correct, P 1 performs step 121 and aborts. In other cases, P 1 can continue to step 125 of the method and open the commitment to Q 1 and the proof. If the commitment is computed as described above as a hash value, then it is opened by sending Q 1 and the proof and the random string to P 2 . In step 127 P 2 receives the value Q 1 and the proof. In step 129 P 2 verifies that the proof of the ZKP associated with Q 1 is correct, and that the commitment is correct. Thus, in case either the proof or the commitment are not corrected, P 2 performs the step 121 of the method and aborts.
FIG. 1B discloses a method denoted KeyGen_ 2 for generating a distributed key between two honest parties P 1 and P 2 , using the random shares generated in KeyGen_ 1 , by using an additively homomorphic encryption scheme, according to the exemplary embodiments of the present invention. In step 131 P 1 holds a share x 1 in Z q where Q 1 =x 1 ·G and G is the generator point of an Elliptic-curve group Q of order q. P 2 also holds a share x 2 in Z q where Q 2 =x 2 ·G and G is the generator point of the same Elliptic-curve group Q of order q. In step 135 P 1 generates a public key denoted pk and a private key denoted sk for the public key of an additively homomorphic encryption scheme. The homomorphic encryption scheme may support addition of ciphertexts and multiplication by a scalar. The additively homomorphic encryption scheme can be used by any implementation of additively homomorphic encryption scheme known to a person who has ordinary skills in the art. Such an exemplary implementation may be an implementation of lattice-based schemes, such as Regev's implementation of lattice-based schemes. In some cases, the Paillier encryption scheme can be used for the same purpose.
Once P 1 holds the public key pk, a parameter denoted C key can be computed such that C key =Enc pk (x 1 ), wherein Enc pk ( ) is the encryption process utilizing the public key pk. In step 140 P 1 generates a ZKP to prove that N, defined as N=pk is a valid RSA modulus which is also a proof that the public key pk was correctly generated. In step 145 P 1 generates a ZKP of knowledge to prove that C key is an encryption of the unique x 1 such that Q 1 =x 1 ·G. Such zero-knowledge proofs can be designed using standard techniques known to any person who has ordinary skills in the art. In step 150 P 1 sends the proof resultant of the process in step 140 which proved that N is a valid RSA modulus, and the proof resultant of the process in step 145 which proved that C key is an encryption of the unique x 1 such that Q 1 =x 1 ·G, to P 2 . In step 153 P 2 receives the proofs sent at step 153 . In step 155 P 2 verifies the proofs received in step 153 according to the specified verification technique of the proof. In case the verification fails, P 2 aborts. In step 157 P 2 verifies that the public key pk =N is of length at least min (3log|q|, n), where q is the order of the Elliptic curve group, and n denotes the standard recommended length of RSA public keys, and in case the verification fails, the process aborts. In step 160 P 1 computes Q=x 1 ·Q 2 and stores (x 1 , Q) and stores (x 1 , Q, pk, sk), and in step 165 P 2 computes Q=x 2 ·Q 1 and stores (x 1 , Q, C key .),
FIG. 2 discloses a procedure denoted Sign(M) for digital signing by utilizing a key distributed between two parties, P 1 and P 2 , under the assumption that one of P 1 and P 2 may behave dishonestly, according to exemplary embodiments of the present invention. In step 205 a message for signing is prepared by a computerized application. Such an application may be operated by one of the parties, which may require to sign a digital message or document. In such a case, P 1 and P 2 compute: Mâ²âH q (M). In some cases, the H q ( ) may be a hash function known to both parties P 1 and P 2 , where H q maps strings of arbitrary length to Z q .
In step 210 P 1 chooses a random k 1 , computes R 1 =k 1 ·G and then computes a ZKP of knowledge of the Discrete Log k 1 of R 1 . In step 215 P 1 sends a commitment of R 1 and the proof to P 2 . Such a commitment may be the hash of the value, the proof and a random string, as described above. In step 220 P 2 chooses a random k 2 , computes R 2 =k 2 ·G and then computes a ZKP of knowledge of the Discrete Log k 2 of R 2 . In step 225 P 2 sends the value R 2 and the proof, which may be the Discrete Log k 2 of R 2 , to P 1 . In step 230 P 1 receives R 2 and the proof from P 2 and verifies that the Discrete Log of R 2 is correct using the specified verification of the proof. In case the proof is not correct, P 1 aborts the method. In step 235 P 1 opens the commitment to R 1 and the proof. For example, if the commitment uses a hash, then P 1 sends R 1 , the proof and the random string. In step 240 P 2 receives R 1 and the proof, verifies the commitment (by re-computing the hash and comparing) and validates that the proof is correct using the proof verification specification. In step 250 P 2 computes R=k 2 ·R 1 and r=r x mod q, wherein R=(r x , r y ) by the Elliptic curve point definition, and q is the order of the Elliptic curve group. In step 255 P 2 chooses a random ÏâZ q2 and uses the additively homomorphic properties (such as those provided by Paillier encryption or any other additively homomorphic encryption schemes) to compute an encryption defined by Enc pk (Ï·q+[(k 2 ) â1 ·Mâ²+(k 2 ) â1 ·R·x 2 ·x 1 mod q]). This is computed using C key in the following steps: (1) compute C 1 âEnc pk (p·q+[(k 2 ) â1 Mâ² mod q]) using the additively homomorphic encryption scheme, (2) compute vâ(k 2 ) â1 ·r·x 2 mod q, and C 2 âvâC key using the homomorphic property of additive encryption that enables multiplication by a scalar, (3) computes C=C 1 âC 2 using the homomorphic property of additive encryption that enables the addition of two ciphertexts. In step 260 P 2 sends the value C to P 1 and then in step 265 P 1 computes R=k 1 ·R 2 , Sâ²=Dec sk (C) and S=(k 1 ) â1 ·Sâ² mod q, wherein Dec sk ( ) is the decryption function utilizes the private key sk for the additively homomorphic public key scheme. In step 270 P 1 verifies that (r, s) is a valid signature on message m, using the standard ECDSA signature verification procedure, otherwise P 1 aborts.
FIG. 3 discloses a method for multiparty digital signing by utilizing ECDSA based on using multiple distinct signing keys, distributed between two parties according to exemplary embodiments of the present invention. In step 305 a third-party entity requests to sign a digital message or a document denoted as M, by P 1 and P 2 . In some cases, signing on M may require a digital signing by more than one person, or a joint signature provided by more than one signees. For example, bitcoin transactions or other transactions may require multi-signatures.
P 1 and P 2 may be computerized devices configured to digitally sign electronic messages or documents. In some cases, such a third-party entity may be a server or other computerized device configured to verify the authenticity of the digital signature associated with a digital message or a document. In some cases, P 1 and P 2 may be may be computerized devices operated by two different people, which may need to provide multiparty digital signing.
In step 310 P 1 verifies that (x 1 , Q, pk, sk) are stored according to method KeyGen_ 2 and message M is received. In some embodiments of the present invention a session ID, denoted as a sid, may be provided by the third-party entity. The provided sid can be an integer number functioning as a counter, a unique string sequence, and the like, which define the multiparty digital signing session. In some cases, P 1 and P 2 may utilize the sid inside the zero-knowledge proofs to ensure that the sid is unique to the current multiparty digital signing session. In step 315 P 2 verifies (x 2 , Q), pk and C key are stored according to method KeyGen_ 2 . In step 320 P 1 and P 2 perform the procedure Sign(M) and receive the ECDSA signature (r, s) on message M. In step 325 P 1 and P 2 send the signature (r, s) and the message M. In step 330 the third-entity verifies the authenticity of the signature by using a standard ECDSA signature verification procedure. In some cases, the third-party which verifies the authenticity of the signature may be configured to operate a procedure of ECDSA signature verification. For example, the third-party entity may have the public-key on the curve wherein Q is a point at the curve.
FIG. 4 discloses a system designed to perform a multiparty digital signing by utilizing ECDSA based on using one or more shared signing keys distributed between two parties, according to exemplary embodiments of the present invention. FIG. 4 shows a multiparty digital signing system 405 comprising a multiparty digital signing party 415 and a multiparty digital signing party 410 . The multiparty digital signing parties
410 and 415 can be computerized devices operated singlehandedly by persons. For example, in some cases, the multiparty digital signing party 415 may be operated by one person and the multiparty digital signing party 410 may be operated by another person. The multiparty digital signing parties
415 and 410 may also have cryptographic modules
435 and 430 respectively. The cryptographic modules
435 and 430 may be configured for processing cryptographic procedures such as an encryption, security algorithms, generating secret shares, signing digital messages or digital documents and the like. The multiparty digital signing parties
415 and 410 can communicate via connection 450 which may be a telecommunication network connection such as an internet protocol based connection, a computer network based connection, and the like. The multiparty digital signing parties
415 and 410 also comprise key storages
425 and 420 respectively configured to store the key shares and the secrets utilized in the digital signing processes. For example, in some cases, the multiparty digital signing party 415 may utilize the key storage 425 to store the (x 1 , Q) required at the digital signing process, and the multiparty digital signing party 415 may store the (x 2 , Q) required at the same digital signing process. The key storages
425 and 420 may be a data storage device, a magnetic storage such as hard disk, a solid-state storage, other media comprising a non-volatile memory, and the like.
In some cases, one of the parties either multiparty digital signing party 415 or multiparty digital signing party 410 may launch the KeyGen_ 1 and KeyGen_ 2 to generate the distributed keys between multiparty digital signing parties
410 and 415 . In some cases, the multiparty digital signing party 410 may launch the Sign(M) procedure for signing on a message M, per request provided by the third- party entity 470 . In some other cases, the multiparty digital signing party 415 may be the party which launches the Sign(M) procedure for signing on a message M, per request provided by the third- party entity 470 . In such cases, the multiparty digital signing party 415 and multiparty digital signing party 410 may utilize the key storage 425 and the key storage 420 , respectively to store the cryptographic data. The cryptographic data may be keys, key shares, parameters related to the elliptic-curve computation, numbers, and the likes.
The third- party entity 470 may be a computerize device seeking to receive a message M signed by a person or persons operating the multiparty digital signing parties
410 and 415 . In some cases, the message M to sign may be sent by the third- party entity 470 to one of the multiparty digital signing parties
410 or 415 . Then, the party received the request to sign the message M may launch the digital signing process and conduct said digital signing process with the third- party entity 470 .
While the disclosure has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings without departing from the essential scope thereof. Therefore, it is intended that the disclosed subject matter not be limited to the particular embodiment disclosed as the best mode contemplated for carrying out this invention, but only by the claims that follow.
Claims ( 9 )
The invention claimed is:
1. A method for digital signing by utilizing ECDSA with a group generator of an elliptic-curve group of order q, and an elliptic curve point Q, comprising: receiving a digital message and a request from a third-party to sign said digital message by two parties denoted P 1 and P 2 configured to perform digital signing by utilizing ECDSA, wherein:
(i) P 1 holds a first random share set to compute a first point on said elliptic curve, a public key and a private key of an additively homomorphic encryption scheme, the elliptic curve point Q,
(ii) P 2 holds a second random share, set to generate a second point on said elliptic curve, said public key, and a cipher text created by encrypting said first random share with said public key, the elliptic curve point Q,
creating a hash value of the digital message using a hash function applied by P 1 , and creating a hash value of the digital message with said hash function applied by P 2 ;
performing a digital signing procedure by P 1 and P 2 , wherein said digital signing procedure comprises:
using a random value K 1 chosen by P 1 to compute an elliptic curve point R 1 on said elliptic curve,
sending elliptic curve point R 1 from P 1 to P 2 ,
using a random value K 2 chosen by P 2 to compute an elliptic curve point R 2 ,
utilizing elliptic curve point R 1 and random value K 2 by P 2 to compute an elliptic curve point R,
using additive homomorphic scheme by P 2 to compute a value C, wherein said value C comprising: the hash value of the digital message, first random share, second random share, random value K 1 , random value K 2 and a random value chosen by P 2 , and wherein value C is encrypted with said public key,
sending value C from P 2 to P 1 ,
decrypting value C with the private key by P 1 , and utilizing the content in value C to produce a digital signature of the digital message;
sending the digital signature of the digital message and the hash value of the digital message to the third-party.
2. The method of claim 1 , wherein the digital message and the request from the third-party also comprise a session ID.
3. The method of claim 1 , wherein the first random share is not exposed to P 2 in a nonencrypted format during the signing process.
4. The method of claim 1 , wherein the second random share was not exposed to P 1 in a nonencrypted format during the signing process.
5. The method of claim 1 , wherein the hash value is created independently by P 1 with the one hash function.
6. The method of claim 1 , wherein the hash value is created independently by P 2 with the one hash function.
7. The method of claim 1 , wherein the digital signature of the digital message is sent by P 1 .
8. The method of claim 1 , wherein the additive homomorphic scheme is based on implementation of lattice-based scheme.
9. The method of claim 1 , wherein the additive homomorphic scheme is based on Paillier encryption scheme.
US15/727,768
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Active
2038-06-08
US10530585B2
( en )
Priority Applications (2)
Application Number
Priority Date
Filing Date
Title
US15/727,768
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
PCT/IL2018/050505
WO2018225053A1
( en )
2017-06-07
2018-05-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Applications Claiming Priority (2)
Application Number
Priority Date
Filing Date
Title
US201762516113P
2017-06-07
2017-06-07
US15/727,768
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Publications (2)
Publication Number
Publication Date
US20180359097A1
US20180359097A1 ( en )
2018-12-13
US10530585B2
true
US10530585B2 ( en )
2020-01-07
Family
ID=64563006
Family Applications (1)
Application Number
Title
Priority Date
Filing Date
US15/727,768
Active
2038-06-08
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Country Status (2)
Country
Link
US
( 1 )
US10530585B2
( en )
WO
( 1 )
WO2018225053A1
( en )
Cited By (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12099997B1
( en )
2020-01-31
2024-09-24
Steven Mark Hoffberg
Tokenized fungible liabilities
US12225138B2
( en )
2022-03-15
2025-02-11
Tata Consultancy Services Limited
Method and system for distributed digital signature computation
Families Citing this family (38)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US10333715B2
( en )
*
2016-11-14
2019-06-25
International Business Machines Corporation
Providing computation services with privacy
US11507683B2
( en )
2017-01-20
2022-11-22
Enveil, Inc.
Query processing with adaptive risk decisioning
US11196541B2
( en )
2017-01-20
2021-12-07
Enveil, Inc.
Secure machine learning analytics using homomorphic encryption
US11777729B2
( en )
2017-01-20
2023-10-03
Enveil, Inc.
Secure analytics using term generation and homomorphic encryption
US10972251B2
( en )
2017-01-20
2021-04-06
Enveil, Inc.
Secure web browsing via homomorphic encryption
US10873568B2
( en )
2017-01-20
2020-12-22
Enveil, Inc.
Secure analytics using homomorphic and injective format-preserving encryption and an encrypted analytics matrix
US10903976B2
( en )
2017-01-20
2021-01-26
Enveil, Inc.
End-to-end secure operations using a query matrix
US10897357B2
( en )
*
2018-04-04
2021-01-19
International Business Machines Corporation
Computation using lattice-based cryptography
US20190318118A1
( en )
*
2018-04-16
2019-10-17
International Business Machines Corporation
Secure encrypted document retrieval
US11444779B2
( en )
2018-08-02
2022-09-13
Paypal, Inc.
Techniques for securing application programming interface requests using multi-party digital signatures
US10902133B2
( en )
2018-10-25
2021-01-26
Enveil, Inc.
Computational operations in enclave computing environments
US11240001B2
( en )
*
2018-11-06
2022-02-01
International Business Machines Corporation
Selective access to asset transfer data
CLAIMS
Claims ( 9 )
The invention claimed is:
1. A method for digital signing by utilizing ECDSA with a group generator of an elliptic-curve group of order q, and an elliptic curve point Q, comprising: receiving a digital message and a request from a third-party to sign said digital message by two parties denoted P 1 and P 2 configured to perform digital signing by utilizing ECDSA, wherein:
(i) P 1 holds a first random share set to compute a first point on said elliptic curve, a public key and a private key of an additively homomorphic encryption scheme, the elliptic curve point Q,
(ii) P 2 holds a second random share, set to generate a second point on said elliptic curve, said public key, and a cipher text created by encrypting said first random share with said public key, the elliptic curve point Q,
creating a hash value of the digital message using a hash function applied by P 1 , and creating a hash value of the digital message with said hash function applied by P 2 ;
performing a digital signing procedure by P 1 and P 2 , wherein said digital signing procedure comprises:
using a random value K 1 chosen by P 1 to compute an elliptic curve point R 1 on said elliptic curve,
sending elliptic curve point R 1 from P 1 to P 2 ,
using a random value K 2 chosen by P 2 to compute an elliptic curve point R 2 ,
utilizing elliptic curve point R 1 and random value K 2 by P 2 to compute an elliptic curve point R,
using additive homomorphic scheme by P 2 to compute a value C, wherein said value C comprising: the hash value of the digital message, first random share, second random share, random value K 1 , random value K 2 and a random value chosen by P 2 , and wherein value C is encrypted with said public key,
sending value C from P 2 to P 1 ,
decrypting value C with the private key by P 1 , and utilizing the content in value C to produce a digital signature of the digital message;
sending the digital signature of the digital message and the hash value of the digital message to the third-party.
2. The method of claim 1 , wherein the digital message and the request from the third-party also comprise a session ID.
3. The method of claim 1 , wherein the first random share is not exposed to P 2 in a nonencrypted format during the signing process.
4. The method of claim 1 , wherein the second random share was not exposed to P 1 in a nonencrypted format during the signing process.
5. The method of claim 1 , wherein the hash value is created independently by P 1 with the one hash function.
6. The method of claim 1 , wherein the hash value is created independently by P 2 with the one hash function.
7. The method of claim 1 , wherein the digital signature of the digital message is sent by P 1 .
8. The method of claim 1 , wherein the additive homomorphic scheme is based on implementation of lattice-based scheme.
9. The method of claim 1 , wherein the additive homomorphic scheme is based on Paillier encryption scheme.
US15/727,768
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Active
2038-06-08
US10530585B2
( en )
Priority Applications (2)
Application Number
Priority Date
Filing Date
Title
US15/727,768
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
PCT/IL2018/050505
WO2018225053A1
( en )
2017-06-07
2018-05-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Applications Claiming Priority (2)
Application Number
Priority Date
Filing Date
Title
US201762516113P
2017-06-07
2017-06-07
US15/727,768
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Publications (2)
Publication Number
Publication Date
US20180359097A1
US20180359097A1 ( en )
2018-12-13
US10530585B2
true
US10530585B2 ( en )
2020-01-07
Family
ID=64563006
Family Applications (1)
Application Number
Title
Priority Date
Filing Date
US15/727,768
Active
2038-06-08
US10530585B2
( en )
2017-06-07
2017-10-09
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
Country Status (2)
Country
Link
US
( 1 )
US10530585B2
( en )
WO
( 1 )
WO2018225053A1
( en )
Cited By (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12099997B1
( en )
2020-01-31
2024-09-24
Steven Mark Hoffberg
Tokenized fungible liabilities
US12225138B2
( en )
2022-03-15
2025-02-11
Tata Consultancy Services Limited
Method and system for distributed digital signature computation
Families Citing this family (38)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US10333715B2
( en )
*
2016-11-14
2019-06-25
International Business Machines Corporation
Providing computation services with privacy
US11507683B2
( en )
2017-01-20
2022-11-22
Enveil, Inc.
Query processing with adaptive risk decisioning
US11196541B2
( en )
2017-01-20
2021-12-07
Enveil, Inc.
Secure machine learning analytics using homomorphic encryption
US11777729B2
( en )
2017-01-20
2023-10-03
Enveil, Inc.
Secure analytics using term generation and homomorphic encryption
US10972251B2
( en )
2017-01-20
2021-04-06
Enveil, Inc.
Secure web browsing via homomorphic encryption
US10873568B2
( en )
2017-01-20
2020-12-22
Enveil, Inc.
Secure analytics using homomorphic and injective format-preserving encryption and an encrypted analytics matrix
US10903976B2
( en )
2017-01-20
2021-01-26
Enveil, Inc.
End-to-end secure operations using a query matrix
US10897357B2
( en )
*
2018-04-04
2021-01-19
International Business Machines Corporation
Computation using lattice-based cryptography
US20190318118A1
( en )
*
2018-04-16
2019-10-17
International Business Machines Corporation
Secure encrypted document retrieval
US11444779B2
( en )
2018-08-02
2022-09-13
Paypal, Inc.
Techniques for securing application programming interface requests using multi-party digital signatures
US10902133B2
( en )
2018-10-25
2021-01-26
Enveil, Inc.
Computational operations in enclave computing environments
US11240001B2
( en )
*
2018-11-06
2022-02-01
International Business Machines Corporation
Selective access to asset transfer data
US10817262B2
( en )
2018-11-08
2020-10-27
Enveil, Inc.
Reduced and pipelined hardware architecture for Montgomery Modular Multiplication
US10887110B2
( en )
*
2018-11-26
2021-01-05
Unbound Tech Ltd
Method for digital signing with multiple devices operating multiparty computation with a split key
CN111447065B
( en )
*
2019-01-16
2021-03-09
ä¸å½ç§å¦é¢è½¯ä»¶ç 究æ
An active and secure two-party generation method of SM2 digital signature
CN109639439B
( en )
*
2019-02-27
2020-10-30
æ¦æ±å¤§å¦
An ECDSA Digital Signature Method Based on Two-Party Collaboration
CN110011803B
( en )
*
2019-02-27
2020-10-30
æ¦æ±å¤§å¦
A Lightweight SM2 Method for Two-Party Collaboration to Generate Digital Signatures
IL286016B2
( en )
*
2019-03-05
2024-07-01
Blockdaemon Aps
A method for providing a digital signature to a message
US11374771B2
( en )
*
2019-03-08
2022-06-28
Ares Technologies, Inc.
Methods and systems for implementing mixed protocol certificates
EP3709561A1
( en )
*
2019-03-14
2020-09-16
Thales Dis France SA
Method for generating a digital signature of an input message
GB201907396D0
( en )
2019-05-24
2019-07-10
Nchain Holdings Ltd
Hash function attacks
GB2584154A
( en )
*
2019-05-24
2020-11-25
Nchain Holdings Ltd
Knowledge proof
GB201907392D0
( en )
2019-05-24
2019-07-10
Nchain Holdings Ltd
Proof-of-work
GB201907394D0
( en )
*
2019-05-24
2019-07-10
Nchain Holdings Ltd
Knowledge proof
GB201907397D0
( en )
*
2019-05-24
2019-07-10
Nchain Holdings Ltd
Knowledge proof
CN110289968B
( en )
*
2019-06-27
2022-06-24
ç©éµå ææ¯ï¼æ·±å³ï¼æéå ¬å¸
Private key recovery method, collaborative address creation method, collaborative address signature device and storage medium
GB201913704D0
( en )
*
2019-09-23
2019-11-06
Nchain Holdings Ltd
Computer implemented method and system for storing certified data on a blockchain
CN111010285B
( en )
*
2019-11-25
2023-04-18
æ¦æ±å¤§å¦
SM2 two-party collaborative signature method and medium suitable for lightweight client
CN111147254B
( en )
*
2019-12-24
2022-09-02
ç©éµå ææ¯ï¼æ·±å³ï¼æéå ¬å¸
Method and device for generating EdDSA digital signature cooperated by two parties
US11601258B2
( en )
2020-10-08
2023-03-07
Enveil, Inc.
Selector derived encryption systems and methods
CN112686669B
( en )
*
2020-12-28
2025-11-07
浪潮äºæ´²å·¥ä¸äºèç½æéå ¬å¸
Signature method, device and storage medium of super account book
CN112769539B
( en )
*
2020-12-30
2023-09-22
èªå¤©ä¿¡æ¯è¡ä»½æéå ¬å¸
A method and system for generating RSA keys and coordinating RSA signature and decryption
CN114285577B
( en )
*
2021-04-27
2024-05-03
åé ä¸ç§(å京)ä¿¡æ¯ææ¯æéå ¬å¸
Multiparty collaborative signature method and system
CN113704831B
( en )
*
2021-08-11
2023-11-03
å京天å¨è¯ä¿¡çµååå¡æå¡æéå ¬å¸
Digital signature multiparty generation method and system without simultaneous online of participants
CN114257366B
( en )
*
2021-12-20
2024-04-12
æé½å«å£«éä¿¡æ¯äº§ä¸è¡ä»½æéå ¬å¸
Information homomorphic processing method, device, equipment and computer readable storage medium
WO2025099552A1
( en )
*
2023-11-08
2025-05-15
Dwallet Labs Ltd.
2pc-mpc: ecdsa threshold signature based on a threshold additively homomorphic encryption
US12500734B2
( en )
*
2024-05-15
2025-12-16
Seagate Technology Llc
Third-party private set difference
GB202407564D0
( en )
*
2024-05-29
2024-07-10
Cybernetica As
Composite elliptic-curve digital signatures
Citations (3)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20160105414A1
( en )
*
2014-10-13
2016-04-14
Morpho
Method for Authenticating a Client Device to a Server Using a Secret Element
US20170155628A1
( en )
*
2015-12-01
2017-06-01
Encrypted Dynamics LLC
Device, system and method for fast and secure proxy re-encryption
US20190052458A1
( en )
*
2016-02-23
2019-02-14
nChain Holdings Limited
Determining a common secret for the secure exchange of information and hierarchical, deterministic cryptographic keys
Family Cites Families (6)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20020057796A1
( en )
*
1998-12-24
2002-05-16
Lambert Robert J.
Method for accelerating cryptographic operations on elliptic curves
US7936869B2
( en )
*
2005-01-07
2011-05-03
First Data Corporation
Verifying digital signature based on shared knowledge
US9489522B1
( en )
*
2013-03-13
2016-11-08
Hrl Laboratories, Llc
Method for secure and resilient distributed generation of elliptic curve digital signature algorithm (ECDSA) based digital signatures with proactive security
FR3035986B1
( en )
*
2015-05-06
2018-07-27
Morpho
METHOD FOR GENERATING A MESSAGE SIGNATURE FROM A DIGITAL SIGNATURE TOKEN USING A HOMOMORPHIC ENCRYPTION FUNCTION
CN106549770B
( en )
*
2017-01-13
2019-07-12
æ¦æ±ç工大å¦
SM2 digital signature generation method and system
CN107707358B
( en )
*
2017-10-30
2019-12-24
æ¦æ±å¤§å¦
A method and system for generating EC-KCDSA digital signature
2017
2017-10-09
US
US15/727,768
patent/US10530585B2/en
active
Active
2018
2018-05-09
WO
PCT/IL2018/050505
patent/WO2018225053A1/en
not_active
Ceased
Patent Citations (3)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20160105414A1
( en )
*
2014-10-13
2016-04-14
Morpho
Method for Authenticating a Client Device to a Server Using a Secret Element
US20170155628A1
( en )
*
2015-12-01
2017-06-01
Encrypted Dynamics LLC
Device, system and method for fast and secure proxy re-encryption
US20190052458A1
( en )
*
2016-02-23
2019-02-14
nChain Holdings Limited
Determining a common secret for the secure exchange of information and hierarchical, deterministic cryptographic keys
Non-Patent Citations (2)
* Cited by examiner, â Cited by third party
Title
R. Gennaro, S. Goldfeder, and A. Narayanan, " Threshold-optimal DSA/ECDSA signatures and an application to Bitcoin wallet security, " Cryptology ePrint Archive, Report 2016/013, 2016, http://eprint.iacr.org/ 2016/013.
*
S. Goldfeder, R. Gennaro, H. Kalodner, J. Bonneau, E. W. Felten, J. A. Kroll, and A. Narayanan. Securing bitcoin wallets via a new DSA/ECDSA threshold signature scheme, 2014.
*
Cited By (2)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US12099997B1
( en )
2020-01-31
2024-09-24
Steven Mark Hoffberg
Tokenized fungible liabilities
US12225138B2
( en )
2022-03-15
2025-02-11
Tata Consultancy Services Limited
Method and system for distributed digital signature computation
Also Published As
Publication number
Publication date
US20180359097A1
( en )
2018-12-13
WO2018225053A1
( en )
2018-12-13
Similar Documents
Publication
Publication Date
Title
US20180359097A1
( en )
2018-12-13
Digital signing by utilizing multiple distinct signing keys, distributed between two parties
US10211981B2
( en )
2019-02-19
System and method for generating a server-assisted strong password from a weak secret
CN108667626B
( en )
2020-03-03
Secure two-party collaboration SM2 signature method
US6792530B1
( en )
2004-09-14
Implicit certificate scheme
US7796761B2
( en )
2010-09-14
Distribution and authentication of public keys using random numbers and diffie-hellman public keys
US7359507B2
( en )
2008-04-15
Server-assisted regeneration of a strong secret from a weak secret
US6058188A
( en )
2000-05-02
Method and apparatus for interoperable validation of key recovery information in a cryptographic system
CN104270249B
( en )
2017-10-17
It is a kind of from the label decryption method without certificate environment to identity-based environment
US6249585B1
( en )
2001-06-19
Publicly verifiable key recovery
CN104301108B
( en )
2017-10-17
It is a kind of from identity-based environment to the label decryption method without certificate environment
US9088419B2
( en )
2015-07-21
Keyed PV signatures
JP2002534701A
( en )
2002-10-15
Auto-recoverable, auto-encryptable cryptosystem using escrowed signature-only keys
JP2019537349A
( en )
2019-12-19
Composite digital signature
KR20010013155A
( en )
2001-02-26
Auto-recoverable auto-certifiable cryptosystems
JP4307589B2
( en )
2009-08-05
Authentication protocol
GB2421407A
( en )
2006-06-21
Generating a shared symmetric key using identifier based cryptography
Kwon
2002
Virtual software tokens-a practical way to secure PKI roaming
Hwu et al.
2006
End-to-end security mechanisms for SMS
US7035403B2
( en )
2006-04-25
Encryption method and apparatus with escrow guarantees
Chen et al.
2023
A Novel Hybrid Encryption Scheme Using RSA-Co-CP-ABE for Ciphertext Transmission in Cloud Environment
Sumanth et al.
2021
Recent Advances in Mathematical Research and Computer Science Vol. 5
CN121585375A
( en )
2026-02-27
Quantum-resistant collaborative signature methods, signature verification methods, systems, devices and media
Penev
2005
Identity Based Public Key Infrastructures
Sama et al.
2013
A Java Implementation of Signcryption Protocol Based on Elliptic Curve|
Oh et al.
2003
An Efficient Hybrid Cryptosystem Providing Authentication for SenderâS Identity
Legal Events
Date
Code
Title
Description
2017-10-09
AS
Assignment
Owner name : BAR-IIAN UNIVERSITY, ISRAEL
Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:LINDELL, YEHUDA;REEL/FRAME:043813/0153
Effective date : 20170720
2017-10-09
FEPP
Fee payment procedure
Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY
2017-11-06
FEPP
Fee payment procedure
Free format text : ENTITY STATUS SET TO SMALL (ORIGINAL EVENT CODE: SMAL); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY
2017-11-17
STPP
Information on status: patent application and granting procedure in general
Free format text : DOCKETED NEW CASE - READY FOR EXAMINATION
2019-08-08
STPP
Information on status: patent application and granting procedure in general
Free format text : NON FINAL ACTION MAILED
2019-09-26
STPP
Information on status: patent application and granting procedure in general
Free format text : NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS
2019-12-05
STPP
Information on status: patent application and granting procedure in general
Free format text : PUBLICATIONS -- ISSUE FEE PAYMENT VERIFIED
2019-12-18
STCF
Information on status: patent grant
Free format text : PATENTED CASE
2022-03-17
AS
Assignment
Owner name : COINBASE IL RD LTD, CALIFORNIA
Free format text : CHANGE OF NAME;ASSIGNOR:UNBOUND SECURITY LTD;REEL/FRAME:059380/0994
Effective date : 20220308
Owner name : UNBOUND SECURITY LTD, ISRAEL
Free format text : ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BAR ILAN UNIVERSITY;REEL/FRAME:059289/0592
Effective date : 20211125
2023-08-28
FEPP
Fee payment procedure
Free format text : MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY
2023-10-05
FEPP
Fee payment procedure
Free format text : SURCHARGE FOR LATE PAYMENT, LARGE ENTITY (ORIGINAL EVENT CODE: M1554); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
Free format text : ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
2023-10-05
MAFP
Maintenance fee payment
Free format text : PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY
Year of fee payment : 4