Computer-implemented method of generating a threshold vault
AssigneenChain Holdings Limited
InventorCraig Steven Wright
Life of this patent
Estimating the term…
Abstract
A method and devices for securely and privately generating a threshold vault address and distributed individual key shares reliant upon individually selected polynomial functions, without revealing the key shares and without ever reconstructing the private key. A digital asset stored at the threshold vault address may be used as an input to a transaction through generating a digital signature corresponding to the threshold vault address. Methods and devices are described for collaboratively generating the digital signature without reconstructing the private key or revealing individual key shares. Methods and devices are described for refreshing the distributed private key shares.
Claims43
A computer-implemented method of securely generating a threshold vault, where the threshold vault has a public key address, a private key and a threshold k, each node of a plurality of nodes having a respective first secret and a respective k−1 degree polynomial function with that node's respective first secret set as a constant term of said polynomial function, the nodes including a first node having a first polynomial function, the method performed by the first node comprising:
- for each other node of the plurality of nodes, setting a variable in the first polynomial function to a value associated with that other node, finding a respective result of the polynomial function for that value, and securely communicating the respective result to that other node;
- receiving, from at least a threshold number of the other nodes, respective second secrets, where each of the respective second secrets is a result of that other node's respective polynomial function for a first value associated with said first node;
- communicating, to the other nodes, an elliptic curve point multiplication of each of the respective results;
- receiving, from at least the threshold number of the other nodes, elliptic curve point multiplications of the respective second secrets shared by the other nodes with any of the nodes;
- forming and storing a first private key share of the private key based on a sum of the respective second secrets received from the other nodes;
- and
- determining the public key corresponding to the private key based on a sum of the received elliptic curve point multiplications of the respective second secrets and using polynomial interpolation.
A computer-implemented method of securely generating a digital signature for a message relating to a threshold vault, where the threshold vault has a public key address, a private key and a threshold, each node of a plurality of nodes having a respective private key share, ephemeral key share, multiplicative mask share, first additive mask share, and second additive mask share, the method performed by a first node of the plurality of nodes comprising:
- generating and sharing a double masked key share from the ephemeral key share masked by the multiplicative key share and by the first additive key share, and an elliptic curve point multiplication of the multiplicative key share;
- receiving from at least a threshold number of other nodes, the respective double masked key shares corresponding to said nodes and respective elliptic curve point multiplication (ECPM) of the multiplicative key shares corresponding to said nodes;
- determining a first signature component using polynomial interpolation over the double masked key shares and polynomial interpolation over the ECPM of the multiplicative key shares;
- and
- determining and revealing a second signature component share based on the message, the private key share, the first signature component, the ephemeral key share, masked by the second additive mask share,
- whereby the second signature component is obtainable from the respective second signature component shares of at least the threshold number of the nodes.
A computer implemented method of multi-party computation,
- the method comprising:
- distributing, among a plurality of first nodes, shares of a plurality of secrets, wherein each said secret is a constant term of a respective polynomial function, and each said share is a respective value of the polynomial function associated with said first node, wherein the secret is accessible by means of polynomial interpolation of a threshold number of said shares and is inaccessible in the absence of said threshold number of shares;
- receiving, at a second node, from each of a plurality of said first nodes, a respective share of a computed secret, wherein each said first node calculates its share of the computed secret by carrying out at least one predetermined computation on shares of a respective plurality of said secrets allocated to said nodes;
- and
- determining, at said second node, the computed secret by means of polynomial interpolation of at least a threshold number of said shares of said computed secret.
A computer-implemented method of distributing, among a plurality of nodes, shares of a private key of a public-private key cryptography system, wherein each said node has a respective first secret, a respective first polynomial function with that node's respective first secret set as its constant term, and a respective first share of a private key, wherein the private key is a sum of the first secrets and is the constant term of a second polynomial function, wherein the private key is accessible by means of polynomial interpolation of at least a threshold number of said first shares and is inaccessible to less than said threshold number of said first shares, the nodes including a first node the method performed by the first node comprising:
- selecting a respective third polynomial function having zero set as the respective constant term of said third polynomial function;
- for each other node of the plurality of nodes, setting a variable in the third polynomial function to a value associated with that other node, determining a respective result of the third polynomial function for that value, and securely communicating the respective result to that other node;
- receiving, from each other node, a respective share of a respective second secret, wherein said share is a result of that other node's respective third polynomial function for a first value associated with said first node;
- and
- forming and storing a respective second share of the private key, wherein said second share is the sum of the respective first share and the sum of the received shares of the second secrets.
A computing device to participate in a blockchain transaction, the computing device being a first node of a plurality of nodes, the computing device comprising:
- a processor;
- a memory;
- a network interface to provide network connectivity to the other nodes in the plurality of nodes;
- and
- a blockchain application containing computer-executable instructions that, when executed by the processor, cause the processor to carry out a method of securely generating a threshold vault, where the threshold vault has a public key address, a private key and a threshold k, each node of the plurality of nodes having a respective first secret and a respective k−1 degree polynomial function with that node's respective first secret set as the constant term of said polynomial function, the nodes including a first node having a first polynomial function, the method performed by the first node comprising:
- for each other node of the plurality of nodes, setting a variable in the first polynomial function to a value associated with that other node, finding a respective result of the polynomial function for that value, and securely communicating the respective result to that other node;
- receiving, from at least a threshold number of the other nodes, respective second secrets, where each of the respective second secrets is a result of that other node's respective polynomial function for a first value associated with said first node;
- communicating, to the other nodes, an elliptic curve point multiplication of each of the respective results;
- receiving, from at least the threshold number of the other nodes, elliptic curve point multiplications of the respective second secrets shared by the other nodes with any of the nodes;
- forming and storing a first private key share of the private key based on a sum of the respective second secrets received from the other nodes;
- and
- determining the public key corresponding to the private key based on a sum of the received elliptic curve point multiplications of the respective second secrets and using polynomial interpolation.
A computing device to participate in a blockchain transaction, the computing device being a first node of a plurality of nodes, the computing device comprising:
- a processor;
- a memory;
- a network interface to provide network connectivity to the other nodes in the plurality of nodes;
- and
- a blockchain application containing computer-executable instructions that, when executed by the processor, cause the processor to carry out a method of securely generating a digital signature for a message relating to a threshold vault, where the threshold vault has a public key address, a private key and a threshold, each node of the plurality of nodes having a respective private key share, ephemeral key share, multiplicative mask share, first additive mask share, and second additive mask share, the method performed by a first node of the plurality of nodes comprising:
- generating and sharing a double masked key share from the ephemeral key share masked by the multiplicative key share and by the first additive key share, and an elliptic curve point multiplication of the multiplicative key share;
- receiving, from at least a threshold number of other nodes, the respective double masked key shares corresponding to said nodes and respective elliptic curve point multiplication (ECPM) of the multiplicative key shares corresponding to said nodes;
- determining a first signature component using polynomial interpolation over the double masked key shares and polynomial interpolation over the ECPM of the multiplicative key shares;
- and
- determining and revealing a second signature component share based on the message, the private key share, the first signature component, the ephemeral key share, masked by the second additive mask share,
- whereby the second signature component is obtainable from the respective second signature component shares of at least the threshold number of the nodes.
A computing device to participate in a blockchain transaction, the computing device being a first node of a plurality of nodes, the computing device comprising:
- a processor;
- a memory;
- a network interface to provide network connectivity to the other nodes in the plurality of nodes;
- and
- a blockchain application containing computer-executable instructions that, when executed by the processor, cause the processor to carry out a method of multi-party computation, the method comprising:
- distributing, among the plurality of first nodes, shares of a plurality of secrets, wherein each said secret is a constant term of a respective polynomial function, and each said share is a respective value of the polynomial function associated with said first node, wherein the secret is accessible by means of polynomial interpolation of a threshold number of said shares and is inaccessible in the absence of said threshold number of shares;
- receiving, at a second node, from each of a plurality of said first nodes, a respective share of a computed secret, wherein each said first node calculates its share of the computed secret by carrying out at least one predetermined computation on shares of a respective plurality of said secrets allocated to said nodes;
- and
- determining, at said second node, the computed secret by means of polynomial interpolation of at least a threshold number of said shares of said computed secret.
A computing device to participate in a blockchain transaction, the computing device being a first node of a plurality of nodes, the computing device comprising:
- a processor;
- a memory;
- a network interface to provide network connectivity to the other nodes in the plurality of nodes;
- and
- a blockchain application containing computer-executable instructions that, when executed by the processor, cause the processor to carry out a method of distributing, among the plurality of nodes, shares of a private key of a public-private key cryptography system, wherein each said node has a respective first secret, a respective first polynomial function with that node's respective first secret set as its constant term, and a respective first share of a private key, wherein the private key is the sum of the first secrets and is the constant term of a second polynomial function, wherein the private key is accessible by means of polynomial interpolation of at least a threshold number of said first shares and is inaccessible to less than said threshold number of said first shares, the nodes including a first node, the method performed by the first node comprising:
- selecting a respective third polynomial function having zero set as the respective constant term of said third polynomial function;
- for each other node of the plurality of nodes, setting a variable in the third polynomial function to a value associated with that other node, determining a respective result of the third polynomial function for that value, and securely communicating the respective result to that other node;
- receiving, from each other node, a respective share of a respective second secret, wherein said share is a result of that other node's respective third polynomial function for a first value associated with said first node;
- and
- forming and storing a respective second share of the private key, wherein said second share is the sum of the respective first share and the sum of the received shares of the second secrets.
Dependencies are inferred from the claim text.