US 11,671,255 B2
Threshold digital signature method and system
Stephane Savanah, London (GB); and Craig Steven Wright, London (GB)
Assigned to nChain Licensing AG, Zug (CH)
Appl. No. 16/639,096
Filed by nChain Licensing AG, Zug (CH)
PCT Filed Jul. 26, 2018, PCT No. PCT/IB2018/055604
§ 371(c)(1), (2) Date Feb. 13, 2020,
PCT Pub. No. WO2019/034951, PCT Pub. Date Feb. 21, 2019.
Claims priority of application No. 1713064 (GB), filed on Aug. 15, 2017; application No. PCT/IB2017/054961 (WO), filed on Aug. 15, 2017; and application No. PCT/IB2017/057782 (WO), filed on Dec. 11, 2017.
Prior Publication US 2020/0213113 A1, Jul. 2, 2020
Int. Cl. H04L 29/06 (2006.01); H04L 9/30 (2006.01); H04L 9/06 (2006.01); H04L 9/08 (2006.01); H04L 9/00 (2022.01)
CPC H04L 9/3066 (2013.01) [H04L 9/0637 (2013.01); H04L 9/0643 (2013.01); H04L 9/085 (2013.01); H04L 9/304 (2013.01); H04L 9/50 (2022.05); H04L 2209/56 (2013.01)] 37 Claims
OG exemplary drawing
 
1. A method of digitally signing a digital message by means of a private key of a public-private key pair of a cryptography system, to provide a digital signature that can be verified by means of a public key of the public-private key pair, the method comprising:
receiving at least a first threshold number of partial signatures of said digital message, wherein each said partial signature includes a respective first part based on the message and a respective second part based on a respective share of the private key, wherein the private key is accessible to a second threshold number of shares of the private key and is inaccessible to less than said second threshold number of shares, wherein each said partial signature corresponds to a respective value of a first polynomial function such that the first polynomial function is accessible to said first threshold number of partial signatures and is inaccessible to less than said first threshold number of partial signatures; and
determining said first polynomial function, by means of determining coefficients of the first polynomial function from a plurality of known values of said partial signatures, to effect the digital signature of the message;
wherein the step of determining said first polynomial function comprises:
defining an error locator polynomial function and a second polynomial function, wherein the second polynomial function is a product of said first polynomial function and said error locator polynomial function, determining coefficients of said second polynomial function and said error locator polynomial function from a plurality of known values of said partial signatures, and determining said first polynomial function from said second polynomial function and said error detector polynomial function, to effect the digital signature of the message.