Cloud-edge-end based key management for decentralized applications

How to securely manage and use private keys of digital signature schemes is a pivotal problem for blockchain-based decentralized applications (DApps), as they determine the ownership of data contents and digital assets. A well-recognized approach for key management is threshold cryptography which distributes private keys to different nodes such that the whole system can tolerate a certain number of failures or corruptions. Motivated by the key management need of DApps, threshold signature has attracted widespread attention, with a number of new constructions being proposed in recent years. However, a practical one for DApps' end users is still lacking, as existing schemes are hard to deploy due to the high cost of communication and distributed features. In this paper, we combine $$ (2, 3) $$ -threshold signature with the widely deployed cloud-edge-end (CEE) paradigm. We first propose the CEE key management framework which involves an end node, an edge node and a cloud node maintaining $$ (2, 3) $$ shares of end users' private keys. Then, following the framework, we construct a $$ (2, 3) $$ -threshold elliptic curve digital signature algorithm (ECDSA) scheme with provable security based on the ECDSA assumption. Compared with representative constructions of generalized threshold ECDSA, the new scheme is easy to deploy in applications developed following the CEE framework. Additionally, it addresses share tampering and requires only three messages for distributively issuing a signature, which is lower than the best practice of $$ (2, 2) $$ -threshold ECDSA (four messages) that cannot tolerate tampering.