Aggregatable Distributed Key Generation

Abstract

In this paper, we introduce a distributed key generation (DKG) protocol with aggregatable and publicly-verifiable transcripts. Compared with prior publicly-verifiable approaches, our DKG reduces the size of the final transcript and the time to verify it from O(n 2 ) to O(n log n), where n denotes the number of parties. As compared with prior non-publicly-verifiable approaches, our DKG leverages gossip rather than all-to-all communication to reduce verification and communication complexity. We also revisit existing DKG security definitions, which are quite strong, and propose new and natural relaxations. As a result, we can prove the security of our aggregatable DKG as well as that of several existing DKGs, including the popular Pedersen variant. We show that, under these new definitions, these existing DKGs can be used to yield secure threshold variants of popular cryptosystems such as El-Gamal encryption and BLS signatures. We also prove that our DKG can be securely combined with a new efficient verifiable unpredictable function (VUF), whose security we prove in the random oracle model. Finally, we experimentally evaluate our DKG and show that the perparty overheads scale linearly and are practical. For 64 parties, it takes 71 ms to share and 359 ms to verify the overall transcript, while for 8192 parties, it takes 8 s and 42.2 s respectively. cLabs, Ethereum Foundation.

Efficient Asynchronous Byzantine Agreement without Private Setups

“…2. Cipher broadcast (Line 7-10, [16][17][18][19][20][21][22][23][24][25][26]. In this phase, the dealer broadcasts its actual input encrypted by the key shared in the earlier phase, i.e., A(0).…”

“…Given the recent elegant result of aggregatable public verifiable secret sharing (PVSS) due to Gurkan et al [22], constructing an exemplary Seeding protocol and proving its security are rather tedious, and thus we defer the proof for Lemma 1 along with the exemplary construction to Appendix C. Intuitively, it is simple to let each party send an aggregatable PVSS script carrying a random secret to the leader, so the leading party can aggregate them to produce an aggregated PVSS script committing an unpredictable nonce contributed by enough parties (e.g., 2f + 1). Then, before recovering the unpredictable secret hidden behind the aggregated PVSS script, the leader must send it to at least 2f + 1 parties to collect enough digital signatures to form a "certificate" to prove that the nonce is fixed and committed to the PVSS script.…”

“…Here we give an exemplary construction for reliable leaded seeding (Seeding) through the elegant idea of aggregatable public verifiable secret sharing (PVSS) in [22]. The general idea of [22] is to lift the beautiful Scrape PVSS scheme [16] to enable the aggregation of PVSS scripts from distinct participating parties, and along the way, it presents a way of using knowledge-of-signatures to allow each party to attach an aggregatable "tag" attesting its contribution in the aggregated PVSS script, thus ensuring that anyone can check the finally aggregated PVSS script pvss (and tag) to verify whether pvss indeed commits a polynomial collectively "generated" by more than f parties while preserving the size of communicated scripts minimal. It thus becomes immediate to follow the nice idea to construct an efficient Seeding protocol as shown in Alg.…”

“…For sake of completeness, we briefly review the cryptographic abstraction of the aggregatable PVSS scheme (with unforgeable tags attesting contributions) among n parties with a secrecy threshold t due to Gurkan et al [22]. Note that we mainly focus on abstracting the needed properties to construct and prove our Seeding protocol.…”

“…To lift PVSS scheme to enjoy aggregability, an aggregating algorithm can be added to the scheme [22], which naturally combines any two valid sharing scripts to form another one:…”