Bandwidth-Efficient Threshold EC-DSA

Abstract

Threshold Signatures allow n parties to share the power of issuing digital signatures so that any coalition of size at least t+1 can sign, whereas groups of t or less players cannot. Over the last few years many schemes addressed the question of realizing efficient threshold variants for the specific case of EC-DSA signatures. In this paper we present new solutions to the problem that aim at reducing the overall bandwidth consumption. Our main contribution is a new variant of the Gennaro and Goldfeder protocol from ACM CCS 2018 that avoids all the required range proofs, while retaining provable security against malicious adversaries in the dishonest majority setting. Our experiments show that-for all levels of security-our signing protocol reduces the bandwidth consumption of best previously known secure protocols for factors varying between 4.4 and 9, while key generation is consistently two times less expensive. Furthermore compared to these same protocols, our signature generation is faster for 192-bits of security and beyond.

Improving security for users of decentralized exchanges through multiparty computation

“…Castagnos et al [21] build upon Gennaro and Goldfeder's t-of-n threshold signature scheme [18], improving computational and bandwidth efficiency. The number of communication rounds required for generating signatures is reduced from 9 to 8, which leaves the scheme still impractical for our use.…”

Efficient CCA Timed Commitments in Class Groups

“…In this variant we replace the complex NIZK proof by a sigma protocol that prove the well-formedness of the time-lock puzzle 𝑍 for which we assume straight-line extractability. More precisely, to prove that (𝑍 1 , 𝑍 2 ) = (𝐺 𝑟 ,𝜓 𝑞 (𝐻 𝑟 ) • 𝐹 𝑚 ) relatively to 𝐺 and 𝐻 for some 𝑟 and 𝑚, we can straightforwardly adapt the proof from [29] that a CL ciphertext is well formed to our fast variant, which allows a direct extraction of the message 𝑚. This reduce the size of the crs as we do not need to define G. Moreover, the size of 𝑐 shrinks a lot as we do not need to re-encrypt bit by bit the randomness 𝑟 .…”

“…We recall the 2 𝜆 -low order assumption for class groups. Definition B.5 (𝛾-Low order assumption [30]). We say that the 𝛾-low order assumption holds for the class group generation CGGen for a given 𝛾 if there exists a negligible function negl, such that for all 𝜆 ∈ N, all PPT adversaries A the following holds:…”

“…We remark that many of these proofs are already well known in the literature (e.g. some proofs for the CL encryption scheme can be found in [28,30]) and we present them here only for completeness. Theorem E.2 (Zero-knowledge).…”

Blind Functional Encryption

“…As in [14], the solution is to use repeated GPS proofs [21] with binary challenges to get special soundness. More efficient techniques have been recently proposed in [15]. For the proofs that concern the group G coming from the IPFE setup, a standard Schnorr proof is sufficient.…”