On the Security of Two-Round Multi-Signatures

Abstract

A multi-signature scheme allows a group of signers to collaboratively sign a message, creating a single signature that convinces a verifier that every individual signer approved the message. The increased interest in technologies to decentralize trust has triggered the proposal of highly efficient two-round Schnorr-based multi-signature schemes designed to scale up to thousands of signers, namely BCJ by Bagherzandi et al. (CCS 2008), MWLD by Ma et al. (DCC 2010), CoSi by Syta et al. (S&P 2016), and MuSig by Maxwell et al. (ePrint 2018). In this work, we point out serious security issues in all currently known two-round multi-signature schemes (without pairings). First, we prove that none of the schemes can be proved secure without radically departing from currently known techniques. Namely, we show that if the one-more discrete-logarithm problem is hard, then no algebraic reduction exists that proves any of these schemes secure under the discrete-logarithm or one-more discrete-logarithm problem. We point out subtle flaws in the published security proofs of the above schemes (except CoSi, which was not proved secure) to clarify the contradiction between our result and the existing proofs. Next, we describe practical subexponential attacks on all schemes, providing further evidence to their insecurity. Being left without two-round multi-signature schemes, we present mBCJ, a variant of the BCJ scheme that we prove secure under the discrete-logarithm assumption in the random-oracle model. Our experiments show that mBCJ barely affects scalability compared to CoSi, allowing 16384 signers to collaboratively sign a message in about 2 seconds, making it a highly practical and provably secure alternative for large-scale deployments.

A Tightly Secure DDH-based Multisignature with Public-Key Aggregation

“…This can be done by using the general forking lemma [2], and it is known that the (general) forking lemma induces loose security. Due to the same reason, the security of other multisignatures [18,7,6,16] is also loose.…”

“…Maxwell, Poelstra, Seurin, and Wuille [18] proposed the first multisignature with public-key aggregation based on the discrete logarithm (DL) assumption. Following their work, several multisignatures with public-key aggregation based on the DL assumption are constructed [7,6,13]. Not only the DL-based schemes but also lattice-based multisignatures with public-key aggregation are given [16,10].…”

Two-Party Adaptor Signatures from Identification Schemes

“…Remark 3 (On security definition.). There are two different approaches for modeling signatures with aggregatable public keys in the literature, namely the plain public-key model [3] (also known as key-verification model [15]) and the knowledge-of-secret-key (KOSK) model [8]. In the plain public-key setting the adversary chooses a key pair (sk b , pk b ) and only declares the public key pk b to the challenger in the security game.…”

SklCoin: Toward a Scalable Proof-of-Stake and Collective Signature Based Consensus Protocol for Strong Consistency in Blockchain

“…Recently, it turned out that, according to [26], CoSi was not proved secure. The authors introduced mBCJ, a secure tworound multi-signature scheme.…”