Dynamic-FROST: Schnorr threshold signatures with a flexible committee

A digital signature is one of the most widely used cryptographic primitives in asymmetry cryptography. According to the security requirements in different symmetry or asymmetry network models, various digital signatures have been developed in the literature. To protect the right of the signer, Chaum and Antrepen first introduced the concept of an undeniable signature, where interactive protocols are needed for the verification process. Besides, a signer can, also, perform a disavowal protocol to prove that they did not sign the message. On the other hand, threshold cryptography is, usually, used to protect the system from a single point of failure. In a (t,n)-threshold signature scheme, as long as t people in the group of n people participate, the signature can be smoothly signed. By combining these two features, an undeniable threshold signature enjoys the advantages from both sides. After our survey, we found that the existing undeniable threshold signature schemes are either insecure or apply impractical assumptions. Thus, in this manuscript, we aim at designing a novel and provably secure undeniable threshold signature scheme. The proposed scheme is formally proven to be unforgeable and invisible. Besides, our scheme supports cheater identification, which allows one to find the cheater, when a signing protocol fails. Moreover, the proposed scheme can be performed without the help of trusted third parties or secure cryptographic modules, which would be more practical when our scheme is deployed in real-world applications.

Blockchain-based mobile edge computing (BMEC) solves the problem of limited computing resources of devices in the Internet of Things (IoT). However, there are some security threats in the blockchain environment, among which the attacks against consensus algorithms are particularly serious, such as double-spending attacks and long-range attacks. These attacks target the block proposal or validation process, which compromise the integrity of the BMEC by overwriting the correct block record with the wrong block record. In this article,we propose a scheme to solve the above problem by using the cooperative threshold signature and group management scheme to protect the block validity. The blockchain process of a single node is controlled in a group cooperative way, and each new block is regarded as a valid block only if it has a valid threshold signature for the group to which it belongs. Concretely, the system is initialized by a cooperative distributed key generation protocol, the device management protocol uses a resident node to ensure the security and efficiency of device join and leave, and the signature issuing protocol can tolerate a certain degree of exceptions of nodes within the group. We analyze the resistance ability of the scheme against consensus attacks, prove the security of the scheme, and analyze the computing and communication efficiency. Experimental evaluations on the protocols of the proposed scheme have been conducted on cloud virtual machines and embedded boards, including Raspberry Pi and UP2 Grove, which indicated that the scheme is efficient in practical scenarios.

Certificateless threshold signature scheme from bilinear maps

A t-out-of-l threshold signature scheme allows l members of a group to own shares of a private key such that any t of them can create a signature, while fewer than t cannot. Most of these schemes require a single trusted party to create the secret key and calculate the l shares. Harn [10] and Li, Hwang, and Lee [13] have devised threshold schemes based on the difficulty of solving the discrete logarithm problem which do not require such a trusted party. This paper extends that property to 2-out-of-l threshold signatures based on the Digital Signature Standard and describes two possible generalizations to a t-out-of-l scheme.KeywordsSignature SchemeSecret SharingSecret Share SchemeThreshold SchemeDiscrete Logarithm ProblemThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Threshold signature schemes are examples of threshold cryptosystems, as introduced by Desmedt, [4]. The purpose of this paper is to present a rather simple alternative to threshold signatures which raises questions about the value of such schemes, at least when applied to the mobile agent scenario.

The threshold signature scheme is a protocol that allows any subset of t parties out of n to generate a signature. Since the t members can cooperate together to compute the secret key, we introduce the server-aided threshold signature, which provides controllability for activating the signing function in a certain enhanced way. In this study, we present a server-aided threshold RSA signature protocol against the adaptive attacks. We give the universally composable secure model for the server-aided threshold signature primitive and prove that the proposed protocol is claimed to be well-formed, correct and unforgeability. As a separate contribution we also prove that it is also secure in the adaptive universal composability framework. After the discussion about the security and the performance, we claim that the protocol is practical and efficient.

DistriTrust: Distributed and low-latency access validation in zero-trust architecture

The paper presents group-oriented (t,n) threshold digital signature schemes based on the difficulty of solving the discrete logarithm problem. By employing these schemes, any t out of n users in a group can represent this group to sign the group signature. The size of the group signature and the verification time of the group signature are equivalent to that of an individual digital signature. In other words, the (t, n) threshold signature scheme has the following five properties: (i) any group signature is mutually generated by at least t group members; (ii) the size of the group signature is equivalent to the size of an individual signature; (iii) the signature verification process is simplified because there is only one group public key required; (iv) the group signature can be verified by any outsider; and (v) the group holds the responsibility to the signed message. In addition to the above properties, two of the schemes proposed do not require the assistance of a mutually trusted party. Each member selects its own secret key and the group public key is determined by all group members. Each group member signs a message separately and sends the individual signature to a designated clerk. The clerk validates each individual signature and then combines all individual signatures into a group signature. The (n, n) threshold signature scheme can be easily extended to become a digital multisignature scheme.< >

Efficient generic on-line/off-line (threshold) signatures without key exposure

Ring Confidential Transaction (RingCT) protocols are widely used in cryptocurrencies to protect user privacy. Consequently, a corresponding digital signature scheme, such as a ring signature scheme that hides the signers’ identities, is required. Accordingly, the security of a RingCT protocol depends on the confidentiality of the secret signing keys of the underlying ring signature scheme. However, existing solutions like hardware wallets, Trusted Execution Environments (TEEs), and threshold signature schemes have limitations such as specified expensive hardware, targeting attacks at CPUs on insufficiently secure hardware, and overheads caused by multiple parties. On the contrary, program obfuscation for signature schemes offers advantages over these existing approaches. Concretely, we propose a novel obfuscator that secures the secret keys of the concise linkable spontaneous anonymous group (CLSAG) signature scheme, which is the latest ring signature scheme used in Monero’s RingCT protocol. To achieve enhanced security, the proposed obfuscator leverages Paillier homomorphic encryption to transform secret keys into an obfuscated form resistant to attacks. The security of the proposed obfuscator has been formally proved. Computational efficiency has been both theoretically analyzed and experimentally evaluated with positive results on various testing platforms.

A Distributed Key Generation (DKG) protocol is an essential component of threshold cryptosystems required to initialize the cryptosystem securely and generate its private and public keys. In the case of discrete-log-based (dlog-based) threshold signature schemes (ElGamal and its derivatives), the DKG protocol is further used in the distributed signature generation phase to generate one-time signature randomizers (r = gk). In this paper we show that a widely used dlog-based DKG protocol suggested by Pedersen does not guarantee a uniformly random distribution of generated keys: we describe an efficient active attacker controlling a small number of parties which successfully biases the values of the generated keys away from uniform. We then present a new DKG protocol for the setting of dlog-based cryptosystems which we prove to satisfy the security requirements from DKG protocols and, in particular, it ensures a uniform distribution of the generated keys. The new protocol can be used as a secure replacement for the many applications of Pedersen's protocol. Motivated by the fact that the new DKG protocol incurs additional communication cost relative to Pedersen's original protocol, we investigate whether the latter can be used in specific applications which require relaxed security properties from the DKG protocol. We answer this question affirmatively by showing that Pedersen's protocol suffices for the secure implementation of certain threshold cryptosystems whose security can be reduced to the hardness of the discrete logarithm problem. In particular, we show Pedersen's DKG to be sufficient for the construction of a threshold Schnorr signature scheme. Finally, we observe an interesting trade-off between security (reductions), computation, and communication that arises when comparing Pedersen's DKG protocol with ours.

Mobile Ad Hoc Networks (MANET), due to their lack of physical infrastructures or centralized authorities, pose a number of security challenges to a protocol designer. In particular, several typical application scenarios demand the design of protocols that cannot base their security on the existence of trusted parties or setup information, but rather need to leverage uniquely on assumptions limiting the corrupting power of the adversaries. This naturally defines security design and analysis paradigms similar to those of the Threshold Cryptography area, where it is typically assumed that an adversary can corrupt up to a limited amount of entities or resources. Therefore a secure realization of primitives from Threshold Cryptography in MANET promises to be applicable to several MANET protocols.Recently, in [10], we started the analysis of Threshold Cryptography solutions over MANET, by focusing on the problem of extending to these networks known efficient threshold signature schemes for wired networks. In particular, we noted a major design difficulty due to the lack of full network connectivity that significantly constrained the network topology assumptions under which a MANET threshold signature scheme can be proved secure. In this paper we continue our investigation and present a new MANET threshold signature scheme that is secure under significantly improved topology assumptions. Surprisingly, we break through an apparent barrier due to well-known results from the Distributed Computing area.

We examine all of the signature submissions to Round-2 of the NIST PQC “competition” in the context of whether one can transform them into threshold signature schemes in a relatively straight forward manner. We conclude that all schemes, except the ones in the MQ family, have significant issues when one wishes to convert them using relatively generic MPC techniques. The lattice based schemes are hampered by requiring a mix of operations which are suited to both linear secret shared schemes (LSSS)-based and garbled circuits (GC)-based MPC techniques (thus requiring costly transfers between the two paradigms). The Picnic and SPHINCS+ algorithms are hampered by the need to compute a large number of hash function queries on secret data. Of the nine submissions the two which would appear to be most suitable for using in a threshold like manner are Rainbow and LUOV, with LUOV requiring less rounds and less data storage.

Threshold Signature Scheme with Traceability and Resisting Conspiracy Attack

The work presents an efficient identification threshold signature scheme based on the elliptic curve cryptosystem, with a view to optimizing these techniques for implementation within a network. (Any t out of n users in a group can represent this group to sign the group signature) as compared with the existing threshold signature scheme based on the public key system of RSA and ELGmal, our scheme need less parameters but can provide more efficient and super security. Moreover it is constructed on the two base points but other threshold signature scheme constructed on the only one point. The distinguishing feature of the proposed scheme is that the threshold value denotes the minimum number of members required to produce a valid group signature. All message recipients then can verify the signature.