Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes:

  1. $(t,n)$-threshold signature with a trusted dealer, i.e. the dealer generates a public/private key pair, broadcasts the public key, and distributes shares of the private key to n parties such that any subset of t parties can generate signed messages. The verifier possesses the dealer's public key and signed messages are verified the usual way with the dealer's public key.

  2. Certificate authority method: A trusted dealer generates a public/private key pair for itself (call it a CA), broadcasts the public key, and for each of n parties, generates a key pair $P_i,S_i$, signs the public key $P_i$ with the dealer's private key, and distributes the signed key pair to that party. Each message $M$ can be signed by a subset of the parties (i.e. each party can sign $M$ with their private key $S_i$ and also attach $P_i$ and the dealer's signature of $P_i$) The verifier possesses only the dealer's public key, and can verify signed messages by checking that $M$ is signed by $t$ distinct keys, and that each of those keys is signed by the dealer.

Right now I'm mostly confused when one would use scheme 1 (threshold cryptography) when scheme 2 seems more practical. I like the theoretical elegance of scheme 1, but it seems difficult to justify.

Possible advantages of scheme 1 that I can think of:

  • Slightly smaller final signatures and slightly simpler verification
  • The verifier can be ignorant of $t$ (or $t$ can be hidden) or even that more than one party signed
  • $t$ parties can usually recover the dealer's secret key if needed (this could also be a disadvantage)
  • 'Forward revocation' can be done without knowledge or participation of verifier; the dealer can distribute new shares of the same private key (in case some old shares were compromised)

Possible advantages of scheme 2:

  • Fairly simple to implement with any crypto library
  • The dealer can send a key revocation list to the verifier, ensuring that all signatures from a malicious party can be removed after the fact
  • The verifier can choose $t$ (or change $t$ at any time)
  • Infeasible for all parties to recover the dealer's (CA) secret key
  • Possibly less interaction needed between parties

Of course the situation could change without a trusted dealer, as well.

share|improve this question
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$ – Ricky Demer Apr 11 '14 at 3:10
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$ – Ricky Demer Apr 11 '14 at 17:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.