# Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes:

1. $(t,n)$-threshold signature with a trusted dealer, i.e. the dealer generates a public/private key pair, broadcasts the public key, and distributes shares of the private key to n parties such that any subset of t parties can generate signed messages. The verifier possesses the dealer's public key and signed messages are verified the usual way with the dealer's public key.

2. Certificate authority method: A trusted dealer generates a public/private key pair for itself (call it a CA), broadcasts the public key, and for each of n parties, generates a key pair $P_i,S_i$, signs the public key $P_i$ with the dealer's private key, and distributes the signed key pair to that party. Each message $M$ can be signed by a subset of the parties (i.e. each party can sign $M$ with their private key $S_i$ and also attach $P_i$ and the dealer's signature of $P_i$) The verifier possesses only the dealer's public key, and can verify signed messages by checking that $M$ is signed by $t$ distinct keys, and that each of those keys is signed by the dealer.

Right now I'm mostly confused when one would use scheme 1 (threshold cryptography) when scheme 2 seems more practical. I like the theoretical elegance of scheme 1, but it seems difficult to justify.

Possible advantages of scheme 1 that I can think of:

• Slightly smaller final signatures and slightly simpler verification
• The verifier can be ignorant of $t$ (or $t$ can be hidden) or even that more than one party signed
• $t$ parties can usually recover the dealer's secret key if needed (this could also be a disadvantage)
• 'Forward revocation' can be done without knowledge or participation of verifier; the dealer can distribute new shares of the same private key (in case some old shares were compromised)

• The verifier can choose $t$ (or change $t$ at any time)
There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$ –  Ricky Demer Apr 11 at 3:10
Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$ –  Ricky Demer Apr 11 at 17:02