0
$\begingroup$

Normally, when computing an EC threshold DKG, I have all parties reveal a commitment to the public key, and only reveal their own public key after verifying the commitments. Otherwise it's trivial to produce a public key that gives one member control. In a 2 party, for example, one can just wait for the other's public key, compute the inverse, and then publish that.

But can you make it noninteractive by publishing a proof of secret key? IE: Alice publishes her public key and a signature of the public key with her private key. Then Bob sees it and does the same.

Is there any way Bob can select a key that gives him control over the sum of those two keys? I can't see how. Seems like the commitment step can be avoided with a simple proof of secret key.

Then all Alice has to do is refuse to accept Bob's fraction of the key unless the proof works.

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ DKG stands for Distributed Key Generation. $\endgroup$
    – fgrieu ♦
    Commented Jun 2, 2023 at 12:52
  • $\begingroup$ The only weakness i see is that bob can begin searching for weak public keys. But it's DLP-hard for him to forge a signature for weak keys he finds. There is a form of birthday attack i think, since he can vary both the signature and the public key, looking for intersections. But it's not any better than the typical attacks that render 256-bit EC keys as 128-bit strength. $\endgroup$
    – Erik Aronesty
    Commented Jun 2, 2023 at 14:08

1 Answer 1

Reset to default
1
$\begingroup$

Yes publishing a proof of exponent knowledge works.

If you want to do this with no setup whatsoever, use "Simple Schnorr Multi-Signatures with Applications to Bitcoin". They mention the option of publishing proofs but present an alternate scheme that prevents rogue key attacks by multiplying each key by a pseudorandom value generated from the hash of all input keys.

They also deal with another attack during the signing protocol. It's a good protocol to implement.

Improve this answer
$\endgroup$
8
  • $\begingroup$ unfortunately that doesn't work with threshold setups or redistribution, both of which i need $\endgroup$
    – Erik Aronesty
    Commented Jun 16, 2023 at 16:37
  • $\begingroup$ That would have been important to mention in the question. "Extensible Decentralized Secret Sharing and Application to Schnorr Signatures" is about the most general threshold EC signature system I know of. Unfortunately it's interactive. Threshold and noninteractive and distributed? Not sure that's been done yet. Threshold DKG usually involves evaluating polynomials on secret values which requires parties be online. $\endgroup$
    – Richard Thiessen
    Commented Jun 17, 2023 at 0:54
  • 1
    $\begingroup$ I strongly suspect that what you want is impossible(one party takes as input a set of keys (K1,K2,...Kn) and produces a threshold signature public key point K_th). Non-interactive multi signature keys can be generated by multiplying each signer's key by a public scalar. That's all that can be done non-interactively and you can't build a threshold public key from that. I'm pretty sure even in the (n,(n+1)) threshold case where one key holder is generating the threshold key it's still impossible. $\endgroup$
    – Richard Thiessen
    Commented Jun 17, 2023 at 1:06
  • $\begingroup$ non-interactivity was never a requirement for signing. it's ok to get a round of g*k commitments from the signers (k is their blinding factor). then a threshold schnorr sig is easy, you just apply the polynomial and get a consensus blinding factor, and use the same on on the partial-signatures you get. as far as the consensus public key, i just need the pubkeys of t signers, i can choose whatever polynomial i want after receiving the public keys. they don't need to know how they're being combined. $\endgroup$
    – Erik Aronesty
    Commented Jun 19, 2023 at 15:13
  • $\begingroup$ actually that article seems very strange to me. the level of interactivity is unnecessary and the weakness of "r" parties being able to recover the key is bizarre. not sure what the goals are but i would never use that $\endgroup$
    – Erik Aronesty
    Commented Jun 19, 2023 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.