I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario:

One Base Station is transmitting signed broadcast message to all members in a communication cell. Each mobile member can verify the signature only with the key that it holds. If users exit / entry, the base station just have to use the appropriate keys to sign and everywhere intended for the communication can verify the signature again.

I was looking a lot a threshold signature schemes, but here there is always a (n,l) combination. However, I do not know if the same principle still applies when there is a (100,1) combination, i.e. there are 100 users but you only need one key to verify the message.

I appreciate any help/tip to possible protocols / algorithms.


EDIT: The requirements I got listed that only the member of the communication group should be able to verify the message. I was originally thinking of using something like a Chinese Remainder Based Group Key procedure, in which each member gets a secret key and the group key can get retrieved by each member via a broadcast message and their individual keys. But then I read about threshold cryptography and was wondering if a better approach exists here.

  • $\begingroup$ You might need to explain your use-case a bit more. In these sort of situations, generally each mobile member would have the base station's public key and use that to verify. It doesn't matter that users join/leave, the key remains the same $\endgroup$ Jan 3 at 21:09
  • $\begingroup$ The obvious solution is to have the base station use a standard (that is, no thresholding involved) signature key (e.g. RSA) and have each of the mobile members have the public key (and the key doesn't change if users exit /entry. Is there a specific reason why this obvious solution doesn't work in your scenario? Is there a requirement that someone who's not in the group not be able to validate the signatures? $\endgroup$
    – poncho
    Jan 3 at 22:02
  • $\begingroup$ Thank you for your comments! Yes, there is a requirement that only members of the group should be able to verify the message (do not ask me why). Therefore a public key update would be necessary each time the group composition changes. I updated the question and again, appreciate your knowledge! $\endgroup$
    – Tom
    Jan 3 at 22:15

1 Answer 1


In a typical MPC / threshold signature scheme, the private key is shared among the participants. A quorum of those participants can then come together to sign a message, and the power of the technique lies in the fact that no share of the private key is exposed during this process. That's the main point here, since the goal is to maintain the secrecy of the private key, and the protocol ensures that this is the case. The goal is not to preserve the secrecy of the public key since its is - public, and can be distributed to participants in its integral form for signature verification. Your post implies that a single base station is generating the signature with a private key. In this case you do not need threshold cryptography


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.