Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes:
$(t,n)$-threshold signature with a trusted dealer, i.e. the dealer generates a public/private key pair, broadcasts the public key, and distributes shares of the private key to n parties such that any subset of t parties can generate signed messages. The verifier possesses the dealer's public key and signed messages are verified the usual way with the dealer's public key.
Certificate authority method: A trusted dealer generates a public/private key pair for itself (call it a CA), broadcasts the public key, and for each of n parties, generates a key pair $P_i,S_i$, signs the public key $P_i$ with the dealer's private key, and distributes the signed key pair to that party. Each message $M$ can be signed by a subset of the parties (i.e. each party can sign $M$ with their private key $S_i$ and also attach $P_i$ and the dealer's signature of $P_i$) The verifier possesses only the dealer's public key, and can verify signed messages by checking that $M$ is signed by $t$ distinct keys, and that each of those keys is signed by the dealer.
Right now I'm mostly confused when one would use scheme 1 (threshold cryptography) when scheme 2 seems more practical. I like the theoretical elegance of scheme 1, but it seems difficult to justify.
Possible advantages of scheme 1 that I can think of:
- Slightly smaller final signatures and slightly simpler verification
- The verifier can be ignorant of $t$ (or $t$ can be hidden) or even that more than one party signed
- $t$ parties can usually recover the dealer's secret key if needed (this could also be a disadvantage)
- 'Forward revocation' can be done without knowledge or participation of verifier; the dealer can distribute new shares of the same private key (in case some old shares were compromised)
Possible advantages of scheme 2:
- Fairly simple to implement with any crypto library
- The dealer can send a key revocation list to the verifier, ensuring that all signatures from a malicious party can be removed after the fact
- The verifier can choose $t$ (or change $t$ at any time)
- Infeasible for all parties to recover the dealer's (CA) secret key
- Possibly less interaction needed between parties
Of course the situation could change without a trusted dealer, as well.
