Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes:

  1. $(t,n)$-threshold signature with a trusted dealer, i.e. the dealer generates a public/private key pair, broadcasts the public key, and distributes shares of the private key to n parties such that any subset of t parties can generate signed messages. The verifier possesses the dealer's public key and signed messages are verified the usual way with the dealer's public key.

  2. Certificate authority method: A trusted dealer generates a public/private key pair for itself (call it a CA), broadcasts the public key, and for each of n parties, generates a key pair $P_i,S_i$, signs the public key $P_i$ with the dealer's private key, and distributes the signed key pair to that party. Each message $M$ can be signed by a subset of the parties (i.e. each party can sign $M$ with their private key $S_i$ and also attach $P_i$ and the dealer's signature of $P_i$) The verifier possesses only the dealer's public key, and can verify signed messages by checking that $M$ is signed by $t$ distinct keys, and that each of those keys is signed by the dealer.

Right now I'm mostly confused when one would use scheme 1 (threshold cryptography) when scheme 2 seems more practical. I like the theoretical elegance of scheme 1, but it seems difficult to justify.

Possible advantages of scheme 1 that I can think of:

  • Slightly smaller final signatures and slightly simpler verification
  • The verifier can be ignorant of $t$ (or $t$ can be hidden) or even that more than one party signed
  • $t$ parties can usually recover the dealer's secret key if needed (this could also be a disadvantage)
  • 'Forward revocation' can be done without knowledge or participation of verifier; the dealer can distribute new shares of the same private key (in case some old shares were compromised)

Possible advantages of scheme 2:

  • Fairly simple to implement with any crypto library
  • The dealer can send a key revocation list to the verifier, ensuring that all signatures from a malicious party can be removed after the fact
  • The verifier can choose $t$ (or change $t$ at any time)
  • Infeasible for all parties to recover the dealer's (CA) secret key
  • Possibly less interaction needed between parties

Of course the situation could change without a trusted dealer, as well.

  • 3
    $\begingroup$ There might be examples of type 1 that can hide who signed from the dealer. $\:$ The same 'forward revocation' would be possible for type 2 by including an "iteration number" in the certificates. $\hspace{.86 in}$ $\endgroup$
    – user991
    Apr 11, 2014 at 3:10
  • 1
    $\begingroup$ Also, for scheme 2, the verifier's information about $n$ is limited to the keys it has seen so far. $\hspace{.95 in}$ $\endgroup$
    – user991
    Apr 11, 2014 at 17:02
  • $\begingroup$ How about a $(t, n)$ verified distributed identity that produces implicit certificates? $\endgroup$
    – cypherfox
    Mar 10, 2018 at 17:06


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.