ECDSA threshold signing

Question

I searched "ECDSA threshold signing" recently and found a lot of papers where it is said that their authors solved the problem of ECDSA threshold signing efficiently: e.g. here and here. Why there are no practical implementations of those (e.g. in cryptocurrencies)?

Answer 1

I just saw this question now. There is no reference implementation of the 2-party threshold ECDSA protocol since this was joint work with Unbound Tech (previously Dyadic Security), and they did the implementation. In general, I am a strong proponent of open source, and all pure academic work that I do is published with open source code (see https://github.com/cryptobiu). However, in some cases, research is carried out in collaboration with industry, and where they do the implementation it is limited by them. I believe that this is a reasonable balance.

Note that Unbound Tech does have a commercial offering using this for protecting cryptocurrencies (but at the level of enterprises, and not individual wallets).

Answer 2

I am not a cryptocurrency wallet implementor, so I can only guess as to why they did not use these protocols for their implementations. As for why there are no reference implementations I can also guess.

First, let's start with the "easy" part: Why are there no reference implementations? Note, these are only guesses, I don't actually know.

• The authors may have implemented their protocols, but didn't want to publish the code because of the low quality.
• The authors may have implemented their protocols, but didn't want to publish because they thought, this would mean a lot of work to maintain the code.
• The authors may have guided implementations of their protocols and got measurements, but the code was actually written by a company which wants to sell the code / otherwise profit from it, making it a business decision outside the reach of the researchers to not publish the code. I suspect this is what happened to Lindell's paper's protocol (I can't comment on the other paper, because I haven't read it).
• The authors may have not implemented their protocols, because "what matters" to some academics is only the number / quality of the published papers and not whether the described things can actually be deployed.

Now let's head over to potential reasons why these protocols haven't been picked up by wallet implementors.

• The implementors may simply not have been aware of such (efficient) protocols.
• The implementors may have considered these protocols "too inefficient".
• The implementors may have considered these protocols "too complex", maybe also in relation to the "little" benefit these provide over the self-invented solutions of the inventors.
• The implementors may have not bothered to search for such schemes and may have successfully found their own solutions / work-around to the problem.
• The cryptocurrency itself has support for this built-in in some acceptable sense. I think Bitcoin has this and I know you can do this with Ethereum using their smart contracts.
• The implementors may have been scared away by the lack of useful engineering things, like readable protocol descriptions, like test vectors or like reference implementations to test against.