I want a threshold signature t out of n algorithm where set of t signers are not known before hand and want to remain anonymous after signing. How is recombination possible if id of signer is not revealed (i.e. lagrange interpolation will be a problem) ?

  • $\begingroup$ This paper may be interesting to you, even though it only appears to work with $t=n$ (also because it contains a load of pointers to previous literature and terminology, hopefully enough for you to find what you need with a little bit of search). $\endgroup$ – SEJPM May 23 '18 at 19:39
  • $\begingroup$ But still it will require the combiner to know the id of signer for computing lagrange co-efficient if I want a t out of n signature. For n signature this works fine but for t<n, we need a polynomial of deg t-1 @SEJPM. Correct me if I am wrong. $\endgroup$ – Subhra Mazumdar May 24 '18 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.