3
$\begingroup$

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is valid is already published (but I couldn't find it):

Problem: "t" actors need to create an ECC private key and public key without a trusted dealer. Assuming some standard ECC parameters, and generator $G$.

Solution: Each actor $a_i$ creates a private key $p_i$. Final private key is $\sum_{i}{p_i}$ that will never be published.

Actors publish the public key by publishing their part $p_i.G$. Final public key can be created by $\sum_{i}{p_i.G}$

Question Is this too simple to be true? What are the risk factors here that I am not anticipating? Note that in elliptic curve fields $(a+b).P=a.P+b.P$

Please note that for simplicity we assume at the time of signing we can trust the signer and she can collect the private key parts from the actors. Hence, the question is only in regards to creating a public key without a trusted dealer.

$\endgroup$
  • $\begingroup$ I believe that the point of these more complicated protocols is that we don't have a trusted signer... $\endgroup$ – poncho May 24 '18 at 12:09
1
$\begingroup$

Suppose Bob watches Alice publish $A = [a]G$. Bob then picks $b$ and publishes $B = [b]G - A$ as his share of the public key. Now the combined public key is $A + B = A + [b]G - A = [b]G$, so Bob can unilaterally sign messages without Alice's consent.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.