# A method for creating distributed public key for ECDSA, what are the risk factors?

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is valid is already published (but I couldn't find it):

Problem: "t" actors need to create an ECC private key and public key without a trusted dealer. Assuming some standard ECC parameters, and generator $G$.

Solution: Each actor $a_i$ creates a private key $p_i$. Final private key is $\sum_{i}{p_i}$ that will never be published.

Actors publish the public key by publishing their part $p_i.G$. Final public key can be created by $\sum_{i}{p_i.G}$

Question Is this too simple to be true? What are the risk factors here that I am not anticipating? Note that in elliptic curve fields $(a+b).P=a.P+b.P$

Please note that for simplicity we assume at the time of signing we can trust the signer and she can collect the private key parts from the actors. Hence, the question is only in regards to creating a public key without a trusted dealer.

• I believe that the point of these more complicated protocols is that we don't have a trusted signer... May 24, 2018 at 12:09

Suppose Bob watches Alice publish $$A = [a]G$$. Bob then picks $$b$$ and publishes $$B = [b]G - A$$ as his share of the public key. Now the combined public key is $$A + B = A + [b]G - A = [b]G$$, so Bob can unilaterally sign messages without Alice's consent.