I am looking for references for the following problem:

Consider we have a DSA with the keypair $(sk, pk)$ and a message $m$, such that its signature is $s = sig(m,sk)$ and the verification result is $v=ver(s,pk) $.

Now, I would like to have a threshold DSA with 2 players (for simplicity) with keypairs $(sk_1, pk_1)$ and $(sk_2, pk_2)$ such that their signature $s_t=sig_t(m,sk_1, sk_2)$ is equivalent to the original $s$ in the sense that $v \equiv v_t = ver_t(s_t,pk_1,pk_2) \equiv ver(s_t,pk) $.

Simply speaking, I would like to sign with a threshold signature but verify with one master key.

  1. Have there be any work in this direction?
  2. What keywords and topics should I be looking for?
  • $\begingroup$ Does it have to be DSA (the Digital Signature Algorithm, which is a speciifc signature algorithm based on a multiplicative group)? That particular signature algorithm isn't particularly threshold friendly, but there are others (e.g. EdDSA) which are... $\endgroup$ – poncho Feb 18 at 13:58
  • $\begingroup$ @poncho At the moment I'm more interested in the existence (or the possibility) of such algorithms. For practical uses, it would be ECDSA used in Bitcoin and whatever is used in other popular blockchains. $\endgroup$ – user87152 Feb 18 at 14:02
  • $\begingroup$ Yes, ECDSA isn't particularly easy to run as a threshold signature (which is the term for what you're looking for), but it can be done - a quick google finds eprint.iacr.org/2019/523.pdf $\endgroup$ – poncho Feb 18 at 14:05
  • $\begingroup$ Thanks! The thing is, I would like to have not a simple threshold signature (with keys generated during sharing), but a signature that can be verified by one key that existed before the sharing. Loosely speaking, I want to have two equivalent in term of results signatures: common one threshold. $\endgroup$ – user87152 Feb 18 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.