1
$\begingroup$

I'm currently working on a distributed threshold DSA scheme that requires to find the product of two sums via secure multi-party computation. Specifically speaking, every one of $n$ parties $P_i$ possesses a DSA key pair $(sk_i, pk_i)$, where $sk_i=d_i \in \mathbb{Z}_q$ and $pk_i = g^{d_i}$. I want to collectively generate a signature $S_{\Sigma} = k_{\Sigma}^{-1}(m+r_{\Sigma}d_{\Sigma})$, where$k_{\Sigma}=k_1+\dots k_n$, $r_{\Sigma}d_{\Sigma}=(r_1+\dots+r_n)\cdot(d_1+\dots+d_n)$. My prior question is that is there a proper paradigm to compute $r_{\Sigma}d_{\Sigma}$ without leaking information about secret keys $(d_1,\dots,d_n)$? For computing $k_{\Sigma}$, I'm using the BGW Protocol and Shamir threshold secret sharing scheme. Is it possible to compute $r_{\Sigma}d_{\Sigma}$ using BGW protocol as well?

PS: I'm new to SMPC, and English is not my first language. Sorry for the troubles. Thanks!

$\endgroup$
0
0
$\begingroup$

Yes it is, see for example this page. Note that multiplication requires $O(n^2)$ additional communication, in contrast to addition (which is free).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.