Practical Threshold Signatures

Practical Threshold Signatures

2000 | Victor Shoup
This paper presents a new threshold RSA signature scheme with three key properties: unforgeability and robustness in the random oracle model under the RSA assumption, non-interactive signature share generation and verification, and a signature share size bounded by a constant times the RSA modulus size. The scheme is based on a "hash and invert" RSA signature, with restrictions on the public exponent and modulus. The scheme is simple and has not been previously proposed or analyzed. The paper introduces a dual-parameter threshold signature scheme, where there are two thresholds: one for the maximum number of corrupt players (t) and another for the minimum number of authorized players (k). This allows for stronger security guarantees than single-parameter schemes. The scheme is robust, meaning that corrupted players cannot prevent uncorrupted players from generating signatures. The paper describes two protocols: Protocol 1 for the case k = t + 1, and Protocol 2 for the more general case k ≥ t + 1. Protocol 1 is proven secure in the random oracle model under the RSA assumption. Protocol 2 is proven secure under the RSA and Decision Diffie-Hellman assumptions. The paper also discusses previous work on threshold signatures, highlighting the challenges of achieving non-interactive signature share generation and verification. It notes that all previous schemes either lacked rigorous security proofs, required interactive protocols, or had signature share sizes that grew linearly with the number of players. The paper concludes by discussing the practical implications of the new threshold RSA signature scheme, particularly in the context of asynchronous Byzantine agreement protocols. The scheme is efficient and simple, making it a promising alternative to previous threshold signature schemes.This paper presents a new threshold RSA signature scheme with three key properties: unforgeability and robustness in the random oracle model under the RSA assumption, non-interactive signature share generation and verification, and a signature share size bounded by a constant times the RSA modulus size. The scheme is based on a "hash and invert" RSA signature, with restrictions on the public exponent and modulus. The scheme is simple and has not been previously proposed or analyzed. The paper introduces a dual-parameter threshold signature scheme, where there are two thresholds: one for the maximum number of corrupt players (t) and another for the minimum number of authorized players (k). This allows for stronger security guarantees than single-parameter schemes. The scheme is robust, meaning that corrupted players cannot prevent uncorrupted players from generating signatures. The paper describes two protocols: Protocol 1 for the case k = t + 1, and Protocol 2 for the more general case k ≥ t + 1. Protocol 1 is proven secure in the random oracle model under the RSA assumption. Protocol 2 is proven secure under the RSA and Decision Diffie-Hellman assumptions. The paper also discusses previous work on threshold signatures, highlighting the challenges of achieving non-interactive signature share generation and verification. It notes that all previous schemes either lacked rigorous security proofs, required interactive protocols, or had signature share sizes that grew linearly with the number of players. The paper concludes by discussing the practical implications of the new threshold RSA signature scheme, particularly in the context of asynchronous Byzantine agreement protocols. The scheme is efficient and simple, making it a promising alternative to previous threshold signature schemes.
Reach us at info@futurestudyspace.com
[slides and audio] Practical Threshold Signatures