This paper presents a simple three-round multiparty Schnorr signing protocol that is secure for any number of corrupted parties, even in the setting of a dishonest majority. The protocol is fully simulatable, secure under concurrent composition, and proven secure in the standard model or random-oracle model. It realizes an ideal Schnorr signing functionality with perfect security in the ideal commitment and zero-knowledge hybrid model, requiring only the assumptions needed to realize these functionalities.
The protocol is designed to be practical and efficient, with a communication pattern that is easy to implement. It does not assume that all parties start with the message to be signed, the identities of the participating parties, or a unique common session identifier. Instead, these parameters are agreed upon by the parties as the protocol progresses.
The paper also discusses the advantages of full simulation over game-based approaches, including reduced assumptions, tight security, and concurrent composition. It addresses the efficiency and optimizations of the protocol, emphasizing that in many cases, the security of Schnorr signatures is more important than performance.
The security of the protocol is proven in the standard real/ideal paradigm for MPC, with a hybrid model that includes an ideal zero-knowledge and commitment functionality. The simulator does not rewind the adversary, achieving perfect simulation. The protocol is also shown to be UC-secure, meaning it remains secure under concurrent composition with arbitrary protocols.
The paper concludes with a discussion on related work, noting that while there have been many threshold signature schemes, most do not achieve full simulation or concurrent composition. The protocol in this paper fills this gap and provides a robust and secure solution for multiparty Schnorr signing.This paper presents a simple three-round multiparty Schnorr signing protocol that is secure for any number of corrupted parties, even in the setting of a dishonest majority. The protocol is fully simulatable, secure under concurrent composition, and proven secure in the standard model or random-oracle model. It realizes an ideal Schnorr signing functionality with perfect security in the ideal commitment and zero-knowledge hybrid model, requiring only the assumptions needed to realize these functionalities.
The protocol is designed to be practical and efficient, with a communication pattern that is easy to implement. It does not assume that all parties start with the message to be signed, the identities of the participating parties, or a unique common session identifier. Instead, these parameters are agreed upon by the parties as the protocol progresses.
The paper also discusses the advantages of full simulation over game-based approaches, including reduced assumptions, tight security, and concurrent composition. It addresses the efficiency and optimizations of the protocol, emphasizing that in many cases, the security of Schnorr signatures is more important than performance.
The security of the protocol is proven in the standard real/ideal paradigm for MPC, with a hybrid model that includes an ideal zero-knowledge and commitment functionality. The simulator does not rewind the adversary, achieving perfect simulation. The protocol is also shown to be UC-secure, meaning it remains secure under concurrent composition with arbitrary protocols.
The paper concludes with a discussion on related work, noting that while there have been many threshold signature schemes, most do not achieve full simulation or concurrent composition. The protocol in this paper fills this gap and provides a robust and secure solution for multiparty Schnorr signing.