Secure Two-party Threshold ECDSA from ECDSA Assumptions

Doerner, Jack; Kondi, Yashvanth; Lee, Eysa; Shelat, Abhi

doi:10.1109/sp.2018.00036

Cited by 112 publications

(90 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A recent work [24] shows a protocol to compute an ECDSA signature using multi-party computation. However, it is not as efficient as Lindell's approach [37].…”

Section: Related Workmentioning

confidence: 99%

Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability

Malavolta

Moreno-Sanchez

Schneidewind

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

193

155

View full text Add to dashboard Cite

Tremendous growth in cryptocurrency usage is exposing the inherent scalability issues with permissionless blockchain technology. Payment-channel networks (PCNs) have emerged as the most widely deployed solution to mitigate the scalability issues, allowing the bulk of payments between two users to be carried out off-chain. Unfortunately, as reported in the literature and further demonstrated in this paper, current PCNs do not provide meaningful security and privacy guarantees [30], [40]. In this work, we study and design secure and privacypreserving PCNs. We start with a security analysis of existing PCNs, reporting a new attack that applies to all major PCNs, including the Lightning Network, and allows an attacker to steal the fees from honest intermediaries in the same payment path. We then formally define anonymous multi-hop locks (AMHLs), a novel cryptographic primitive that serves as a cornerstone for the design of secure and privacy-preserving PCNs. We present several provably secure cryptographic instantiations that make AMHLs compatible with the vast majority of cryptocurrencies. In particular, we show that (linear) homomorphic one-way functions suffice to construct AMHLs for PCNs supporting a script language (e.g., Ethereum). We also propose a construction based on ECDSA signatures that does not require scripts, thus solving a prominent open problem in the field. AMHLs constitute a generic primitive whose usefulness goes beyond multi-hop payments in a single PCN and we show how to realize atomic swaps and interoperable PCNs from this primitive. Finally, our performance evaluation on a commodity machine finds that AMHL operations can be performed in less than 100 milliseconds and require less than 500 bytes of communication overhead, even in the worst case. In fact, after acknowledging our attack, the Lightning Network developers have implemented our ECDSA-based AMHLs into their PCN. This demonstrates the practicality of our approach and its impact on the security, privacy, interoperability, and scalability of today's cryptocurrencies.

show abstract

“…A recent work [24] shows a protocol to compute an ECDSA signature using multi-party computation. However, it is not as efficient as Lindell's approach [37].…”

Section: Related Workmentioning

confidence: 99%

Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability

Malavolta

Moreno-Sanchez

Schneidewind

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

193

155

View full text Add to dashboard Cite

show abstract

“…Kondi, Lee and shelat [8] showed additional issues in the proof for UC-security in the case of corrupt receiver.…”

Section: Dierences With the Previous Versions And Related Workmentioning

confidence: 99%

“The simplest protocol for oblivious transfer” revisited

Genç¹,

Iovino²,

Rial³

2020

Information Processing Letters

View full text Add to dashboard Cite

In 2015, Chou and Orlandi presented an oblivious transfer protocol that already drew a lot of attention both from theorists and practitioners due to its extreme simplicity and high eciency. Chou and Orlandi claimed that their protocol is universally composable secure (UC-secure) in the random oracle model under dynamic corruptions. UCsecurity is a very strong security guarantee that assures that, not only the protocol in itself is secure, but can be also used safely in larger protocols. Unfortunately, in this work we point out a aw in their security proof for the case of a corrupt sender. In more detail, we dene a decisional problem and we prove that, if a correct security proof for the Chou and Orlandi's protocol is provided, then this problem can be solved correctly with overwhelming probability. Therefore, the protocol of Chou and Orlandi cannot be instantiated securely with groups for which our decisional problem cannot be solved correctly with overwhelming probability. Consequently, the protocol of Chou and Orlandi cannot be instantiated with all groups G in which the CDH problem is intractable, but only with groups in which both the CDH problem is intractable and our decisional problem can be solved with overwhelming probability. After the appearance of our work, Chou and Orlandi acknowledged the problems we pointed out in their security proof and subsequent works showed additional issues, removing the claims of UC security of their protocol.

show abstract

“…Recent work explores two-party protocols for ECDSA signing when each party holds a share of the signing key [49,84]. In contrast, in our setting the token has the entire secret key and the browser's role is to enforce that the token samples its signing randomness from the correct distribution.…”

Section: Related Workmentioning

confidence: 99%

True2F: Backdoor-Resistant Authentication Tokens

Dauterman

Corrigan-Gibbs

Mazières

et al. 2019

2019 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

We present True2F, a system for second-factor authentication that provides the benefits of conventional authentication tokens in the face of phishing and software compromise, while also providing strong protection against token faults and backdoors. To do so, we develop new lightweight two-party protocols for generating cryptographic keys and ECDSA signatures, and we implement new privacy defenses to prevent cross-origin tokenfingerprinting attacks. To facilitate real-world deployment, our system is backwards-compatible with today's U2F-enabled web services and runs on commodity hardware tokens after a firmware modification. A True2F-protected authentication takes just 57ms to complete on the token, compared with 23ms for unprotected U2F.

show abstract

Secure Two-party Threshold ECDSA from ECDSA Assumptions

Cited by 112 publications

References 44 publications

Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability

Anonymous Multi-Hop Locks for Blockchain Scalability and Interoperability

“The simplest protocol for oblivious transfer” revisited

True2F: Backdoor-Resistant Authentication Tokens

Contact Info

Product

Resources

About