Threshold ECDSA with an Offline Recovery Party

Abstract

A (t, n)− threshold signature scheme enables distributed signing among n players such that any subgroup of size t can sign, whereas any group with fewer players cannot. Our goal is to produce signatures that are compatible with an existing centralized signature scheme: the key generation and signature algorithm are replaced by a communication protocol between the parties, but the verification algorithm remains identical to that of a signature issued using the centralized algorithm. Starting from the threshold schemes for the ECDSA signature due to R. Gennaro and S. Goldfeder [16], we present the first protocol that supports multiparty signatures with an offline participant during the Key Generation Phase, without relying on a trusted third party. Following well-established approaches, we prove our scheme secure against adaptive malicious adversaries.

A Provably-Unforgeable Threshold EdDSA with an Offline Recovery Party

“…The approach we have taken is very similar to the one presented in [2] and [18], although there are some key differences between the works. First of all our main idea is to have two active participants to simulate the action of the third one.…”

“…Here F can fully predict what A will output and then it can choose its shards in order to match the signature it received from its oracle. Comparing to the proofs of ECDSA threshold protocols in [18,3] we do not need to make a distinction between semi-correct and non-semi-correct executions, since we can always provide a perfect simulation that ends with the desired result (except with negligible probability).…”

“…Usually threshold schemes translate in the multi-party setting a well-established signature scheme, while producing signatures that are compatible with this centralized version. Then their security is proved with a reduction to the standard centralized scheme, like the proof presented in [2] and [19]. The key-generation and signature algorithms are replaced by a communication protocol between the parties, while the compatibility is achieved by keeping the verification algorithm of the centralized algorithm.…”

“…To let existing wallets enjoy the advantages of threshold multi-signature schemes, these signatures should be fully-compatible with (and possibly indistinguishable from) standard ones. Following this approach, in [2] the authors propose an ECDSA-compatible (2, 3)-threshold multi-signature protocol in which the recovery party is involved only once (in a preliminary set-up), and afterwards it is not involved until a lost account must be recovered. More precisely, two parties collaborate in the creation of their own private keys and of some additional data to be eventually sent to the third non-active player.…”

“…In this paper we propose an EdDSA-compatible variant of [2] where again the key-generation algorithm of the protocol does not require the active involvement of all three players. While EdDSA offers better performance than ECDSA, the latter is at first glance better suited for a multiparty environment: the presence of hash computations in EdDSA is indeed not readily-compatible with an MPC setting.…”