Dynamic-FROST: Schnorr threshold signatures with a flexible committee

2.1 Threshold signature schemes

As introduced in Section 1, a threshold signature scheme allows any subgroup of t signers out of n participants to generate a signature for a message m . Formally, a threshold signature scheme can be defined as follows.

Different threshold signature schemes have been defined so far. Shoup [9] defined one of the most used threshold signature schemes, which is based on RSA [10–13]. It requires a trusted, centralized dealer for key generation, and then uses non-interactive signature share generation and signature verification protocols.

Gennaro et al. [14] proposed a threshold DSA signature scheme, with n ≥ 2 t − 1 , where a trusted centralized dealer is adopted. The more general, threshold-optimal case is then presented in the study of Gennaro et al. [15], where they propose a dealer-less approach supporting the case n ≥ t . However, DKG is costly and impractical. Then, Gennaro and Goldfeder [16,17] presented an ECDSA-based protocol supporting efficient DKG, which obtains faster signing than Gennaro et al. [15] and requires less data to be transmitted. In a closely related work, Lindell et al. [18] proposed an efficient threshold ECDSA scheme, which employs different methods to neutralize any adversarial behavior. Differently from the study of Gennaro and Goldfeder [16], this protocol revolves around a modification of the ElGamal encryption scheme. Using an ElGamal signature scheme, Noack and Spitz [19] propose a dynamic threshold signature scheme, which does not rely on a trusted third party. It has the nice property of not changing the public key while adding or removing a certain number of nodes.

A detailed (and more extensive) review of threshold ECDSA schemes can be found in the study of Aumasson et al. [20]. Although ECDSA is fast and secure, aggregated signatures cannot be easily obtained with it.

Conversely, BLS [21] and Schnorr [22] schemes can be easily transformed into threshold schemes by supporting the sum of partial signatures with no overhead [23]. In particular, Boldyreva [24] proposed the most widely adopted approach for threshold BLS signatures. Here, the DKG does not require a trusted dealer, and the signature generation does not require participant interaction (or any zero-knowledge proof). It can only tolerate up to t − 1 < n ⁄ 2 malicious parties, but it allows us to periodically renew the secret shares.

Recently, Tomescu et al. [25] proposed a more efficient BLS signature scheme, that improves signing and verification time. Threshold BLS signature schemes rely on pairing-based cryptography [21] and can perform signing operations in a single round among participants.

Schnorr signatures received increased interest recently, and they have been included in the Bitcoin protocol^[3]. Komlo and Goldberg [1] proposed FROST, an efficient Schnorr-based threshold scheme, whereby signing can be performed in two rounds, or optimized to a single round with preprocessing. FROST is currently considered the most efficient scheme for generating Schnorr threshold signatures [26]. Ruffing et al. [3] proposed ROAST, a wrapper protocol around FROST that provides liveness guarantees in the presence of malicious nodes and asynchronous networks.

We prioritize efficiency over robustness, so we assume FROST as the starting point of our work. FROST’s efficiency comes from another valuable feature, which is the ability to perform signing operations asynchronously.

2.2 Possible solutions

To find the solution that best fits our problem, we consider many DPSS schemes, namely, PSS schemes that involve dynamic committees. For the sake of clarity, we report here the formal definition of a DPSS, as presented in the study of Hu et al. [27].

DPSS protocols can be classified into three categories, based on whether they use a synchronous, partially synchronous, or asynchronous network.

In D-FROST, we suppose to be in a synchronous setting, since FROST works synchronously during KeyGen and Preprocess. Thus, there is no need for a DPSS that operates in an asynchronous network, especially if it weakens the protocol. In particular, all asynchronous and partially synchronous DPSS schemes in the literature (e.g., Schultz’s MPSS [28], COBRA [29], Robust Asynchronous DPSS [30]) require the presence of a dealer, giving up decentralization. Moreover, they are less efficient than many synchronous techniques and have lower threshold bounds. We therefore opt for a synchronous protocol.

To the best of our knowledge, the most recent and efficient synchronous PSS schemes with dynamic committees are CHURP [8], Benhamouda et al.’s [31], and Goyal et al.’s [32]. However, the protocol by Benhamouda et al. involves a dealer and the one by Goyal et al. demands that the secret s is held by a client. Since we want the secret to be hidden from everybody, none of these schemes suits our purpose. Thus, we select CHURP as the best solution, which is a highly efficient and decentralized protocol with a large upper bound on the threshold.

As stated in Section 1, D-FROST is the first Schnorr-based threshold signature scheme that allows modifications to the committee and to the threshold, without changing the group public key.

The first scheme to achieve something similar is that in the study of Battagliola et al. [33], which enables a group of t participants to add a new node to the committee. Thus, this system only achieves one of the properties we desire.

An improvement is accomplished by the SPRINT protocol [34], which allows both to remove and add a participant. Even though this scheme tolerates dynamic committees, it does not allow threshold changes, and therefore, it is less flexible than D-FROST.

3.1 FROST

FROST [1] is a Schnorr threshold signature scheme that allows a group of t out of n nodes to sign a message m with a signature that is indistinguishable from a single-party Schnorr signature. It is a decentralized protocol, where each participant has the same power, except for the signature aggregator (SA). SA is a semi-trusted node that has the ability to report misbehaving participants and to publish the group signature at the end of the protocol. The SA role might also be assigned to an external party that has access to all public keys. In the following, we provide an overview of the protocol. For the sake of completeness, we detail FROST’s KeyGen, Preprocess( π ), and Sign(m), respectively, in Algorithms 1–3.

Protocol details. Let G be a group of prime order q , and let g be a generator of G . Let { P i } i ∈ [ n ] denote the set of participants, where [ n ] ≔ { 1 , … , n } . The protocol starts with a secret sharing scheme that distributes the secret s ∈ Z q in n secret shares s i , one for each P i , such that t shares are enough to reconstruct s and t − 1 participants cannot learn any information about s . The key generation scheme used by FROST is a modified version of Pedersen’s DKG. The idea behind this scheme is to generate a random polynomial f ( x ) ∈ Z q [ x ] such that deg f = t − 1 and f ( 0 ) = s . Each P i is given the value f ( i ) = s i , which is its secret share of s , and thus can compute its public key Y i ≔ g s i . Every time a misbehaving node is detected, FROST aborts in order to avoid rogue-key attacks [35]. To collectively reconstruct s , t nodes might perform Lagrange interpolation with their shares and obtain s = ∑ i = 1 t λ i s i , where λ i ≔ ∏ j ≠ i j j − i . However, the secret is never directly recovered by any node, as otherwise such a node could sign messages independently from the others. Instead, Lagrange interpolation is indirectly used during the signing operations. The group public key is Y ≔ g s . The polynomial f ( x ) is generated in a decentralized way, by adding polynomials f i ( x ) randomly generated by each participant, and each share s i is recovered by the correspondent participant without help from a particular node. This is an important feature of Pedersen’s DKG, as FROST values decentralization and there is no trusted dealer who knows the secret.

FROST’s KeyGen (Algorithm 1) is Pedersen’s DKG with a slight modification, which consists in a zero-knowledge proof of knowledge, computed by each participant, of their corresponding secret a i 0 ≔ f i ( 0 ) . Thanks to this change, the upper bound on the threshold t is raised from n 2 to n without losing security against rogue-key attacks. Once KeyGen is completed, the protocol proceeds with Preprocess( π ), which is a preprocessing stage reported in Algorithm 2. Here, each P i creates and publishes π pairs of commitments ( D i j , E i j ) ≔ ( g d i j , g e i j ) , where d i j and e i j are the random elements of Z q . Each pair of commitments is used for a single signature and discarded afterwards. If the committee needs to sign a new message and there are no more available commitments, the Preprocess( π ) protocol is executed again.

The last part of the protocol is the signing phase. During Sign(m), which is described in Algorithm 3, SA selects the set S of nodes that will sign the message m . This set is made of α signing nodes, where t ≤ α ≤ n . Then, SA obtains the next available commitment for each P i and creates B ≔ ⟨ ( i , D i , E i ) ⟩ i ∈ S . Once all nodes have received B , they validate m and compute ρ l ≔ H 1 ( l ‖ m ‖ B ) , l ∈ S , where H 1 is a hash function mapping to Z q * . Next, they derive the group commitment R ≔ ∏ l ∈ S D l ⋅ ( E l ) ρ l and the challenge c ≔ H 2 ( R ‖ Y ‖ m ) , where H 2 is also a hash function. Then, each P i computes z i ≔ d i + e i ⋅ ρ i + λ i ⋅ s i ⋅ c and returns it to SA. The SA verifies the validity of z i , for i ∈ S . If every response is correct, SA computes z ≔ ∑ i ∈ S z i . Finally, the signature σ ≔ ( R , z ) is published.

Note that the way R is calculated binds the message, the set of signing participants, and the pairs ( D i , E i ) i ∈ S to each signature share. This binding method prevents the adversary from changing anything or combining signature shares across disjoint signing operations, which makes the protocol resistant to the Drijvers attack.

Synchronicity assumptions. During the first two phases of the protocol (KeyGen and Preprocess( π )), FROST requires a synchronous network, while the signing phase can be performed asynchronously.

3.2 Security of FROST

The protocol is proved to be EUF-CMA secure under the Discrete Logarithm (DL) assumption in the random oracle model.

The scheme is also secure against the Drijvers attack [36] and the ROS solver [37]. In particular, this means that the protocol is secure against a concurrent adversary, i.e., an adversary that can open simultaneous signing sessions at once. As stated in Section 3.1, the protocol is resistant to rogue-key attacks too.

FROST’s proof of security uses the general forking algorithm (see Algorithm 4), which we denote by GF A , and the general forking lemma by Bellare and Neven [38]. The symbol $ indicates random sampling.

The adversary in FROST’s proof of security is supposed to be active and static with the power to corrupt up to t − 1 nodes, including SA. In particular, a static adversary decides which nodes are corrupted at the beginning of the protocol; thus, FROST does not achieve adaptive security, in which the adversary adaptively selects corrupted nodes during the execution of the protocol.

3.3 CHURP

CHURP [8] is a DPSS scheme, started by a group C = { P i } i ∈ [ n ] of nodes that ( t , n ) -share a secret s . CHURP allows C to go through a proactivization phase (handoff) in which the committee passes the secret to a new possibly disjoint group C ′ = { P i ′ } i ∈ [ n ′ ] . Table 1 summarizes the main notation used throughout this article.

Initially, the secret is shared among nodes in C via a bivariate polynomial B ( x , y ) such that B ( 0 , 0 ) = s and deg B = ⟨ t − 1 , 2 t − 2 ⟩ . Each P i holds the ( 2 t − 2 ) -degree polynomial B ( i , y ) , which we refer to as full share. Then, during the handoff, B ( x , y ) is proactivized into a new polynomial B ′ ( x , y ) such that B ′ ( 0 , 0 ) = B ( 0 , 0 ) = s . Here, we suppose that the threshold is fixed for ease of exposition. Nevertheless, in this phase, both the threshold and the number of participants can be changed, as long as t − 1 < n 2 . The reason behind this bound is that the adversary is given the power to corrupt up to t − 1 nodes from each committee, so the total number of corrupted nodes is at most 2 t − 2 ; then, the previous inequality follows from the fact that 2 t − 2 < n must hold.

To protect the secret during the handoff against 2 t − 2 possibly corrupted nodes, the threshold is raised to 2 t − 1 . This is the main reason for using a bivariate polynomial, as it allows to switch dimensions easily. Indeed, s can be distributed both with the ( t , n ) -shares s i = B ( i , 0 ) and the ( 2 t − 1 , n ) -shares s j = B ( 0 , j ) . In particular, during the handoff, the participants hold polynomial shares B ( x , j ) , which we refer to as reduced shares (since a higher threshold gives less power to a single share). These shares are used to distribute, to all the members of the new committee, the new proactivized full shares B ′ ( i , y ) , that are independent of the old ones.

This protocol is executed periodically, at the beginning of a fixed interval of time called epoch.

Invariants. To preserve integrity of the secret while transmitting it to a new committee, CHURP makes use of the Kate, Zaverucha, Goldberg (KZG) scheme [39], a polynomial commitment protocol: it allows a user to commit to a polynomial P ( x ) and to prove that P ( i ) is the result of the evaluation of P ( x ) at some index i .

After a successful handoff, the system is in a steady state, which means that the following three invariants must hold for the new committee { P i } i ∈ [ n ] and the new polynomial B ( x , y ) :

• INV-SECRET: the secret s is the same across handoffs.

• INV-STATE: each node P i holds a full share B ( i , y ) and a proof to the correctness thereof. Specifically, the full share B ( i , y ) is a ( 2 t − 2 ) -degree polynomial, and hence can be uniquely represented by 2 t − 1 points { B ( i , j ) } j ∈ [ 2 t − 1 ] .The proof is a set of witnesses { W B ( i , j ) } j ∈ [ 2 t − 1 ] .

• INV-COMM: KZG commitments to reduced shares { B ( x , j ) } j ∈ [ 2 t − 1 ] are available to all nodes.

Setup. First, the protocol selects an initial committee C ( 0 ) and each participant is given a private/public key pair, where public keys are known to all nodes in the system. Then, the generation of the secret and the setup of KZG are executed by a trusted party or a committee with at least one honest participant.

Communication model. Nodes in CHURP have two ways to communicate with each other: a blockchain available to everyone, on which nodes can publish and read messages, or peer-to-peer channels to send and receive messages. Both communication methods are supposed to be synchronous, i.e., once a message is sent, it is received within a finite period of time T . Synchronicity in peer-to-peer channels is required only for performance, not for liveness, secrecy, or integrity. This kind of communication is used only in the optimistic path, and if a message takes too long to deliver, the protocol switches to the pessimistic path, where all communications happen on-chain, as explained below.

The use of a blockchain for communication is not strictly necessary, and it could be replaced with any other kind of reliable bulletin board. However, this change would require additional work that goes beyond the scope of our work, so we employ a blockchain for broadcast communication.

Protocol details. CHURP is made of three subprotocols: Opt-CHURP, Exp-CHURP-A, and Exp-CHURP-B. The first one is the optimistic path, while the others are the pessimistic ones. When CHURP is started, Opt-CHURP is executed by default. To speed up the protocol, most communications take place off-chain. If a fault is detected, the protocol switches to Exp-CHURP-A: from this point forward, nodes communicate on-chain only. This allows participants to perform verifiable accusations and expel corrupted nodes from the committee. If a breach in the underlying assumptions of the KZG scheme is detected, the protocol switches to Exp-CHURP-B. This pessimistic path is proved to be secure under the DL assumption, but it lowers the bound on the threshold to t − 1 < n 3 . In D-FROST, we suppose all necessary assumptions hold, so we only consider the first two paths and exclude Exp-CHURP-B. Moreover, since the difference between the two paths is only in the communication model, the two protocols are largely the same, and we only explain Opt-CHURP in the next paragraph. More details on Opt-CHURP and Exp-CHURP-A are included in Sections 3.3.1 and 3.3.2, respectively.

Opt-CHURP. Even though the protocol supports changes to both the threshold and the number of nodes in the committee, in this section, we assume that the threshold is fixed and n can change. In particular, if t e is the threshold in epoch e , we set t e − 1 = t e = t . In Section 3.3.3, we explain how threshold changes are managed.

Opt-CHURP is divided into three stages. The first one is Opt-ShareReduce (Algorithm 5), which allows a set U ′ of 2 t − 1 members of the new committee C ′ = { P i ′ } i ∈ [ n ′ ] to recover the reduced shares B ( x , j ) . This is done by interpolating t verified points B ( i , j ) . To check the validity of the points, nodes use the KZG commitments and witnesses produced by members of the old committee.

The second phase of Opt-CHURP is Opt-Proactivize (Algorithm 6), during which the polynomial B ( x , y ) obtains proactivized. The idea is to add a random zero-hole polynomial Q ( x , y ) to B ( x , y ) , obtaining a new polynomial B ′ ( x , y ) such that B ′ ( 0 , 0 ) = B ( 0 , 0 ) = s , deg B ′ = ⟨ t − 1 , 2 t − 2 ⟩ and B ′ is independent from B . To create Q ( x , y ) , the algorithm generates a zero-hole polynomial P ( x ) of degree 2 t − 2 and 2 t − 1 zero-shares s j such that s j = P ( j ) . Then, each node in U ′ generates a random polynomial R j ( x ) such that R j ( 0 ) = s j . Q ( x , y ) is defined as the interpolation of { R j ( x ) } j ∈ [ 2 t − 1 ] , and therefore, Q ( x , j ) = R j ( x ) ∀ j ∈ [ 2 t − 1 ] . Since Q ( 0 , j ) = P ( j ) , it also follows that Q ( 0 , 0 ) as required. Then, U j ′ can proactivize its reduced share, by defining B ′ ( x , j ) ≔ B ( x , j ) + Q ( x , j ) . Participants prepare all necessary information to allow the others to verify validity of the updated shares. Specifically, each U j ′ computes Z j ( x ) ≔ R j ( x ) − s j and sends { g s j , C Z j , W Z j ( 0 ) , C B ′ ( x , j ) } off-chain to all members of C ′ . This way, nodes can check correctness of new shares without knowing either B ′ ( x , j ) or s j . Note that, after this step, the commitments { C B ′ ( x , j ) } j ∈ [ 2 t − 1 ] are available to all nodes in C ′ , as required by INV-COMM.