Re: [Cfrg] Schnorr multisignatures on Ed448 and Ed25519

[Taylor R Campbell <[e-mail]>]

> Date: Tue, 7 May 2019 17:45:59 -0400
> From: Phillip Hallam-Baker <[e-mail]>
> 
> Are there any academics who are interested in doing this analysis and
> producing a draft that either explains a safe means of creating an Ed448
> signature using private keys a, b such that they can be verified with key
> A+B or tells us why this is a bad idea?

In the usual naive way to do this, if Alice publishes A = a*G as her
public key, Bob can publish B - A for B = b*G as his public key and
thereby unilaterally sign messages that pass verification under the
public key A + (B - A) = B.

There's been a spate of papers in the past couple of years on
threshold signature schemes, some (all?) of which avoid this at some
cost, including CoSi, MuSig, and mBCJ.  There was an internet-draft,
draft-ford-cosi-cfrg, but it didn't seem to go anywhere.

The problem seems to be complicated, but it would be nice for the
internet to have a good standard threshold signature scheme -- ideally
without changes to verifiers -- and to get away from foolhardy
applications of secret-sharing that inherently leave some party with
unilateral signing power at some stage.