[Cfrg] New versions of ECDH Threshold modes

[Phillip Hallam-Baker <[e-mail]>]

All,

Two updated drafts describing threshold modes for the CFRG ECDH curves have
been submitted. These are on the agenda for Vancouver with a proposal to
adopt as working group items:

https://www.ietf.org/id/draft-hallambaker-threshold-02.html
https://www.ietf.org/id/draft-hallambaker-threshold-sigs-02.html

Note that since the documents were written to the HTML format it is VERY
STRONGLY recommended you read these. They make use of math superscripts
etc.

I have been in contact with the authors of FROST at Waterloo but we have
not been able to merge our proposals yet. But we expect to be able to do
this if the work item is adopted.

The main change from previous versions of the draft are to reorganize the
material so that the Shamir Secret Sharing modes are described in the base
document to allow their use for n>t decryption as well as for signature.
The VSS scheme from FROST should go there as well.

One major change to the signature scheme is that it allows 'stateless'
generation of the final threshold share. This addresses what was the major
concern for me in the earlier schemes which was that the requirement to
keep track of the values r_i/R_i to avoid reuse was inevitably a drain on
resources. The new approach does not solve the general problem but does
address the concern of implementation at signature services, HSMs and the
like.

The only drawback to the new approach is that the party performing final
signature generation step has to derive the value k. Which means that it
has to support the specific signature scheme used. This is not a major
concern for traditional HSMs which are only rated for specific algorithms
anyway. It could be a concern for on CPU crypto co-processors.

PHB