Re: [Cfrg] Threshold signatures

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Jan 3, 2020 at 12:08 PM Dan Wing <[e-mail]> wrote:

> Also, if just need signatures, why not do 3 normal signatures where each
> signature says "to be valid, there need to be 2 other valid signatures".
> Or are you trying to enforce correctness via crypto (so that if only one
> signature, it can't be valid)?  If so, that is admirable, but unless
> something critical is encrypted, not achievable.
>
> -d
>

That is a perfectly valid approach in my view. The cost of three signatures
over two is that the verifier has to check three signatures and three
signature key validation chains. It also means that the verifier knows the
structure of who signed.

So let us consider the case where BigCorp decides Alice, Bob or Mallet can
sign code releases. Today, they all get the same private key, no separation
of duties, no accountability if the key is lost.

Introducing a simple two way split between a cloud service and tokens
separately issued to Alice, Bob, Mallet means that we now have the
potential for accountability if Mallet sells his key on hacker-bay, we can
prevent it being used to sign more stuff after we find out.

Introducing shamir secret sharing (n,t) scheme would allow us to require
two of the engineers to sign.


Back in the days when I was doing XML Web Services, we discovered that a
compressed encoding was an absolute and inescapable requirement for
deployment. The problem was that message size was really easy for a
journalist with an shoe size level IQ to measure and print a snotty
irrelevant report. So we wrote a stupid compression scheme and journalists
stopped commenting on the message sizes (10K vs 5K) and nobody ever used
it. But we couldn't have got people using SAML etc. without that.

So it might well be that multi-signatures turn out to be perfectly adequate
for everyone's needs. But we probably still need Edwards curve threshold
sigs to get people to agree that is the case.