[Cfrg] FROST — Flexible Round-Optimized Schnorr Threshold signatures

[Tony Arcieri <[e-mail]>]

With the recent discussions around threshold Ed25519 multisignatures, I
thought this would be of interest to the group.

The batched non-interactive preprocessing stage sounds particularly
interesting for use cases like code signing.

https://crysp.uwaterloo.ca/software/frost/

Unlike signatures in a single-party setting, threshold signatures require
> cooperation among a threshold number of signers each holding a share of a
> common private key. Consequently, generating signatures in a threshold
> setting imposes overhead due to network rounds among signers, proving
> costly when secret shares are stored on network-limited devices or when
> coordination occurs over unreliable networks. In this work, we present
> FROST, a Flexible Round-Optimized Schnorr Threshold signature scheme that
> improves upon the state of the art to reduce network overhead during
> signing operations. We present two variants of signing operations in FROST,
> the first requiring participants to send and receive two messages in total,
> and an optimized single-round variant with a batched non-interactive
> pre-processing stage. FROST achieves its efficiency improvements by
> allowing the protocol to abort in the presence of a misbehaving party (who
> is then identified and excluded from future operations)—a reasonable model
> for practical deployment scenarios. We present two use cases of threshold
> signatures demonstrating the practicality of this tradeoff to real-world
> implementations, and prove FROST is as secure as Schnorr's signature scheme
> in a single-party setting.


-- 
Tony Arcieri