Re: [Cfrg] Recommendations Regarding Deterministic Signatures

[Phillip Hallam-Baker <[e-mail]>]

Does this scheme work? It was brought up on the NIST list.

https://eprint.iacr.org/2018/068

It would require some changes to RFC8032. But if it is secure (and I have
not read it deeply enough to even start on an opinion) and we could modify
it to use the Ed448 curve it would be a win. The signatures are not
deterministic and they are not RFC8032 compliant but if we could do
something that would pass RFC8032 validation, even better.


On Fri, Dec 20, 2019 at 1:21 PM Tony Arcieri <[e-mail]> wrote:

> On Fri, Dec 20, 2019 at 10:09 AM Phillip Hallam-Baker <
> [e-mail]> wrote:
>
>> In particular, I believe that we need a threshold signature scheme that
>> is non-interactive. This is because I need to be able to explain the scheme
>> to a layperson who does not understand the signature scheme. For example:
>> The Alice+Bob aggregate signature is secure because it is constructed a
>> signature contribution from Alice and a signature contribution from Bob,
>> both of which are secure signatures in their own right and both of which
>> have the same exact construction with respect to Alice and Bob's public key
>> as the aggregate signature does to the aggregate key.
>>
>
> There's already draft-irtf-cfrg-bls-signature work which supports
> offline/non-interactive aggregation. BLS trivially supports threshold
> signatures (although I don't see much mention of that in that draft).
>
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature/
>
> Aside from a pairings-based scheme like BLS, I don't believe it's possible
> to support offline/non-interactive aggregation using (EC)DLP security
> alone, but I could be mistaken.
>
> --
> Tony Arcieri
>