Re: [Cfrg] Threshold signatures

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Jan 3, 2020 at 11:42 AM Tony Arcieri <[e-mail]> wrote:

> On Fri, Jan 3, 2020 at 10:04 AM Phillip Hallam-Baker <
> [e-mail]> wrote:
>
>> At this point, I think we need to focus on making X25519/448 and
>> Ed25519/448 the basis for the next gen of security products. It took about
>> five years from AES being announced as a winner for it to become the new
>> normal.
>>
>
> Given your stated goals of a multisignature which can work for both
> developers and things like HSMs and cloud KMS services, and code signing
> systems only supporting a single signature as opposed to threshold
> signature sets, I think it's worth questioning whether Ed25519 signatures
> are the right tool for the job.
>
> I think draft-boneh-bls-signature might be a better fit as it supports
> offline aggregation. This means HSMs/KMS systems do not need to participate
> in an interactive protocol to produce a signature. It also facilitates
> offline/"airgapped" codesigning (using e.g. hardware tokens).
>

They may well be more convenient if the number of signers is greater than
two. For the case where n=2 and the coordinator is one of the parties,
Ed25519 is fine.

BLS requires protocol designers like myself to get comfortable with an
entirely new mathematical construct. That is a much bigger ask than you
seem to think.

Rather than seeing threshold variants of Ed25519 as competing with BLS, you
should consider the possibility that acceptance and use of Threshold
Ed25519 is likely to be a necessary pre-condition to considering BLS type
signatures at all.



> An interactive signing protocol where all of the participants must be able
> to reach a central online "broker" in order to produce a multisignature
> (and also all be online at the same time) is an onerous requirement, as
> opposed to one where each system can produce a signature and they can be
> retroactively aggregated.
>

If a device isn't online, it is not communicating. If it is not
communicating it is hardly going to need a threshold signature scheme
capable of supporting a huge value of n.

People are always positing central control as a potential source of
unreliability which is rather odd as in my experience, peer-peer systems
are vastly more fragile in practice.