Re: [Cfrg] Adoption of threshold drafts by RG

[Ian Goldberg <[e-mail]>]

On Tue, Sep 29, 2020 at 08:21:28PM +0000, Chelsea Komlo wrote:
> After performing O(k*b*2^{1/lg(k)})

Typo fix: that should be O(k*b*2^{b/(1+lg(k))}) [and k here is actually
one more than the number of parallel signing operations the victim is
willing to support].  So 1 signing op at a time means k=2, and the above
is O(2b*2^{b/2}); i.e., basically the cost of extracting a DL in a b-bit
group, as expected.  But 7 parallel signing ops means k=8, and the above
is O(8b*2^{b/4}), etc.