Re: [DNSOP] [dnsext] New Version Notification for draft-mcgrew-tss-02 (fwd)

[Michael StJohns <[e-mail]>]

At 06:27 PM 3/11/2009, David McGrew wrote:
>Hi Mike,
>>Hi Alfred -
>>A better scheme for threshold signing for the root might be the  
>>Shoup paper: "Practical Threshold Signatures", Victor Shoup ([e-mail] ), IBM Research Paper RZ3121, 4/30/99
>>The major difference between the two is that the Shamir system  
>>(which you describe) requires the base secret (private key) be  
>>reconstituted (by a trusted entity) before it can be used, where the  
>>Shoup system allows partial signatures with a public gather  
>>function.  E.g. In a 3 of 5 system, each of the 3 key share holders  
>>partial-sign the data using their share of the private key and send  
>>it (as public data) to a central location where a gather function is  
>>used to form the actual signature.
>I agree that threshold signatures have nice security properties, and  
>that Shoup's PTS method looks good, especially because its signature- share generation step does not require any interaction between the  
>signers.
>
>As you say, the TSS draft lacks the partial-signature capability, but  
>TSS does have the benefit of simplicity.
>>Shamir is nice in that it can be used for any set of key bits. But  
>>the reconstitution requirement is a point of weakness where the  
>>actual private key may be compromised. The Shoup system is only  
>>specified for RSA as far as I know.
>Shoup's PTS method requires the use of a trusted dealer to generate  
>the private keys of all of the signers.   So while it eliminates the  
>need for a trusted dealer during the signing step, it does not  
>eliminate that need entirely.  (At least this is the case for the  
>paper that you cited above; if there is work that eliminates the  
>trusted dealer, I would be very interested to see it.)
>
>best regards,
>
>David

Hi David -

What I would recommend doing here is build a computer and set it up with no connections to the outside world.  Load it with the generation software and the public keys of the N share holders.  Connect it to a printer.  Run the generation software and then print out the 5 public key wrapped shares armored as HEX ascii in an OCR font.  Destroy the hard drive.   Melt, burn, magnetize, disassemble, etc.

Send the wrapped shares off to the various share holders.  Have them OCR them into the encrypted key shares they'll use later to do the signing.

The ceremony for doing the generation in a reasonably trusted manner and ensuring that information doesn't leak is manageable.. :-) 

But it would be nice if we didn't need a trusted dealer....

Mike