mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
57 lines
3.0 KiB
TeX
57 lines
3.0 KiB
TeX
\section{Introduction}
|
|
|
|
\label{sec:intro}
|
|
% ============================================================
|
|
|
|
Cross-chain bridges must hold custody of assets on source chains while issuing
|
|
representations on destination chains. The security of billions of dollars in locked
|
|
value depends on how the custodial key is managed. Three approaches dominate
|
|
production deployments:
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{Multisig}: $k$-of-$n$ on-chain multisignature. Transparent but
|
|
expensive (linear gas cost in $k$) and chain-specific (not all chains support
|
|
native multisig).
|
|
\item \textbf{Trusted committee}: A centralized signer or small committee holds
|
|
the private key. Cheap verification but catastrophic failure mode.
|
|
\item \textbf{Threshold signatures}: $t$-of-$n$ MPC-based signing produces a
|
|
single standard signature indistinguishable from a single-signer output.
|
|
Constant verification cost. No on-chain multisig infrastructure required.
|
|
\end{enumerate}
|
|
|
|
Threshold signatures are the only approach that achieves both constant on-chain cost
|
|
and distributed trust. However, the blockchain ecosystem uses two incompatible
|
|
signature families: ECDSA (secp256k1) for Ethereum, Bitcoin legacy, TRON, and XRPL;
|
|
and Schnorr/EdDSA (Ed25519 or BIP-340) for Solana, Cardano, TON, Polkadot, Cosmos,
|
|
and Bitcoin Taproot. No single threshold protocol covers both.
|
|
|
|
\paragraph{Contribution.} We present a dual-protocol threshold framework:
|
|
|
|
\begin{itemize}[nosep]
|
|
\item \textbf{FROST}~\cite{komlo2020frost} for Schnorr/EdDSA chains: 2-round
|
|
threshold signing, 64-byte signatures, compatible with Ed25519 and BIP-340.
|
|
\item \textbf{CGGMP21}~\cite{canetti2021cggmp} for ECDSA chains: threshold ECDSA
|
|
with identifiable abort, 65-byte signatures, compatible with secp256k1.
|
|
\item \textbf{Shared infrastructure}: common DKG, key refresh, signer rotation,
|
|
and monitoring layer for both protocols.
|
|
\item \textbf{Formal composition}: proof that sharing infrastructure between the
|
|
two protocols does not degrade security of either.
|
|
\end{itemize}
|
|
|
|
The framework is deployed in Lux Teleport, securing cross-chain transfers across
|
|
18 native bridge programs and 270 registered chain IDs. On-chain verification uses
|
|
a single MPC group address---the aggregate public key from DKG---rather than
|
|
individual signer keys: $\texttt{ecrecover}(\text{digest}, \sigma) = \texttt{mpcGroupAddress}$.
|
|
Individual signer identities exist for accountability and identifiable abort only.
|
|
|
|
\subsection{Notation}
|
|
|
|
We use the following notation throughout. Let $\mathbb{G}$ denote a cyclic group of
|
|
prime order $q$ with generator $G$. For a set $S$ of signers with $|S| = t$, the
|
|
Lagrange coefficient of party $i$ in $S$ is $\lambda_{i,S} = \prod_{j \in S, j \neq i}
|
|
\frac{j}{j - i} \bmod q$. We write $H : \{0,1\}^* \to \mathbb{F}_q$ for a
|
|
collision-resistant hash function modeled as a random oracle. $[n]$ denotes
|
|
$\{1, \ldots, n\}$. $x \xleftarrow{\$} S$ denotes uniform sampling from set $S$.
|
|
|
|
% ============================================================
|