mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
59 lines
2.3 KiB
TeX
59 lines
2.3 KiB
TeX
\section{CGGMP21: Threshold ECDSA}
|
|
|
|
\label{sec:cggmp21}
|
|
|
|
\subsection{Protocol Overview}
|
|
|
|
CGGMP21~\cite{canetti2021uc} is a threshold ECDSA protocol proven secure in the
|
|
UC (Universal Composability) framework. It operates in two phases:
|
|
|
|
\begin{enumerate}[leftmargin=2em]
|
|
\item \textbf{Key generation}: Dealerless DKG produces additive shares
|
|
$sk_i$ such that $sk = \sum_{i \in S} \lambda_i \cdot sk_i$ for any
|
|
qualifying set $S$ of size $t$, where $\lambda_i$ are Lagrange
|
|
coefficients.
|
|
\item \textbf{Presigning}: Before the message is known, parties precompute
|
|
nonce shares $(k_i, \gamma_i)$ and exchange commitments. This is the
|
|
expensive phase (Paillier encryption, range proofs).
|
|
\item \textbf{Signing}: Given message $m$, parties combine presigned values
|
|
with message-dependent terms to produce $(r, s)$.
|
|
\end{enumerate}
|
|
|
|
\subsection{Identifiable Abort}
|
|
|
|
A critical property of CGGMP21 is \emph{identifiable abort}: if any party deviates
|
|
from the protocol, the honest parties can identify the cheater. This is essential for
|
|
validator slashing---a misbehaving threshold signer can be identified and penalized.
|
|
|
|
\begin{definition}[Identifiable abort]
|
|
A threshold signing protocol has identifiable abort if, whenever the protocol fails
|
|
to produce a valid signature, every honest party can output the identity of at least
|
|
one corrupted party.
|
|
\end{definition}
|
|
|
|
\subsection{secp256k1 Compatibility}
|
|
|
|
CGGMP21 produces standard ECDSA signatures on secp256k1. The output is
|
|
indistinguishable from a single-signer ECDSA signature. EVM \texttt{ecrecover}
|
|
returns the expected address. No smart contract changes are needed.
|
|
|
|
\begin{algorithm}[ht]
|
|
\caption{CGGMP21 Signing (simplified).}
|
|
\label{alg:cggmp21}
|
|
\begin{algorithmic}[1]
|
|
\Require Message hash $e$; presigned tuples $(k_i, \chi_i, R)$ for $i \in S$
|
|
\Ensure ECDSA signature $(r, s)$
|
|
\State $r \leftarrow R.x \mod q$ \Comment{$R = (k^{-1}) \cdot G$}
|
|
\ForAll{$P_i \in S$}
|
|
\State Compute $s_i \leftarrow k_i \cdot e + k_i \cdot r \cdot \chi_i \mod q$
|
|
\State Broadcast $s_i$
|
|
\EndFor
|
|
\State $s \leftarrow \sum_{i \in S} s_i \mod q$
|
|
\State \Return $(r, s)$
|
|
\end{algorithmic}
|
|
\end{algorithm}
|
|
|
|
%% ========================================================================
|
|
%% 5. FROST: THRESHOLD SCHNORR/BLS
|
|
%% ========================================================================
|