upcarta
  • Sign In
  • Sign Up
  • Explore
  • Search

FROST: Flexible Round-Optimized Schnorr Threshold Signatures

  • Paper
  • Dec 20, 2020
  • #Cryptography
Chelsea Komlo
@chelseakomlo
(Author)
Ian Avrum Goldberg
@IanAvrumGoldberg
(Author)
eprint.iacr.org
Read on eprint.iacr.org
1 Recommender
1 Mention
Unlike signatures in a single-party setting, threshold signatures require coop- eration among a threshold number of signers each holding a share of a common private key. Consequentl... Show More

Unlike signatures in a single-party setting, threshold signatures require coop- eration among a threshold number of signers each holding a share of a common private key. Consequently, generating signatures in a threshold setting imposes overhead due to network rounds among signers, proving costly when secret shares are stored on network-limited devices or when coordination occurs over unreliable networks. In this work, we present FROST, a Flexible Round-Optimized Schnorr Threshold signature scheme that reduces network overhead during signing opera- tions while employing a novel technique to protect against forgery attacks appli- cable to similar schemes in the literature. FROST improves upon the state of the art in Schnorr threshold signature protocols, as it can safely perform signing op- erations in a single round without limiting concurrency of signing operations, yet allows for true threshold signing, as only a threshold t out of n possible partici- pants are required for signing operations, such that t ≤ n. FROST can be used as either a two-round protocol, or optimized to a single-round signing protocol with a pre-processing stage. FROST achieves its efficiency improvements in part by allowing the protocol to abort in the presence of a misbehaving participant (who is then identified and excluded from future operations)—a reasonable model for practical deployment scenarios. We present proofs of security demonstrating that FROST is secure against chosen-message attacks assuming the discrete logarithm problem is hard and the adversary controls fewer participants than the threshold.

Show Less
Recommend
Post
Save
Complete
Collect
Mentions
See All
Rijndael @rot13maxi · May 5, 2022
  • Post
  • From Twitter
Finally sat down and read the FROST paper this morning. Really neat protocol. The key generation is basically shamirs secret sharing, but in reverse + commitments. And then signing is just adding partwise sigs because schnorr is all “linear” (that is its + and * group ops).
  • upcarta ©2025
  • Home
  • About
  • Terms
  • Privacy
  • Cookies
  • @upcarta