idnits 2.17.1 draft-hallambaker-threshold-sigs-04.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an Authors' Addresses Section. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Using lowercase 'not' together with uppercase 'MUST', 'SHALL', 'SHOULD', or 'RECOMMENDED' is not an accepted usage according to RFC 2119. Please use uppercase 'NOT' together with RFC 2119 keywords (if that is what you mean). Found 'MUST not' in this paragraph: Implementations MUST not use threshold signatures in applications where signature values are used in place of cryptographic digests as unique content identifiers. -- The document date (September 4, 2020) is 1323 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Missing Reference: 'TBS' is mentioned on line 1266, but not defined Summary: 1 error (**), 0 flaws (~~), 3 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group P. M. Hallam-Baker 3 Internet-Draft ThresholdSecrets.com 4 Intended status: Informational September 4, 2020 5 Expires: March 8, 2021 7 Threshold Signatures in Elliptic Curves 8 draft-hallambaker-threshold-sigs-04 10 Abstract 12 A Threshold signature scheme is described. The signatures created 13 are computationally indistinguishable from those produced using the 14 Ed25519 and Ed448 curves as specified in RFC8032 except in that they 15 are non-deterministic. Threshold signatures are a form of digital 16 signature whose creation requires two or more parties to interact but 17 does not disclose the number or identities of the parties involved. 19 https://mailarchive.ietf.org/arch/browse/cfrg/ 20 (http://whatever)Discussion of this draft should take place on the 21 CFRG mailing list (cfrg@irtf.org), which is archived at . 23 Status of This Memo 25 This Internet-Draft is submitted in full conformance with the 26 provisions of BCP 78 and BCP 79. 28 Internet-Drafts are working documents of the Internet Engineering 29 Task Force (IETF). Note that other groups may also distribute 30 working documents as Internet-Drafts. The list of current Internet- 31 Drafts is at https://datatracker.ietf.org/drafts/current/. 33 Internet-Drafts are draft documents valid for a maximum of six months 34 and may be updated, replaced, or obsoleted by other documents at any 35 time. It is inappropriate to use Internet-Drafts as reference 36 material or to cite them other than as "work in progress." 38 This Internet-Draft will expire on March 8, 2021. 40 Copyright Notice 42 Copyright (c) 2020 IETF Trust and the persons identified as the 43 document authors. All rights reserved. 45 This document is subject to BCP 78 and the IETF Trust's Legal 46 Provisions Relating to IETF Documents (https://trustee.ietf.org/ 47 license-info) in effect on the date of publication of this document. 48 Please review these documents carefully, as they describe your rights 49 and restrictions with respect to this document. 51 Table of Contents 53 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 54 1.1. Applications . . . . . . . . . . . . . . . . . . . . . . 4 55 1.1.1. HSM Binding . . . . . . . . . . . . . . . . . . . . . 4 56 1.1.2. Code Signing . . . . . . . . . . . . . . . . . . . . 4 57 1.1.3. Signing by Redundant Services . . . . . . . . . . . . 5 58 2. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 5 59 2.1. Requirements Language . . . . . . . . . . . . . . . . . . 5 60 2.2. Defined Terms . . . . . . . . . . . . . . . . . . . . . . 5 61 2.3. Related Specifications . . . . . . . . . . . . . . . . . 5 62 2.4. Implementation Status . . . . . . . . . . . . . . . . . . 6 63 3. Principles . . . . . . . . . . . . . . . . . . . . . . . . . 6 64 3.1. Direct shared threshold signature . . . . . . . . . . . . 7 65 3.2. Shamir shared threshold signature . . . . . . . . . . . . 9 66 3.3. Stateless computation of final share . . . . . . . . . . 10 67 3.3.1. Side channel resistance . . . . . . . . . . . . . . . 11 68 3.4. Security Analysis . . . . . . . . . . . . . . . . . . . . 12 69 3.4.1. Calculation of r values . . . . . . . . . . . . . . . 12 70 3.4.2. Replay Attack . . . . . . . . . . . . . . . . . . . . 13 71 3.4.3. Malicious Contribution Attack . . . . . . . . . . . . 13 72 3.4.4. Rogue Key Attack . . . . . . . . . . . . . . . . . . 13 73 4. Ed2519 Signature . . . . . . . . . . . . . . . . . . . . . . 14 74 5. Ed448 Signature . . . . . . . . . . . . . . . . . . . . . . . 15 75 6. Test Vectors . . . . . . . . . . . . . . . . . . . . . . . . 16 76 6.1. Direct Threshold Signature Ed25519 . . . . . . . . . . . 16 77 6.2. Direct Threshold Signature Ed448 . . . . . . . . . . . . 19 78 6.3. Shamir Threshold Signature Ed25519 . . . . . . . . . . . 22 79 6.4. Shamir Threshold Signature Ed448 . . . . . . . . . . . . 25 80 7. Security Considerations . . . . . . . . . . . . . . . . . . . 28 81 7.1. Rogue Key attack . . . . . . . . . . . . . . . . . . . . 28 82 7.2. Disclosure or reuse of the value r . . . . . . . . . . . 28 83 7.3. Resource exhaustion attack . . . . . . . . . . . . . . . 28 84 7.4. Signature Uniqueness . . . . . . . . . . . . . . . . . . 28 85 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 29 86 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 29 87 10. Normative References . . . . . . . . . . . . . . . . . . . . 29 88 11. Informative References . . . . . . . . . . . . . . . . . . . 29 90 1. Introduction 92 Threshold encryption and key generation provide compelling advantages 93 over single private key approaches because splitting the private key 94 permits the use of that key to be divided between two or more roles. 96 All existing digital signatures allow the signer role to be divided 97 between multiple parties by attaching multiple signatures to the 98 signed document. This approach, known as multi-signatures, is 99 distinguished from a threshold signature scheme in that the identity 100 and roles of the individual signers is exposed. In a threshold 101 signature scheme, the creation of a single signature requires the 102 participation of multiple signers and the signature itself does not 103 reveal the means by which it was constructed. 105 Rather than considering multi-signatures or threshold signatures to 106 be inherently superior, it is more useful to regard both as two 107 points on a continuum of choices: 109 Multi-signatures Multiple digital signatures on the same document. 110 Multi-signatures are simple to create and provide the verifier 111 with more information but require the acceptance criteria to be 112 specified independently of the signature itself. This requires 113 that the application logic or PKI provide some means of describing 114 the criteria to be applied. 116 Multi-party key release A single signature created using a single 117 private key stored in an encrypted form whose use requires 118 participation of multiple key decryption shares. 120 Threshold signatures A single signature created using multiple 121 signature key shares. Signature creation may be subject to 122 complex criteria such as requiring an (n,t) quorum of signers but 123 these criteria are fixed at the time the signature is created 125 Aggregate Signatures A single signature created using multiple 126 signature key shares such that validation of the aggregate 127 signature serves to validate the participation of each of the 128 individual signers. 130 This document builds on the approach described in 131 [draft-hallambaker-threshold] to define a scheme that creates 132 threshold signatures that are computationally indistinguishable from 133 those produced according to the algorithm specified in [RFC8032]. 134 The scheme does not support the creation of aggregate signatures. 136 The approach used is based on that developed in FROST [Komlo]. This 137 document describes the signature scheme itself. The techniques used 138 to generate keys are described separately in 139 [draft-hallambaker-threshold]. 141 As in the base document, we first describe signature generation for 142 the case that _n_ = _t_ using 'direct' coefficients, that is the 143 secret scalar is the sum of the secret shares. We then show how the 144 scheme is modified using Shamir secret sharing [Shamir79] and 145 Lagrange coefficients for the case that _n_ > _t_. 147 1.1. Applications 149 Threshold signatures have application in any situation where it is 150 desired to have finer grain control of signing operations without 151 this control structure being visible to external applications. It is 152 of particular interest in situations where legacy applications do not 153 support multi-signatures. 155 1.1.1. HSM Binding 157 Hardware Security Modules (HSMs) prevent accidental disclosures of 158 signature keys by binding private keys to a hardware device from 159 which it cannot be extracted without substantial effort. This 160 provides effective mitigation of the chief causes of key disclosure 161 but requires the signer to rely on the trustworthiness of a device 162 that represents a black box they have no means of auditing. 164 Threshold signatures allow the signer to take advantage of the key 165 binding control provided by an HSM without trusting it. The HSM only 166 contributes one of the key shares used to create the signature. The 167 other is provided by the application code (or possibly an additional 168 HSM). 170 1.1.2. Code Signing 172 Code signing is an important security control used to enable rapid 173 detection of malware by demonstrating the source of authorized code 174 distributions but places a critical reliance on the security of the 175 signer's private key. Inadvertent disclosure of code signing keys is 176 commonplace as they are typically stored in a form that allows them 177 to be used in automatic build processes. Popular source code 178 repositories are regularly scanned by attackers seeking to discover 179 private signature keys and passwords embedded in scripts. 181 Threshold signatures allow the code signing operation to be divided 182 between a developer key and an HSM held locally or by a signature 183 service. The threshold shares required to create the signature can 184 be mapped onto the process roles and personnel responsible for 185 authorizing code release. This last concern might be of particular 186 advantage in open source projects where the concentration of control 187 embodied in a single code signing key has proved to be difficult to 188 reconcile with community principles. 190 1.1.3. Signing by Redundant Services 192 Redundancy is as desirable for trusted services as for any other 193 service. But in the case that multiple hosts are tasked with 194 compiling a data set and signing the result, there is a risk of 195 different hosts obtaining a different view of the data set due to 196 timing or other concerns. This presents the risk of the hosts 197 signing inconsistent views of the data set. 199 Use of threshold signatures allows the criteria for agreeing on the 200 data set to be signed to be mapped directly onto the requirement for 201 creating a signature. So if there are three hosts and two must agree 202 to create a signature, three signature shares are created and with a 203 threshold of two. 205 2. Definitions 207 This section presents the related specifications and standard, the 208 terms that are used as terms of art within the documents and the 209 terms used as requirements language. 211 2.1. Requirements Language 213 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 214 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 215 document are to be interpreted as described in [RFC2119]. 217 2.2. Defined Terms 219 See [draft-hallambaker-threshold]. 221 2.3. Related Specifications 223 This document extends the approach described in 224 [draft-hallambaker-threshold] to support threshold signatures. The 225 deterministic mechanism described in specification 226 [draft-hallambaker-mesh-udf] is used to generate the private keys 227 used in the test vectors. 229 2.4. Implementation Status 231 The implementation status of the reference code base is described in 232 the companion document [draft-hallambaker-mesh-developer]. 234 3. Principles 236 The threshold signatures created according to the algorithms 237 described in this document are compatible with but not identical to 238 the signatures created according to the scheme described in 239 [RFC8032]. In particular: 241 * The signature verification algorithm is unchanged. 243 * The unanimous threshold scheme produces values of _R_ and _S_ that 244 are deterministic but different from the values that would be 245 obtained by using the aggregate private key to sign the same 246 document. 248 * The deterministic quorate threshold scheme produces values of _R_ 249 and _S_ that are deterministic for a given set of signers but will 250 change for a different set of signers or if the aggregate private 251 key was used to sign the same document. 253 * ?The non-deterministic quorate threshold scheme produces values of 254 _R_ and _S_ that will be different each time the document is 255 signed. 257 Recall that a digital signature as specified by [RFC8032] consists of 258 a pair of values _S_, _R_ calculated as follows: 260 _R_ = _r.B_ 262 S = _r_ + _k.s_ mod _L_ 264 Where _B_ is the base point of the elliptic curve. 266 _r_ is an unique, unpredictable integer value such that 0 r L 268 _k_ is the result of applying a message digest function determined 269 by the curve (Ed25519, Ed448) to a set of parameters known to the 270 verifier which include the values _R_, _A_ and PH(_M_). 272 _A_ is the public key of the signer, _A_ = _s.B_ 274 PH(_M_) is the prehash function of the message value. 276 _s_ is the secret scalar value 277 _L_ is the order of the elliptic curve group. 279 To verify the signature, the verifier checks that: 281 _S.B_ = _R_ + _k.A_ 283 This equality must hold for a valid signature since: 285 _S.B_ = (_r_ + _k.s_)._B_ 287 = _r.B_ +_k_.(_s.B_) 289 = _R_ + _k.A_ 291 The value _r_ plays a critical role in the signature scheme as it 292 serves to prevent disclosure of the secret scalar. If the value _r_ 293 is known, _s_ can be calculated as _s_ = (_S-r_)._k_^(-1) mod _L_. It 294 is therefore essential that the value _r_ be unguessable. 296 Furthermore, if the same value of _r_ is used to sign two different 297 documents, this results two signatures with the same value _R_ and 298 different values of _k_ and _S_. Thus 300 _S_(1)_ = _r_ + _k_(1)_._s_ mod _L_ 302 S_(2) = _r_ + _k_(2).s mod L_ 304 s = (_S_(1)_ - _S_(2)_)(_k_(1)_ - _k_(2)_)^(-1) mod _L_ 306 The method of constructing _r_ MUST ensure that it is unique and 307 unguessable. 309 3.1. Direct shared threshold signature 311 A threshold signature R, S is constructed by summing a set of 312 signature contributions from two or more signers. For the case that 313 the composite private key is the sum of the key shares (_n_ = _t_), 314 each signer _i_ provides a contribution as follows: 316 A_(i) = s_(i).B 318 R_(i) = r_(i).B 320 S_(i) = r_(i) + k.s_(i) mod L 322 Where s_(i) and r_(i) are the secret scalar and unguessable value for 323 the individual signer. 325 The contributions of signers {1, 2, ... n} are then combined as 326 follows: 328 R = R_(1) + R_(2) + ... + R_(n) 330 S = S_(1) + S_(2) + ... + S_(n) 332 A = s.B 334 Where s = (s_(1) + s_(2) + ... + s_(n)) mod L 336 The threshold signature is verified in the same manner as before: 338 S.B = R + k.A 340 Substituting for S.B we get: 342 = (S_(1) + S_(2) + ... + S_(n)).B 344 = S_(1).B + S_(2).B + ... + S_(n).B 346 = (r_(1) + k.s_(1)).B + (r_(2) + k.s_(2)).B + ... + (r_(n) + 347 k.s_(n)).B 349 = (r_(1).B + k.s_(1).B) + (r_(2).B + k.s_(2).B) + ... + (r_(n).B + 350 k.s_(n).B) 352 = (R1 + k.A1) + (R1 + k.A1) + ... + (Rn + k.An) 354 Substituting for R + k.A we get: 356 = R_(1) + R_(2) + ... + R_(n) + k.(A_(1) + A_(2) + ... + A_(n)) 358 = R_(1) + R_(2) + ... + R_(n) + k.A_(1) + k.A_(2) + ... + k.A_(n) 360 = (R_(1) + k.A_(1)) + (R_(1) + k.A_(1)) + ... + (R_(n) + k.A_(n)) 362 As expected, the operation of threshold signature makes use of the 363 same approach as threshold key generation and threshold decryption as 364 described in [draft-hallambaker-threshold]. As with threshold 365 decryption it is not necessary for each key share holder to have a 366 public key corresponding to their key share. All that is required is 367 that the sum of the secret scalar values used in calculation of the 368 signature modulo the group order be the value of the aggregate secret 369 scalar corresponding to the aggregate secret key. 371 While verification of [RFC8032] signatures is unchanged, the use of 372 threshold signatures requires a different approach to signing. In 373 particular, the fact that the value k is bound to the value R means 374 that the participants in the threshold signature scheme must agree on 375 the value R before the value k can be calculated. Since k is 376 required to calculate the signature contributions S_(i) can be 377 calculated, it is thus necessary to calculate the values R_(i) and 378 S_(i) in separate phases. The process of using a threshold signature 379 to sign a document thus has the following stages orchestrated by a 380 dealer as follows: 382 0. The dealer determines the values F, C and PH(M) as specified in 383 [RFC8032] and transmits them to the signers {1, 2, ... n}. 385 1. Each signer generates a random value r_(i) such that 1 r_(i) L, 386 calculates the value R_(i) = r_(i).B and returns R to the dealer 387 . 389 2. The dealer calculates the value R = R_(1) + R_(2) + ... + R_(n) 390 and transmits R and A to the signers {1, 2, ... n}. 392 3. Each signer uses the suppled data to determine the value k and 393 hence S_(i) = r_(i) + k.s_(i) mod L and transmits it to the 394 dealer . 396 4. The dealer calculates the value S = S_(1) + S_(2) + ... + S_(n) 397 and verifies that the resulting signature R, S verifies according 398 to the mechanism specified in [RFC8032]. If the signature is 399 correct, the dealer publishes it. Otherwise, the dealer MAY 400 identify the signer(s) that provided incorrect contributions by 401 verifying the values R_(i) and S_(i) for each. 403 For clarity, the dealer role is presented here as being implemented 404 by a single party. 406 3.2. Shamir shared threshold signature 408 To construct a threshold signature using shares created using Shamir 409 Secret Sharing, each private key value _s_(i)_ is multiplied by the 410 Lagrange coefficient _l_(i)_ corresponding to the set of shares used 411 to construct the signature: 413 A_(i) = s_(i)l_(i).B 415 R_(i) = r_(i).B 417 _S_(i) = ri + klisi mod L_ 418 It is convenient to combine the derivation of _S_(i)_ for the 419 additive and Shamir shared threshold signatures by introducing a key 420 multiplier coefficient _c_(i)_: 422 _S_(i) = ri + kcisi mod L_ 424 Where _c_(i)_ = 1 for the additive shared threshold signature 426 _c_(i)_ = _l_(i)_ for the Shamir shared threshold signature 428 3.3. Stateless computation of final share 430 One of the chief drawbacks to the algorithm described above is that 431 it requires signers to perform two steps with state carried over from 432 the first to the second to avoid reuse of the value _r_(i)_. This 433 raises particular concern for implementations such as signature 434 services or HSMs where maintaining state imposes a significant cost. 436 Fortunately, it is possible to modify the algorithm so that the final 437 signer does not need to maintain state between steps: 439 0. All the signers except the final signer _F_ generate their value 440 _r_(i)_ and submit the corresponding value _R_(i)_ to the dealer 442 1. Dealer calculates the value _R_ - _R_(F)_ and sends it to the 443 final signer together with the all the other parameters required 444 to calculate _k_ and the final signer's key multiplier 445 coefficient _c_(F)_. 447 2. The final signer generates its value _r_(F)_ 449 3. The final signer calculates the value _R_(F)_ from which the 450 values _R_ and _k_ can now be determined. 452 4. The final signer calculates its key share contribution _S_(F) = 453 rF + kcFsF mod L._ 455 5. The final signer returns the values _S_(F)_ and _R_ to the 456 dealer. 458 6. The dealer reports the value R to the other signers and continues 459 the signature process as before. 461 While this approach to stateless computation of the signature 462 contributions is limited to the final share, this is sufficient to 463 cover the overwhelming majority of real-world applications where _n_ 464 = _t_ = 2. 466 Note that the final signer MAY calculate its value _r_(F)_ 467 deterministically provided that the parameters _R_ - _R_(F)_ and 468 _c_(F)_ are used in its determination. Other signers MUST NOT use a 469 deterministic means of generating their value _r_(i)_ since the 470 information known to them at the time this parameter is generated is 471 not sufficient to fix the value of _R_. 473 3.3.1. Side channel resistance 475 The use of Kocher side channel resistance as described in 476 [draft-hallambaker-threshold] entails randomly splitting the private 477 key into two shares and performing the private key operation 478 separately on each share to avoid repeated operations using the same 479 private key value at the cost of performing each operation twice. 481 This additional overhead MAY be eliminated when threshold approaches 482 are used by applying blinding factors whose sum is zero to each of 483 the threshold shares. 485 For example, if generation of the threshold signature is divided 486 between an application program A and an HSM B using the final share 487 approach to avoid maintaining state in the HSM, we might generate a 488 blinding factor thus: 490 0. A generates a random nonce _n_(A)_ and sends it to B with the 491 other parameters required to generate the signature. 493 1. B generates a random nonce _n_(B)_ 495 2. B calculates the blinding factor _x_ by calculating 496 _H_(_n_(A,)nB) where H is a strong cryptographic digest function 497 and converting the result to an integer in the range 1 x L._ 499 3. B calculates the signature parameters as before except that the 500 threshold signature contribution is now _S_(B) = rB + k(cBsB + x) 501 mod L._ 503 4. B returns the nonce _n_(B)_ to A with the other parameters. 505 5. A calculates the blinding factor _x_ using the same approach as B 507 6. A calculates the signature parameters as before except that the 508 threshold signature contribution is now _S_(A) = rA + k(cAsA - x) 509 mod L._ 511 This approach MAY be extended to the case that _t_ > 2 by 512 substituting a Key Derivation Function (e.g. [RFC5860]) for the 513 digest function. 515 3.4. Security Analysis 517 We consider a successful breach of the threshold signature scheme to 518 be any attack that allows the attacker to create a valid signature 519 for any message without the participation of the required threshold 520 of signers. 522 Potential breaches include: 524 * Disclosure of the signature key or signature key share. 526 * Modification of signature data relating to message M to allow 527 creation of a signature for message M'. 529 * Ability of one of the signers to choose the value of the aggregate 530 public key. 532 * Access control attacks inducing a signer to create a signature 533 contribution that was not properly authenticated or authorized. 535 We regard attacks on the access control channel to be out of scope 536 for the threshold signature algorithm, though they are certainly a 537 concern for any system in which a threshold signature algorithm is 538 employed. 540 We do not consider the ability of a signer to cause creation of an 541 invalid signature to represent a breach. 543 3.4.1. Calculation of r values 545 The method of constructing the values _r_(i)_ MUST ensure that each 546 is unique and unguessable both to external parties, the signers and 547 the dealer. The deterministic method specified in [RFC8032] cannot 548 be applied to generation of the values r_(i) as it allows the dealer 549 to cause signers to reveal their key shares by requesting multiple 550 signature contributions for the same message but with different 551 values of _k_. In particular, requesting signature contributions for 552 the same message: 554 With different Lagrange coefficients. 556 With a false value of _R_ 558 To avoid these attacks, the value r_(i) is generated using a secure 559 random number generator. This approach requires the signer to ensure 560 that values are never reused requiring that the signing API maintain 561 state between the first and second rounds of the algorithm. 563 While there are many approaches to deterministic generation of r_(i) 564 that appear to be sound, closer inspection has demonstrated these to 565 be vulnerable to rogue key and rogue contribution attacks. 567 3.4.2. Replay Attack 569 The most serious concern in the implementation of any Schnorr type 570 signature scheme is the need to ensure that the value r_(i) is never 571 revealed to any other party and is never used to create signatures 572 for two different values of k.s_(i). 574 Ensuring this does not occur imposes significant design constraints 575 as creating a correct signature contribution requires that the signer 576 use the same value of r_(i) to construct its value or R_(i) and 577 S_(i). 579 For example, a HSM device may be required to perform multiple 580 signature operations simultaneously. Since the storage capabilities 581 of an HSM device are typically constrained, it is tempting to attempt 582 to avoid the need to track the value of r_(i) within the device 583 itself using an appropriately authenticated and encrypted opaque 584 state token. Such mechanisms provide the HSM with the value of r_(i) 585 but do not and cannot provide protection against a replay attack in 586 which the same state token is presented with a request to sign 587 different values of k. 589 3.4.3. Malicious Contribution Attack 591 In a malicious contribution attack, one or more parties present a 592 signature contribution that does not meet the criteria R_(i) = 593 r_(i).B and S_(i) = r_(i) + ks_(i). 595 Such an attack is not considered to be a breach as it merely causes 596 the signature process to fail. 598 3.4.4. Rogue Key Attack 600 A threshold signature scheme that allows the participants to 'bring 601 their own key' may be vulnerable to a rogue key attack in which a 602 signer is able to select the value of the aggregate public signature 603 key by selecting a malicious public signature key value. 605 The scheme described in this document is a threshold signature scheme 606 and does not support this feature. Consequently, this attack is not 607 relevant. It is described here for illustrative purposes only. 609 This particular attack only applies when the individual signers 610 create their own signature shares. It is not a concern when the 611 signature shares are created by splitting a master signature private 612 key. 614 Consider the case where the aggregate public key signature is 615 calculated from the sum of public signature key share values 616 presented by the signers: 618 A = A_(1) + A_(2) + ... + A_(n) 620 If the public key values are presented in turn, the last signer 621 presenting their key share can force the selection of any value of A 622 that they choose by selecting A_(n) = A_(m) - (A_(1) + A_(2) + ... + 623 A_(n-1)) 625 The attacker can thus gain control of the aggregate signature key by 626 choosing A_(m) = s_(m).B where s_(m) is a secret scalar known only to 627 the attacker. But does so at the cost of not knowing the value s_(n) 628 and so the signer cannot participate in the signature protocol. 630 This attack allows the attacker and the attacker alone to create 631 signatures which are validated under the aggregate signature key. 633 The attack is a consequence of the mistaken assumption that a 634 signature created under the signature key A_(1) + A_(2) + ... + A_(n) 635 provides evidence of the individual participation of the 636 corresponding key holders without separate validation of the 637 aggregate key. 639 Enabling the use of threshold signature techniques by ad-hoc groups 640 of signers using their existing signature keys as signature key 641 shares presents serious technical challenges that are outside the 642 scope of this specification. 644 4. Ed2519 Signature 646 The means by which threshold shares are created is described in 647 [draft-hallambaker-threshold]. 649 The dealer selects the signers who are to construct the signature. 650 Each signer then computes the value R_(i): 652 0. Randomly generate an integer r_(i) such that 1 r_(i) L. 654 1. Compute the point R_(i) = r_(i)B. For efficiency, do this by 655 first reducing r_(i) modulo L, the group order of B. Let the 656 string R_(i) be the encoding of this point. 658 2. Transmit the value R_(i) to the dealer 660 3. At some later point, the dealer MAY complete the signature by 661 returning the values F, C, A and R as specified in [RFC8032] 662 together with the key multiplier coefficient c_(i). The signers 663 MAY then complete their signature contributions: 665 4. Compute SHA512(dom2(F, C) || R || A || PH(M)), and interpret the 666 64-octet digest as a little-endian integer k. 668 5. Compute S_(i) = (r_(i) + kc_(i)s_(i)) mod L. For efficiency, 669 again reduce k modulo L first. 671 6. Return the values R_(i), S_(i) to the dealer . 673 The dealer then completes the signature by: 675 0. Computing the composite value S = S_(1) + S_(2) + ... + S_(n) 677 1. Verifying that the signature R, S is valid. 679 2. Publishing the signature. 681 5. Ed448 Signature 683 The means by which threshold shares are created is described in 684 [draft-hallambaker-threshold]. 686 The dealer selects the signers who are to construct the signature. 687 Each signer then computes the value R_(i): 689 0. Randomly generate an integer r_(i) such that 1 r_(i) L. 691 1. Compute the point R_(i) = r_(i)B. For efficiency, do this by 692 first reducing r_(i) modulo L, the group order of B. Let the 693 string R_(i) be the encoding of this point. 695 Transmit the value R_(i) to the dealer 697 0. At some later point, the dealer MAY complete the signature by 698 returning the values F, C, A and R as specified in [RFC8032] 699 together with the key multiplier coefficient c_(i). The signers 700 MAY then complete the signature contributions: 702 1. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114), and 703 interpret the 114-octet digest as a little-endian integer k. 705 2. Compute S_(i) = (r_(i) + kc_(i)s_(i)) mod L. For efficiency, 706 again reduce k modulo L first. 708 3. Return the values R_(i), S_(i) to the dealer. 710 The dealer then completes the signature by: 712 0. Computing the composite value S = S_(1) + S_(2) + ... + S_(n) 714 1. Verifying that the signature R, S is valid. 716 2. Publishing the signature. 718 6. Test Vectors 720 6.1. Direct Threshold Signature Ed25519 722 The signers are Alice and Bob's Threshold Signature Service 'Bob'. 723 Each creates a key pair: 725 ED25519Alice's Key (ED25519) 726 UDF: ZAAA-GTSI-GXED-255X-XALI-CEXS-XKEY 727 Scalar: 56271244081186130980636545017945156580516101894352492 728 459594967614223399428880 729 Encoded Private 730 33 40 0E 22 D8 67 17 F4 8A 9F 6A 46 61 B4 0E AD 731 8C D0 DD C3 79 CD 85 BD 95 5C 90 B9 6C CB 8C 23 732 X: 11116793672970427161790264469280294507189044728140547954071022 733 7976454124042406369344932655633664630560242213431409139866940 734 284702002648469365756492647970 735 Y: 61655404171611396573021808119108664749574235125343680206454285 736 6299141386615046548323087409388548650272224487089895079970526 737 0143544115364878870129761259200 738 Encoded Public 739 E2 AB 8F 37 62 C8 7B F9 E9 BC 59 0C 2E 99 A5 58 740 0C C3 19 D5 CD DA 53 DF 3E C1 F0 C0 FE D3 55 5E 741 ED25519Bob's Key (ED25519) 742 UDF: ZAAA-GTSI-G2ED-255X-XBOB-XSXK-EY 743 Scalar: 54940772670153459146152925564198105262971485730889818 744 986727608573229799020168 745 Encoded Private 746 68 9A 68 92 8A 06 17 84 35 3C B7 08 F8 56 00 3F 747 BA 31 8C 42 B0 42 FE 2D 18 F2 7F AB CD 10 49 F1 748 X: 14271495069349838216379540196263140964032393512903842206168182 749 5518850827098876289800868735522232908519794251130907125878675 750 6343411484065706313568410880015 751 Y: 28094328948004112428189466223757440886388684291254605355859923 752 6240968229706795825282419594219442074647093851302547452470435 753 9438513477629978601366725015573 754 Encoded Public 755 32 E5 8D 5E 66 B2 F9 E9 14 79 08 71 96 3B 9A 75 756 A2 31 59 4B 8E ED 18 EF BD FF 11 D4 47 2A 8C F4 758 The composite Signature Key A = A_(a) + A_(b) 759 Aggregate Key = Alice + Bob () 760 UDF: TBS 761 Scalar: 26569330913556569171916721364983482306308422345436973 762 56293312113171384684213 763 Encoded Private 764 B5 CE 0E B3 9C CF 18 99 CF 8D 4C BB AE 81 79 1F 765 CE 13 AA 3E 63 59 5B AC 8D 2C EB A4 55 C5 DF 05 766 X: 67872685043898469012456949773240814121645904736114813455820339 767 8688906486811443744733724675994181258029547346985079901494367 768 752381127781166234556148580090 769 Y: 36481740058369645484420180976004932062085375941522344052907594 770 0118552792158551197107484892204562290802810655253510302448455 771 4128548992118101415797909250954 772 Encoded Public 773 29 65 63 86 4F FB 10 8D BA 7A 0A 68 04 6D 00 DA 774 9B 1D C3 A4 AF BA 95 B4 5D 27 B4 35 00 2F DF 32 776 To sign the text "This is a test", Alice first generates her value r 777 and multiplies it by the base point to obtain the value R_(a): 779 Alice: 780 r_a = 39481530989500570659081556772521617337911026343586730199076077 781 22114057563970 782 R_a = 783 97 4A 15 AC C8 05 21 91 87 B7 1F C1 2F AB C4 00 784 6E 52 85 09 54 04 00 5E 30 62 99 F5 62 A5 2F 7E 786 Alice passes her value R_(A) to Bob along with the other parameters 787 required to calculate i. Bob then calculates his value R_(A) and 788 multiplies it by the base point to obtain the value R_(b): 790 Bob: 791 r_b = 53794602633571448603419732447329315217287976777312087913574775 792 08723470105822 793 R_b = 794 8E 48 01 72 91 74 D0 C9 36 44 EA 7B 8A D2 50 0D 795 F2 4B F9 2C 53 B7 AF 2D 91 06 81 79 3D 28 43 DD 797 Bob can now calculate the composite value R = R_(a) + R_(b) and thus 798 the value k. 800 R = 801 55 1A 67 0A D2 8C F6 74 FD A7 0E BE 4D AA A8 8F 802 E6 AB 98 61 7B 7D 04 D4 F2 05 0A 71 D3 81 59 AF 803 k = 2421363997835522134020668429031063921379440688711932467881614021 804 504091928861 806 Bob calculates his signature scalar contribution and returns the 807 value to Alice: 809 Bob: 810 S_b = 16218971061984715973738168270294546698092320250831576357174059 811 25399123547360 813 Alice can now calculate her signature scalar contribution and thus 814 the signature scalar S. 816 Alice: 817 S_a = 48633098250297226038262755114982589781022109179929876390922466 818 96122249236384 819 S = 6485206931228194201200092338527713647911442943076145274809652621 820 521372783744 822 Alice checks to see that the signature verifies: 824 S.B = R + kA = 825 X: 31970754396382072160768904923868016501704809130751339430468771 826 226924902729588 827 Y: 42652466254796906167986746499263519020730974689311471235758253 828 40736275086949 830 6.2. Direct Threshold Signature Ed448 832 The signers are Alice and Bob's Threshold Signature Service 'Bob'. 833 Each creates a key pair: 835 ED448Alice's Key (ED448) 836 UDF: ZAAA-ITSI-GXED-44XA-LICE-XSXK-EY 837 Scalar: 63495803583658817688110446314786076976347236361354035 838 5597788771064742993095132758589292255654895141583596922516472 839 738879360490167934280 840 Encoded Private 841 A0 53 4C 93 3C 34 00 76 AE 5D B5 4A C2 71 5F 43 842 E1 D6 63 2C 5C 56 53 C8 98 A0 8F 03 FF F5 22 96 843 91 45 8C 2B CF E3 FD 7E 2A 9E 0B D6 F4 CC 66 61 844 43 62 72 7B 34 B4 79 92 845 X: 24743197509267833262111449556527285120868167712209919570838426 846 3466168536901525943558973091346360088759980994772668117646359 847 614426660579 848 Y: 21342899120576770537664462049685258390853729788303428349051130 849 8752175233505795318243164692156369495328007220135137156078814 850 081547431302 851 Encoded Public 852 0A 3B F3 27 E7 E1 67 63 2C 59 E2 1C D1 84 C7 83 853 E8 1E D1 68 9F 32 A1 16 99 00 5C DA 29 B9 6C 08 854 E4 15 57 7E E5 63 C2 32 08 23 41 68 5F 49 1F FF 855 BC 4D CD 3A 4E A6 85 49 00 856 ED448Bob's Key (ED448) 857 UDF: ZAAA-ITSI-G2ED-44XB-OBXS-XKEY 858 Scalar: 72649803773199751564998543891898904839718409312910780 859 0262041941160989643727331987658132182181970054245587322070535 860 846720571414845714224 861 Encoded Private 862 BC 53 B4 74 3E A7 A7 FA 9F 05 9A BC 8C 22 26 15 863 A1 4E BB 10 0E B5 59 6B DE 9C 1B E9 F2 3C 65 42 864 E7 B4 47 18 60 AC 18 A6 D2 78 B8 BC CE F5 F4 28 865 B2 3A FF 08 61 EF 6B 7C 866 X: 58235851934808640621920816872959059172692411187640950432203039 867 8116748997750134460231406698091317008063030408798536634284207 868 667468558264 869 Y: 34390767697909283892495761259186538632120422458392131201372282 870 6056455656591826216381185634080685718154852726725624178995827 871 091591132128 872 Encoded Public 873 93 63 5A 45 2D 4C 94 32 45 23 CD E2 A8 46 E4 78 874 A0 80 59 DA 36 CB 6B 0C 06 64 6F BE 51 AB C0 BF 875 1E DB A8 3F 2B 3B 80 0F BF 00 E6 78 DD E0 83 E9 876 AC 20 02 55 87 07 39 38 00 878 The composite Signature Key A = A_(a) + A_(b) 879 Aggregate Key = Alice + Bob () 880 UDF: TBS 881 Scalar: 89488306051273634069773238262841883041784075539841550 882 3672228636597106090916876462340541507950185640860121886233669 883 49466515613996100051 884 Encoded Private 885 D3 29 DD AB F6 0D 99 8B 75 65 B8 06 36 C9 3A 2C 886 D4 08 C3 9B 7C F9 77 8C 68 29 0E 3D 5D C7 3E 00 887 92 8B DC AE 26 FB 16 39 CD 25 1B 23 4A 5A 05 61 888 1D 5C C4 70 0A C9 84 1F 889 X: 17985659098670117617173315763082238685735647626871251468000984 890 2080317111091696183607307614171726960576308774975742249260532 891 199160570999 892 Y: 31506323224859159594386181995639405170623657273945727288760063 893 1624406694682617334725040181287905351066763414658543828623841 894 509161975864 895 Encoded Public 896 9B 3E DF 49 55 40 9F 7B EA 0B AA 40 B7 3D 15 82 897 60 9F 7C 40 CF 67 DE 56 56 0D 03 87 63 3B 15 F2 898 45 33 FE 48 BD 2D A0 A2 8B CC 74 DA 94 0F 39 00 899 AC 39 CB 0A 9F A4 EB B0 00 901 To sign the text "This is a test", Alice first generates her value r 902 and multiplies it by the base point to obtain the value R_(a): 904 Alice: 905 r_a = 12579897228229965435145658294327712989795531501893232106499892 906 89681302839491331449888721535664675983310277410977228241931824542 907 50578091 908 R_a = 909 25 81 8E 72 12 06 2B 9F C2 90 9F 9E 16 55 51 16 910 A1 53 24 FD C3 29 82 A5 3E DC 0E 69 5C C7 FF 7E 911 71 60 4E 21 CB 71 59 84 68 9B 1F 59 E1 56 F0 FD 912 4A 80 67 9C 99 2D C9 A8 80 914 Alice passes her value R_(A) to Bob along with the other parameters 915 required to calculate i. Bob then calculates his value R_(A) and 916 multiplies it by the base point to obtain the value R_(b): 918 Bob: 919 r_b = 94475541305183315492441638684696640787219219352824613903602377 920 05284653346212377761617015793185322655995130417461462487958500972 921 3713102 922 R_b = 923 AF 91 A2 24 B1 B3 5E F4 F3 2C A5 06 45 A7 90 23 924 28 68 4A 3E E8 8D D7 B2 40 12 55 85 20 BF 53 82 925 86 97 9A 3D 84 40 D5 A3 4E E6 A6 D2 2E 80 1A DC 926 40 32 04 DF AB 09 E1 FE 80 928 Bob can now calculate the composite value R = R_(a) + R_(b) and thus 929 the value k. 931 R = 932 FB 04 F2 8A 1D 26 6D AF 0F C5 27 3C 19 4C 9F 30 933 D7 B8 CB B3 73 F2 EC 7C 0C 41 ED D5 AB B6 50 A9 934 C9 AD 45 50 34 A6 24 83 50 91 0A 9A 56 EC 59 D9 935 15 34 81 7A 5D 40 96 F4 80 936 k = 1114611014063501116613867141529424596251655496753131787628559383 937 37364120817354370936515245042197321114567413248741160748378478790 938 681471 940 Bob calculates his signature scalar contribution and returns the 941 value to Alice: 943 Bob: 944 S_b = 16039476917135265334527230911158039502139318338070597455056095 945 64681863169906962950761847223946073430255036087562611717818559618 946 1028696 948 Alice can now calculate her signature scalar contribution and thus 949 the signature scalar S. 951 Alice: 952 S_a = 21026356483062916567544814937806998370021341112531790514607516 953 15676503362950349198935476068933071440579133782644266606317107429 954 0101794 955 S = 3706583340019818190207204584896503787216065945060238796966361180 956 35836653285731214969732329287914487083416987020687832413566704711 957 30490 959 Alice checks to see that the signature verifies: 961 S.B = R + kA = 962 X: 13430030555801715651108391534497698605996566164478554520490263 963 44715275527428 964 Y: 23294518891760930618220409397109930286557491844791521429604956 965 720890326572862 967 6.3. Shamir Threshold Signature Ed25519 969 The administrator creates the composite key pair 970 ED25519Aggregate Key (ED25519) 971 UDF: ZAAA-GTSI-GQED-255X-XAGG-REGA-TEXK-EY 972 Scalar: 39348647608109113656999806950437958090469802387424444 973 589375066079861075223816 974 Encoded Private 975 37 39 5E 7A 8B A5 A0 19 46 4B 58 22 EA 24 A5 71 976 45 2C 2A AC 7A 3E FB CA CE 3F D4 12 9A BA EB 70 977 X: 14198837758377867455716504277518729070915183249890461230792115 978 9904969716778427995951234766002164511738587575257530388758374 979 7824906047250057721855068523970 980 Y: 20211025649802071998810413948266748565975140520947927724517956 981 2067625505077751598018629551746824533726709810990193455662385 982 6152736116303441031851305458040 983 Encoded Public 984 6E 13 79 B4 39 DA 97 9C 5A 34 CE 79 CD 1B 50 DF 985 A0 76 AD 49 81 6D 52 59 A4 2C DB CE 44 FF 3E F5 987 Three key shares are required for Alice, Bob and Carol with a 988 threshold of two. The parameters of the Shamir Secret Sharing 989 polynomial are: 991 a0 = 3934864760810911365699980695043795809046980238742444458937506607 992 9861075223816 993 a1 = 1642892179747526362125411177719513794207741359956661956935408266 994 531254199801 996 The key share values for the participants are 998 xa = 1 999 ya = 4806511901195328949259285312942500680391961950481568516300719654 1000 965058168672 1002 xb = 2 1003 yb = 6449404080942855311384696490662014474599703310438230473236127921 1004 496312368473 1006 xc = 3 1007 yc = 8552906833581194595369211053385340279503283110149848241695852497 1008 42112317285 1010 Alice and Carol are selected to sign the message "This is another 1011 test" 1013 The Lagrange coefficients are: 1015 la = 3618502788666131106986593281521497120428558179689953803000975469 1016 142727125496 1017 lc = 3618502788666131106986593281521497120428558179689953803000975469 1018 142727125494 1020 Alice and Carol select their values ra, rc 1022 ra = 4582163519135697954212356121831281867610872330474418182918654552 1023 719487887500 1024 Ra = 1025 2A E0 F9 8B D2 85 C5 61 5D 14 D8 BF EA E9 96 D3 1026 1A E2 0B 37 8A 7C 5C FE 90 6C DF 36 70 D0 BC 90 1028 rc = 3679566825305648240874136350616349919194440179398151235437522804 1029 353602423864 1030 Rc = 1031 3D 0B 8B D5 B4 5A 93 B0 3E B0 24 CE 42 AD F7 FF 1032 4D 43 6C 09 1C 07 0A F9 76 9C F5 D2 59 E2 B7 9A 1034 The composite value R = R_(a) + R_(c) 1036 R = 1037 B7 93 54 14 DD AC A5 94 00 3D 09 EB 60 E6 91 18 1038 9A AF 60 07 DA CA E5 83 7E 1F 3E 6A C4 49 DF A3 1040 The value k is 1042 k = 40993397091938598651697285820684701229880737187373552994300226559 1043 88467436177 1045 The values R and k (or the document to be signed) and the Lagrange 1046 coefficients are passed to Alice and Carol who use them to calculate 1047 their secret scalar values: 1049 sa = 7209767851792993423888927969413751020587942925722352774451079482 1050 447587253008; 1051 sc = 3190857446987071377218132728852230106453394024182461390916182844 1052 271670966852 1054 The signature contributions can now be calulated: 1056 Sa = 3328989745507326292266821261476737658921447882205957270253608502 1057 484638974498 1058 Sc = 5932746180467179638638850117242322706693329974834825884925701595 1059 858986229620 1061 The dealer calculates the composite value S = S_(a) + S_(b) 1062 S = 2024730348642243716932484815676066124757661497660875549177359160 1063 058170953129 1065 The dealer checks to see that the signature verifies: 1067 S.B = R + kA = 1068 X: 13666591543765071964834317735790194069963726165121686955487832 1069 105142108752977 1070 Y: 20775966697642032279966691396030726941085308409030793184460185 1071 676304105925271 1073 6.4. Shamir Threshold Signature Ed448 1075 The administrator creates the composite key pair 1077 ED448Aggregate Key (ED448) 1078 UDF: ZAAA-ITSI-GQED-44XA-GGRE-GATE-XKEY 1079 Scalar: 50890460656419721531273587958284096015810982760541575 1080 4207268050539683337837216003977228732536078674802149039736292 1081 653681850024283019712 1082 Encoded Private 1083 78 22 7E 3B 89 95 80 5D 04 19 DC 27 F1 7F 9B E4 1084 86 2B 0B DD 55 64 EE 04 19 49 4D DE B9 04 3B 9E 1085 8B 7D DC EC EC 8F DD 1D E7 88 86 FD 11 FD 78 EF 1086 1A 8B 84 8F 77 00 73 65 1087 X: 44109173355278142669484438370724914685176368933547176239809629 1088 7503768465595321590690311221269514682222687386378631457535068 1089 446135118173 1090 Y: 53219402718535721212460981200104434180077825188675868294070079 1091 5084662920552823356888138706016038637934794839496624474125511 1092 419755284720 1093 Encoded Public 1094 43 61 20 A0 B1 DF AA BD 6B 55 00 97 A3 BE CB B8 1095 09 57 20 88 16 69 E4 B9 E1 7E 9C 13 C0 41 5B CB 1096 4D 3E E4 99 2E 2D 48 89 1C C0 FB 26 58 C2 DD 5C 1097 C1 DC 17 82 D7 A0 43 EE 80 1099 Three key shares are required for Alice, Bob and Carol with a 1100 threshold of two. The parameters of the Shamir Secret Sharing 1101 polynomial are: 1103 a0 = 5089046065641972153127358795828409601581098276054157542072680505 1104 39683337837216003977228732536078674802149039736292653681850024283 1105 019712 1106 a1 = 1550999901841386151901998425672690051264689056286441960494229439 1107 42535003917136508299604076339687566636344266479521172051858028847 1108 271091 1110 The key share values for the participants are 1112 xa = 1 1113 ya = 1188755535266306625909428662341065645193477127185714050455733450 1114 96780329869733755128245543000689113548562425088538838819386785551 1115 341466 1117 xb = 2 1118 yb = 9226586263686755514381175682937443605740627817538608602462373924 1119 41693298253306777116538640486843042215963978589683485664710585389 1120 62778 1122 xc = 3 1123 yc = 6565617174710444769668064742464230759546484363220076700367413339 1124 15583297809276002950621850966794948946303706293978583135553315265 1125 84090 1127 Alice and Carol are selected to sign the message "This is another 1128 test" 1130 The Lagrange coefficients are: 1132 la = 9085484053695086131866547598600056679420517008591475753518627489 1133 75730019807697928580978776458461879816551468545458311523868779298 1134 24891 1135 lc = 9085484053695086131866547598600056679420517008591475753518627489 1136 75730019807697928580978776458461879816551468545458311523868779298 1137 24889 1139 Alice and Carol select their values ra, rc 1141 ra = 1496695989301362163168579893078939576055478053582077987842188159 1142 81572439136632201150848887159722470726697626221876540830488497692 1143 099942 1144 Ra = 1145 8F C2 62 01 43 39 35 2F 15 1C 97 BD D6 29 92 ED 1146 C2 DF E7 56 0B 49 37 E4 F7 BA 7A 5D BA 45 1C 39 1147 EE 23 EF FE F3 CB 5B ED 33 AB A8 D9 97 0D B4 9C 1148 70 C1 02 A2 71 08 20 F8 80 1150 rc = 1315259132332389080097729070288895479376412145635234566561260348 1151 85686598945854770737828828936179895865317203017520659128509983064 1152 478834 1153 Rc = 1154 B0 37 9E BC 5A 50 0E DC 19 56 7D 1A 4E 6F 92 63 1155 33 C2 82 5C 77 45 2E A7 79 54 7A A2 FB FE F4 F8 1156 90 CE D1 5C 04 A0 7C EB 87 D2 BA E5 57 CF 3F 45 1157 FA FD 27 7E 10 29 91 AC 80 1159 The composite value R = R_(a) + R_(c) 1161 R = 1162 02 F1 FC 76 4F 34 A6 74 39 CB AF D3 96 DF C2 6F 1163 F8 D2 8C C7 28 C8 36 F1 DE 9A E7 CE 9A DE C6 79 1164 90 9E 2F 2A E8 14 E0 14 CD 06 8B 30 F1 61 EA C0 1165 89 11 7C 85 33 F2 8A 08 00 1167 The value k is 1169 k = 24349522678580469525531601305349874786441698191777297108871400571 1170 64322563268580245413433284674218785382878420998275959014579479614 1171 7935 1173 The values R and k (or the document to be signed) and the Lagrange 1174 coefficients are passed to Alice and Carol who use them to calculate 1175 their secret scalar values: 1177 sa = 1783133302899459938864142993511598467790215690778571075683600176 1178 45170494804600632692368314501033670322843637632808258229080178327 1179 012199; 1180 sc = 1488815952003494987889906282596799797906779183557291315685354830 1181 99366839071075785568664662743352628515995108394392733147996090096 1182 357734 1184 The signature contributions can now be calulated: 1186 Sa = 1813098642235159385577750965787902646262662182590690423179327447 1187 87548599871305490942337029804015073122558685157994421699467930005 1188 403407 1189 Sc = 1786732187196626949822274127967658987330014322486999403584441819 1190 61287645876306473101042347188778074681315014827243713964951294010 1191 546032 1193 The dealer calculates the composite value S = S_(a) + S_(b) 1195 S = 1782734018692769109026715574035550297708573103359394676060043769 1196 53690241786072378327183621701100771840563406276146473359645468156 1197 299660 1199 The dealer checks to see that the signature verifies: 1201 S.B = R + kA = 1202 X: 22269164075823155982206235662550890548495096320747189740776580 1203 698080912420099 1204 Y: 22192519940337997518518077627365944525840303920321484782585911 1205 563432903433924 1207 7. Security Considerations 1209 All the security considerations of [RFC7748], [RFC8032] and 1210 [draft-hallambaker-threshold] apply and are hereby incorporated by 1211 reference. 1213 7.1. Rogue Key attack 1215 The rogue key attack described in [draft-hallambaker-threshold] is of 1216 particular concern to generation of threshold signatures. 1218 If _A_ and _B_ are public keys, the intrinsic degree of trust in the 1219 composite keypair _A_ + _B_ is that of the lesser of _A_ and _B_. 1221 7.2. Disclosure or reuse of the value r 1223 As in any Schnorr signature scheme, compromise of the value _r_ 1224 results in compromise of the private key. The base signature 1225 specification [RFC8032] describes a deterministic construction of _r_ 1226 that ensures confidentiality and uniqueness for a given value of _k_. 1228 As described above, this approach is not applicable to the generation 1229 of values of _r_(i)_ to compute threshold signature contributions. 1230 Accordingly the requirements of [RFC4086] regarding requirements for 1231 randomness MUST be observed. 1233 Implementations MUST NOT use a deterministic generation of the value 1234 _r_(i)_ for any threshold contribution except for calculating the 1235 final contribution when all the other parameters required to 1236 calculate _k_ are known. 1238 7.3. Resource exhaustion attack 1240 Implementation of the general two stage signing algorithm requires 1241 that signers track generation and use of the values _r_(i)_ to avoid 1242 reuse for different values of _R_(i)_. Implementations MUST ensure 1243 that exhaustion of this resource by one party does not cause other 1244 parties to be denied service. 1246 7.4. Signature Uniqueness 1248 Signatures generated in strict conformance with [RFC8032] are 1249 guaranteed to be unique such that signing the same document with the 1250 same key will always result in the same signature value. 1252 The signature modes described in this document are computationally 1253 indistinguishable from those created in accordance with [RFC8032] but 1254 are not unique. 1256 Implementations MUST not use threshold signatures in applications 1257 where signature values are used in place of cryptographic digests as 1258 unique content identifiers. 1260 8. IANA Considerations 1262 This document requires no IANA actions. 1264 9. Acknowledgements 1266 [TBS] 1268 10. Normative References 1270 [draft-hallambaker-mesh-udf] 1271 Hallam-Baker, P., "Mathematical Mesh 3.0 Part II: Uniform 1272 Data Fingerprint.", Work in Progress, Internet-Draft, 1273 draft-hallambaker-mesh-udf-10, July 27, 2020, 1274 . 1277 [draft-hallambaker-threshold] 1278 Hallam-Baker, P., "Threshold Modes in Elliptic Curves", 1279 Work in Progress, Internet-Draft, draft-hallambaker- 1280 threshold-02, March 9, 2020, . 1283 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1284 Requirement Levels", BCP 14, RFC 2119, 1285 DOI 10.17487/RFC2119, March 1997, 1286 . 1288 [RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker, 1289 "Randomness Requirements for Security", BCP 106, RFC 4086, 1290 DOI 10.17487/RFC4086, June 2005, 1291 . 1293 [RFC7748] Langley, A., Hamburg, M., and S. Turner, "Elliptic Curves 1294 for Security", RFC 7748, DOI 10.17487/RFC7748, January 1295 2016, . 1297 [RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital 1298 Signature Algorithm (EdDSA)", RFC 8032, 1299 DOI 10.17487/RFC8032, January 2017, 1300 . 1302 11. Informative References 1304 [draft-hallambaker-mesh-developer] 1305 Hallam-Baker, P., "Mathematical Mesh: Reference 1306 Implementation", Work in Progress, Internet-Draft, draft- 1307 hallambaker-mesh-developer-10, July 27, 2020, 1308 . 1311 [Komlo] Komlo, C. and I. Goldberg, "FROST: Flexible Round- 1312 Optimized Schnorr Threshold Signatures", 2020. 1314 [RFC5860] Vigoureux, M., Ward, D., and M. Betts, "Requirements for 1315 Operations, Administration, and Maintenance (OAM) in MPLS 1316 Transport Networks", RFC 5860, DOI 10.17487/RFC5860, May 1317 2010, . 1319 [Shamir79] Shamir, A., "How to share a secret.", 1979.