Threshold Signatures Using Ed25519 and Ed448
draft-hallambaker-threshold-sigs-00

Document Type Active Internet-Draft (individual)
Last updated 2020-01-05
Stream (None)
Intended RFC status (None)
Formats plain text html xml pdf htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
Network Working Group                                 P. M. Hallam-Baker
Internet-Draft                                     Venture Cryptography.
Intended status: Informational                            5 January 2020
Expires: 8 July 2020

              Threshold Signatures Using Ed25519 and Ed448
                  draft-hallambaker-threshold-sigs-00

Abstract

   A Threshold signature scheme is described.  The signatures created
   are computationally indistinguishable from those produced using the
   Ed25519 and Ed448 curves as specified in RFC8032 except in that they
   are non-deterministic.  Threshold signatures are a form of digital
   signature whose creation requires two or more parties to interact but
   does not disclose the number or identities of the parties involved.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 8 July 2020.

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.

Hallam-Baker               Expires 8 July 2020                  [Page 1]
Internet-Draft    Threshold Signatures Ed25519 & Ed448      January 2020

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Definitions . . . . . . . . . . . . . . . . . . . . . . . . .   4
     2.1.  Requirements Language . . . . . . . . . . . . . . . . . .   4
     2.2.  Defined Terms . . . . . . . . . . . . . . . . . . . . . .   4
     2.3.  Related Specifications  . . . . . . . . . . . . . . . . .   4
     2.4.  Implementation Status . . . . . . . . . . . . . . . . . .   4
   3.  Threshold Signature Construction  . . . . . . . . . . . . . .   4
     3.1.  Threshold signature . . . . . . . . . . . . . . . . . . .   6
     3.2.  Ed2519 Signature  . . . . . . . . . . . . . . . . . . . .   8
     3.3.  Ed448 Signature . . . . . . . . . . . . . . . . . . . . .   9
     3.4.  Security Analysis . . . . . . . . . . . . . . . . . . . .  10
       3.4.1.  Replay Attack . . . . . . . . . . . . . . . . . . . .  10
       3.4.2.  Malicious Contribution Attack . . . . . . . . . . . .  11
       3.4.3.  Rogue Key Attack  . . . . . . . . . . . . . . . . . .  11
   4.  Unanimous Signature . . . . . . . . . . . . . . . . . . . . .  12
     4.1.  Using threshold key generation  . . . . . . . . . . . . .  12
     4.2.  Using key splitting . . . . . . . . . . . . . . . . . . .  13
   5.  Quorate Signature . . . . . . . . . . . . . . . . . . . . . .  13
     5.1.  Key Generation  . . . . . . . . . . . . . . . . . . . . .  13
     5.2.  Calculating the secret scalar value . . . . . . . . . . .  14
   6.  Test Vectors  . . . . . . . . . . . . . . . . . . . . . . . .  15
     6.1.  Unanimous Threshold Signature Ed25519 . . . . . . . . . .  15
     6.2.  Unanimous Threshold Signature Ed448 . . . . . . . . . . .  17
     6.3.  Quorate Threshold Signature Ed25519 . . . . . . . . . . .  20
     6.4.  Quorate Threshold Signature Ed448 . . . . . . . . . . . .  23
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .  25
   8.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  25
   9.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  25
   10. Normative References  . . . . . . . . . . . . . . . . . . . .  26
   11. Informative References  . . . . . . . . . . . . . . . . . . .  26

1.  Introduction

   Threshold encryption and key generation provide compelling advantages
   over single private key approaches because splitting the private key
   permits the use of that key to be divided between two or more roles.

   All existing digital signatures allow the signer role to be divided
   between multiple parties by attaching multiple signatures to the
   signed document.  This approach, known as multi-signatures is
   distinguished from a threshold signature scheme in that the identity
   and roles of the individual signers is exposed.  In a threshold
   signature scheme, the creation of a single signature requires the
   participation of multiple signers and the signature itself does not
Show full document text