Two-Round Threshold Schnorr Signatures with FROST
draft-irtf-cfrg-frost-15

(Via drafts-eval@iana.org): IESG/Authors/ISE:

The IANA Functions Operator has reviewed draft-irtf-cfrg-frost-15 and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

For definitions of IANA review states, please see:

https://datatracker.ietf.org/help/state/draft/iana-review

Thank you,

Amanda Baber
IANA Operations Manager

[Ballot comment]
I performed the IRSG review for this document; it was broadly ready then, and my minor comments have been addressed by the new revisions; thanks!

[Ballot comment]
Disclaimer: I am a CFRG co-chair.
On the other hand, I was not heavily involved in the process with this document, since Nick Sullivan was the document shepherd.

[Ballot comment]
Disclaimer: I am a CFRG co-chair.
On the other hand, I was not really involved in the process with this document, since Nick Sullivan was the document shepherd.

IRTF Chair review comments sent on 2023-04-13. Marking as Revised I-D Needed for now, but it may just need discussion. Awaiting confirmation that any necessary IPR disclosures have been made.

Technical Summary

This document describes a mechanism for threshold signatures over prime
order groups. FROST signatures can be issued after a threshold number of
entities cooperate to compute a signature, allowing for improved distribution
of trust and security. The scheme also minimizes the network overhead of
producing Schnorr signatures in a threshold setting, as well as reducing the
amount of communication required between parties.

FROST is designed with flexibility in mind, allowing for different levels of
security depending on the number of entities involved in the signing process.
This makes it suitable for use in various applications such as distributed ledgers,
multi-signature wallets, and secure hardware devices. Additionally, FROST
provides an efficient way to securely share secrets among multiple parties
without having to rely on a trusted third party or central authority.

This document also provides concrete instantiations of these signatures over
several types of elliptic curves or prime order groups derived from elliptic curves
(such as Ristretto). Signatures produced with this method for Ed25519 are
compatible with signature verification algorithms described in RFC 8032.
This document is a product of the Crypto Forum Research Group (CFRG) in
the IRTF.

Working Group Summary

The document was adopted in 2021 as the starting point for a call for adoption
for threshold signatures at the CFRG. It has gone through multiple iterations
and improvements after adoption including compatibility with curves defined
In the CFRG and NIST.

Document Quality

This document went through an expert review by Thomas Pornin on the Crypto
Review panel and extensive review from CFRG participants, including Tim Ruffins,
Orie Steele, Conrado Gouvêa, Henry de Valence, Paul Bottinelli, Christopher Patton,
Denis Varlakov and others. The shepherd also reviewed the document and provided
Comments during two last call periods. There are several implementations of this
draft online in various languages and the draft includes test vectors.

Personnel

Nick Sullivan is the Document Shepherd.
Colin Perkins is the IRTF Chair.

Technical Summary

This document describes a mechanism for threshold signatures over prime
order groups. FROST signatures can be issued after a threshold number of
entities cooperate to compute a signature, allowing for improved distribution
of trust and security. The scheme also minimizes the network overhead of
producing Schnorr signatures in a threshold setting, as well as reducing the
amount of communication required between parties.

FROST is designed with flexibility in mind, allowing for different levels of
security depending on the number of entities involved in the signing process.
This makes it suitable for use in various applications such as distributed ledgers,
multi-signature wallets, and secure hardware devices. Additionally, FROST
provides an efficient way to securely share secrets among multiple parties
without having to rely on a trusted third party or central authority.

This document also provides concrete instantiations of these signatures over
several types of elliptic curves or prime order groups derived from elliptic curves
(such as Ristretto). Signatures produced with this method for Ed25519 are
compatible with signature verification algorithms described in RFC 8032.
This document is a product of the Crypto Forum Research Group (CFRG) in
the IRTF.

Working Group Summary

The document was adopted in 2021 as the starting point for a call for adoption
for threshold signatures at the CFRG. It has gone through multiple iterations
and improvements after adoption including compatibility with curves defined
In the CFRG and NIST.

Document Quality

This document went through an expert review by Thomas Pornin on the Crypto
Review panel and extensive review from CFRG participants, including Tim Ruffins,
Orie Steele, Conrado Gouvêa, Henry de Valence, Paul Bottinelli, Christopher Patton,
Denis Varlakov and others. The shepherd also reviewed the document and provided
Comments during two last call periods. There are several implementations of this
draft online in various languages and the draft includes test vectors.

Personnel

Nick Sullivan is the Document Shepherd.
Colin Perkins is the IRTF Chair.