GG1820

Chen-Mou Cheng

chenmou.cheng@gmail.com

Reference

• R. Gennaro and S. Goldfeder. Fast Multiparty Threshold ECDSA with Fast Trustless Setup. https://eprint.iacr.org/2019/114
• R. Gennaro and S. Goldfeder. One Round Threshold ECDSA with Identifiable Abort.  https://eprint.iacr.org/2020/540

Shamir's secret sharing

• Break into shares \(p(1),p(2),\ldots,p(n)\) for \[ p(x)=\color{red}a_0\color{black}+a_1x+\cdots+a_{t-1}x^{t-1},t\leq n \]
• Reconstruct via Lagrange interpolation \[ \forall S=\{s_1,\ldots,s_t\}\subset\{1,\ldots,n\},p(x)=\sum_{i=1}^t\frac{\prod_{j=1,j\neq i}^t(x-s_j)}{\prod_{j=1,j\neq i}^t(s_i-s_j)}p(s_i) \]
• In particular, SSS is linear: \[ \color{red}a_0\color{black}=p(0)=\sum_{i=1}^t\lambda_{i,S}p(s_i)=\begin{bmatrix} \lambda_{1,S} & \cdots & \lambda_{t,S} \end{bmatrix} \begin{bmatrix} p(s_1) \\ \vdots \\ p(s_t) \end{bmatrix} \]

Verifiable secret sharing

• Dealer publishes \(v_0=g^{\color{red}a_0\color{black}},v_1=g^{a_1},\ldots,v_{t-1}=g^{a_{t-1}}\)
• Player \(i\) checks whether \[ g^{p(i)}=g^{\color{red}a_0\color{black}+a_1i+\cdots+a_{t-1}i^{t-1}}\stackrel{?}{=}v_0v_1^i\cdots v_{t-1}^{i^{t-1}} \]

Putting it all together (GG18)

1. Generate \(k=\sum_{i\in S}k_i,\gamma=\sum_{i\in S}\gamma_i\) and publish \(\Gamma_i=g^{\gamma_i}\)
2. Use MtA to compute \[ \begin{aligned}k\gamma&=\sum_{i,j\in S}k_i\gamma_j\bmod q&=\sum_{i\in S}\delta_i,\\ kx&=\sum_{i,j\in S}k_i\left(\lambda_{j,S}x_j\right)\bmod q&=\sum_{i\in S}\sigma_i\end{aligned} \]
3. Reconstruct \(\delta\bmod q\)
4. \(H'\left(\left(\prod_{i\in S}\Gamma_i\right)^{\delta^{-1}}\right)=H'\left(\left(g^{\sum_{i\in S}\gamma_i}\right)^{\delta^{-1}}\right)=H'\left(g^{k^{-1}}\right)=r\)
5. Set \(s_i=mk_i+r\sigma_i\) and compute \[ \sum_{i\in S}s_i=m\sum_{i\in S}k_i+r\sum_{i\in S}\sigma_i=mk+rkx=s \]

Putting it all together (GG20)

(Recall: \(k=\sum k_i\) and \(kx=\sum\sigma_i\) )

4. \(H'\left(\left(\prod_{i\in S}\Gamma_i\right)^{\delta^{-1}}\right)=H'\left(\left(g^{\sum_{i\in S}\gamma_i}\right)^{\delta^{-1}}\right)=H'\left(g^{k^{-1}}\right)=r\)

5. Broadcast \(\bar R_i=(g^{k^{-1}})^{k_i}\) and check if \(g=\prod_{i\in S}\bar R_i\)

6. Broadcast \(S_i=(g^{k^{-1}})^{\sigma_i}\) and check if \( y=\prod_{i\in S}S_i \)

7. Set \(s_i=mk_i+r\sigma_i\) and compute \[ \sum_{i\in S}s_i=m\sum_{i\in S}k_i+r\sum_{i\in S}\sigma_i=mk+rkx=s \]

(Abort if the signature does not verify)

Schnorr's DLP proof

• To prove that P knows \(x\in(\mathbb Z/q\mathbb Z)^*\) s.t. \(y=g^x\)
  • P publishes \(t=g^v\) for a random secret \(v\in(\mathbb Z/q\mathbb Z)^*\)
  • V challenges P with a random \(c\in(\mathbb Z/q\mathbb Z)^*\)
  • P responds with \(r=v-cx\)
  • V verifies \(t=g^ry^c\)
    (Because \(g^ry^c=g^{v-cx}(g^x)^c=g^v\))
• Generalizes to any structures with an endomorphism ring (containing a subring) isomorphic to \((\mathbb Z/n\mathbb Z)^*\)

Fiat-Shamir heuristics

• To prove that P knows \(x\in(\mathbb Z/q\mathbb Z)^*\) s.t. \(y=g^x\)
  • P publishes \(t=g^v\) for a random secret \(v\in(\mathbb Z/q\mathbb Z)^*\)
  • \(\color{red}c=H(g||y||t||m)\in(\mathbb Z/q\mathbb Z)^*\)
  • P responds with \(r=v-cx\)
  • V verifies \(t=g^ry^c\)
    (Because \(g^ry^c=g^{v-cx}(g^x)^c=g^v\))

Commitment schemes

• \(C:\mathbb P\times\mathbb R\rightarrow\mathbb C\)
  • Binding: cannot change a commitment afterward
  • Concealing: cannot tell what has been committed
• Hash-based scheme
  • \(C(m,r)=H(r||m)\) for some hash function \(H\)
• Pedersen's scheme
  • \(C(m,r)=g^rh^m\) for \(h=g^x\) unknown to Prover
  • \(C(m_1,r_1)C(m_2,r_2)=C(m_1+m_2,r_1+r_2)\)

A basic ZK range proof

• Due to Damgård (1993)
• Given \(c\leftarrow C(m,r)\) for \(m\in[a,a+e)\)
• Prover: \(C(t_1,r_1),C(t_2,r_2)\) for \(t_1\stackrel{\$}{\leftarrow}[0,e),t_2=t_1-e\)
• Verifier asks Prover opens either:
  • \(C(t_1,r_1),C(t_2,r_2)\)
  • Or \(C(t_i+m,r_i+r)\) s.t. \(t_i+m\in[a,a+e)\)