Subject: [Cfrg] New Version Notification for draft-komlo-frost-00.txt

From: Chelsea Komlo <[email-masked]>
Date: Fri, 7 Aug 2020 19:19:19 +0000

All,

We posted our -00 draft for FROST, a Flexible Round Optimized Schnorr Threshold Signature scheme. This draft reflects our updated FROST construction [1].

FROST improves upon prior constructions as it can be used as a single-round signing protocol with preprocessing, while remaining safe against known forgery attacks that are applicable to prior schemes in the literature [2].

Please let us know if there are any questions. We look forward to this draft being considered for adoption as a work item.

Chelsea

[1] https://eprint.iacr.org/2020/852

[2] https://eprint.iacr.org/2018/417

________________________________
From: [email-masked] <[email-masked]>
Sent: Friday, August 7, 2020 6:53 AM
To: Ian Goldberg; Chelsea Komlo
Subject: New Version Notification for draft-komlo-frost-00.txt

A new version of I-D, draft-komlo-frost-00.txt
has been successfully submitted by Chelsea Komlo and posted to the
IETF repository.

Name:           draft-komlo-frost
Revision:       00
Title:          FROST: Flexible Round-Optimized Schnorr Threshold Signatures
Document date:  2020-08-07
Group:          Individual Submission
Pages:          22
URL:            https://www.ietf.org/internet-drafts/draft-komlo-frost-00.txt
Status:         https://datatracker.ietf.org/doc/draft-komlo-frost/
Htmlized:       https://tools.ietf.org/html/draft-komlo-frost-00
Htmlized:       https://datatracker.ietf.org/doc/html/draft-komlo-frost
draft-komlo-frost-00<https://datatracker.ietf.org/doc/html/draft-komlo-frost>
datatracker.ietf.org
FROST: Flexible Round-Optimized Schnorr Threshold Signatures (Internet-Draft, 2020)

Abstract:
   Unlike signatures in a single-party setting, threshold signatures
   require cooperation among a threshold number of signers each holding
   a share of a common private key.  Consequently, generating signatures
   in a threshold setting imposes overhead due to network rounds among
   signers, proving costly when secret shares are stored on network-
   limited devices or when coordination occurs over unreliable networks.
   This draft describes FROST, a Flexible Round-Optimized Schnorr
   Threshold signature scheme that reduces network overhead during
   signing operations while employing a novel technique to protect
   against forgery attacks applicable to similar schemes in the
   literature.  FROST improves upon the state of the art in Schnorr
   threshold signature protocols, as it can safely perform signing
   operations in a single round without limiting concurrency of signing
   operations, yet allows for true threshold signing, as only a
   threshold number of participants are required for signing operations.
   FROST can be used as either a two-round protocol where signers send
   and receive two messages in total, or optimized to a single-round
   signing protocol with a pre-processing stage.  FROST achieves its
   efficiency improvements in part by allowing the protocol to abort in
   the presence of a misbehaving participant (who is then identified and
   excluded from future operations)--a reasonable model for practical
   deployment scenarios.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Richard Barnes <[email-masked]>
Date: Fri, 7 Aug 2020 15:38:06 -0400

Hi Chelsea,

Thanks for posting this.  I've been following FROST and looked at it for a
couple of applications.  I appreciate its simplicity and robustness
relative to other options in this space.  I would be interested in this
draft moving forward.

--RLB

On Fri, Aug 7, 2020 at 3:20 PM Chelsea Komlo <[email-masked]> wrote:

> All,
>
>
> We posted our -00 draft for FROST, a Flexible Round Optimized Schnorr
> Threshold Signature scheme. This draft reflects our updated FROST
> construction [1].
>
>
> FROST improves upon prior constructions as it can be used as a
> single-round signing protocol with preprocessing, while remaining safe
> against known forgery attacks that are applicable to prior schemes in the
> literature [2].
>
>
> Please let us know if there are any questions. We look forward to this
> draft being considered for adoption as a work item.
>
>
> Chelsea
>
>
> ------------------------------
> *From:* [email-masked] <[email-masked]>
> *Sent:* Friday, August 7, 2020 6:53 AM
> *To:* Ian Goldberg; Chelsea Komlo
> *Subject:* New Version Notification for draft-komlo-frost-00.txt
>
>
> URL:
> https://www.ietf.org/internet-drafts/draft-komlo-frost-00.txt
> <https://tools.ietf..org/html/draft-komlo-frost-00>
> draft-komlo-frost-00
> <https://datatracker.ietf.org/doc/html/draft-komlo-frost>
> datatracker.ietf.org
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Nick Mathewson <[email-masked]>
Date: Wed, 12 Aug 2020 10:19:10 -0400

> Threshold Signature scheme. This draft reflects our updated FROST
Hello!  I'm told it's important to know whether there's interest for having
a standardized algorithm of this kind.  At Tor, we are eager to have any
standardized, efficient, secure threshold signature scheme for several
purposes, including our planned replacement for our current directory
protocol.
(We don't have enough cryptographic expertise to evaluate this specific
scheme, however.)

cheers,
-- 
Nick Mathewson

---

From: "Christopher Wood" <[email-masked]>
Date: Tue, 18 Aug 2020 17:10:12 -0700

On Fri, Aug 7, 2020, at 12:38 PM, Richard Barnes wrote:
> Hi Chelsea,
> 
> Thanks for posting this.  I've been following FROST and looked at it 
> for a couple of applications.  I appreciate its simplicity and 
> robustness relative to other options in this space.  I would be 
> interested in this draft moving forward.

+1 -- given the growing use cases for threshold cryptography, and the tradeoffs FROST makes for improved network overhead, I'd like to see this draft advance as well.

Best,
Chris

> > Htmlized:       https://tools.ietf.org/html/draft-komlo-frost-00 <https://tools.ietf...org/html/draft-komlo-frost-00>
> > draft-komlo-frost-00 <https://datatracker.ietf.org/doc/html/draft-komlo-frost>
> > datatracker.ietf.org