[curves] Threshold ECDSA / comparison to Schnorr

[Trevor Perrin]

On Tue, Mar 10, 2015 at 8:19 AM, Watson Ladd <watsonbladd at gmail.com> wrote:
>
> Threshold Schnorr can directly get any linear sharing
> scheme with linear storage cost, while threshold ECDSA requires
> enumerating all sets that are allowed.

OK, so it's similar to the threshold RSA of [1] which turns a
distributed scheme into an m-of-n scheme by sharing the private key
n-choose-m times, e.g.

k-of-k = 1 share
2-of-3 = 3 shares
3-of-5 = 10 shares
4-of-7 = 35 shares
5-of-10 = 252 shares (worst case for n <= 10)

That seems fine for typical uses.

Trevor

[1] http://crypto.stanford.edu/~dabo/papers/ittc.pdf