[curves] Threshold ECDSA / comparison to Schnorr

Trevor Perrin trevp at trevp.net
Tue Mar 10 13:08:46 PDT 2015

On Tue, Mar 10, 2015 at 8:19 AM, Watson Ladd <watsonbladd at gmail.com> wrote:
> Threshold Schnorr can directly get any linear sharing
> scheme with linear storage cost, while threshold ECDSA requires
> enumerating all sets that are allowed.

OK, so it's similar to the threshold RSA of [1] which turns a
distributed scheme into an m-of-n scheme by sharing the private key
n-choose-m times, e.g.

k-of-k = 1 share
2-of-3 = 3 shares
3-of-5 = 10 shares
4-of-7 = 35 shares
5-of-10 = 252 shares (worst case for n <= 10)

That seems fine for typical uses.


[1] http://crypto.stanford.edu/~dabo/papers/ittc.pdf

More information about the Curves mailing list