[curves] Threshold ECDSA / comparison to Schnorr

[Tony Arcieri]

I have one question about these sorts of schemes...

There's a naive approach where you don't attempt to model multisignature
trust in terms of a single signature, but rather have a whitelisted set of
keys, and have k / n potential signers produce an individual signature.

This clearly takes more space for signatures, but seems a lot more
straightforward and easy-to-implement. Also, it can work with any signature
scheme, so it's pluggable and easy to switch out once you have the basic
framework in place.

What is the advantage of "fancy" threshold signature schemes? I'm really
not seeing it aside from the space savings.

FWIW The Update Framework uses a unique signature per principal.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20150310/80b3dbcc/attachment.html>