Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.Sign up
Two round trip Schnorr multi-signatures #6
There is now supposedly a clear break for the simple two-round multi-signature scheme, maybe not in https://eprint.iacr.org/2018/417 but forthcoming, so we'll do the three round version using session types, but..
There are many real world problems with using session types on small devices, including that you ideally should never serialize anything. I noticed an approach to this problem in
We do eventually want two-round multi-signatures so we need :
First, another curve with base field Z/lZ where l is the group group order of Ed25519, meaning l = 2^252+27742317777372353535851937790883648493. We'd prefer an Edwards curve with group order 2^255-19, but this sounds impossible. Any Edwards curve for which we can implement Ristretto works for this use case however. It'd be cool if we find a non-Edwards curve with group order 2^255-19 though.
Second, an implementation of a ZK proof scheme for the VRF that taks a key from this curve and yields a point on Ed25519. We should collaborate with blockstream on this as much as possible, but it's considerable work.
I think #15 mostly supersedes this issue for now, as it provides reasonable messages sizes which matters for parity signer use cases. I'll leave this open however since the two-round trip Schnorr multi-signatures looks solvable this way, but maybe it's not really required here.