search

bnb-chain / tss-lib

Threshold Signature Scheme, for ECDSA and EDDSA
MIT License
778 stars 265 forks source link

Can all parties use the same preparam? #153

Open yandc opened 2 years ago

yandc commented 2 years ago

Can anyone explain what the role of preparam is? What problems will there be if all participants are allowed to use a fixed number of preparams?

yycen commented 2 years ago

The pre-parameters h1j, h2j, and NTildej are used in sigma PoK protocols, as to commit to private value x, h1^x * h2^r for random r. The prover should not know the relation of h1 and h2=h1^k, otherwise he can easily commit a fake value x' by setting x'+kr'= x+kr; So the pre-parameters would be provided by the verifier side. On the other side, the verifier should not be able to extract private value from the commitment of prover, so it needs to prove that pre-parameters are safe, like zkmod or zkprm does. If there is a multi-party protocol that can generate these pre-parameters jointly, then we can use only one set of pre-parameter, and simplify the signing protocol significantly. I know there are some protocols, but not sure if it is practical or not. And if we can assume a trusted third party, then we can use it to generate pre-paremeters.

yandc commented 2 years ago

The pre-parameters h1j, h2j, and NTildej are used in sigma PoK protocols, as to commit to private value x, h1^x * h2^r for random r. The prover should not know the relation of h1 and h2=h1^k, otherwise he can easily commit a fake value x' by setting x'+kr'= x+kr; So the pre-parameters would be provided by the verifier side. On the other side, the verifier should not be able to extract private value from the commitment of prover, so it needs to prove that pre-parameters are safe, like zkmod or zkprm does. If there is a multi-party protocol that can generate these pre-parameters jointly, then we can use only one set of pre-parameter, and simplify the signing protocol significantly. I know there are some protocols, but not sure if it is practical or not. And if we can assume a trusted third party, then we can use it to generate pre-paremeters.

I plan to use tsslib in web pages through wasm technology, but in practice we found that generating pre-parameters is too slow. Therefore, we intend to generate these pre-parameters in advance on the server and consume them when created tss key. I am confused why this protocol runs so slowly in wasm. Not only pre-parameter, key creation and signing are also slow.