Multi-Signatures for Blockchains Yannick Seurin Agence nationale de - - PowerPoint PPT Presentation

▶
multi signatures for blockchains
SMART_READER_LITE
LIVE PREVIEW

Multi-Signatures for Blockchains Yannick Seurin Agence nationale de - - PowerPoint PPT Presentation

Nov 06, 2023 231 likes •922 views

Multi-Signatures for Blockchains Yannick Seurin Agence nationale de la scurit des systmes dinformation June 12, 2019 LINCS Blockchain Day Y. Seurin (ANSSI) Multi-Signatures for Blockchains 12/06/2019 1 / 17 Uses of cryptography

slide-1
SLIDE 1

Multi-Signatures for Blockchains

Yannick Seurin

Agence nationale de la sécurité des systèmes d’information

June 12, 2019 — LINCS Blockchain Day

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 1 / 17

slide-2
SLIDE 2

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-3
SLIDE 3

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-4
SLIDE 4

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-5
SLIDE 5

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-6
SLIDE 6

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-7
SLIDE 7

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-8
SLIDE 8

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-9
SLIDE 9

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-10
SLIDE 10

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-11
SLIDE 11

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-12
SLIDE 12

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-13
SLIDE 13

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-14
SLIDE 14

Uses of cryptography in blockchains

  • define valid transactions
  • signatures
  • multi-, threshold, aggregate, . . . signatures
  • achieve distributed consensus on the state of the ledger
  • proof of work: hash functions
  • proof of stake:
  • verifiable random functions (VRFs)
  • verifiable delay functions (VDFs)
  • proof of space
  • provide privacy
  • ring signatures, stealth addresses (Monero)
  • confidential transactions (homomorphic commitments, range proofs)
  • zero-knowledge proofs / ZK-SNARKs (Zcash)
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 2 / 17

slide-15
SLIDE 15

Bitcoin transactions

A Bitcoin transaction spends inputs and creates outputs:

  • an input consists of a reference to an output of a previous

transaction and a signature authorizing spending of this output

  • an output consists of an amount and a public key

txid: e62b0a. . . Inputs Outputs

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 3 / 17

slide-16
SLIDE 16

Bitcoin transactions

A Bitcoin transaction spends inputs and creates outputs:

  • an input consists of a reference to an output of a previous

transaction and a signature authorizing spending of this output

  • an output consists of an amount and a public key

txid: e62b0a. . . Inputs Outputs prevOut: {txid = 29a5c7. . . , ind=3} sig: 3f4de6. . . 3 BTC prevOut: {txid = 63ba6f. . . , ind=1} sig: f7b6c4. . . 1 BTC prevOut: {txid = e953b0. . . , ind=7} sig: fbb521. . . 5 BTC

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 3 / 17

slide-17
SLIDE 17

Bitcoin transactions

A Bitcoin transaction spends inputs and creates outputs:

  • an input consists of a reference to an output of a previous

transaction and a signature authorizing spending of this output

  • an output consists of an amount and a public key

txid: e62b0a. . . Inputs Outputs prevOut: {txid = 29a5c7. . . , ind=3} sig: 3f4de6. . . 3 BTC prevOut: {txid = 63ba6f. . . , ind=1} sig: f7b6c4. . . 1 BTC prevOut: {txid = e953b0. . . , ind=7} sig: fbb521. . . 5 BTC val: 7 BTC pubKey: 601b3a. . . val: 2 BTC pubKey: d781a3. . .

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 3 / 17

slide-18
SLIDE 18

Signatures in Bitcoin

  • Bitcoin (and ∼ all blockchains) use ECDSA (curve secp256k1)
  • size of an ECDSA public key: 33 bytes
  • typical size of an ECDSA signature: 72 bytes

(two 32-bytes integers + 6 bytes DER encoding)

  • 420 000 000 transactions in the blockchain, ∼ 2 inputs/tx

⇒ ≃ 88 GB of pk+sig data (40% blockchain size)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 4 / 17

slide-19
SLIDE 19

Signatures in Bitcoin

  • Bitcoin (and ∼ all blockchains) use ECDSA (curve secp256k1)
  • size of an ECDSA public key: 33 bytes
  • typical size of an ECDSA signature: 72 bytes

(two 32-bytes integers + 6 bytes DER encoding)

  • 420 000 000 transactions in the blockchain, ∼ 2 inputs/tx

⇒ ≃ 88 GB of pk+sig data (40% blockchain size)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 4 / 17

slide-20
SLIDE 20

Signatures in Bitcoin

  • Bitcoin (and ∼ all blockchains) use ECDSA (curve secp256k1)
  • size of an ECDSA public key: 33 bytes
  • typical size of an ECDSA signature: 72 bytes

(two 32-bytes integers + 6 bytes DER encoding)

  • 420 000 000 transactions in the blockchain, ∼ 2 inputs/tx

⇒ ≃ 88 GB of pk+sig data (40% blockchain size)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 4 / 17

slide-21
SLIDE 21

Signatures in Bitcoin

  • Bitcoin (and ∼ all blockchains) use ECDSA (curve secp256k1)
  • size of an ECDSA public key: 33 bytes
  • typical size of an ECDSA signature: 72 bytes

(two 32-bytes integers + 6 bytes DER encoding)

  • 420 000 000 transactions in the blockchain, ∼ 2 inputs/tx

⇒ ≃ 88 GB of pk+sig data (40% blockchain size)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 4 / 17

slide-22
SLIDE 22

Optimizing transaction size matters

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 5 / 17

slide-23
SLIDE 23

Signature scheme: definition

A signature scheme consists of three algorithms:

  • 1. key generation algorithm KeyGen:
  • returns a public/secret key pair (pk, sk)
  • 2. signature algorithm Sign:
  • takes as input a secret key sk and a message m
  • returns a signature σ
  • 3. verification algorithm Ver:
  • takes as input a public key pk, a message m, and a signature σ
  • returns 1 if the signature is valid and 0 otherwise

Correctness property: ∀(pk, sk) ← KeyGen, ∀m, Ver

pk, m, Sign(sk, m) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 6 / 17

slide-24
SLIDE 24

Signature scheme: definition

A signature scheme consists of three algorithms:

  • 1. key generation algorithm KeyGen:
  • returns a public/secret key pair (pk, sk)
  • 2. signature algorithm Sign:
  • takes as input a secret key sk and a message m
  • returns a signature σ
  • 3. verification algorithm Ver:
  • takes as input a public key pk, a message m, and a signature σ
  • returns 1 if the signature is valid and 0 otherwise

Correctness property: ∀(pk, sk) ← KeyGen, ∀m, Ver

pk, m, Sign(sk, m) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 6 / 17

slide-25
SLIDE 25

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

skA pkA

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-26
SLIDE 26

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

skA pkA

m1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-27
SLIDE 27

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

skA pkA

m1 σ1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-28
SLIDE 28

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

skA pkA

m1 σ1 . . . mq

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-29
SLIDE 29

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

skA pkA

m1 σ1 . . . mq σq

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-30
SLIDE 30

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

pkA

m1 σ1 . . . mq σq

pkA

(m∗, σ∗)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-31
SLIDE 31

Signature scheme: security

  • “gold” security notion: Existential Unforgeability against Chosen

Message Attacks (EUF-CMA)

pkA

m1 σ1 . . . mq σq

pkA

(m∗, σ∗)

m∗ = m1, . . . , mq Ver(pkA, m∗, σ∗) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 7 / 17

slide-32
SLIDE 32

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-33
SLIDE 33

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB) σA σB Ver(pkA, m, σA) = 1 Ver(pkB, m, σB) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-34
SLIDE 34

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB)

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-35
SLIDE 35

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB) σ σ Ver({pkA, pkB}, m, σ) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-36
SLIDE 36

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB) σ σ pk = KeyAgg(pkA, pkB) Ver(pk, m, σ) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-37
SLIDE 37

Multi-signatures

  • often, transactions must be authorized by multiple parties

(shared wallet, escrow, payment channel, atomic swap, . . . )

  • currently in Bitcoin: trivial solution (concatenation of pks/sigs)
  • better: one signature, independently of the number of signers
  • even better: one public key, independently of the number of signers
  • difficulty: rogue-key attacks (plain public-key model: no CA)

(skA, pkA) (skB, pkB) σ σ pk = KeyAgg(pkA, pkB) Ver(pk, m, σ) = 1

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 8 / 17

slide-38
SLIDE 38

Elliptic curves

  • defined over a finite field
  • points on the curve can be added

⇒ group G

  • order p, generator G
  • nG = G + · · · + G
  • n times
  • can be computed in O(log n) time

(double-and-add)

  • discrete logarithm problem:

Given H ∈ G, find n ∈ {0, . . . , p − 1} such that H = nG

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 9 / 17

slide-39
SLIDE 39

Elliptic curves

  • defined over a finite field
  • points on the curve can be added

⇒ group G

  • order p, generator G
  • nG = G + · · · + G
  • n times
  • can be computed in O(log n) time

(double-and-add)

  • discrete logarithm problem:

Given H ∈ G, find n ∈ {0, . . . , p − 1} such that H = nG

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 9 / 17

slide-40
SLIDE 40

History of discrete log-based signature schemes

  • 1984: ElGamal signatures
  • 1985: Elliptic Curve Cryptography proposed by

Koblitz and Miller

  • 1989: Schnorr signatures, U.S. Patent 4,995,082
  • 1991: DSA (Digital Signature Algorithm) proposed

by NIST

  • 1992: ECDSA (Elliptic Curve DSA) proposed by

Vanstone

  • 1993: DSA standardized by NIST as FIPS 186
  • 2000: ECDSA included in FIPS 186-2
  • 2008: Schnorr’s patent expires
  • 2009: Bitcoin is launched; uses ECDSA

C.P. Schnorr

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 10 / 17

slide-41
SLIDE 41

Schnorr signatures [Sch90, Sch91]

  • secret key: x ←$ Zp

public key: X = xG

  • signature:

r ←$ Zp R := rG s := r + H(X, R, m)x mod p σ := (R, s)

  • verification:

sG ? = R + H(X, R, m)X

  • provably secure under the DL assumption in the random oracle

model for H [PS00]

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 11 / 17

slide-42
SLIDE 42

Schnorr signatures [Sch90, Sch91]

  • secret key: x ←$ Zp

public key: X = xG

  • signature:

r ←$ Zp R := rG s := r + H(X, R, m)x mod p σ := (R, s)

  • verification:

sG ? = R + H(X, R, m)X

  • provably secure under the DL assumption in the random oracle

model for H [PS00]

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 11 / 17

slide-43
SLIDE 43

Schnorr signatures [Sch90, Sch91]

  • secret key: x ←$ Zp

public key: X = xG

  • signature:

r ←$ Zp R := rG s := r + H(X, R, m)x mod p σ := (R, s)

  • verification:

sG ? = R + H(X, R, m)X

  • provably secure under the DL assumption in the random oracle

model for H [PS00]

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 11 / 17

slide-44
SLIDE 44

Schnorr signatures [Sch90, Sch91]

  • secret key: x ←$ Zp

public key: X = xG

  • signature:

r ←$ Zp R := rG s := r + H(X, R, m)x mod p σ := (R, s)

  • verification:

sG ? = R + H(X, R, m)X

  • provably secure under the DL assumption in the random oracle

model for H [PS00]

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 11 / 17

slide-45
SLIDE 45

Schnorr signatures [Sch90, Sch91]

  • secret key: x ←$ Zp

public key: X = xG

  • signature:

r ←$ Zp R := rG s := r + H(X, R, m)x mod p σ := (R, s)

  • verification:

sG ? = R + H(X, R, m)X

  • provably secure under the DL assumption in the random oracle

model for H [PS00]

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 11 / 17

slide-46
SLIDE 46

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-47
SLIDE 47

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG X = XA + XB = (xA + xB)G

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-48
SLIDE 48

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG X = XA + XB = (xA + xB)G RA = rAG RB = rBG R = RA + RB

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-49
SLIDE 49

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG X = XA + XB = (xA + xB)G RA = rAG RB = rBG R = RA + RB sA = rA + H(X, R, m)xA sB = rB + H(X, R, m)xB s = sA + sB

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-50
SLIDE 50

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG X = XA + XB = (xA + xB)G RA = rAG RB = rBG R = RA + RB sA = rA + H(X, R, m)xA sB = rB + H(X, R, m)xB s = sA + sB Ver(X, m, (R, s)) = 1

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-51
SLIDE 51

“Naive” Schnorr multi-signatures

XA = xAG XB = xBG X = XA + XB = (xA + xB)G RA = rAG RB = rBG R = RA + RB sA = rA + H(X, R, m)xA sB = rB + H(X, R, m)xB s = sA + sB Ver(X, m, (R, s)) = 1

  • rogue-key attack: Bob sets XB = xG − XA

⇒ X = xG and Bob can compute signatures without Alice

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 12 / 17

slide-52
SLIDE 52

Schnorr multi-signatures: MuSig [MPSW19, BDN18]

  • “delinearized” aggregate key → thwarts rogue-key attacks

X = XA + XB

  • partial signature sA = rA + µAH(X, R, m)xA
  • improves efficiency (n-of-n multisig: 1 pk, 1 sig)
  • improves privacy (n-of-n multisig output indistinguishable from

“standard” single sig output)

  • could be extended to multi-input transactions
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 13 / 17

slide-53
SLIDE 53

Schnorr multi-signatures: MuSig [MPSW19, BDN18]

  • “delinearized” aggregate key → thwarts rogue-key attacks

X = µAXA + µBXB µA = H({XA, XB}, 1), µB = H({XA, XB}, 2)

  • partial signature sA = rA + µAH(X, R, m)xA
  • improves efficiency (n-of-n multisig: 1 pk, 1 sig)
  • improves privacy (n-of-n multisig output indistinguishable from

“standard” single sig output)

  • could be extended to multi-input transactions
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 13 / 17

slide-54
SLIDE 54

Schnorr multi-signatures: MuSig [MPSW19, BDN18]

  • “delinearized” aggregate key → thwarts rogue-key attacks

X = µAXA + µBXB µA = H({XA, XB}, 1), µB = H({XA, XB}, 2)

  • partial signature sA = rA + µAH(X, R, m)xA
  • improves efficiency (n-of-n multisig: 1 pk, 1 sig)
  • improves privacy (n-of-n multisig output indistinguishable from

“standard” single sig output)

  • could be extended to multi-input transactions
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 13 / 17

slide-55
SLIDE 55

Schnorr multi-signatures: MuSig [MPSW19, BDN18]

  • “delinearized” aggregate key → thwarts rogue-key attacks

X = µAXA + µBXB µA = H({XA, XB}, 1), µB = H({XA, XB}, 2)

  • partial signature sA = rA + µAH(X, R, m)xA
  • improves efficiency (n-of-n multisig: 1 pk, 1 sig)
  • improves privacy (n-of-n multisig output indistinguishable from

“standard” single sig output)

  • could be extended to multi-input transactions
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 13 / 17

slide-56
SLIDE 56

Schnorr multi-signatures: MuSig [MPSW19, BDN18]

  • “delinearized” aggregate key → thwarts rogue-key attacks

X = µAXA + µBXB µA = H({XA, XB}, 1), µB = H({XA, XB}, 2)

  • partial signature sA = rA + µAH(X, R, m)xA
  • improves efficiency (n-of-n multisig: 1 pk, 1 sig)
  • improves privacy (n-of-n multisig output indistinguishable from

“standard” single sig output)

  • could be extended to multi-input transactions
  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 13 / 17

slide-57
SLIDE 57

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-58
SLIDE 58

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-59
SLIDE 59

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-60
SLIDE 60

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-61
SLIDE 61

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-62
SLIDE 62

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-63
SLIDE 63

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-64
SLIDE 64

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-65
SLIDE 65

(Non-interactive) aggregate signatures

  • similar to multi-signatures but for different messages
  • Schnorr signatures: requires interaction
  • possible using pairings: e : G1 × G2 → Gt such that

e(aX, bY ) = e(X, Y )ab

  • BLS signatures [BLS01, BGLS03]:
  • secret key: x ←$ Zp

public key: X = xG

  • signature: σ = xH(m)

(H : {0, 1}∗ → G2)

  • verification: e(G, σ)

?

= e(X, H(m))

  • aggregation can be done publicly after signatures have been

computed (e.g. by miners)

  • would allow to aggregate all signatures in the blockchain into a

single one

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 14 / 17

slide-66
SLIDE 66

The end. . .

Thanks for your attention! Comments or questions?

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 15 / 17

slide-67
SLIDE 67

References I

Dan Boneh, Manu Drijvers, and Gregory Neven. Compact multi-signatures for smaller blockchains. In ASIACRYPT 2018, Part II, pages 435–464. Dan Boneh, Craig Gentry, Ben Lynn, and Hovav Shacham. Aggregate and verifiably encrypted signatures from bilinear maps. In EUROCRYPT 2003, pages 416–432. Dan Boneh, Ben Lynn, and Hovav Shacham. Short signatures from the Weil

  • pairing. In ASIACRYPT 2001, pages 514–532.

Gregory Maxwell, Andrew Poelstra, Yannick Seurin, and Pieter Wuille. Simple Schnorr multi-signatures with applications to Bitcoin. Designs, Codes and Cryptography, 2019. David Pointcheval and Jacques Stern. Security arguments for digital signatures and blind signatures. Journal of Cryptology, 13(3):361–396, June 2000. Claus-Peter Schnorr. Efficient identification and signatures for smart cards. In CRYPTO’89, pages 239–252.

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 16 / 17

slide-68
SLIDE 68

References II

Claus-Peter Schnorr. Efficient signature generation by smart cards. Journal of Cryptology, 4(3):161–174, January 1991.

  • Y. Seurin (ANSSI)

Multi-Signatures for Blockchains 12/06/2019 17 / 17