Actually bringing your own key is possible, but there are limitations.
A FROST signing share is a polynomial evaluation. If, say, 3 people join together each bringing their own fixed signing shares, there exists some quadratic polynomial that interpolates their shares. However, it's impossible to find a linear (degree-one) polynomial which does the same.
In practice, this means if `n` people BYOK, they can definitely create an `n` of `n` threshold key with FROST. They can then issue new shares to add more people to the FROST group if they wanted, to make it an `n` of `m` threshold.
I'm not sure about the security implications of what a DKG would look like if only SOME keys are fixed and others can be variable. That's a different ball game 😅
How would one go about discovering the security implications of such a DKG?
You sit down, put pencil to paper and work it out!
There is likely a way to do the DKG so that some cosigners have fixed keys and others have fresh random keys. It'd probably just take some clever math and a security proof that malicious cosigners couldnt bias the DKG to do evil stuff like backdoor the group key.
Lol. Learning cryptography still! Might have to give it a try. Its just math, right?
Thread collapsed
Thread collapsed
Thread collapsed
Great point they can just interpolate existing keys, but yes i believe the security is weakened - maybe ok in certain contexts. By omitting the commitment round, you allow for a misbehaving participant to bias the distribution of key generation outcomes by selectively complaining/failing (mentioned in FROST paper sec 2.3).
nostr:npub1l6uy9chxyn943cmylrmukd3uqdq8h623nt2gxfh4rruhdv64zpvsx6zvtg thanks again for these great posts , nostr:npub160t5zfxalddaccdc7xx30sentwa5lrr3rq4rtm38x99ynf8t0vwsvzyjc9 you might be interested in checking them out:
https://conduition.io/cryptography/shamir/
My pleasure 😄 i wonder if the DKG could be run securely (incl commitment round) if the participants sampled random evaluations instead of random coefficients when building their keygen polynomial f_i(x)...
Damn, times like now, i really wish nostr had LaTeX support 🥲 stay tuned and maybe i'll write something up for this
"Securely" does it that have any special meaning in this context? Or just the general computer terminology?
nostr:npub1zswjq57t99f444z6485xtn0vfyjjfu8vqpnyj6uckuyem2446evqnxgc6x worked on an implementation that uses fedimint nodes for DKG. (https://github.com/EthnTuttle/fedimint/tree/nostrmint-cli)
Thread collapsed
Thread collapsed
nostr:npub1j8d6h8mzvc8f2fvysrf09nlkmn7m2ylj32zl5na4tm5e8fd5dqysrg26k2
nostr:note1pr9682453najqgfrc746pgu6rtntd3ugnyy4srt5cesapnf42nuspfmkpy
Thread collapsed
Thread collapsed
