Paper 2024/1947 Original: eprint.iacr.org/2024/1947 ↗
One-More Unforgeability for Multi- and Threshold Signatures
Abstract
This paper initiates the study of one-more unforgeability for multi-signatures and threshold signatures as a stronger security goal, ensuring that ℓ executions of a signing protocol cannot result in more than ℓ signatures. This notion is widely used in the context of blind signatures, but we argue that it is a convenient way to model strong unforgeability for other types of distributed signing protocols. We provide formal security definitions for one-more unforgeability (OMUF) and show that the HBMS multi-signature scheme does not satisfy this definition, whereas MuSig and MuSig2 do. We also show that mBCJ multi-signatures do not satisfy OMUF, as well as expose a subtle issue with their existential unforgeability (which does not contradict their original security proof). For threshold signatures, we show that FROST satisfies OMUF, but ROAST does not.
Metadata
- Available format(s)
PDF- Category
- Public-key cryptography
- Publication info
- Preprint.
- History
- 2024-12-02: last updated
- 2024-12-01: published
- Short URL
- https://ia.cr/2024/1947
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2024/1947,
author = {Sela Navot and Stefano Tessaro},
title = {One-More Unforgeability for Multi- and Threshold Signatures},
howpublished = {Cryptology {ePrint} Archive, Paper 2024/1947},
year = {2024},
url = {https://eprint.iacr.org/2024/1947}
}