Abstract

We present two efficient protocols which implement robust threshold RSA signature schemes, where the power to sign is shared by N players such that any subset of more then T signers can collaborate to produce a valid RSA signature on any given message, but no subset of fewer than T corrupted players can forge a signature. Our protocols are robust in the sense that the correct signature is computed even if up to T players behave in arbitrarily malicious way during the signature protocol. This in particular includes the cases of players that refuse to participate or that generate incorrect partial signatures. Our protocols achieve fault tolerance T of N=2, which is optimal. Our protocols are also very efficient, as the computation performed by each player is comparable to the computation cost of a single RSA signature. Robust threshold signature schemes have very important applications, since they provide increased security and availability for a signing server (e.g. a certification auth...

Citations