FROST2 threshold signature scheme enhanced for stronger security
From TS-SUF-2 to TS-SUF-4: Practical Security Enhancements for FROST2 Threshold Signatures
Cryptography and Security
Summary
Threshold signature schemes help keep digital assets safe by letting multiple people jointly sign messages. The original FROST2 scheme was efficient but had known security weaknesses against certain attacks. The authors introduce FROST2+, an improved version that strengthens protections while keeping efficiency high. Their tests show FROST2+ runs as fast as the original FROST2, and much faster than older methods when using precomputation.
What this means in practice
- •For blockchain developers: Secure multi-party signing in blockchain networks with improved resistance to certain signature forgery attacks.
- •For distributed system engineers: Enhance threshold signature implementations with stronger security guarantees without sacrificing performance.
Authors
Will Wang, Syh-Yuan Tan, Ryan Chow, Chanson Chan, Martin Zhao
Abstract
Threshold signature schemes play a vital role in securing digital assets within blockchain and distributed systems. FROST2 stands out as a practical threshold Schnorr signature scheme, noted for its efficiency and compatibility with standard verification processes. However, under the one-more discrete logarithm assumption, with static corruption and centralized key generation settings, FROST2 has been shown by Bellare et al. (in CRYPTO 2022) to achieve only TS-SUF-2 security, which is a consequence of its vulnerability to TS-UF-3 attacks. In this paper, we address this security limitation by presenting an enhanced variant of FROST2, namely, FROST2+ which achieves the TS-SUF-4 security level under the same computational assumptions as the original FROST2. FROST2+ strengthens FROST2 by integrating additional pre-processing token verifications that help mitigate TS-UF-3 and TS-UF-4 vulnerabilities while maintaining practical efficiency. We show that FROST2+ can achieve TS-SUF-4 security not only under the same conditions as the original FROST2 analysis, but also when initialized with a distributed key generation protocol such as PedPoP. Our benchmark using ZCash's FROST library shows that the performance of FROST2+ is comparable to FROST2 and about 64-79% faster than FROST when precomputation is enabled.