The Key to FROST: What is Distributed Key Generation?

Multisig is a well-known idea for many in Bitcoin: a multisig transaction requires approval from a number of events earlier than it may be executed. We distinguish between “n-of-n” multi-signatures, the place the variety of concerned events is n, and so they all have to approve, and “t-of-n” threshold signatures, the place solely a smaller quantity t of individuals have to approve. Cryptographic schemes like MuSig, MuSig-DN and MuSig2 for multi-signatures and FROST by Komlo and Goldberg for threshold signatures can scale back transaction value and enhance privateness of multisig wallets.

To this point, within the Bitcoin Neighborhood FROST has solely been utilized in experimental implementations. On this put up, we clarify why that is the case and the way we purpose to advance FROST in a Bitcoin manufacturing surroundings by means of our latest publication of a BIP draft for the ChillDKG distributed key era protocol.

First, what are the advantages of FROST?

Privateness and Effectivity Beneficial properties with MuSig2 and FROST

With MuSig2 and FROST, despite the fact that a number of individuals contribute to the signing course of, the result is a single signature.

This not solely offers higher privateness to the individuals by making the transaction seem like as bizarre singlesig-wallet transaction. It additionally trims down the transaction, lowering its dimension and subsequently reducing the transaction price. All nice issues!

MuSig2 and FROST permit Bitcoin customers to function a multisig pockets with the identical transaction value as an everyday single-signature pockets. The price advantages are particularly vital for methods with numerous signers and frequent transactions, corresponding to federated sidechains like Liquid or Fedimint. Not like conventional multisig, which leaves a definite fingerprint that permits blockchain observers to establish transactions of the pockets, FROST-based wallets are indistinguishable from common single-signature wallets on the blockchain. Due to this fact, they supply an enchancment in privateness in comparison with conventional multisig wallets.

Whereas MuSig2 has seen adoption from the Bitcoin trade, the identical can’t be stated for FROST so far as we all know. This can be stunning, contemplating the existence of a number of FROST implementations, corresponding to in ZF FROST (by the Zcash Basis), secp256kfun (by Lloyd Fournier), and an experimental implementation in libsecp256k1-zkp (by Jesse Posner and Blockstream Analysis). There’s even a IETF specification for FROST, RFC 9591 (although it isn’t appropriate with Bitcoin as a result of Taproot tweaking and x-only public keys). One of the crucial believable explanations is that FROST’s key era course of is significantly extra complicated in comparison with MuSig2.

The Unresolved Puzzle of FROST in Manufacturing Techniques

FROST basically consists of two elements: key era and signing. Whereas the signing course of carefully resembles that of MuSig2, key era is considerably extra concerned than in MuSig2. Key era in FROST is both trusted or distributed:

1. Trusted key era entails a “trusted vendor” who generates the important thing and distributes key shares to the signers. The vendor represents a single level of failure: if malicious or hacked, the FROST pockets is vulnerable to being emptied.
2. Distributed key era (DKG), whereas eliminating the necessity for a trusted vendor, presents its personal challenges: All individuals should be concerned in an interactive key era “ceremony” run earlier than signing can begin.

The Core Problem: Settlement

DKG usually requires safe (i.e., authenticated and encrypted) channels between individuals to ship secret shares to particular person signers, and a safe settlement mechanism. The aim of the safe settlement mechanism is to make sure that all individuals ultimately attain settlement over the outcomes of the DKG, which embrace not solely parameters such because the generated threshold public key, but additionally whether or not no error occurred and the ceremony was not disrupted by a misbehaving participant.

Whereas the IETF specification considers DKG out of scope completely, the FROST implementations talked about above don’t implement safe settlement, leaving this process to the library consumer. However settlement is just not trivial to implement: there exist numerous protocols and flavors of settlement, starting from easy echo broadcast schemes to full-fledged Byzantine consensus protocols, and their safety and availability ensures differ considerably, and generally subtly.

Regardless of the confusion which will come up as a result of this jungle of settlement protocols, the precise taste of settlement that DKG depends on is commonly not clearly communicated to engineers, leaving them at midnight.

ChillDKG: a Standalone DKG for FROST

To beat this impediment, we suggest ChillDKG, a brand new “ready-to-use” DKG protocol tailor-made to the use in FROST (draft). We offer an in depth description within the type of a draft of a Bitcoin Enchancment Proposal (BIP), which is meant to function a specification for implementers.

The primary function of ChillDKG is that it’s standalone: The institution of safe communications and safe settlement is completed inside the protocol, whereas all of this underlying complexity is hidden behind a easy and hard-to-misuse API. In consequence, ChillDKG is able to use in observe and doesn’t depend on any setup assumption, besides that every signer has selected the set of co-signers as recognized by particular person public keys. ChillDKG relies on the SimplPedPop protocol, in whose design and formal safety proof Blockstream Analysis has been concerned, see, the CRYPTO 2023 paper “Sensible Schnorr Threshold Signatures With out the Algebraic Group Mannequin” by Chu, Gerhart, Ruffing (Blockstream Analysis), and Schröder

Extra targets for ChillDKG’s design embrace:

• Broad applicability: ChillDKG helps a variety of situations, from these the place the signing units are owned and related by a single particular person to these the place a number of house owners handle the units from distinct areas.
• Easy backups: As an alternative of getting to again up secrets and techniques acquired from the opposite signers in a safe location, ChillDKG permits restoring the pockets solely from the gadget seed and public information that’s the similar for all DKG individuals. Consequently, an attacker getting access to the general public backup information doesn’t receive the key signing key, and if a consumer loses their backup, they will request it from one other trustworthy signer.

The ChillDKG BIP is at the moment in draft stage, and we’re looking for suggestions on design decisions and implementation particulars. Whereas the specification is generally full, it lacks check vectors, and we’re contemplating including some further options (e.g., “identifiable aborts”). As soon as finalized, the ChillDKG BIP can be utilized together with a BIP for FROST signing to instantiate your entire FROST protocol.

This can be a visitor put up by Jonas Nick, Kiara Bickers, and Tim Ruffing. Opinions expressed are completely their very own and don’t essentially mirror these of BTC Inc or Bitcoin Journal.