Designated confirmer threshold signature and its applications in blockchains

Abstract The non-transferability of a designated confirmer signature scheme allows a signer to control the verification ability of a signature, hence protecting the signer’s privacy. However, a designated confirmer signature is insufficient when the secret keys are damaged and incapable of collaborative signature generation. In this paper, we circumvent these limitations by introducing the notion of designated confirmer threshold signature. First, we present a formal security model, then give a generic construction, which utilizes threshold signature schemes, encryption schemes and $$\Sigma$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>Σ</mml:mi> </mml:math> -protocols. Instantiating this generic construction, we have two specific schemes, based on threshold Schnorr and threshold ECDSA, respectively. We further design two efficient $$\Sigma$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>Σ</mml:mi> </mml:math> -protocols for efficient proofs. We also implement these schemes, and the experiment results show that our schemes are practical with rich functionalities. Finally, we demonstrate interesting applications for blockchains, such as verifiable asset auctions in blockchain and traditional electronic bidding.