Dynamic-FROST: Schnorr threshold signatures with a flexible committee

Abstract Threshold signatures enable any subgroup of predefined cardinality <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:mi>t</m:mi> </m:math> t out of a committee of <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:mi>n</m:mi> </m:math> n participants to generate a valid, aggregated signature. Although several <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:mrow> <m:mo>(</m:mo> <m:mrow> <m:mi>t</m:mi> <m:mo>,</m:mo> <m:mi>n</m:mi> </m:mrow> <m:mo>)</m:mo> </m:mrow> </m:math> \left(t,n) -threshold signature schemes exist, most of them assume that the threshold <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:mi>t</m:mi> </m:math> t and the set of participants do not change over time. Practical applications of threshold signatures might benefit from the possibility of updating the threshold or the committee of participants. Examples of such applications are consensus algorithms and blockchain wallets. In this article, we present Dynamic-FROST (D-FROST) that combines FROST, a Schnorr threshold signature scheme, with CHURP, a dynamic proactive secret sharing scheme. The resulting protocol is the first Schnorr threshold signature scheme that accommodates changes in both the committee and the threshold value without relying on a trusted third party. Besides detailing the protocol, we present a proof of its security: as the original signing scheme, D-FROST preserves the property of existential unforgeability under chosen-message attack.