Threshold signatures, especially ECDSA, enhance key protection by addressing the single-point-of-failure issue. Threshold signing can be divided into offline and online phases, based on whether the message is required. Schemes with low-cost online phases are referred to as “online-friendly”. Another critical aspect of threshold ECDSA for real-world applications is robustness, which guarantees the successful completion of each signing execution whenever a threshold number$t$of semi-honest participants is met, even in the presence of misbehaving signatories. The state-of-the-art online-friendly threshold ECDSA with-out robustness was developed by Doerner et al. in S&P'24, requiring only three rounds. Recent work by Wong et al. in NDSS'23 (WMY+23) and NDSS'24 (WMC24) achieves robustness but demands additional communication rounds (7 and 4, respectively) or incurs costly operations in the online phase, such as computations over a homomorphic encryption scheme. This paper presents the first three-round threshold ECDSA scheme with both robustness and an online-friendly design. The online phase of our scheme relies solely on several elliptic-curve group operations, which are 2 to 3 orders of magnitude less computationally intensive than those based on linearly homomorphic encryption schemes. We implement our protocol and conduct a comprehensive comparison with WMY+23 and WMC24. Benchmark results show that the online phase of our scheme is 2.5x faster than that of WMY+23 and hundreds of times faster than that of WMC24. Lastly, we demonstrate that our techniques can be extended to construct an online-friendly and robust three-round threshold BBS + scheme.

Secure and efficient data sharing is essential in cloud environments, where data owners must delegate decryption rights without re-encrypting data for each user. Proxy Re-Encryption (PRE) addresses this by allowing a proxy to transform ciphertexts for authorized recipients without accessing the plaintext. As a variant, Attribute-Based Conditional PRE (AB-CPRE) enhances traditional PRE by incorporating two key features: (1) attribute-based access control, and (2) conditional ciphertext transformation based on a specified policy. Despite significant advancements, existing AB-CPRE schemes face a trilemma in balancing functionality and security, hindering their use in cloud data-sharing: (1) support limited to single-hop re-encryption, restricting multi-hop scenarios; (2) a weak security model relying on selective security without allowing the adversary to choose the target attributes or policies adaptively; and (3) an insufficient security guarantee only targeting chosen plaintext attacks (CPA), offering no protection against honest re-encryption attacks (HRA).In this paper, we propose the first AB-CPRE scheme tailored to the cloud environment that simultaneously supports multi-hop transformation, adaptive-policy security, and resistance to HRA. Our construction is based on the learning with errors (LWE) assumption in the standard model, making it also quantum-resistant. We prove security through a novel re-encryption key simulatability technique, allowing the simulation of the re-encryption key without knowing the corresponding secret key, which is of independent interest. Through a comprehensive performance comparison, our scheme demonstrates a lower decryption overhead and a comparable re-encryption key size, showing its practicality compared to the state-of-the-art schemes while offering stronger security and functionality.

We present Rhombus, a new secure matrix-vector multiplication (MVM) protocol in the semi-honest two-party setting, which is able to be seamlessly integrated into existing privacy-preserving machine learning (PPML) frameworks and serve as the basis of secure computation in linear layers. Rhombus adopts RLWE-based homomorphic encryption (HE) with coefficient encoding, which allows messages to be chosen from not only a field Fp but also a ring Z2l, where the latter supports faster computation in non-linear layers. To achieve better efficiency, we develop an input-output packing technique that reduces the communication cost incurred by HE with coefficient encoding by about 21×, and propose a split-point picking technique that reduces the number of rotations to that sublinear in the matrix dimension. Compared to the recent protocol HELiKs by Balla and Koushanfar (CCS'23), our implementation demonstrates that Rhombus improves the whole performance of an MVM protocol by a factor of 7.4x ~ 8x, and improves the end-to-end performance of secure two-party inference of ResNet50 by a factor of 4.6x ~ 18x.

With the demand of cryptocurrencies, threshold ECDSA recently regained popularity. So far, several methods have been proposed to construct threshold ECDSA, including the usage of OT and homomorphic encryptions (HE). Due to the mismatch between the plaintext space and the signature space, HE-based threshold ECDSA always requires zero-knowledge range proofs, such as Paillier and Joye-Libert (JL) encryptions. However, the overhead of range proofs constitutes a major portion of the total cost.

Abstract Two-party signing can be used to provide a high level of key protection especially in the blockchain systems where the safety of money relies on the safety of the signing key. With a two-party signing protocol, the signing key is distributed among two devices, thus the funds are safe as long as one device remains uncorrupted. In this paper, we study the two-party signing protocols for all ISO/IEC signature standards. The mechanisms based on elliptic curve discrete logarithm in ISO/IEC can be divided into three types: Schnorr-type, Elliptic Curve Digital Signature Algorithm (ECDSA)-type and SM2-type. There have already been efficient two-party protocols based on Schnorr signature scheme which can be easily extended into all Schnorr-type standards. However, it is particularly hard to construct efficient distributed SM2-type and ECDSA-type protocols due to their nonlinear signing equations. In this paper, we present the first secure and efficient two-party protocol over SM2-type signature standard. We prove its security in the generic group model. We then construct a more efficient two-party ECDSA protocol that is secure in the generic group model and outperforms all previous works.

A threshold signature scheme distributes the ability to generate signatures through distributed key generation and signing protocols. A threshold signature scheme should be functionally interchangeable, meaning that a signature produced by a threshold scheme should be verifiable by the same algorithm used for non-threshold signatures. To resist future attacks from quantum adversaries, lattice-based threshold signatures are desirable. However, the performance of existing lattice-based threshold signing protocols is still far from practical. This paper presents the first lattice-basedt-out-of-nthreshold signature scheme with functional interchangeability that has been implemented. To build ant-out-of-naccess structure for arbitraryt≤n, we first present a novelt-out-of-nversion of the SPDZ MPC protocol. For high concrete efficiency, we avoid using the MPC protocol to evaluate hash operations. Moreover, we design an efficient distributed rejection sampling protocol. As a consequence, the online phase of our distributed signing protocol takes only 0.5 seconds in the two-party setting and 7.3 seconds in the 12-party setting according to our implementation. As a byproduct, our scheme also presents a periodic key refreshment mechanism and offers proactive security.