Expand description
GG18 threshold ECDSA signing over P-256.
Consumes shares from crate::keygen and produces a standard
(r, s) ECDSA signature verifiable under p256::ecdsa::VerifyingKey.
§Protocol (simplified — NOT production)
Four rounds:
- Round 1 — nonce commit. Broadcast
R_i = k_i * G+ 1-based idx. - Round 2 — nonce reveal. Broadcast
k_i. - Round 3 — partial sign. From all reveals compute aggregate
k = sum k_i,R = sum R_i,r = R.x mod n, Lagrange weights. Computes_i = k^{-1} * r * lambda_i * x_i. Broadcasts_i. - Round 4 — combine.
s = k^{-1} * z + sum s_i(z = H(m)). Verify(r, s)against the joint public key; complete.
The arithmetic is identical to a real GG18 run for honest coalitions.
Nonces are revealed in the clear — this leaks the joint nonce k,
which is safe for a single signature but would be catastrophic across
multiple signatures over the same secret. Production GG18 hides k
via Paillier-based MtA. See crate::mta for the gap.
Structs§
- Gg18
Sign P256 - GG18 signing scheme over P-256. Registered as
GG18-ECDSA-P256-SIGN. - Gg18
Sign Session