CMP20 Threshold ECDSA

Status

This spec is a draft. The reference implementation lives in crates/confium-tc-cmp20.

Motivation

CMP20 (Gennaro & Goldfeder 2020) is the canonical 3-round threshold ECDSA protocol over P-256. It supersedes GG18 with simpler rounds and better performance. Confium’s CMP20 implementation uses real Paillier homomorphic encryption and MtA (Multiplicative-to-Additive) conversion.

Scope

• 2-of-N up to T-of-N threshold signing
• P-256 curve
• Three rounds: key generation (DKG), pre-signing, signing
• In-process driver for testing + multi-party coordinator for production
• Wire format for cross-party messages

Out of scope

• Other curves (use FROST-Ed25519 for Ed25519)
• BLS signatures (use confium-tc-bls)
• Post-quantum schemes (use composite signatures via confium-composite)

Specification

Round 1 — Key generation (DKG)

Each party i:

. Generates a Paillier keypair (N_i, λ_i). . Generates an ECDSA secret share x_i ∈ Z_q. . Publishes N_i, a Feldman-VSS commitment to x_i·G, and a Schnorr proof of knowledge of x_i. . Encrypts x_i under each other party’s Paillier public key.

Round 2 — Pre-signing

Each party computes a random nonce pair (k_i, γ_i) and runs MtA with each other party to compute additive shares of k·γ and k·x without revealing them.

Round 3 — Signing

The signer reveals the public nonce R = k^{-1}·G, computes the signature share s_i = k_i·(m + r·x_i), and the parties combine shares into the final signature (r, s).

Verification

The final signature is verified against the joint public key Y = Σ x_i · G using standard ECDSA verification.

Security considerations

• Paillier modulus N_i must be ≥ 2048 bits (Confium default: 3072). The honest-execution share bound is N > q⁵ + q² (~1282 bits for P-256’s q): below it the MtA mask can wrap mod N and leak.
• Range proofs are required on every MtA ciphertext. Implemented per GG18/GG20 Appendix A (eprint 2019/114): the initiator proves its encrypted nonce < q³, the responder proves its output ciphertext is c₁^x·Γ^y·r^N with x < q³, y < q⁷, both as Fiat-Shamir sigma protocols over a Strong-RSA commitment key (Ñ_i = P̃·Q̃ safe-prime product, h₂ = h₁^w with w discarded, generated by the VERIFIER of the proof). Outstanding: the proof-of-form for Ñ_i (trusted-setup gap, tracked in the audit ledger).
• The MtA exchange runs under the INITIATOR’s Paillier key: party i encrypts k_i under its own public key, party j responds using public material only, and only party i can decrypt the response. This is forced by the share contract (α − β′ = k_i·x_j exactly): whichever party ever holds both α and β′ recovers the peer’s secret outright, so the final decryption must stay with the initiator, who never learns β′.
• Nonces k_i, γ_i must NEVER be reused across sessions.
• All inter-party messages MUST be authenticated and transcript-bound.

References

• Gennaro, R., & Goldfeder, S. (2020). One Round Threshold ECDSA with Identifiable Abort. Cryptology ePrint Archive, 2020/540.
• Confium source: crates/confium-tc-cmp20