Threshold Signature Verification for Denial-of-Service Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threshold signature schemes are vulnerable to denial-of-service attacks where malicious participants provide incorrect data, preventing the generation of valid signatures, which can have severe consequences in applications like blockchain transactions and voting systems.
Innovation Solution
A method to identify denial-of-service attacks by calculating target and verification public keys based on shared secret shares, allowing honest participants to detect and prevent the generation of invalid signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threshold signature schemes allow multiple participants to collectively generate signatures, then security and fault tolerance are improved, but vulnerability to denial-of-service attacks increases
Solution Approach 1:
The patent applies preliminary action by calculating verification public keys in advance during the key generation phase, before the actual signature generation occurs. Each participant computes their verification public key share based on their private key share and the group public key, storing it for later use. This advance preparation enables immediate detection of malicious participants during signature generation without adding computational overhead at the critical signing moment, thus maintaining security while preventing denial-of-service attacks.
Solution Approach 2:
The patent implements feedback by comparing the verification public key calculated during signature generation with the pre-computed verification public key share. If they match, the signature share is valid; if they differ, a denial-of-service attack is detected. This feedback mechanism allows the system to identify and reject malicious participants in real-time, ensuring that only valid signature shares contribute to the final signature, thereby maintaining reliability while blocking harmful actions.
2Reliability
If verification mechanisms are added to detect malicious participants, then security against denial-of-service attacks is improved, but computational overhead and complexity increase
Solution Approach 1:
The patent reduces computational overhead during signature generation by performing the verification public key calculation in advance during the key generation phase. This preliminary computation stores the verification public key share, which can be directly compared during signature generation without requiring complex real-time calculations. This approach maintains high security while minimizing the computational burden at the time of signing.
Solution Approach 2:
The patent uses copying by creating a verification public key share that is a derived copy of the original key material. Instead of performing complex verification calculations during signature generation, the system copies the pre-computed verification public key share and compares it with the newly calculated verification public key. This copying approach simplifies the verification process significantly while maintaining security, reducing computational complexity without sacrificing reliability.
Data Source
AI summary
A computer-implemented method of identifying a denial-of-service attack during a threshold signature scheme, wherein each participant has respective shares of first and second shared secrets, wherein the method is performed by a first participant of the group and comprises: calculating a first target share; calculating a target value based on the first target share and a first predetermined amount of other target shares; calculating a target public key corresponding to the target value; calculating a first verification share based on the first share of the first shared secret and a public key corresponding to the second shared secret; calculating a verification public key based on at least the first verification share and a second predetermined amount of other verification shares; and determining whether at least one other participant is attempting a denial-of-service attack based on whether the verification public key matches the target public key.