LLFourn

Unifing FROST and MuSig

There might be a secure scheme that non-interactively generates a n-of-n FROST key and from there you can interactively turn it into a t-of-n by issuing new shares (i.e. enrolment). I don't really know if this is a useful contribution even if it works. There might be some utility in not having multiple schemes but rather a one size fits all approach.

Idea

MuSig takes a "multiset" of n public keys and outputs a single aggregated key which takes n-of-n secret keys to sign. Set z_i = H(X_1,.. X_i, .. X_n, X_i) for i = 1,2, .. n.

LLFourn

My review of Practical Schnorr Threshold Signatures Without the Algebraic Group Model

Inline comments

Page 4

However, this is non-trival because we need to consider the PedPoP DKG and the signing protocol together. The rationale behind this is that PedPoP (like Pedersen DKG) lacks the ability to be simulated. Hence, it becomes crucial to examine the combination of the DKG and the signing