17
HAL Id: inria-00565274 https://hal.inria.fr/inria-00565274 Submitted on 11 Feb 2011 HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés. One Round Threshold Discrete-Log Key Generation without Private Channels Pierre-Alain Fouque, Jacques Stern To cite this version: Pierre-Alain Fouque, Jacques Stern. One Round Threshold Discrete-Log Key Generation without Private Channels. Kwangjo Kim. Public Key Cryptography, 4th International Workshop on Practice and Theory in Public Key Cryptography : PKC 2001, 2001, Cheju Island, South Korea. Springer, 1992, pp.300-316, 2001, Lecture Notes in Computer Science. <inria-00565274>

One Round Threshold Discrete-Log Key Generation without Private

  • Upload
    dohuong

  • View
    219

  • Download
    0

Embed Size (px)

Citation preview

Page 1: One Round Threshold Discrete-Log Key Generation without Private

HAL Id: inria-00565274https://hal.inria.fr/inria-00565274

Submitted on 11 Feb 2011

HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.

One Round Threshold Discrete-Log Key Generationwithout Private ChannelsPierre-Alain Fouque, Jacques Stern

To cite this version:Pierre-Alain Fouque, Jacques Stern. One Round Threshold Discrete-Log Key Generation withoutPrivate Channels. Kwangjo Kim. Public Key Cryptography, 4th International Workshop on Practiceand Theory in Public Key Cryptography : PKC 2001, 2001, Cheju Island, South Korea. Springer,1992, pp.300-316, 2001, Lecture Notes in Computer Science. <inria-00565274>

Page 2: One Round Threshold Discrete-Log Key Generation without Private

�������������� �������������������������������! #"$�&%(')��*�+,�-������./�0�1�2�

3 �4�0���5�768�9�4:;./���=<���.>�����?�1�

@-ACBED�D�BGFIHJLKMALNPORQTSVU#SRB5KMNXW$YTKMZEU[SRB]\2^`_4BED1NabXcedgfih�jkdglnm>o1fih?p]qsr ahtlnuvheqwlnhyx{z ahtr|o1l~}nhtm;he�E}9��� ���{��d1lnm>o1}nui�Eqsh

�E�Exslnqsh��T� �!fvm�x{�[���y�y�1�y�>�Ro1lnuv�k��h4�{ht���y�]x|�wlIog�wceh�e�w�g�y�y�E�E�g�]�y�E���V ¢¡E£1¤E¥y¤]�[¦n§y�E¨1¥g¤]�]©[ «ªy¬G�y�y�s­1®y�g�s©[ ¢¯G�

°>±R²e³e´�µ|¶g³y· �`he�whtln�~he�2�wht�~ui¸g�sh4�;}n¹sh9ºsln�«}0�~c»¹whem;h¼�½dgl9¸ghe�shtlIo�}nuv�s¸/z!ui�~c»lnht}nht�¢¾#dg¸/¿GhtÀ{�VÁ9uv}n¹wdyq{}o1�]ÀÂ}~lnqs�«}nh4���{h4ogfvhtl;uv�ÄÃ4ÅgÅ{ÃgÆ�Ǽ�-}n¹wui�-rwlnd1}ndEcedyf�uv�È�~uvm;rsfvh&og�s��htÉ;ceuvhe�E}4xRuÊ}>o1rsrMh4o�lnh4��}ndÌËMhÍ h»l~Ào�}~}~lIogct}nu Í hgÆ|�sd1lko-fvdy�w¸È}nuim;hgx{}n¹wuv�0lndyËsqw�«}kogfv¸yd1lnuv}n¹wmι|o1�¼ËMhthe�2}~lnqw�«}nh4�o1�¼ËMhtui�w¸È�~heceq{lnhyÆÏkd�Á�h Í htl4xGui�ÐÃeÅyÅyÅ]xsÑ!he�s�so1lndÒ»ÓVÔyÕiÖGrwlnd Í h4�È}n¹|o�}�dg�sh¼dg��}n¹sh9lnh4�EqsuÊlnhem;he�E}n�Xuv�0�sd1}0¸gq|o1lIo1�E}nheh4��×m;d1lnh�rwlnhectui�~htfvÀExw}n¹sh�r{lndyrMhtl~}¢À>}n¹|o1}�}n¹wh�¿GhtÀ>uv�9qs�wuv�½dglnm;fÊÀ2�wuv�«}~lnuvËsq{}nh4�uv�2}n¹wh�¿GhtÀ&�~r|o1cehyÆØ0¹wheuÊl�m>o1ui�-dyË]Ù«hec»}nu Í h9Á0og�X}nd!lnhersoguÊlX}n¹sh��~heceq{lnuÊ}�À�ÚMoeÁÛÁ9uv}n¹wdyq{}Ü�no1ctlnuʺ|ceuv�w¸�dy�ÈhtÉÈceuvhe�sctÀEÆyÇk�Volnhe�~qwfÊ}4x4}n¹shXrwlnd1}ndEcedyf]ËMhec4o1m;hX�~heceqwlnhVËsq{}[�~dgm;he¹sd4ÁÂqs�sr{lIogct}nuvc4o1fCÆ�����r|o�l~}nuvceqsfio1l4x4}n¹wh-Ý¢cedym;rwfioguv�E}rw¹|og�~htÞwx]uv�;Á9¹suvc»¹>cI¹sh4o�}nhtln��o�lnh¼}n¹{lnd�Á9�>dgqw}4xEm>o1¿Ghe�Ü}n¹wh9�~c»¹whem;h9d Í htlnfÊÀ;cedym;rwfvht�;o1�|�>�wuÊÉ;ceqwfÊ}}nd��{h4ogfEÁ9uÊ}n¹/uv�-rwlIogc»}nuiceogfs�~uÊ}nqso1}nuvdy�w�eÆy�¢�-d1lI�whtlX}nd�o Í dgui�?}n¹suv�Rrw¹|og�~h0og�|�?dg}n¹whtlV�{lIoeÁ9Ë|o1c»¿]�R�~qwc»¹o1��}n¹sh?ui�wuÊ}nußo1fvuiàeo1}nuvdy��rw¹|og�~h?Á9¹shtlnh-rwlnu Í o1}nh/cI¹|o1�s�whefv��¹|o Í h�}ndËMh?ctlnh4o�}nh4��xTÁ0h-rwlnhe�~ht�]}�o5ágâMÒã ágä]âMåæ�~c»¹whem;h?Á9¹wuvc»¹Ì¸yhe�whtlIo1}nht��o2�{uv�~ctlnht}nht�çfvdy¸2¿GhtÀ�Á9uÊ}n¹ÌrsqsËwfvuic-c»¹sog�w�shefv��dg�sfÊÀEÆT�`uv�|o1fifÊÀExTÁ0h�~¹wd�Áè¹wd4Á�}ndkuvm;rwlnd Í hX}n¹shÜhtÉ;ceuvhe�wctÀ�dg�sdyq{lXogfv¸yd1lnuÊ}n¹sméÁ9¹sht�?}n¹wh��]qsm-ËMhtl[d1�|�~htl Í htln�`uv�sctlnheog�~he�eÆ

êë]ìèí?î ´1ï`²yð Ø0¹wlnhe�~¹wdyfi�z�¾�ñòÑ!he�whtlIo1}nuvdy��xM�XqsËwfiuvcefÊÀ2óÜh»lnuvº|ogËwfih�bV�wctl~À{rw}nuvdy��xsÇk�so1rw}nu Í h�o1�|���dg�sceq{l~lnhe�E}!Çk� Í h»ln�no1l~À

ô õsö¼÷MøTù�ú-û?ü[÷Týnù¼ö

þtN$QMD1WRBED>_4QÿWRB]\�A��TNÄ_��XD�B]\��RQTJLW$ZGD����V_4QT\��[\�_4B�è\2\1SXZ� KM\\�A��TNVK|_�SRD�BÐQMD��VS �VJLAçZ��MB��ÄB]NXZGD���X_�ALQTN\�Z�RB�èB]\���_��RB��VD1\�_�\�_�K��MBÛZGQTNX\�AL\�_�\ÐALNé\��XK|D1ALN�� _��RB��MB����MB]NRBED1K|_�ALQTN��XD�Q`ZGB]WXSRD�B���þeNXWRBEB]W���A��/K_4D1SX\4_4B]W WRB]KMJCBED�AL\5SX\4B]W ALN _��XB��MB����MB]NXBED1K|_�ACQTN��XD�QM_4Q`ZGQTJ �!_��RBÿ\�B]ZESRD1AC_!� Q��>_��RBÿQ#"MBED1KMJLJÈWXAç\eF_4D1A��VSR_4B]W \�Z$�RB��BÄWRB��0B]NXWX\ÌQTNÎK SXNVALU#SXB \4BED�"MBED#�&%ÐB��'�MB]NRBED1K|_�ACQTN��XD1QM_4Q[ZGQTJL\�K|D1B��VKM\�B]W QTND1KMNXWRQ(�,WXAL\4_4D1A)�VSR_�ACQTN��XD1Q[ZGB]\�\�B]\���*+�XB&\4BED�"MBED1\-,4QTALN#_�J����MB]NRBED1K|_4B�KÌD1KMNVWRQ(�.�MB��Û\1SXZ� _��XK|_��#K|__��RBæB]NXWPQ���_��RB/�XD1Q[ZGB]\�\�VKMJLJ��RQTNRB]\�_>\4BED�"MBED1\0�XK"MBÌKÛ\��XK|D�BÐQ���_��RBæ\4B]ZGD1BE_��MB����

þ1�2�XD�Q#"MB�èB]N�_�\ÿ_4Q _��RB$DgKMNXWRQ(�3�MB]NRBED1K|_�ACQTN Q��/�XD1A)"sK|_4B4�MB��[\5��QMD��VS��VJLALZ6�MB�� ZGD���X_4Q��|FD1K��7��� SX\�SVKMJLJ����«KMJLJÈALN�_4Qé_!8-Q K|D1B]KM\:9�_��RB WXAL\4_4DgA��VSR_�ACQTNòQ��K \4B]ZGD1BE_��¢QMDèWXAç\�ZGD�BE_4BGFIJCQ����VKM\�B]WZGD����V_4QT\��[\�_4B�è\&KMNXWP_��XBÌWXAL\4_4DgA��VSR_�ACQTN Q��<;^`H=�MB��[\�

*+�RB$JçK|_4_4BEDÿZEKM\4B AL\2�ÜK|D�_�ALKMJLJ�� \4QTJ�"MB]W>��� _��RB NXALZGB?�ÜK���BEDÛQ��A@-QTNXB� KMNXW8ORD1KMN �`JLALNCB D�EF�G&QH8-B�"MBED�/_��RB?�VD�QM_4Q[ZGQTJ&WRQ#B]\ NRQM_èKMJLJCQH8 _4QòBJIÿZEACB]N�_�J)� \��VK|D�BK;^RHL��Q`WXSXJçSX\M8&AC_��Î\4_4D�QTN���XD1A)��B]\5KMNXW Aç\5NRQM_5D�Q��VSX\�_5K��TKMALNX\�_5Z�XB]K|_4BED1\���ORQTJLJCQH8&ALN � _��XAL\N�VK��0BED�¼_!8-QéK|D�_�ALZEJCB]\O�XD�QH"[AçWRBD�Q��VSX\4_�NXB]\�\�SX\�ALN �ÿWXAQP0BED�B]N#__4B]Z$�XNXALU[SRB]\���*+�XBN�VDg\4_2QTNXB����$OXD1KMN �MB]J0RS�T�U�VWBQX�XYEF�¼AL\��VKM\�B]W QTN_��RB5\�K��èBM��BE_��XQ[WX\KM\�B D�E�KMNXW SX\4B]\2_��RBO�XD�QM_4Q`ZGQTJ¼Q��W@/B]N`F1Z�D�\[QTJçW 8/KM\1\4BEDKMNVWK]�ALW �MBED1\�QTNB_^HE-8&AC_��6�XDgA�"sK|_4BæZ$�XKMNXNRB]Jç\`��BE_!8-BEB]N$B]KMZ�4�VKMACD;Q��&�VK|D�_�ALZEA)�VKMN�_�\�XORD1KMN �MB]JaRSbT�UQV�KMJL\4Q��VD�Q��0QT\4B�XD�QM_4Q`ZGQTJL\è_��XK|_5�èK��MB$_��XB$\�Z�XB��BK�XD1QTKMZG_�A�"MB ALN=BQX�X��#X�cd�HX^HEF�-þtNCB_^�^HEÐ@!QTS �VK|D1W KMNXW ^[_4BEDgN�XD�B]\4B]N#_-KN�XD�QM_4Q`ZGQTJ7��QMD-_!8-QM�VJLK#�MBED1\a8��XALZ$�èK"MQTALWV\a�VD1A�"|K|_4B&Z�XKMNVNRB]JL\��e*��RB��èALN#_4D�Q[WVSXZGB>K5NXB�8_4B]Z�XNXAçU#SRBP\�A)�2�VJCBED5KMNVW��èQMD�BPBJI ZEACB]N#_Â_��VK|_�WXQ#B]\�NRQM_�NRBEB]W _4Qf�0BED���QMD�g�ÛKMNe� D�QTSXNXWX\5Q��ZGQ(�2�5SVNXALZEK|_�ACQTN��¼þ»_ÂAL\A�VKM\�B]WòQTN K _4D1K���WRQ[QMDN"MBED1\1ACQTNòQ��;_��RB WXAL\�ZGD�BE_4BÿJCQ��TK|D1AC_��7�h�XD�Q��VJLB�:�

Page 3: One Round Threshold Discrete-Log Key Generation without Private

*+�XAL\��`ALNXW�Q�� �VD�QM_4Q[ZGQTJ[AL\�8/B]JLJ�FI\1SXAC_4B]WÐ_4Q\��èKMJLJ��MD1QTS �ÌQ�� �VK|D1_�ALZEA��VKMN#_�\�8��XAçZ�����D�Q(� K+�XD1KMZG_�AçZEKMJ��QTAçN�_ÈQ��<"[ALB�8A�XAL\È_��RBÌSV\�SXKMJ�ZEKM\4B�� [ÐALJ��0QTK��XKM\+��QTJLJCQH8-B]WÄ_��VAL\ ��BE_��RQ`W ALN�BQXJD�EF�

�$BE_��XQ[WX\A�¢QMDæWXAç\4_4D1A��VSX_�ALN �2�MB��`\/��QMDæWXAL\�ZGD�BE_4BGFIJLQ�� ZGD����V_4QT\��[\�_4B�è\A�XK#"MB2�0BEB]N4�`NRQH8&Nf�¢QMDKèJCQTN �è_�A ��B��X\4_�K|D�_�ALN��28&AC_�� OXB]JLW��èKMN KMNVW @!B]WRBED1\4B]NK�VK��0BED1\NB�� �$^�cd�$^dXYEF� G&QH8-B�"MBED#��K��ÜK8 AçN_��RB�D�B]U[SXACD�B��B]N#_�\/�XKM\/�0BEB]NòWVAL\�ZGQ#"MBED1B]WòKMNXWòK5�VDg\4_Ð\4QTJLSR_�ACQTN KM\N8-B]JçJ�KM\æKÄ\4B]ZESRD1AL_ �f��Q[WXB]J�¢QMD���%/[.�XD�QM_4Q`ZGQTJL\+�XK#"MBO�0BEB]N WRBJ��NRB]W6���K[B]NVNXK|D�Q�RS`T�UQV�ALN BQX�HEF� *+�RBÌ\�QTJLSR_�ACQTN:�XKM\��0BEB]NA)���XD�QH"MB]Wf����ÈKMNRBE_4_�A�R�S0T�UQV!ALN B �#E?_4Q?82AC_��X\4_�KMNXW KMWVK��X_�A�"MBèK|_4_�KMZ��`\��!þtN BQX�HEF��� �`\��TKMNX\��|K�TKKMNXWÎYTK|D�B]Z�[A �XK#"MB:�XD�Q��0QT\4B]W _ 8/QòNRB�8 ��Q`WRB]JL\5Q��2\4B]ZESRDgAC_ ����QMD�_��XAL\O�`ALNXW Q��2K|_4_�KMZ��`\��W*��RB�VD1\4_æQTNXBÿWRB]KMJL_5KMJL\4Q48&AC_�� ZGQTNXZESRD�D�B]N#_5KMW�"MBED1\�K|D1ACB]\O8��RBED1B]KM\Ì_��RBP\4B]ZGQTNXW'�XD�B]\�B]N�_�\5BED1KM\�SRD1BGF�¢D�BEB KMWXK��X_�A�"MB \4B]ZESRD1AC_!� 8&AC_�� �0BED1\�Aç\4_4B]N�_�J)� ALNXZGQTNV\�AL\4_4B]N#_2�VJLK#�MBED1\��W*��RB$\�Z$�RB��B]\ÿK|D�BK�VKM\�B]WQTN @!B]WRBEDg\4B]N���BEDgAQ�ÜK��VJCB ^[B]ZGD�BE_ ^d�XK|D1AçN � KMNXW ZGQTNX\4B]U[SRB]N#_�J�� SX\4B4�XD1A�"|K|_4B Z$�XKMNXNRB]Jç\��`Z�NVJ����YTK|D�B]Z�[A��v\;\�QTJLSR_�ACQTN SX\4B]\b�VS �VJçALZ>Z�VKMNXNRB]JL\a�VSR_/AC_/NXBEB]WX\ÈNRQTN`FIZGQ(�2�èAL_4_�ALN �ÌB]NVZGD����V_�ACQTN \1Z�RB��B8��XALZ$�:�èK��MB]\>_��RBN�XD�QM_4Q`ZGQTJ9JCB]\�\;BJIÿZEACB]N�_��

] �XBED�B]KM\?�XD1B�"[ACQTSV\ÿ\�QTJLSR_�ACQTNX\P_4Q�� %/[ �XD1Q#"MB \4B]ZESXD1AC_ ��ALN�_��RBòAçN �¢QMD$�èK|_�ACQTN`Fn_��RBEQMD1BE_�ALZ��Q[WXB]J �d8-BÌSV\4BA�RBED�BæKèZGQ(�2�VSR_�K|_�ACQTNXKMJ��èQ[WRB]J¼KM\;_��RB/�MQTKMJ9Q���\�SVZ�6�XD�QM_4Q`ZGQTJ¼Aç\È_4QÛZGQTNX\4_4D1SVZG_KO�ÜS �VJLALZ`�MB�����*��RBED�B���QMD�B���8/B�B]JLA)�èAçNXK|_4B&_��RB�ZGQ(�2�èAL_4_�ALN �M"sKMJLSXB]\?Q��`BQX� ���#E�8��XALZ$� K|D�BÐNRBEB]WXB]W_4Q:�XD�Q#"MBÛ_��RB�\4B]ZESRD1AC_!� K��TKMALNV\4_æKMWXK��X_�A�"MBèKMW�"MBED1\�K|D1ACB]\�\*kQ ZGQ��0B�8&AC_��é\�SXZ$� KMW "MBED1\�K|DgACB]\���8/BWRB]\�A��TNÄK�QTNXBæD�QTSXNXW6�VD�QM_4Q[ZGQTJF�

ORQTJLJCQH8&ALN �$_��RB NRB�8 K����XD�QTKMZ$� �VD�Q��0QT\4B]W�� �é@!QTS �ÜK|D1W KMNXW ^[_4BED1N��¼_��RB ZGQTN#_4D1A��VSX_�ACQTN Q��_��XAL\ �VK��0BED?Aç\�_4Q5ALN#_4D�Q`WXSXZGB �VS��VJLALZ/Z�XKMNVNRB]JL\?AçN�QMD1WRBED�_4Q5D�B]WXSXZGB&_��RB&ZGQ(�2�ÂSXNXALZEK|_�ALQTNèD�QTSXNVWX\_4QÌKÐSXNXALU[SRBb�7�XKM\4B��|þ1� 8/B>SX\4B>NXQTN`FIALN#_4BED1KMZG_�A�"MB �XD�QM_4Q`ZGQTJ ��8/B>ZEKMNÛKMJL\�Q�A)�TNRQMD�B>ZGQTNXZESRD1D�B]N�_�KMNVWKMWXK��X_�A�"MB�KMW "MBED1\1K|D1ACB]\ÐKM\�_��XAL\0�`ALNXW Q��-K|_4_�KMZ��MBEDg\N�èK��MBèNRQÄ\4B]NV\4BÂAçN KÿQTNRB�D�QTSVNXWK�VD�QM_4Q[ZGQTJF�*¼QÎKMZ�VACB�"MBòK NRQTN`FIALN#_4BED1KMZG_�A�"MBf�XD�QM_4Q`ZGQTJ �`8/BéNXBEB]W �XD1A)�èAL_�A�"MB]\Û\�SVZ� _��XK|_ KMJLJ\4BED�"MBED1\ÄZEKMNWRB]ZEALWRB08��RBE_��RBEDÈ_��RBQM_��RBED;\4BED�"MBED1\`�XK#"MBÐZGQMD�D�B]ZG_�J��2�0BED���QMD��B]W _��RB]ACD/_�KM\��`\ÈKMNXW \��[NXZ$�RD�QTNRQTSV\NRBE_ 8/QMD��Â_4Q/�XD�B�"MB]N#_��eDgSX\��XALN��2K|_4_�KMZ��`\��d��/QTNX\4B]U[SRB]N#_�J�����8-B>NRBEB]W��2þ��\% �XD�Q[Q���\�\4B]ZESRD1BÈAçN5_��XBD1KMNXWRQ(� QMD1KMZEJCB ��Q`WRB]J-KMNXW��VS �ÜJLALZ�Z�XKMNVNRB]JL\��9þeN K��7��B]NVWXA �"! �)X�� 8-B D�B]JLK#� _��RBÿKM\�\�S����V_�ACQTNQ��k\��`NXZ�XD�QTNRQTSX\;NRBE_!8-QMD�ÿKMNXW5�XD1B]\4B]N�_;K���Q`WRB]J 8��RBED1B�8/BÐZEKMNÄB]KM\�ALJ)�2�XD�B�"MB]N#_;_��RB$�eD1SX\��VALN �K|_4_�KMZ��%� KMNXW$KMWXK��X_�A�"MBÌKMW�"MBED1\�K|D1ACB]\&K|_>_��RBA�XDgALZGB�Q���K��ÜK|D�_�ALZESXJLK|D �ÜJLK�MBED�

&('�& )+*(,#-/.10#243�5768*4576:9<;%=>*�?@;A6�BC210#-@kB]WXBED1\4B]N \�Z$�RB��B B_^�c EkAç\/K�NXQTN`FIALN#_4BED1KMZG_�A�"MBæ\�Z$�RB��B/8&AC_��6�VD�QTKMWXZEKM\4_>KMNXW6�VD1A�"|K|_4B�Z$�XKMNXNRB]Jç\��*+�RB;\�Z�XB��B;AL\!QMD��TKMNXAEDEB]W�ALNÂ_!8-Q/�7�VKM\4B]\`9MALNÌ_��XB`�VD1\4_�\4_�K��MB��T_��RB`�VK|D1_�ALZEA��VKMN#_�\�\4B]JCB]ZG_�_��RB`�MB��8��XALJCB�ALNé_��XBÛ\4B]ZGQTNXW��¼_��RB2�MB��òAL\ÐWXAç\4_4D1A��VSX_4B]W4�0BE_!8-BEB]N \4BED�"MBED1\��kþtNò_��RBèWXAL\4_4DgA��VSR_4B]W��7�XKM\�B��B]KMZ� \�BED�"MBEDÛKMZG_�\èKM\�_��XB WRB]KMJCBEDèALN K ORB]JLW7�èKMN �XD�QM_4Q`ZGQTJNB��HE+8��XAçZ�ÎSX\4B]\�"MBEDgAQ�ÜK��VJCBP\4B]ZGD�BE_\��XK|D1ALN�� �

@�K|D�_�ALZEA��VKMN#_GF7HÌZ$�RQ[QT\4B]\GI1H$JLKNMèK|_PD1KMNXWRQ(� KMNXW>�VALZ��`\POèD1KMNXWXQ(� N[S��O��BEDg\RQ HTS U AçNKNM$�&*+�RB]N�� �RBÛ\4BE_�\+V#HXW>Y[Z]\_^:`Ubadc Q H>S U Y U 8��RBED�BRQeH>S cR\fI4H!�&G&B��XD1A�"|K|_4B]J��é\4B]NXWX\5K$\4B]ZGD�BE_\��XK|D�B+gH>S hi\jV#HkWElAZ ��Q`W�m�_4Q6�VK|D�_�ALZEA)�VKMN�_nFohÂKMNXW4�XD�QTKMWXZEKM\�_�\2KM\��VS �ÜJLALZÐALN ��QMD�èK|_�ALQTN$pqH>S hr\sAtvuxw y ��Q`W�z-��KMNXW|{ H>S U \ se} uEw ~ �èQ[W�z>�¢QMDR�:\hc%�b�b�b�7��OY� *+�RB]\�B WXK|_�KòZEKMN �0BÄSX\4B]W � � KMJçJ\4BED�"MBED1\2_4QÿZ$�RB]Z��48��RBE_��RBED2_��RBÌDgKMNXWRQ(�:�4I H Z�XQT\4B]N�����F H � �XKM\0��BEB]N ZGQMD�D�B]ZG_�J�� WXAL\4_4D1A)�VSR_4B]W���9BE_

pqHTS hn\ `�Ubadc { h ~H>S U ��Q[W�z

^

Page 4: One Round Threshold Discrete-Log Key Generation without Private

þ!�dg H>S h AL\�NRQM_�_��RB;WXAç\�ZGD�BE_4B;JCQ��TK|D1AC_��7�7Q��1p H>S h ���VK|D�_�ALZEA)�VKMN�_ F h �XD�QTKMWVZEKM\4_�\�K�ZGQ(���VJLKMAçN�_�K��TKMALNX\�_F7H �

*+�RBéZGQ(���VJLKMAçN�_�\PK|D�B��èKMNXK��MB]W�_��XD�QTS �(��WXAQP0BED�B]N#_ÿ\4_4DgK|_4B��TACB]\��>H �0QT\�\1A��VJCB QTNXBéAç\ _��XB�¢QTJLJLQ#8&ALN�� 9RA��-��QMD1B2_��XKMNGOW�VK|D�_�ALZEA��ÜKMN�_�\ÈZGQ(���VJçKMALN K��TKMAçNX\4_;\4BED�"MBED F H!�`_��XK|_;\4BED"MBED>AL\ÈZEJCB]K|D1J����KMSXJL_ � KMNXW AL\ÿWXAL\�U[SXKMJLA��VB]W��aZ_��RBED8&AL\4B�� F7HæD1B�"MB]KMJL\P_��RBé\��XK|D�B[gH>S hK�¢QMDPB]KMZ$� ZGQ(���VJLKMALNVALN ��VJLK�MBED Foh��;þ1�5KMN�� Q��Ì_��RB D�B�"MB]KMJLB]W \��XK|D�B]\6�«KMALJL\ÿ_��RBéB]U[SXK|_�ACQTN pqH>S h�\ sAt uEw y ��Q`W�z-�NF HÂAç\WXAL\�U[SXKMJLAQ�ÜB]W���QM_��RBED�82AL\4B[F H ZEKMN \4_�ALJçJ��0B U#SVKMJLAQ�VB]W�� Z�NRB ZEKMN _��RB]N WXBJ�ÜNRB ��� H�� KM\Ä_��XB\4BE_ Q��æNXQTN`FIWXAL\�U[SXKMJLA��VB]W��VJLK�MBEDg\��b*��RB?�VS �ÜJLALZ6�MB�� AL\ÿWRBJ�ÜNRB]W KM\<p8\�� H���� ��� pqH/8��XBED�BpqH/\ {nH>S c \ s��u �èQ[W�z-�

þtN _��XB5�VD�B�"[ALQTSX\�\�Z�RB�èB�� �VK|D�_�ALZEA)�VKMN�_+F HZ$�RQ#QT\�B]\èKéD1KMNXWRQ(� \�B]ZGD�BE_�I1H�KMNXWÎ\��XK|D1B]\�AC_��BE_!8-BEB]N _��RB QM_��RBEDÿ\4BED�"MBED1\� /QTNX\4B]U[SRB]N#_�J����?\�AçNXZGB WXAL\�U[SXKMJLA��ÜZEK|_�ACQTNX\M�èK� Q`ZEZESRD K���_4BEDÛ_��XBWXAL\4_4D1A)�VSR_�ACQTN5�7�XKM\�B��X_��RB5\�B]JCB]ZG_�ACQTN?� �XKM\4BN80�XALZ�$KMA)�è\&K|_SXNXK��O�VA��TSRQTSV\�J��2�1�`ALN���_��RBN�VS��VJLALZ�MB����wAL\9NXQM_9ZGQ(���VJCBE_4B]WN��B���QMD�B�_��RBW��B��TAçNXNXALN �-Q��`_��RB?WXAL\�_4D1A��VSR_�ALQTN��7�VKM\4B��G&B]NVZGB��wKMNæKMW "MBEDg\�K|D��ZEKMN$ZGQ(���VSX_4Bæ_��RBA�VS��VJLALZ0�MB�� K|_&_��RBÌB]NXWÄQ���_��RBÌWXAç\4_4D1A��VSX_�ACQTN � �XKM\4BæSX\�AçN ��_��RBA"|KMJLSRB]\ {nH>S c ��2B��0B]NXWVALN �$QTN _��XAç\5ALN#_4B]NXWRB]W'"|KMJLSRB KMNVW QTN _��RB5�MQTKMJÈQ��>_��RBPKMW "MBED1\1K|D�����_��XAL\O�VJLK�MBEDèZEKMN ��¢QMD�B �RK����VJCB��0WXAL\�U[SXKMJLA)� �Ä\4Q(��B���B�O�0BED1\�ALN$QMDgWRBED�_4Q6�èQ[WXA)� �P_��RB��VS �ÜJLALZ �MB��éWXAL\4_4D1A)�VSR_�ACQTN��[B]NXNXK|D�QKRSWT�U�VXWRB]\�ZGDgA��0B&KMNÄK|_4_�KMZ��ÄALN�8��XALZ$�Û_!8-Q2�ÛKMJLALZEACQTSX\b��B�O�0BED1\-ZEKMNÄZGD1B]K|_4BæKO�ÜALKM\-AçN_��RB5WXAç\4_4D1A��VSX_�ACQTNÿQ��!_��XB5JLKM\4_��VAC_>Q���_��RBO�VS �VJLAçZ0�MB��:82AC_��:�XD�Q��ÜK��VALJLAC_!�P���HDÿD1K|_��RBED2_��XKMN'X���^ �*+�RB]ACD&K|_4_�KMZ�$D�B]JçACB]\>QTN$_��RBN�«KMZG_2_��VK|_&_��RBO�¢QTJLJLQ#8&ALN��è\�Z�RB�èBÂSX\�B]\&\4B]ZGD�BE_�Z�VKMNXNRB]JL\���BE_!8-BEB]NB]KMZ� ��B�O��BEDÂ\�SXZ$�ò_��XK|_O8-BÿZEKMNXNRQM_M�[NRQH8 8��XB]NRB�"MBEDÂKMN BED�D�QMDÂK����0B]K|D1\A8��VALZ� �VK|D�_ ���XKM\Z�RB]K|_4B]W A��-�0QM_��:�ÜJLK�MBED1\&K|D�BÌZGQMD�D1S��X_4B]W��*¼QÛK#"MQTALWÄ_��XAç\;K|_4_�KMZ�� ��[B]NVNXK|D�Q4R�SbT�U�VÜWVS �VJLALZEK|_4B_��RBÌ\1Z�RB��B�9ÜALNÿ_��RB/�VD1\�_b�ÜK|D�_��R_��RBA�RQTNRB]\�_�MD�QTS � AL\P\4B]JCB]ZG_4B]W KMNXW ALN�K \4B]ZGQTNXW �7�XKM\�B��-_��RBf�VS��VJLALZ:"|KMJLSRBéKM\�\4Q`ZEALK|_4B]W�_4Q _��RB \��XK|D1B]W\4B]ZGD�BE_2Aç\+�èKMWRBA�ÜS �VJLALZ��`þeNÄ_��XAL\&ZEKM\4B��V_��RB5U#SXKMJçAQ�VB]W6�MD�QTS � AL\>WRBE_4BED$�èALNRB]WÄK|_2_��RBæB]NXW$Q��!_��XB�VD1\4_��7�XKM\4B���þeN _��XBO�ÜD1\4_�\4B]JCB]ZG_�ACQTN��7�XKM\�B��ÜB]KMZ$�ò\4BED�"MBEDæZGQ(�2�ÛAC_�\�K DgKMNXWRQ(� "sKMJçSRBO82AC_��$_��XBSXNXZGQTNXWXAL_�ACQTNXKMJ�\�Z�XB��BÛQ��;@!B]WRBED1\4B]N ALN B_^dXYE�� 8��RBED�B]KM\ÌALN _��RBÛWVAL\4_4D1A��ÜSR_�ACQTN4�7�XKM\4B�� �ÜJLK�MBED1\D�B]JCB]KM\4BèALN��¢QMD�ÛK|_�ACQTN B]NXK��VJLALN��ÛB�"MBED��MQTNRB _4Q ZGQ(���VSR_4B�_��XBM�ÜS �VJLALZN"sKMJçSRB��0þ!�/K6�VJLK�MBED5Z�RB]K|_�\ALN _��RBè\4B]ZGQTNXW�� �XKM\4B����VSR_ �0B]JCQTN �T\_4Q ��� H�� �0_��RB�QM_��RBEDN�VJLK�MBEDg\ÐD1SXNéKMN BED�D1QMD4FIZGQMD�D�B]ZG_�ALN��KMJ��MQMD1AC_����38&AC_�� _��RB�"sKMJLSXB]\Û_��XK|_ÿ_��RBéZ�RB]K|_�AçN �'�ÜJLK�MBED:�XKMW WXAL\4_4DgA��VSR_4B]W WVSRD1ALN � _��XBK�VDg\4_�7�XKM\4B��

*+�RBèNRBEB]W��¢QMDÐ_!8-Q4�7�XKM\4B]\æZGQ(�èB]\/�¢D1Q(� _��RB��«KMZG_æ_��XK|_æ_��RB��VD1A�"|K|_4BèZ�XKMNXNXB]JL\ÐSX\4B]W��VALWRB��KMSXJL_ �f�VJLK#�MBED1\�� /QTNX\�B]U#SRB]N#_�J����¼K���_4BEDÌ_��XB��VD1\4_/� �XKM\4B28��VALZ� SX\�B]\ÌK \��d�2��BE_4DgALZ�KMJ��MQMD1AC_��7�:�8-BÌWXQèNRQM_+�`NRQ#8 A)�¼_��RBÌZ$�RB]K|_�ALN � �VJLK�MBEDAL\ 9

� _��RBÌ\4B]NVWRBED 8��RQ2�XKM\&\4B]N�_2K���KMJç\4Bæ\��XK|D�B/82AC_��XALNÿ_��RBA�VD1A�"|K|_4B�Z$�XKMNXNRB]JF�RQMD� _��RBæD�B]ZGB]A)"MBED�8��RQ�ZEJLKMA �è\;_��XK|_��XBA�XKM\;D�B]ZGB]A�"MB]W K��VKMWÄ\��VK|D�B��

*+�RBED�B���QMD�B��È_��RB \4B]ZGQTNXW �7�VKM\4B AL\PNRBEB]WRB]W�_4Q \4QTJ�"MBé_��RB �4ZGQ(�2�VJLKMALN#_�\��d� G&QH8-B�"MBED#�+8-BòZEKMNB � �0B]ZG_è_��XK|_ÿALN �MB]NRBED1KMJ2NRQ \4BED"MBED 8&ALJçJa�0B ZGQMD�DgS �X_4B]W�� *+�[SX\�_��VAL\è\4B]ZGQTNXW �7�XKM\4B$K��7��B]K|Dg\_4Q���BÄD1B]WXSXNXWXKMN#_�KMNXWÎSX\4B]JCB]\1\�� �$QMD�BEQH"MBED�-AL_�Aç\�_��RB?��QT\4_�_�A)�èBPZGQTNV\�S��èALN���� �XKM\4BPQ��2_��XB�XD�QM_4Q`ZGQTJ �

&('�� �R3 0��2o= 3 ?��>2o5Z�SRD5K��7�XD�QTKMZ� AL\N�¢Q`ZESX\4B]W QTN \�A)���VJçA�� �`ALN �5�XD�B�"`ACQTSX\A�XD�QM_4Q`ZGQTJL\��!þtN K$D�B]KMJ/A)���ÜJCB��B]N#_�K|_�ACQTNQ��-�XD1A)"sK|_4BÐZ�VKMNXNRB]JL\��RKMNÄKMWXWVAC_�ACQTNXKMJ �XD�B�"`ACQTSX\/D�QTSXNVW��ÂSX\4_`�0B�B �[B]ZESR_4B]W _4Qè\��XK|D�B�_��RBÐ\4B]ZGD�BE_

Page 5: One Round Threshold Discrete-Log Key Generation without Private

�MB��4�0BE_ 8/BEB]N B]KMZ$���VKMACD�Q��È\4BED�"MBED1\� *+�XAL\��VD1\4_�D�QTSVNXWéAL\�SX\�SXKMJLJ)�?�VSR_�KM\æKPD�B]U[SXACD�B�èB]N�_��¢QMD_��RBÌZ�VKMNXNRB]J\�VSR_;_��VAL\`�7�XKM\4BæAçNe"MQTJ�"MB]\��0B]NXKMJC_�ACB]\;ALN6�VD1KMZG_�ALZEKMJ9A)�2�VJCB��B]N#_�K|_�ACQTNX\��

�$QMD1BEQ#"MBED�;ALN �VD1A�"|K|_4B$Z�XKMNVNRB]JL\�� 8/B ZEKMNVNRQM_ �`NRQ#8L8��RBE_��RBED _��RBK�«KMSXJC_!� �VJLK�MBEDÿAL\è_��XB\4B]NXWRBED-QMD-_��RB2D�B]ZGB]A�"MBED;ALN�_��XB��VDg\4_ �7�XKM\�B���*+�RB2\4B]ZGQTNXW��7�XKM\4B2Q��WBQX�HE0AL\?_��RBED�B���QMD�B�NRBEB]WRB]Wè_4Q\4QTJ�"MB_��RB2ZGQ(���ÜJLKMALN#_�\-ZGQ(�èAçN �N��D�Q(�,_��XAL\/K��N�VA)�TSXAC_ ��� G&B]NVZGB��`A)� 8/B�SX\4B2KÂ@?S��VJLALZEJ�� ��BED1AQ�ÜK��ÜJCB^[B]ZGD�BE_5^d�XK|DgALN � \1Z�RB��B W«@ �Ð^V^(Z2KMNXW @?S �ÜJLALZEJ��G��BED1AQ��K��VJCB��?NXZGD�� �X_�ACQTN \�Z$�RB��B W«@ ��� Z�B��HEF�8-BÐK|D�BÐK��VJCB_4Q�A)�2��B]WVALK|_4B]J��èWRBE_4B]ZG_`8��RBE_��XBED/_��XB�\�B]NXWRBED`�XKM\;\4B]N#_b�«KMSXJC_!�2�VK|D�_�\� *+�XB]N�� �ÛKsFJLALZEACQTSX\W�VJLK#�MBED1\-K|D1BZEKMS �(�#_;KMNXW�8-B�WRQ5NXQM_/KMJLJLQ#8 _��RB��ALNè_��RB��MD�QTS �ÿQ��9U[SXKMJLAQ�VB]W���B�O��BEDg\��/QTNX\4B]U[SRB]N#_�J����RQTSRD>\�Z$�RB��BÌZGQTNX\1AL\4_�\ÈQ��!QTNXJ��ÛQTNXB/�7�XKM\4B 8��RBED1BB]KMZ$�?�VK|D1_�ALZEA��VKMN#_;\��XK|D�B]\+�VAL\D1KMNXWRQ(� N[S��N�0BED�8&AC_�� Ké@ �æ^X^ \�Z�XB��B KMNXW _4D1KMNX\���BED1\Â_��RBÄ\��XK|D1Bÿ_4Qé_��RBÄALN#_4B]NXWRB]W��VK|D1_ �8&AC_�� Kÿ@ ��� \�Z�RB�èB�AçN \1SXZ�éK58/K#� _��VK|_�KMJçJ �ÜK|D�_�ACB]\�ZEKMNf"MBED1A�� � _��XK|_�_��RB�D�B]ZGB]A�"MBEDæAç\K��ÜJCB_4QÛD�B]ZGQH"MBED��XAç\;\��XK|D�B��VH\+8/BÌSX\�BæQTNXJ��ÿQTNRBA�7�VKM\4B/8&AC_�� KÛ@ �æ^X^ �XKMJLJ�SX\�BED1\+�ÂSX\4_+�0BæK��VJCBÐ_4QWRBE_4BED�èALNXB_��XB/�VS �VJLAçZ��MB��ÄK|_;_��RBÐB]NXW Q��k_��XAç\;\4_�K��MB��d/QTNV\4B]U#SXB]N�_�J���� 8/BæSX\4BæK�\��[NXZ$�RD�QTNRQTSV\NRBE_ 8/QMD�� _4QéK"MQTAçWC�eD1SX\��XAçN � K|_4_�KMZ��`\��d� 8��XBED�BÿKMN KMW "MBED1\1K|D���8ÈKMAC_�\�SXN�_�AçJ?KMJLJ-QM_��RBED�\4BED�"MBED1\�XK"MB��VJLK#�MB]W���B���QMD�BÂWRBJ�ÜNXALN��ÛAC_�\2Q#8&N�"|KMJLSRB��VþeN _��XAL\\�ZGB]NXK|D1ACQ ��KMNéKMW "MBED1\�K|D�� ZEKMN Z$�RQ[QT\4B�K�VS �VJLAçZ �MB�� QMD>K|_>JLB]KM\4_`�VALKM\/_��RBæWXAL\�_4D1A��VSR_�ALQTN��(*+�RBED�B���QMD�B��`_��RB�D�B]JCB]KM\�BÐQ��-"|KMJLSRB]\ { H>S c08&ALJLJ �0B�èKMWRB>K|_?K �1�[B]W�_�A ��B �¢QMD?B]KMZ�ÿ\4BED�"MBED�MþeNR! �)X 8/B&\��RQH8 �RQH8 _4QÌK#"MQTALWÛ\ �`NXZ$�RD�QTNRQTSX\�NXBE_ 8/QMD��8&AC_��ÄKèNRB�8C�[ALNVW Q��<�VJçK�MBED�

� 2���=>;�� �T?� |2�� ?�� ;��0 21?@2/, 2o=v' þeNÄQTSRD2\�Z�RB�èB��ÜKMJLJ�SX\�BED1\+�XK#"MBÌ_4Q2"MBED1A)� �PKèJCQM_;Q��<�XD�Q[Q��«\��@!K|D1_�ALZESXJLK|D1J)���-A���_��RBéN#S7�N�0BED1\ÛQ��A�VK|D�_�ALZEA)�VKMN�_�\ÿAL\�� KMNXW8B]KMZ� Q��æ_��RB��\��XK|D1B]\��XAç\Û\4B]ZGD�BE_D1KMNXWRQ(��AçN����VALB]ZGB]\�� 8-BO�XK"MB��RW����@Z;\��XK|D�B]\;ALNP_��XBÌ\�Z�XB��B��1� QMD�BEQ#"MBED�0ALNPQTSRD2\�ZGB]NXK|D1ACQ �XKMJçJQ��k_��RB]\�B/�VACB]ZGB]\;K|D�B/�XD1QTKMWXZEKM\4_>KMNXW:�ÂSX\4_`�0B "MBED1AQ�VB]W6� � KMJLJ\�ÜK|D�_�ALZEA��VKMN#_�\��d] BæWRQèNRQM_>SV\4BÐK�4ZGQ(���VJLKMALN#_��7�XKM\4B� ALNK80�XALZ� K��ÛAL\�JCB]KMWXAçN �2�VJLK#�MBEDÐALN ��QMD�è\;_��RBÂQM_��RBED1\_��XK|_�K5"MBED1AQ�ÜZEK|_�ALQTNWRQ#B]\ÌNRQM_/8-QMD� � G2B]NXZGB��9_��RB ZGQ(���VSR_�K|_�ACQTN ZGQ(�2�VJCB �RAC_ �éAL\���W���� � Z$� 8��XBED�B]KM\�QM_��RBED5\1Z�RB��B]\�XK"MBèKÿZGQ(���VJCB �RAC_!� ALN���W����@Z$��G&QH8-B�"MBED�-8-BM�0B]JLACB�"MBÂ_��XK|_ÐAC_WXQ#B]\�NRQM_�_�K����0BED��XD1KMZG_�ALZEKMJLAL_ �\�ALNXZGB�_��RBæN[S��O��BEDÈQ��&�VK|D�_�ALZEA)�VKMN�_�\;Aç\;SX\�SXKMJLJ)�èJLA)�èAC_4B]W �[O�ALNXKMJçJ����#_��XBA�XALWXWRB]NPZGQTNX\�_�KMN�_&AçN _��XB�FINRQM_�K|_�ACQTN$Q��kQM_��XBED��XD�QM_4Q`ZGQTJL\+�ÛK��MB]\>_��RBÌZGQ(�2�VK|D1AL\4QTN$K��VAC_+��B]KMNXAçN �TJCB]\�\��

� ���0 2! o;!� ;A5o?�2�� ?"�7; , 2�� =T;�� �T?� 1' HÈ_+�VD1\�_ �TJLKMNXZGB��VQTSXD&\�Z�XB��B5\4BEB�Û\>_4Q �0BæZGQT\4_�J)�PAçN_4BED�è\�Q���ZGQ(���ÜSR_�K|_�ACQTNX\-\�ALNXZGB>KMJLJV\4BED�"MBED1\a�XK"MB2_4QÌZ�RB]Z�è_��RB&\�XK|D�B]\�Q���_��RB&QM_��RBED1\��eG2Q#8/B�"MBED�KM\NXQM_4B]W K��0QH"MBèALN?�XDgKMZG_�ALZEKMJ�\�AC_�SXK|_�ACQTNV\�8/BM�VK"MB�_4QÄWRB]KMJ¼QTNVJ��:8&AC_��4�¢B�8�\4BED"MBED1\��0OXSRD�_��RBED�F��QMD�B��kA)�b8/B58/KMN#_Ì_4Q B �[B]ZESX_4B QTSRDM�XD�QM_4Q`ZGQTJa8&AC_�����QMD1B \4BED�"MBEDg\�� 8/B �VD�Q#"`ALWRBÛAçN K����0B]NXWXAE�! � ^ÄKÄ\4QTJLSR_�ALQTNé_4Q \��0BEB]W`FIS � _��RB�"MBED1A��ÜZEK|_�ACQTNf�7�XKM\�B�� *+�XKMN �`\�_4Q K:�«KM\4_/�VK|_�Z��"MBED1AQ�ÜZEK|_�ACQTN �8-BO�XD�Q#"MB5_��XK|_>_��RB5ZGQ(���VSR_�K|_�ACQTN ZGQ(���VJCB �RAC_!�ÿQ���QTSXD&\�Z�XB��B5AL\&ZGQ(���VK|D1K��VJLBA8&AC_��:�VD�B�"[ALQTSX\QTNRB]\��

&('$# �R37? = �>5 ; 2�� ?�� ;% *& ;e0

þtNè\�B]ZG_�ACQTN�^ ��8-B&WXBJ�ÜNRB;_��RB&\�B]ZESRD1AC_!���èQ[WRB]J��¢QMD�_��XB&WXAL\4_4DgA��VSR_4B]WM�MB����MB]NRBED1K|_�ALQTNèQ���WXAL\�ZGD1BE_4BGFJCQ��6�MB��[\���þeNé\4B]ZG_�ACQTN[� ��8/BÂD1B]ZEKMJLJ�\4Q(��B�ZGD�� �X_4Q��MD1K��7�XAçZO�VD1A)�èAC_�A)"MB]\&KMNXW��XD�B]\�B]N�_ÐK5�XD�Q[Q���Q����KMACDgNRB]\�\��wþtN5\4B]ZG_�ACQTNMD ��8-BÈWRB]\�ZGD1A)��B?_��RB/\1Z�RB��BÈKMNXWÂALNÌ\�B]ZG_�ACQTN'�>_��RBÈ\4B]ZESRDgAC_ �/�XD1Q#Q��1�sO�ALNVKMJLJ����8-BÌWVAL\�ZESX\�\/_��RB5ZGQ(���VJCB �RAC_ �ÿQ���QTSRD+�XD1QM_4Q[ZGQTJ9AçNÄ\4B]ZG_�ACQTN � �

D

Page 6: One Round Threshold Discrete-Log Key Generation without Private

� ���������ÜüRû�ø�ýn÷��)ù�ú���

�d'�& ���7;�� ;e?�� 240 - *15 6�?"�7;��]=>* o;e0 �Z�SRDA�TK���BPALNXZEJçSXWRB]\�_��RB2��QTJLJCQH8&ALN �:�ÜJLK�MBED1\5ZGQTNXNRB]ZG_4B]W _��RD�QTS��(�òK$\��`NXZ$�RD�QTNRQTSX\N�XD�QTKMWXZEKM\�_Z�XKMNXNXB]J\9TKÐ\4BE_�Q����;\4BED�"MBEDg\ F���b�b�b� ��F���KMNXW�KMNèKMW "MBEDg\�K|D��M8��RQ/�èK��ZGQTN#_4D�QTJXS ��_4QiO�\4BED�"MBED1\�H=�ÜJLK�MBED�F7H�AL\&ZGQTNX\�ALWRBED1B]W�������$KM\JCQTN �èKM\��RBA�XKM\��¢QTJLJLQ#8/B]W _��RBA�VD�QM_4Q[ZGQTJkKMNXW���T! dUQS#" QTNXZGB�RBA�XKM\>WRB�"`ALK|_4B]WK�¢D�Q(��_��XBA�XD�QM_4Q`ZGQTJ �

�d'�� $ 210 � *1=&%$;(' 5 �T?��>245H O»FnQTSR_eFnQ��çF �fS*)�+�R�,-).��U/�10(R2"3��R54 R2+�T�S#67�!48,592)dR5: R AL\ÂK��XD�QM_4Q`ZGQTJÈ_��XK|_�KMJLJCQH8&\�KMNe� \�S �V\4BE_ÂQ��O<; XM�VJLK#�MBED1\�QTSR_�Q�� �5_4Q5�MB]NXBED1K|_4Bè_��RB�\4B]ZGD�BE_/�MB������VSX_WXAç\�KMJLJCQH8&\&_��XBO�MB]NRBEDgK|_�ACQTN A�� ��B�8-BED_��XKMN$Ob�VJLK�MBEDg\+�VK|D�_�AçZEA��VK|_4B�_4QÛ_��RB/�VD�QM_4Q[ZGQTJF�

H O»FnQTSR_eFnQ��¢F �ÿ_��RD1B]\��RQTJLW'�MB�� �MB]NRBEDgK|_�ACQTNÎAL\�ZGQ(���0QT\4B]W���� K10�R2"=� R24 R5+ T�S#67�!4 T�U �(�!+�6 S*)�:_��XK|_-_�K��MB]\;KM\/ALN �ÜSR_?KÌ\�B]ZESRD1AC_!���VK|D1K���BE_4BED � �[_��RB2N[S��O��BED �>Q�� �MB]NRBED1K|_�ALQTNÿ\�BED�"MBED1\��[KMNXWÛ_��XB_��RD�B]\��RQTJçW �VK|DgK���BE_4BEDNO �RAC_/QTSR_��VSR_�\;KM�VS��VJLALZ �MB��PF?>��RKMNXWPKÂJçAL\4_A@B>3��b�b�b� �C@D>E�;Q��k\��XK|D1B]\Q��!_��XB/�XD1A�"|K|_4B/�MB��ÄKM\�\4Q`ZEALK|_4B]W _4Qè_��XBÌJLAL\4_NF?> � �b�b�b�7��F?>F�;Q���\��XK|D1B]\;Q���_��RBA�VS �ÜJLALZ+�MB����

�d'$# G/;e,e370�T?� �9P;IH 3 �>0#;!� ;A5o?��*+�RBè\4B]ZESRDgAC_ � D�B]U[SXACD�B��B]N#_�\ ��QMD5KP_��RD�B]\�RQTJLWf�MB��f�MB]NRBED1K|_�ACQTN \�Z�XB��BÛK|D�BJ9C�!+�+�R-9S#4 R2,-,ÿKMNVW,�RK9+�R-95"�� ] B/�XD�B]\�B]N�_ �RBED�B�_��RB�D�B]U[SXACD1B��B]N�_�\b��QMD>WXAL\�ZGD1BE_4B�JLQ��TK|D1AC_���� �VS �ÜJLALZ �MB��GF?> \:pR\s�� ��Q`W�z KMNXWJ@B> \:I �7*+�RBL@B> AL\&\��XK|D�B]WÄK���QTN��è_��RB �Ð\4BED�"MBED1\�

*+�RBM9C�!+C+�RK9#S#4 R�,C,O�XD1Q���BED1_ �PZGQTNX\�AL\4_�\ÈQ���_��RBÌ_��RD�BEB/��QTJLJCQ#82ALN �T\;AC_4B�è\�

� H2JçJÜ\�S��V\4BE_�\-Q�� ON; X2\��VK|D�B]\b�XD�Q#"`ALWRB]W �����RQTNRB]\4_b�VJLK#�MBED1\ÈWRBJ�ÜNRB2_��RB\1K���BSVNXALU[SRB&\4B]ZGD�BE_�MB��GI-�

� H2JçJ-�RQTNRB]\�_��VK|D�_�ALB]\0�XK#"MB5_��XB5\�K���BM"|KMJLSRBæQ�� �ÜS �VJLALZ��MB���pG\ s � ��Q[W�z �78��RBED1B]I AL\>_��XBSXNXALU[SRBÐ\4B]ZGD�BE_��TSXK|D1KMN#_4BEB]W?� �ÿ_��XB/�XD�B�"`ACQTSX\;AC_4B�:�

� *+�RB/"|KMJLSRB�I Aç\;SXNXA���QMD�èJ��èWVAL\4_4D1A��ÜSR_4B]W AçN$KNM�XKMNXWK�RB]NXZGBipPAL\;SXNXA���QMD�èJ)��WVAL\4_4D1A��ÜSR_4B]W AçN_��RBÌ\�S����MD�QTS �6�MB]NRBED1K|_4B]W4� � s �

*+�RBO,RK9+�R-95"��XD�Q��0BED�_ �/��B]KMNV\9_��XK|_¼NXQ&ALN ��QMD�èK|_�ACQTN�QTN]IÂZEKMNN�0B�JCB]K|D1NRB]W/� �ÐKMNÌKMW "MBEDg\�K|D����B��MQTNVW480�XK|_ �¢QTJLJLQ#8&\���D�Q(� B]U#SVKMJLAC_ � p \ s�� ��Q`W�z-��*+�RB�\4B]ZGD1B]ZJ� ZGQTNXWVAC_�ACQTN ZEKMN��0BM��QMD1B�¢QMD�ÛKMJLJ���B �d�XD�B]\�\4B]WPALN _4BED�è\/Q��!\�A)�ÂSXJLK|_�K��VALJçAC_ ���e*��RB\1A)�5SVJLK|_�ACQTN B]NXK��VJCB]\/_4Q��XD�QH"MB_��VK|_/_��XBK|_4_�KMZ��MBED�P=JCB]K|DgNX\5NXQM_��XALN � QTN _��RBÿD1KMNXWXQ(� N[S��N�0BED1\ÌQ��>_��RBPSXNXZGQMD�DgS �X_4B]W \�BED�"MBED1\����$QMD�B�XD�B]ZEAL\4B]J)���kA��OP �XKM\M�`NRQ#82JCB]W �MBÛQ��&_��RB<OÌD1KMNXWRQ(�(N#S7�N�0BED1\ÌQ��>_��RBPZGQMD�D1S �X_4B]W \4BED�"MBEDg\ÂKMNVW�[NRQH8&\Ð_��RB �VS �VJLAçZN"|KMJLSRB�p �9K:�XD�Q��MDgK��=ZEKMJLJCB]Wò\1A)�5SVJLK|_4QMDRQ�ZEKMN���B�B �`B]ZESR_4B]W ALNéB �d��B]ZG_4B]W��QTJ)�[NRQ(�ÛALKMJT_�A)�èB��|\�Q_��VK|_�_��RB`"[ACB�8 Q��Ü_��RB;KMW "MBED1\�K|D��ÂWXSRD1AçN �2KD�B]KMJ[D1SXN�AL\�ALNVWXAL\4_�ALN��TSXAL\��XK��ÜJCB�¢D�Q(� _��XB�QTSR_��VSR_�Q��?_��XBè\�A)�ÂSXJLK|_4QMD��G2B]NXZGB���_��RBèKMW "MBED1\1K|D�� ZEKMNVNRQM_æ\4BEBèA���_��XBèWXAL\4_4D1A)�VSR_�ACQTNZGQ(��B]\-��D�Q(� K&\�A)�ÂSXJLK|_4QMDkQMD-��D�Q(� K&D�B]KMJTDgSXN��#/QTNV\4B]U#SXB]N�_�J����wKM\¼_��RB/\�A)�ÂSXJLK|_4QMD¼WXQ#B]\kNRQM_-�`NRQ#8_��RB\�B]ZGD�BE_>ALN ��QMD�èK|_�ACQTN �T_��RB�QTSR_��VSR_/Q��9_��RB�\�A)�ÂSXJLK|_4QMD;ZEKMNXNXQM_a�0B�SX\4B]W���� _��RBKMW�"MBED1\�K|D��è_4QJCB]K|D1N:�`NRQ#82JCB]W �MBÐQTNÄ_��RB5\4B]ZGD�BE_&N[S��O��BEDg\ÈQ��!_��XBæSXNXZGQMD�D1S��X_4B]W6�VJLK#�MBED1\��

Page 7: One Round Threshold Discrete-Log Key Generation without Private

�d'�� ���7;��P6 o;e0 �*(0�>*1=��P*�� ;*¼Q�WRBJ�ÜNXB 9-� +C+�RK9#S#4 R�,C,OT!4 ��,�RK9 .+C6 S#" T�eT 6 4N,JSWT�,YSFT�S#679OT�����R5+-,�T!+C"�� 8/BÐZGQTNX\�ALWRBED/_��RB ��QTJLJCQ#82ALN ��TK���BA�VJLK#�MB]W$K��TKMALNV\4_>\�SXZ$� KMW "MBED1\�K|D���

� & *+�RB2KMW "MBED1\�K|D��FP �XKM\a�`NRQ#8&JLB]W �MB>Q���_��RBALN�_4B]NVWRB]W�QTSR_��VSX_?Q���_��RB&WVAL\4_4D1A��ÜSR_4B]W�WXAL\�ZGD1BE_4BGFJCQ��2�VS��VJLALZ��MB�� KMJ��MQMD1AC_���� 9R_��XBA�VS �VJçALZ��MB��Gp �

� � *+�RB;K|_4_�KMZ�MBED/Z$�RQ#QT\�B]\�_4QæZGQMD�D1S��X_ O!\4BED"MBED1\�� P JLB]K|D1NX\�KMJLJ[_��RB]ACD�\�B]ZGD�BE_�\�KMNXW�\��XB>KMZG_�A�"MB]J��ZGQTN�_4D1QTJL\>_��RB]ALD ��B�VK"`ACQMD�

��# �?KMZ$�M�VK|D�_�ALZEA��ÜKMN�_¼Z$�RQ[QT\4B]\�K&D1KMNVWRQ(� N[S��O�0BEDkKMNXW5\��XK|D�B]\!AC_kSV\�ALN �&K@?S��VJLALZEJ��n��BED1AQ�ÜK��ÜJCB^[B]ZGD�BE_^ �XK|D1ALN ��\�Z$�RB��BÌK��èQTN �è_��RBÐQM_��RBEDg\��

� ø �?÷Mù �9ø���&�-ýIü��Ûø�ý�� ýn÷Tý�� ���

#/'�& ���7;���* � =>= �>;A0<, 0� ?@2 � �?@;!���K|D1ACQTSX\ÈZGD�� �X_4QT\��`\4_4B�è\b�VKM\4B]W QTNÿD1KMNXWRQ(�ÛAEDEB]WÛB]NVZGD����V_�ACQTNÛ\�Z$�RB��B]\��PW��jZ$�d8��XAçZ�èB]NVZGD����V_KM�èB]\�\�K��MB�� � �èD1KMAL\�AçN �5KM�VKM\�Aç\ s _4Q�_��RB �0Q#8/BED�� KMNXWP\�SXAC_�K��VJ)�ÂDgKMNXWRQ(�èAED]AçN �Ì_��RBD�B]\�SVJC_���XK"MB+�0BEB]NM�XD�Q��0QT\4B]W�\4Q/�«K|D�BQX � � � �#X@� � X�HEF� *+�RB]ACD�\4B]ZESXD1AC_ �ÂAL\&�VKM\4B]W�QTN�"|K|D1ACQTSV\��eD1B]\�ALWXSRQT\1AC_ �%�KM\�\�S����V_�ACQTNX\ÐKMNXW _��XBè_4D1K���WRQ[QMDæAL\æK:�XALWVWRB]N \�S ���MD1QTS �f8��RBED�BÛWVAL\�ZGD�BE_4BèJCQ�� ZGQ(�2�VSR_�K|_�ACQTNX\K|D�B���B]KM\�A��ÜJCB�� ] BPZEKMJLJ�_��RQT\�BÿZGD�� �X_4QT\��`\4_4B�è\5S#+�T"!.� �� +J�!6 ,295+�R�S R:U/�-�eT!+�6 S*)(: ,292) R2: R�,Y�!H\5KMNA)���0QMD�_�KMN#_-ZGQTNX\4B]U[SRB]NXZGB�Q��k_��XAL\-B]NXZGD�� �X_�ACQTN _4B]Z�XNXAçU#SRB��[_��RQT\4B�\�Z$�RB��B]\ �XK#"MBA�RQ(��Q(��QMD�� �XALZ�XD�Q��0BED�_�ACB]\È_��XK|_2ZEKMN:�0BæALN ��QMD�èKMJLJ�� \4_�K|_4B]W$KM\��¢QTJLJLQ#8&\�9

�PW�� �B;#��Z \$�PW�� ��Z�%&�<W��

�Z KMNXW �<W��'%&�CZ \$�PW��jZ U

@�KMALJLJLACBED&�XKM\ �XD�B]\4B]N#_4B]WÌ_��XD�BEB/ZEJLQT\4B]J��ÐD�B]JLK|_4B]W�\�SVZ�ÂZGD����V_4QT\��[\�_4B�è\�ALN�BQX�HEF��] BÈQTNXJ��ÐD�B]ZEKMJçJ_��RB/�VD1\�_/QTNXB��

*+�XAL\5ZGD�� �X_4QT\��`\4_4B� AL\A�VKM\�B]W QTN _��RB��XD�Q��0BED�_�ACB]\ÌQ��>_��RB�ÈK|D�èALZ$�XK|B]J?JçK��N��WXK:�«SXNXZG_�ALQTN( W�)[Z2ALN K+*-,/.H� ] B�D�B���BED�_4Q ( W�)"Z2KM\ ( � ] B�D�B]ZEKMJLJ&�RBED�BÂ_��RB��èKMALN _ 8/QP_��RBEQMD�B�è\�9 ��QMD�KMN��0 J K+*-,1. �

032 \ X+��Q`W4) � KMNXW 0 * 2 \ X+��Q`W4) �

5 ;� 6�G;A5 ;A0 *�? �T2o5 ' �9BE_7) ��B KMN>;�^`Hh��Q`WXSXJLSV\8) \_zom��a8��RBED�BRz�KMNVW mòK|D1B4�XDgA)��BALN�_4B��MBEDg\����¼BE_:9 �0BÿKMN AçN�_4B��MBED�8��RQT\�B QMD1WXBEDÂAL\ÂK JLK|D��MB6�5SXJL_�A��VJCB�Q���) ��Q[WVSXJCQ;) � �&*��RB�VS �VJLAçZ��MB��ÄAL\NF?> \CW�) �"9]Z;KMNXWÄ_��RBæ\4B]ZGD1BE_��MB��ÄAL\ @B> \ ( �< 5 , 0� 7? �T2o5 ' *kQÂB]NVZGD����V_/K���B]\�\1K��MB=� J K * �[D1KMNXWRQ(�èJ)�èZ�RQ[QT\4B�> ALNPK * .2KMNXWPZGQ(���VSX_4B_��RBÌZEA��7�XBED�_4B �[_+? \@9BAC> * �èQ[W4) � �%$;e, 0� ?��>245 ' *¼Q&WXB]ZGD����V_ ?H�wZGQ(���VSR_4BD� \FE W�? 2 ��Q`W8) � Z

E WG9 2 ��Q`W8) � Z �èQ[W4) 8��RBED1B�_��RB E FF�«SXNXZG_�ACQTN_�K��MB]\ ALN ALN �VSR_ÂB]JCB��B]N#_�\2��D�Q(� _��RB \4BE_MQ * \IHIKJL) ��M I \ X ��Q[W:)ON KMNVW ZGQ(���VSR_4B]\E W>IdZ \ ��P �* �

*+�RBÄALN#_4B��MBED1\8? 2 ��Q`W8)��ÿKMNXWQ9 2 ��Q[W8)%�ÿK|D�BÄB]U#SVKMJ-_4Q X58��XB]N _��XB�� K|D�BÄD1KMAç\4B]W _4Q_��RB��0Q#8/BED=) \4QÄ_��RB��éK|D�B8);RTSÿD�Q#QM_�\æQ��-SXNXAL_ ���9OXSRD1_��RBED��QMD�B���\�SVZ�éD�Q[QM_�\æK|D�B�Q��-_��RB��¢QMD$�W X ;U)"Z�V \3X ;XWY) ��Q`W8)%��� /QTNX\4B]U[SRB]N#_�J�����_��RB E FF�«SXNXZG_�ACQTNÎKMJLJLQ#8&\Û_4Q ZGQ(���VSR_4B \�SXZ�"sKMJLSXB]\�WK��Q`W4)(KMNXW E W�WG9 A Z 2 ��Q`W8)��@Z \$� % E WG9 2 ��Q`W8)%�@Z&��Q[W:) �

Page 8: One Round Threshold Discrete-Log Key Generation without Private

� � ;89<; ���>6 372 ���T?� � =>* � � �r0#2�� =>;!��' H2\1\�S���B _��XB QMD1WRBED Q�� 9 AL\ K��5SVJC_�A��VJCBPQ��=)'�?HN#S��O�0BED�� AL\æ\�KMAçWò_4QK�0BÛK;) R S D�B]\�ALWVSRB���Q[WVSXJCQ&)%�èA��/_��RBED�BÛB �RAL\4_�\5K$N[S��O��BEDB>�J�K+*-,/.\�SXZ� _��XK|_�� \ > * ��Q`W8) � �?ORQMD 0 JCK+* ,1. � 8/B ZEKMJLJ�)&R S D�B]\�ALWXSXQT\�AC_ � ZEJLKM\�\èQ�� 0 8&AL_��D�B]\��0B]ZG_Û_4Q#9 _��RB SXNXALU[SRBÄALN#_4B��MBED��:JCK * �¢QMD�8��XALZ$�Î_��RBED�B B �`Aç\4_�\4> J K * .Ä\�SXZ$� _��VK|_9�� > * \ 0 ��Q`W8) � �

*+�RBn/Q(�2��QT\1AC_4B+;>B]\�AçWXSRQT\�AC_!�+ÈJçKM\�\�@�D�Q��ÜJCB��AL\�WRBJ�ÜNXB]W�_4QA�0BÈ_��RB&ZGQ(���VSX_�K|_�ACQTNXKMJ �XD1Q��RFJCB�)Q���ZGQ(���VSR_�ALN���_��RBæZEJLKM\�\;Q���K�DgKMNXWRQ(��B]JCB��B]N#_&ALN$K *-,/. �Gd;A, 3 0 �T? (' *+�XAç\ �XD�Q��VJLB�7_��XK|_?B �RKMZG_�J��èZGQTNX\�Aç\4_�\?ALNÛALNe"MBED1_�ALN �Ð_��RB&ZGD���X_4QT\��[\4_4B�?�#AL\W��B]JçACB�"MB]W_4QK�0BèALN#_4D1KMZG_�K��VJCB��-*��RBÛ\4B�èKMN#_�ALZè\�B]ZESRD1AC_!�éAç\/�VKM\4B]W QTNò_��RBÛWVAQI ZESXJC_!�$_4Q WXAL\4_�ALN��TSXAL\�� )&R SD�B]\�ALWXSXB]\ ��Q[WVSXJCQ ) � � ] B5D�B��¢BED&_4Q4BQX�HE ��QMD&WRBE_�KMALJç\��

#/'�� � �0 2/2�� 2�� �v* �>0 57; � �þtN8_��XAL\ \4B]ZG_�ACQTN��a8-B��XD�B]\4B]N#_ K'�XD�Q[Q��ÐALN _��XB \4_!�[JLB$Q���B_^q�HE 8��XALZ$� B]NXK��ÜJCB]\Û_4Q��XD�QH"MB _��VK|_WRB]ZGD�� �X_�ACQTNÿQ��C\@9 � > * ��Q`W8) � ALN5�VKM\4BB9�KMJLJLQ#8&\/_4Q�D�B]ZGQH"MBED&_��RBÐWXAL\1ZGD�BE_4BJLQ��TK|D1AC_���� Q��p�\ s � ��Q[W�z ALN6�VKM\4B s ��8��RBED�B s AL\ÈQ���QMD1WRBED&K2�XD1A)��B�m�ALN�K�� .H�

] BÄWRB]\�ZGD1A��0BÛK NRQTN`FIAçN�_4BED1KMZG_�A)"MBÿ\4_�K|_�Aç\4_�ALZEKMJ DEBED�Q|FF�[NXQ#8&JCB]W��MB5�VD�Q#Q��;Q��;_��XB B �RAL\4_4B]NXZGBÿQ��_ 8/Q \��èKMJçJ�N#S��O�0BED1\� òKMNXW��Ä\4Qè_��XK|_ M M J�{7KMNXW M � M J�� 8��VALZ�6"MBED1A)� �ÿ_��XK|_ 9��� P�� AL\&K) R S D�B]\�AçWXSRB���QMD� �� P � \�JCQ����7p � ] B/�XD�QH"MB_��XB\4B]ZESXD1AC_ � Q��9_��RB �XD�Q[Q��9ALN _��RB�D1KMNXWRQ(� QMD1KMZEJLB��Q[WXB]J �

%$; �, 0 � ?��>24582��n?"�7;��0 2/2���' �9BE_�I[J B c%�C@ B��0B5_��RB5\4B]ZGD1BE_�"|KMJLSRB���KMNXW {O����KMNXW @Î_��RD1BEBALN�_4B��MBEDg\&\�SXZ$� _��XK|_ M { M��KM � M�� M @ M ;|� �\8��RBED�B � ��AL\&Kè\4B]ZESRD1AL_ �6�VK|D1K���BE_4BED#� *+�RB/"|KMJLSRB!� Aç\_��RBæQTSR_��VSX_>JCB]N �M_��PQ���K2�XKM\��6�«SXNXZG_�ALQTN#" �

*+�RB5�XD�QH"MBED�Z$�RQ[QT\4B]\�K$DgKMNXWRQ(�$�$ALN B c%��{MB!KMNXW K$DgKMNXWRQ(� g J:K * .H� *+�RB]N��&�RB ZGQ(��F�VSR_4B]\ O \ W s �`�èQ[W�z �"9��bg * ��Q[W8) � Z$�n�¼BE_&%'�0Bò_��RB �XKM\��C"sKMJçSRB'" W s �"9+��po�( � s ����Q`Wz7�"9 � g * ��Q`W8)��@Z$� �2B �[_��;_��XB��XD�Q#"MBED ZGQ(���VSR_4B]\#) \*�M;+%bI KMNVW 0 \ g >-,W��Q`W8)'�;þ!�)/.J B c%��{�B ��_��RB:�XD1Q#"MBEDèD�B]\�_�K|D�_�\�8&AC_�� KMNRQM_��XBED�D1KMNXWRQ(� "|KMJLSRB]\0�éKMNXW�g SVN�_�ALJ1)|J B c%��{MB �*+�RB��XD�Q[Q��ÈAL\Ð_��RBè_4DgA��VJCB�W2%q�()(� 0 Z+JCB c%�(�:B�%�B c%��{�B�%�B c%� ) B ��þ»_ÌAç\æZ�RB]Z�MB]W���� _��RBèB]U[SXK|_�ACQTNX\%�\3" W s �"9���p4�( � s54 p P ,W�èQ[W�z7�"9 4 0 * P ,a��Q[W:)��Z$��)RJ B c%��{MB ��KMNXW$p M \ X���Q[Wiz-�

� 2���=>;e?@;%57; � �q'�6 )dROR87�R-95 S#6#� 4&9RS;:aRR54fT ! + � ��R2+<:B)I�F0 4 �=:B,AS*)dRR,�R-95+�R�S I T!4 �5T8��R2+�6 >`R2+6 ,R,� N9C9$R2,-, �� dU�:D6 S*)J� ��R2+?:B)dR�U :E6*4(� ! + ��9�T5926 U 6 S#" 6 � @@�BA�{ JCXCA�^ U?D 6 ,?4\R ��U 6 � 6E9JU)RV�r0 2/2�� 9 *+�XB�"MBED1A��VBED��XKM\�KMZEZGB]\�\�_4Q�W2%q�()�� 0 Z�8��XBED�BF) \G�L;H%IUJ {O� 0 \ g > , ��Q`W8)'�KMNXW�%�\I" W s �"9���p4�( � s � ��Q`W�z7�"9 � g * �èQ[W8)%�Z$�aG2B$ZEKMN Z$�RB]Z�� 8��XBE_��RBED�) J {O� s � \s �(J , � W s�� Z P , \ s 4 p P , ��Q[W�z �-KMNXW$9���g * \ 9K�LJ , � W�g > , Z * WG9 � > * Z P , \ 9 4 0 * P , ��Q`W) � �

þ!�2_��RB6�XD�QH"MBED��¢QTJLJLQ#8&\Â_��RB6�XD�QM_4Q`ZGQTJ ��_��RB6�XD�Q[Q����«KMALJL\5QTNXJ�� A��M) � {O� *+�RB6�XD�Q��VK��ÜALJLAC_!�Q��+��KMAçJLSRD�BèQ��\�SXZ$� KMN B�"MB]N#_�_�K��MB]N Q#"MBEDèKMJLJa�0QT\�\�A��VJLBÛZ�RQTAçZGBÿQ��M�$AL\�\��èKMJLJLBEDÌ_��XKMN @@�BA�{O�/QTNX\4B]U[SRB]N#_�J����R_��RBÐB �`B]ZESR_�ACQTN Q��!_��RB/�XD1QM_4Q[ZGQTJ9Aç\>\�SXZEZGB]\�\���SXJ\82AC_��5�XD�Q��VK��VAçJLAC_ � �MD�B]K|_4BED&_��XKMNX�NPO�QR ��*+�#SV\��XA��B@��SA�{�AL\>NXB��TJLA��TA��VJLB��#_��RBN�XD�Q��VK��VAçJLAC_ �ÛQ��!\�SVZEZGB]\�\&AL\ÈQH"MBED�8��RB]J �èALN � � TU

Gd2o3 5 6�5 ; � �q'WV �2S*)dR:��R5+C6 >bR5+ T 9-9YR�! S*, S*)dR�! + �� �YXZ:D6 S*) ! + ��9�T�956 U 6 S#" � XCA�� ;\[�:B)dR5+�R0[ 6 ,2T4 �!4�] 4 R �(U 6 � 6E9JU)R�^ �T!47S#6 S#"_X S*)dR54� I,C6*4(� S*)dR-! + ����R2+NT ,ATa`b9JU�T 920�]L9-�c7�d 6 S�6 , !.� ,-,�629�U�ROS � 9-�!:3! S R T!4 �S� ,� N95)4S*) T�S M M J { T!4 � M � M J/� ,C 95)4S*) T�S� �� P � \ I5�èQ[W�m5X s � \ p���Q`W�z>T!4 �9 � � 6 ,OT ) RTS +�R2,C67�! 7R :F���! dU/�8)%��V

Page 9: One Round Threshold Discrete-Log Key Generation without Private

�r0 2/2�� 9/ORQMDÿK��TA�"MB]N�OY�-A���K��XD1Q#"MBED ZEKMN �ÜNXW _!8-Q _4D1A��ÜJCB]\�W2%q�()�� 0 ZèKMNVW W2% � �() � � 0 �xZ�8��XALZ$��VKM\�\2_��RBO�VD�Q#Q��<8&AL_��$NRQTN`FINXB��TJLA��TA��VJLB/�XD�Q��VK��VAçJLAC_ ��� �RB5ZEKMN Q��X_�KMALN _��RBO�¢QTJLJLQ#8&ALN��èB]U#SVKMJLAC_�ACB]\N99 4 P 4 D W 0 A 0 �TZ * , \H , P , D ��Q[W8) � KMNXW s 4 P 4 D \:p , P , D �èQ[W�z �

G&B]NVZGB��ÜA�� 8-BÌNXQM_4B< \3)�N ) � KMNVW �<\H% N % � 9

9 � W 0 A 0 � Z * , \3 � ��Q`W4) � KMNXW s � \:p � ��Q`W�z W X@ZKMNXW M M J�{�KMNXW?c4J M � M J��5�

H2\ p M \ X+��Q`W�z KMNXWPKM\È_��RBED�BÐAL\ÈK�SXNXALU[SRB2\1S ���MD�QTS �ÿQ��9QMD1WXBED mÂALNPK�� . �`_��RB "sKMJLSXBnpÛAç\ALN � s�� �7G2B]NXZGB�����D�Q(��_��RBæ\4B]ZGQTNVWÄB]U#SVKMJLAC_ ��� 8/BæWRB]WXSVZGBÐ_��XK|_ �� P � ��Q`W�mÂAç\È_��RBæWXAL\�ZGD1BE_4B�JLQ��Q���p �

] B NXQM_4B�� \ �TZEW W; d�(�1Z$�/H2\Pm AL\èK �XD1A)�èB N#S��O�0BED� 8/BK�MBE_ A�� \ ��A�� % I6��Q`W�m ��9BE_� 4c \$ A����1�bc \$��A��7�a%æNRQH8&JCB]W �MB$Q���W; 4c �(�bc@ZÂB]NXK��VJLB]\è_4Q ZGQ(���ÜSR_4B$_��RB \4B]ZGD�BE_RIj\ c � c P � ��Q[WRm��

�9BE_��I5�0B;_��RB>D�B]\1SXJC_�Q��0_��RB&WRB]ZGD���X_�ALQTN�Q��� �Tþ1� s� \:p���Q[W�z �(8-B2K|D�B&WRQTNRB��dZ_��RBED�8&Aç\4B��8-BÂ\4B]K|D1Z� _��RBO"sKMJçSRB]\M 4cæKMNXW��bcA8��RBED�B< 4c�\P A������bc�\ ��A��PKMNXW��R\ �TZEW7W; d�(�1Z>_4Q��ÜNXW$I �þtNfB_^q�HEF�X@!QTS �VK|D1WÿKMNXWÄ^[_4BED1NÿWRB]\�ZGD1A��0B��RQ#8 _4QM�ÜNXW� 4c2KMNVW��bc��¢D�Q(���I KMNXW )h�XD�QH"[AçWRB]WÛ_��VK|__��RB0�VD�Q#Q��9Aç\-ZGQMD�D1B]ZG_��d*��RB��Û\��RQH88_��VK|_/_��XB\��ÛKMJLJCB]\4_a"MB]ZG_4QMD;Q��9_��RB�JLK|_4_�ALZGB�Q��¼WXA)�èB]NX\�ACQTN�_!8-Q8��RBED�B?K+�VKM\�AL\9Aç\ W�W�) ��c Z �@W �I��X@Z�Z¼ZGQMD�D�B]\���QTNVWX\�_4Q>_��RBa"MB]ZG_4QMD W; c �(� c Z 8��RB]NXB�"MBED ) � ^�� ^ { �5�G&B]NXZGB��[KM\�_��RB2WXA)��B]NX\1ACQTN�Q��0_��RB&JLK|_4_�ALZGBAL\�_!8-Q � [�KMSX\�\-KMJ��MQMD1AC_���� ZEKMN2�0B&SX\4B]Wè_4QæBJI ZEACB]N#_�J��D�B]ZGQ#"MBED_��RBÌ\��ÛKMJLJCB]\4_`"MB]ZG_4QMD�ALN ��W«JCQ��-)"Z$�

/QTNX\4B]U[SRB]N#_�J����ÈA��Ð_��RB��XD�Q[Q��ÌAL\�8-B]JLJCFF�¢QMD�èB]W��W�VK|D1_�ALZEA��VKMN#_<F HÌZEKMN KMJ�8ÈK�`\ÿD�B]ZGQ#"MBED _��XBALN�_4B]NVWRB]W�\��XK|D�B"I 8��VALZ� �èK|_�Z$�RB]\$p \ s�� ��Q`W�z-� *+�XAç\��«KMACD1NXB]\�\ �VD�Q��0BED�_ � AL\PSX\4B��«SXJ&_4Q�TSXK|D1KMN#_4BEBÌ_��XK|_>_��XBÐD�B]ZGB]A�"MBED�82ALJLJ�D�B]ZGB]A�"MBæ_��XBÌZGQMD�D�B]ZG_&WVK|_�Kd� TU

� ;A0#2�� 5 5 2I�<=>;e6�.1;4'M6 )�6 ,�! + �� �L6 ,OT 4 �!4�] 6*47S R2+�T 9S#6 ��RL,JSFT�S#6 ,YS#679T�U��#R5+ �=] 0 4 �=: U�R-���R3! + ��� �JV�r0 2/2�� 90] B ZEKMN�ZGQTNX\4_4D1SXZG_ K \�A)�ÂSXJLK|_4QMDÄ_��VK|_ \�A)�ÂSXJLK|_4B]\ _��RB KMW "MBED1\1K|D��4�v\4"`ACB�8 8&AC_��XQTSR_�[NRQH8&ALN �Î_��XB�"sKMJçSRB[I�AçN�_��RBòD1KMNXWXQ(� QMD1KMZEJCB �èQ[WRB]JF� ] �RB]N KMN SXNXZGQMD1D1S �X_4B]W �VJçK�MBED Aç\\�S ���0QT\4B]W _4Q �MB]NXBED1K|_4BÎK>�VD�Q#Q�����QMD K �TA)"MB]N p �� ��_��RB \�A)�ÂSXJLK|_4QMDéZ�RQ[QT\4B]\ % J B c%�(�6B �) J B c%��{�B?KMNXW 0 J K * . K|_èD1KMNVWRQ(�:��KMNXW8WRBJ�ÜNRB]\�_��XB?"sKMJçSRBÄQ���_��RB D1KMNXWXQ(� QMD1KMZEJCB$K|_W s �"9+��po�( � s 4 p P ,W��Q`W�z7�"9 4"0 * P ,W�èQ[W8)%�@ZÌ_4Q��0B#%�� ]�AC_�� Q#"MBED�80�RB]J)�èALN��4�XD1Q��VK��VALJLAL_ ���_��RBÿ\1A)�5SVJLK|_4QMDO�XKM\�NRQM_M�MBE_�WRBJ�ÜNRB]W _��RBÛDgKMNXWRQ(� QMD1KMZEJCBPK|_Â_��VAL\A�0QTALN#_�� *+�XB �XD�Q[Q��>AL\+,4SV\4_W;)�� 0 �8%#Z$�[þt_?AL\?\4_4D1KMA��(�#_��¢QMD8/K|D1Wè_4QN"MBED1A�� �Â_��XK|_?_��RB2WXAL\4_4D1A)�VSR_�ACQTNO�XD�Q`WXSXZGB]W�� �Â_��XAL\�\�A �5SXJçK|_4QMDAL\;\4_�K|_�AL\4_�AçZEKMJLJ��PZEJCQT\4Bæ_4Q2�0BED���B]ZG_ �XD�QH"[AçWRB]WP_��XK|_M��@ A�{�AL\>NRB��TJçA��TA��VJCB�� TU

� �����#�|ü.�VöD�0ø�ýIù

�?KMZ� \4BED�"MBED��XKM\;_4Q�"MBED1A�� �ÿKMJLJ �XD�Q[Q���\ �VD�QTKMWXZEKM\4_+� �PQM_��RBED��ÜJLK�MBED1\2KMNXWÄ_4Qÿ\4B]JCB]ZG_>_��RB5U#SXKMJçA�F�VB]W��MD�QTS �ÛQ���\4BED"MBED1\���HJLJd�VJLK#�MBED1\�K|D�B2ZGQTNX\�ALWRBED1B]W�KM\ �XD�Q��ÜK��VALJLAL\�_�ALZ �0QTJ��`NRQ(�èALKMJ[_�A)�èB+*kSRDgALN ��èKMZ�XAçNRB]\���þtN _��RB�ALNXAC_�AçKMJLAED]K|_�ACQTN \�_�K��MB���B]KMZ�f�VK|D�_�AçZEA��VKMN#_0�0BED���QMD�è\&_��RB��MB��K�MB]NRBED1K|_�ALQTN KMJCF�MQMD1AC_���� Q���@�KMALJLJLACBED@�v\>ZGD�� �X_4QT\��`\4_4B�:�0ORQMD�� \ X5_4Q � �Ü_��RBO�ÜS �VJLALZ �MB��`\�F?> H \fWG9 H � ) H Z>K|D1B�VS �VJLAç\��RB]WèKMNXWÿ_��RB�\4BED�"MBED F Hk\�B]ZGD�BE_�J�� \�_4QMD�B]\ @B>�H1� *+�RB�"sKMJçSRB ) H¼AL\ÈK�;^RH ��Q`WXSXJLSX\� 9�H¼Aç\KMNÄB]JCB��B]N#_&ALN$K * ,u . Q��!QMDgWRBED&K2�ÂSXJC_�A��ÜJCB2Q���) H�KMNVW�@B>�H7\ ( W�)]HvZ$�

] B5ZGQTNX\1ALWRBED;_��RBA��QTJLJCQH8&ALN ��\�ZGB]NXK|DgACQ?9

!

Page 10: One Round Threshold Discrete-Log Key Generation without Private

� @�K|D�_�ALZEA��VKMN#_�F H �MB]NXBED1K|_4B]\ÐKÛDgKMNXWRQ(� g H>S c ��\4BE_�\�Q H>S c \jg H>S c KMNXW Z�RQ[QT\4B]\iQ HTS U K|_D1KMNXWXQ(��¢D1Q(� KNM ��QMD�X�� ��� O$�&*+�RBÛN[S��O��BEDg\rQ H>S c#�b�b�b� ��QeH>S ` WRBJ�ÜNRBÛ_��RB �0QTJ��`NRQ(�èALKMJ V#H�W>Y"Z \^:`Ubadc Q H>S U Y U J�KNMJB YKEF� *+�XB]N��-�RBÛZGQ(�2�VSR_4B]\ g@H>S hR\ V#HXWEleZ �èQ[W�m � G2B2�XD1QTKMWXZEKM\4_�\�9 �¢QMD�R\ c%�b�b�b� ��O$�%{ H>S U \ s } uEw ~ ��Q[W�z KMNXW<pqH>S h \ s t uEw y ��Q[Wiz-� 4H>S h \@9 tvuxw yh > * uH>S h �èQ[W8)%�h �[KMNVWK��XD�Q[Q��NW2%bH>S h � 0 H>S hq�()@HTS h#Z$�

� *+�RB]N�� ��QMD>B]KMZ$� X�� � �vl�� � �R_��RB5\4BED�"MBED1\ "MBEDgA�� �ÿ_��XK|_A9`�

Ubadc { h ~H>S U \ `�Ubadc s } uxw ~ h ~ \ s���� ~�� } uEw ~ h ~ \ s� u�� h�� �èQ[W�z

KMNXWÂZ�RB]Z�N8��RBE_��XBED s u�� h�� ��Q`W�z�Aç\¼B]U[SXKMJ#_4QnpqH>S h-ALNÌQMDgWRBEDk_4Q�"MBED1A�� �Ð_��XK|_!_��RBÈWXAL\4_4D1A)�VSR_�ACQTNAL\ÈZGQMD�D�B]ZG_���*+�XB\4BED"MBED1\;KMJL\4QM"MBED1A�� �è_��RB �XD�Q[Q��«\�W2%H>S hq� 0 H>S hq�()@HTS h Z?KMNVWÿA)� p MH>S h \ X+��Q`W�z:�¢QMDX�� ���vl�� ���

� *+�RBè\4BE_ ��� H�� Q��;U[SXKMJLAQ�VB]Wé\4BED"MBED1\æAL\ÐWRBJ��NRB]Wf�¢D1Q(� _��RB2�VJLK#�MBED1\/8��XQ6�VK"MB ZGQMD1D�B]ZG_�J���VJLK#�MB]W��7*+�RBÐQM_��XBED1\>K|D�BÌWVAL\�U[SXKMJLAQ�VB]W �

� @�K|D�_�ALZEA��VKMN#_�FohÂWRB]ZGD�� �X_�\ 1H>S h5KMNXW Q��X_�KMALNX\�gH>S hN�¢QMD�X�� ��� � �\G2BÂ\4_4QMD1B]\2_��XBN�VK|D�_�\�g@HTS h�¢QMD��]J ��� H�� KMNVWòZGQ(���VSR_4B]\5_��RB2�ÜS �VJLALZM�MB��òKM\ � H���� � � { H>S cR\ s � c�� ��Q`W�z A��`8/BNRQM_4BPV W>Y[Z�\ ^ H���� � � V H W>Y[Z$� *+�XBÛ\��XK|D�B�Q��È_��RB �MB�� Q��X_�KMALNRB]W�� �f�VK|D�_�ALZEA)�VKMN�_iF h Aç\B]U#SVKMJ�_4Q

�H���� ��� g@H>S h \8V WElAZ&��Q[WRm

*+�RB&\�B]ZGD�BE_W�MB��RgAL\�\�XK|D�B]WèALN2��QTJ)�[NRQ(�ÛALKMJd�¢QMD$�.8&AC_���V WElAZ<��Q`W�mÐKMNXWèAçNèKMWXWXAC_�A)"MB+�¢QMD$�8&AC_��GI%h+��Q`W�m��0BE_ 8/BEB]N$KMJLJ\�VK|D1_�ALZEA��VKMN#_�\`�0B]JCQTN �TALN ��_4Qè_��XBæ\4BE_ ��� Hn�W�

� �B�VüRû�ø�ýn÷U� øTù�ù��þtN�_��XAç\�\4B]ZG_�ACQTN���8/B+�XD1Q#"MB>_��RB>\�B]ZESRD1AC_!�5Q���_��RB&\�Z$�RB��B+��QTJLJCQH8&ALN �_��RB>\4B]ZESXD1AC_ ����Q`WRB]JRWRBJ�ÜNXB]WALNÄ\4B]ZG_�ACQTN�^ �_D ��] BO�XK#"MBÌ_4QèB]NV\�SRD�B�_��RBÌZGQMD1D�B]ZG_�NRB]\�\2KMNXWÄ_��RBæ\4B]ZGD1B]ZJ�ÄQ��k_��RB5\�Z�RB�èB��

� �!+�+�R-9S#4 R2,-,M�èB]KMNX\;_��XK|_>KMJLJ\�ÜJLK�MBED1\>Q��X_�KMALNÄ_��RBæ\1K���BA�MB��ÄK|_>_��RBÐB]NXWPQ���_��RB/�VD�QM_4Q[ZGQTJF�_��XK|_ OD; XÛZGQMD1D�B]ZG_�\��XK|D�B]\5KMJLJCQ#8 _4Q D�B]ZGQ#"MBED�_��RBÿ\4B]ZGD�BE_M�MB�� KMNXW _��XK|_5_��XB \4B]ZGD�BE_�"|KMJLSRBÛAç\SXNXA���QMD�èJ��èWVAL\4_4D1A��ÜSR_4B]WPALNP_��RBæ\�S �7�MD�QTS �:�MB]NRBED1K|_4B]W4� � s ��Q[WVSXJCQ�z-�

� RK9+�R-95" �èB]KMNX\Â_��XK|_ÂNXQ ALN��¢QMD�ÛK|_�ACQTNòQTN IÎZEKMN���BPJCB]K|D1NXB]W�� �ò_��RBPKMW "MBED1\�K|D�� B �`ZGB��X_8��XK|_ ��QTJLJCQ#82\ �¢D1Q(�)B]U#SVK|_�ACQTN$p�\ s�� ��Q`W�z-�� � ;e240 ; � & 6 )dRL,C) T!+�6 4(� ,592)dR5: R 6 , 9C�!+C+�RK9#S T�eT!6*4N,JS`T�����R5+-,�T!+C6FR�,�V�r0 2/2�� 9o�9BE_>SX\>KM\1\�S���BÐ_��RBÌB �`AL\�_4B]NXZGBæQ���KMN KMW "MBED1\�K|D��P�K��VJCBÐ_4Q �XD�B]K��PO/\4BED"MBED1\��� 210#0 ;A,q? 5 ; � �q' þ»_;AL\ÈZEJCB]K|D;_��XK|_��XK|_È_��RB�B]NXWÿQ��k_��RB �XD�QM_4Q`ZGQTJ �`B]KMZ� \4BED"MBED>Q��X_�KMALNX\/_��RBÐ\�K��èB�VS �VJLAçZ��MB��:�0B]ZEKMSX\4BÌB]KMZ���RQTNRB]\4_&\�BED�"MBED��VKM\;D�B]ZGB]A�"MB]W _��RBÌ\�K��èBÌALN ��QMD�èK|_�ACQTN$KMNXW WRB]WXSVZGB]W_��RBÌ\�K���Bæ\�BE_ ��� Hn�W�

HÈ_Ä_��RBéB]NXW Q��Ì_��RBf�XD1QM_4Q[ZGQTJ �È_��RB \4B]ZGD1BE_:"sKMJLSXB AL\P\��VK|D�B]W�ALN �0QTJ��`NRQ(�èAçKMJ+��QMD��\�SXZ�_��XK|_&KMN��$O�; XÌZGQMD�D�B]ZG_2\�XK|D�B]\>B]NVK��VJCBÐ_4Q AçN�_4BED��0QTJLK|_4BÐ_��XBA�0QTJ��[NXQ(�èALKMJ/V Q���WRB��MD�BEB]Ob8��RQT\�BZGQTNX\4_�KMN#_2ZGQ[BJI ZEACB]N#_>D�B��XD�B]\�B]N�_;_��RB5\4B]ZGD�BE_+�MB���ge�

O�ALNXKMJLJ�����_��RB��VS��VJLALZb�MB���pèAL\-SXNXA���QMD�èJ)�5WXAL\�_4D1A��VSR_4B]W�AçNè_��RB\�S ���MD�QTS�� � s�� �0B]ZEKMSX\4B2A)��QTNXBQ���_��XB+�RQTNRB]\4_?\�BED�"MBED?AL\�NXQM_?WXAL\�U[SXKMJLA��VB]WÌKMNXW �XKM\�\4B]JCB]ZG_4B]W��XAL\�KMWXWVAC_�A�"MB>\��XK|D1BNI1H�K|_�D1KMNXWXQ(�:�_��RB5\4B]ZGD1BE_ ^ H�� �� ��� I4H �èQ[W�mèAç\>D1KMNXWXQ(�èAEDEB]W SXNVA��¢QMD$�èJ�� AçN�KNMY� *+�RBED1B��¢QMD�B��Ü_��RBA"|KMJLSRB pPAç\SXNXA���QMD�èJ���DgKMNXWRQ(�èAEDEB]W$ALN � s�� � TU

Page 11: One Round Threshold Discrete-Log Key Generation without Private

� � ;e240 ; � ��� 4 �eR2++S*) R ��RK956 ,C67�!4 T�U 9-� :�!N� ,C6 S R +�R�,C67�! � ,�6 S#"�T ,-,� .:�!\S#6#�!4KT 4 � 6 46S*)dR +�T!4 � �!:�!+ T�9�U)R :���eRJU XbS*) RL,-) T!+�6*4(��,295)dR2: R 6 , ,�RK9 .+�R�T��T!6*4N,YS&,YSFT(S#6#9�T � ��R2+C,JT +C6FR�,�V

�r0 2/2�� 9 G/;A, 0 ;A, (' ] B&WRB]\�ZGD1A)��B;KÐ\�A �5SXJçK|_4QMD�Q 8��VALZ��_�K��MB]\-KM\?ALN �ÜSR_!KMNèB]JCB��B]N#_ p<J K�� . AçN_��RB/\1S ���MD�QTS �M�MB]NRBED1K|_4B]W�� � s KMNXWO�XD�Q`WXSXZGB]\!KMNÂQTSR_��VSR_�WXAL\�_4D1A��VSR_�ALQTN/8��XALZ$�ÌAL\&�0QTJ��`NRQ(�èALKMJçJ��ALNXWXAL\�_�ALN �TSXAL\�XK��VJCB ��D�Q(� PP�v\ "`ACB�8 Q���K�D1SVNPQ��!_��XBA�XD�QM_4Q`ZGQTJ9_��XK|_&B]NXWX\ 8&AL_��GpPKM\2AC_�\ �VS��VJLALZ�MB��ÿQTSX_��VSR_��

�9BE_ P _��XB�KMW�"MBED1\�K|D���8��RQM�[NRQH8&\ p ALN��7�XKM\�B � & KMNVWÿZGQMD1D1S �X_�\ O?\4BED"MBED1\;K|_È_��RB ��B��TAçN`FNXALN �PQ��È_��RB��XD�QM_4Q`ZGQTJ?AçNf�7�XKM\4B � � � P JCB]K|DgNX\ÐKMJLJ�_��RB]ACD5\4B]ZGD�BE_�\ÌKMNVWò\��RBèKMZG_�A�"MB]J)�éZGQTN#_4D�QTJL\_��RB]ACD �0B�XK"`ACQMD�

G&BED1B��a8/B ZEKMN8_�K��MB KMW�"sKMN#_�K��MBéQ��Ð_��RB$\��`NXZ�XD�QTNXAEDEB]W8NRBE_ 8/QMD�� �a] Bf�XK"MB _4Q \1A)�5SVJLK|_4B_��RBÌWXAL\�_4D1A��VSR_�ALQTNÛQ���KMJLJ9\4BED"MBED1\��7G2Q#8/B�"MBED� 8��RB]N68/BÌ\�A)�ÂSXJLK|_4BÐ_��RBÌD1SXNPQ��!_��RBA�XD�QM_4Q`ZGQTJ �X_��XB\��[NVZ�RD�QTNVAED]K|_�ACQTN AL\ÂNRQM_�NRBEB]WRB]WÎKMNXW�8/BPZEKMN 8ÈKMAC_�SXN#_�ALJ/KMJLJa�ÛKMJLALZEACQTSX\Â\4BED�"MBEDg\��VJLK��� *+�VAL\KMJLJCQ#82\/SV\?_4QèWRBE_4BED$�èALNRB2_��RB �VS �VJLAçZ "sKMJçSRB p .H Q��!K5\���B]ZEA��ÜZ��MQ[Q`Wÿ\�BED�"MBED F .H \1SXZ�ÿ_��XK|_`8/B�WXQNRQM_+�`NRQ#8 AL_�\>ALN#_4BED1NXKMJ�\4_�K|_4B��

G&B]NVZGB��9B]KMZ� \4BED�"MBED]F H1�9B �`ZGB��V_]F .H �9Z�RQ[QT\4B]\5K|_æD1KMNXWRQ(� I4H���Q[W�mPKMNXW�O2QM_��RBEDN"sKMJLSXB]\Q H>S U ��QMDn��\ X �b�b�b� ��O$��G2BÌ\4BE_�\nV#HXW>Y[Z \ ^:`Ubadc Q H>S U Y U J KNMJB Y?EF�7*+�XB]N�� �RBæZGQ(���VSR_4B]\ { H>S U \s } uxw ~ ��Q`W�z:�¢QMD �R\ c%�b�b�b�7��O-KMNVW ZEKMJLZESVJLK|_4B]\ pqH>S h \ s u�� h � ��Q[WizÄKMNVWF4H>S h \@9 u�� h��h > * yH>S h ��Q`W) �h �\*+�RBÌWXAç\4_4D1A��VSX_�ACQTNPQ���_��RB]\4BM"sKMJçSRB]\&KMNXW$_��RB�WXAL\4_4D1A)�VSR_�ACQTNÿQ���_��RQT\4BÂQ���_��RB5D�B]KMJ-�VD�QM_4Q[ZGQTJK|D�BæB]U[SXKMJ �

�&QH8A�`8-B��XK#"MBé_4Q \1A)�5SVJLK|_4B$_��RBéWXAL\�_4D1A��VSR_�ALQTNÎQ��A�VJLK#�MBED$F .H �-þ1�A8/B�8ÈKMN#_ _��RBéB]NXWVALN �"sKMJLSXB _4Q �0B p �ÈJCBE_Gp .H \ { .HTS c \ p � � H�� �� ����������u� W>pqH�Z P � �èQ[W�z-�;KM\ÿ_��RB \4BE_ ��� Hn��Aç\WRBJ�ÜNRB]W�K|_�_��XB>B]NXW�Q���_��RB&\��`NXZ$�RD�QTNXAED]K|_�ALQTN���] B2Z�XQ#QT\4B2K|_?D1KMNXWXQ(�jO "|KMJLSRB]\ V .H W � h Z&��QMD�_��RBNOZGQMD�D1S �X_4B]W�\�BED�"MBED1\-H � ��b�b�b� � � ` N&KMNXW�\4B]NXW�_��XB]\4B`"sKMJLSXB]\�_4QÐ_��RB]\4B>\4BED�"MBEDg\���] AL_���_��RBN�¼K��MD1KMN �MBALN�_4BED��QTJçK|_�ACQTN6�¢QMD$�5SXJçKd� 8-BæZEKMN ZGQ(���VSR_4Bæ_��XB/�VS �VJLAçZ�"|KMJLSRB]\Np .H>S h Q���KMJLJ�QM_��XBED&\��XK|D�B]\&KM\A9

p .H>S h \ s �u � h�� \CW>p .H Z 2 �y w � � `�h�a<� s 2 �y w u y

�u � H y �

8��RBED�B ( OH>S h \ � h D � O ��� h H P h8Dh P h D KMNXWJ@�\ H#c%� � �@�b�b�b�7� � ` N(�

G&BED1B/8-BÐSX\4BÐKMNPKM\�\�S7���X_�ACQTN58��XAçZ�ÿ\4BEB�è\ 8/B]K��MBED>_��XKMNÿ_��RBæKM\�\1S����X_�ACQTNÿSX\4B]WPALNÿQMD1WXBED_4Q��XD1Q#"MBÌ_��XB5\4B�èKMN#_�ALZÂ\4B]ZESRD1AL_ �PQ���_��RB5@�KMALJçJLACBED&ZGD�� �X_4QT\��`\4_4B�:��þeN?�«KMZG_�� 8/BO�XK#"MB s � ��Q[W�zKMNXWU9 � > * ��Q`W4)���8��XBED�B]KM\P_��RBò\4B�èKMN#_�ALZò\�B]ZESRD1AC_!�>�XKM\Ä_4Q WXB]ZEALWRB�8��RBE_��XBEDÄ_��RB�"sKMJçSRB9 � > * ��Q[W8) � B]NXZGD�� �X_�\NI QMD&NRQM_���*kQÛ\�A)�ÂSXJLK|_4BK .H>S h � 8-B5ZEKMNÄ_��RBED�B���QMD�BÌZ$�RQ#QT\�BÌK|_>D1KMNXWXQ(�I H>S h J K * y KMNXW'> h J K * y . �VKMNXWÄ\4BE_Z .H>S h \@9 �uEw yh > * yh ��Q`W4) �h �

@?JLK#�MBEDNF .H �XKM\/KMNPALNXZGQTNX\1AL\4_4B]N#_-ALN#_4BED1NXKMJÜ\4_�K|_4B ��B]ZEKMSV\4B0�RB�WRQ[B]\-NXQM_a�`NRQ#8 _��RB�WXAL\�ZGD1BE_4BGFJCQ���Q�� pqH!ALN5�VKM\�AL\ s ��Q`WXSXJLQO� � G2Q#8/B�"MBED�X_��XAç\`�VJLK�MBED 82ALJLJ�NRQM_`��BÐK|_4_�KMZ�MB]WK�0B]ZEKMSX\4BÐALNÿ_��XAç\��Q[WXB]J�KMJLJ9ZGQMD�D1S��X_4B]WÄ\4BED�"MBED1\2K|D�BæZ�XQT\4B]N$K|_>_��XBA�0B��TALNXNXALN��5Q��!_��RBA�TK���B5HN�

O�ALNXKMJLJ�����ALN _��RBÄ\�A)�ÂSXJLK|_�ALQTN��k_��XBPWVAL\4_4D1A��ÜSR_�ACQTN��VD�Q[WVSXZGB]W � � _��XB \�A)�ÂSXJLK|_4QMD�AL\�\4_�K|_�AL\4_�ACFZEKMJLJ��8ZEJLQT\4B _4Q �0BED���B]ZG_��;þtN�_��RB DgKMNXWRQ(��QMD1KMZEJCB'��Q[WXB]J �a80�RBED�B _��RBò\�A �5SXJçK|_4QMD?�XKM\ÄK ��SVJLJZGQTN�_4D�QTJ>Q��&_��RB:"|KMJLSRB]\�D�BE_�SXD1NRB]W���� _��RB?�XKM\����«SXNXZG_�ACQTN "'� 8-B WXBJ�ÜNRBÿ_��RB:"sKMJçSRBPQ��Z" K|_W s �"9+��po�( � s 4 p P ,�"9 4 0 * P ,�ZÛ_4Q �0B %��`] AL_���Q#"MBED�8��XB]J)�èALN ���XD�Q��ÜK��VALJLAC_!���?_��RB \�A �5SXJçK|_4QMD�XKM\2NXQM_0�MBE_ÐWRBJ�ÜNXB]W _��RBÂD1KMNXWRQ(� QMD1KMZEJCB�K|_�_��XAL\���QTAçN�_\4Q _��XBÂKMW "MBEDg\�K|D��3P ZEKMNXNXQM_WRBE_4B]ZG__��RBæ_ 82AL\4_�� TU

X�c

Page 12: One Round Threshold Discrete-Log Key Generation without Private

� �$ö�÷ ��� ü`ùY� & ����ý~÷ ù��Ì÷ � � -øTù�÷Mù�ü`ù

H2JLJÜ\4BED�"MBED1\b�ÂSX\4_W�0BED���QMD� �-%GW��NfX@ZW"MBED1A��ÜZEK|_�ACQTNX\?Q���_��RB���QMD� pqHTS hn\ � ` Ubadc { h ~H>S U �èQ[W�z5�¢QMDX � � � �5KMNXW���QMD2X � l � �ÌB �RZGB��X_/��QMD_��XB �Â\��XK|D�B]\��MB]NRBED1K|_4B]W���� _��XB�è\4B]J�"MB]\��9O�ALNVKMJLJ����B]KMZ� \4BED�"MBED��ÂSX\4_>WRB]ZGD���X_2AC_�\`�VK|D�_>Q��!_��RBÌ\�B]ZGD�BE_ I-�

þtN _��XAL\;ZEKM\4B��oF7H<�XKM\>ZGQ(���ÜSR_4B]W _��RBiO ; X "|KMJLSRB]\ { H>S U \ se} uxw ~ ��Q`W�z KMNXW _��RB]���/"sKMJLSXB]\g H>S h \8V H WEleZ$�4p H>S h \ sAt uEw y �èQ[W�z-� H>S h \@9 tvuxw yh > * yH>S h ��Q`W8) �h �

ORQMD¼_��XB �XD�Q[Q���\�yB]KMZ$�5\�BED�"MBED7Fdh �XKM\�_4Q2Z�RB]Z�/8��RBE_��RBED%H>S hn\3" W s �"9 h ��pqH>S h �(1H>S h � s 4 uxw y p P , uxw y ��Q[Wz7�"9 4 uEw yh 0

* yH>S h P , uxw yH>S h ��Q`W4)%�h Z�KMNXW�p MH>S h \ X ��Q`W�z ��QMD?B]KMZ$�KX�� l � �;KMNXW���QMD�B]KMZ$�4X�� � � �

B �`ZGB��X_��¢QMD2_��RB/�XD�Q[Q���\+�MB]NRBED1K|_4B]W?� �GF7H �þtNÂ_��XAç\kZEKM\4B��qF H �XKM\!_4Q�ZGQ(���VSR_4BÈ_��RBb�XD�Q[Q��«\ W2%HTS h �()H>S hq� 0 H>S h#Z�8��XBED�B-_��XBb�RB]K#"��ÂZEKMJLZESXJLK|_�ALQTN

AL\È_4Q ZGQ(���ÜSR_4B 0 H>S hn\8g@H>S h > , uEw yH>S h ��Q`W4)�h��O�ALNXKMJLJ����?B]KMZ� \4BED�"MBEDÄWRB]ZGD�� �X_�\ÛAL_�\èQ#82N �VK|D1_�IAh$Q��Ð_��RB ZGQ(� ��QTN8\�B]ZGD�BE_<I �a*kQ'�èK��MB

_��XAL\Q��0BED1K|_�ACQTNéALN KMN BJIÿZEACB]N�_ 8ÈK���9_��XBÂ\4BED"MBEDrFoh�ZGQ(�2�VSR_4B]\_��RB��XD�Q`WXSXZG_�Ah \ � H 1H>S h \9 h � u �uEw y ��Q`W4) h � SX\�ALN�� � N X��ÂSXJC_�A��ÜJLALZEK|_�ACQTNX\KMNXWf�0BED���QMD�è\�KÄ\�ALN��TJCBÂWXB]ZGD����V_�ACQTN QTN h_4Q5D�B]ZGQH"MBED IAh���Q`W8)�h(� *+�VAL\�Q��0BED1K|_�ACQTNPZGQTNX\�Aç\4_�\-AçNÛKÂ\�ALN �TJCB2B � �0QTNRB]N#_�ALK|_�ACQTNÿKM\È\4BEB]NÿALNP� �)X��H2\ IAhn\ ^ H I1H>S h2AL\-S����0BEDW�0QTSXNXWRB]W2���'� � J � %Rm��[KMNXW ��%èJLQ��

�W m �@Z-J JLQ��

�W�)�h#Z ��QMDÈKMJLJAl��#_��XB

\��XK|D�BiI%h+��Q`W8)�hÌAL\;B]U[SXKMJ�_4Q�I%h��*+�RBæZGQ(���ÜJCB �`AL_ �ÿQ��kQTSRD>\1Z�RB��B5AL\;ALN ��W���� � Zb��Q`WXSXJLK|DÈB �d�0QTNRB]N�_�AçK|_�ACQTNX\`8��RBED1B���AL\È_��XB

N#S��O�0BEDÌQ��>\4BED"MBED1\5KMNVW � K$\4B]ZESRDgAC_ ���VK|DgK���BE_4BEDO80�RBED�B]KM\5_��RB ZGQ(���ÜJCB �`AL_ � Q��NBQX� � �#EÈAL\ÌAçN��W����@Z$� G&QH8-B�"MBED� �¢QMDæKP\��ÛKMJLJ�N#S��O�0BED�Q��W�VK|D�_�AçZEA��VKMN#_�\��ÜQTSXD/�XD�QM_4Q`ZGQTJ�AL\/��QMD�B�BJI ZEACB]N#_���þeNKMNÄK����0B]NXWXA �P! � ^ � 8/BA�XD1Q#"`ALWRB�KMN A)���XD1Q#"MB��B]N#_;Q��¼_��RBæZGQ(�2�VSR_�K|_�ACQTNÄZGQT\4_�8��RB]N��0�0B]ZGQ(��B]\JLK|D��MBÌKMNXWÄ\�RQ#8 _��XK|_>_��RBæZGQ(���ÜJCB �`AL_ �PAL\;Q��!_��RBÌ\�K���BÐQMDgWRBED&KM\+�VD�B�"[ALQTSX\;\�Z�XB��B]\��

� ùkö?üN Iû �|ýnù¼ö

þtN _��XAL\O�VK��0BED� 8-B:�XK#"MB:�XD�Q��0QT\4B]W K _��XD�B]\��RQTJLW WXAL\�ZGD1BE_4BGFIJCQ��f�MB�� �MB]NRBED1K|_�ALQTNÎ\�Z�RB�èB��&] B�XK"MBPWRB]\�ZGD1A)��B]W K$WXAL\�_4D1A��VSR_4B]W��MB����MB]NXBED1K|_�ACQTN'8&AC_����VS��VJLALZ�Z$�XKMNXNRB]JL\5SX\�ALN��ÄQTNRBÛD�QTSVNXW Q��ZGQ(�2�5SVNXALZEK|_�ACQTN��?^`AçNXZGBP_��RB ZGQ(�2�ÂSXNXALZEK|_�ACQTN �VKM\���BEB]N D1B]WXSXZGB]W���_��RB ZGQ(���ÜSR_�K|_�ACQTNXKMJ;ZGQT\4_Q��&_��RBP\�Z�XB��B ALNXZGD�B]KM\�B]\�� �ÜSR_ÂA)�>_��RBPN#S��O�0BED5Q��\4BED�"MBED1\�Aç\5JLA �èAC_4B]W��k_��RBPQ#"MBED�RB]KMWÎAç\ÂNXQM_\�A��TNXAQ��ZEKMN�_��

Z�SRDK����XD�QTKMZ$�$_4B]NXWV\&_4QP\�A)���ÜJLA�� � �XD�B�"`ACQTSX\+8-QMD�� AçN$KMN K|D�B]K 80�RBED�BÌD1B]ZGB]N�_�8-QMD�[\��XK"MBD�B]\�SXJC_4B]W ALN��èK��`ALN � \1Z�RB��B]\ÐZGQ(�2�VJCB �\�o� QMD�BEQ#"MBED#�¼K \�B]ZGQTNXWf�7�XKM\4BÂAL\�NRQM_�NRB]ZGB]\�\�K|D�� A�� 8/BSX\4B �VS �VJçALZ&Z$�XKMNXNRB]J�ALNV\4_4B]KMWPQ�� �VD1A�"|K|_4B�Z$�XKMNXNRB]J�KM\+8/KM\>WXQTNRB/�0B��¢QMD�B��7Z�SXD �XD�QM_4Q`ZGQTJ�AL\`8-B]JçJ�F\�SXAC_4B]W �¢QMD/\��èKMJLJ �MD1QTS �V\�Q��9\�BED�"MBED1\��#þ»_-D1SXNX\�AçN�QTNRB&D1QTSXNXWèKMNXWÿWRQ[B]\?NRQM_-D�B]U[SXACD�B>ALN#_4BED1KMZG_�ACQTN��BE_!8-BEB]N \4BED�"MBED1\�

� � � �Vø �Vö?ü.� �ÃyÆ��5Æ��hefvfio1lnhyx�wÆ�Ç�Æ#Ñ�o1lIoeÀExTog�s�æØ!Æ �!o1Ësuv�#Æ��sog�«}���o1}ncI¹5óVhtlnuʺ|c4o�}nuvdy�Ð��d1l��d]�wqsfio�l�bX�{rMdg�she�E}nuio1}nuvdy�5og�s�z�uv¸yuÊ}Iogf#p{uv¸g�|o1}nq{lnhe�eÆ`�¢����ä ã á�� ã���� Ó�� ���yx{¾#j���pÐÃt�G�y�]xsrsog¸ghe�9�g�����]�y�g�]ÆTp]rwlnuv�s¸ghtl~�çóÜhtlnfio1¸wxTÃ4ÅgÅ �{ÆRÇ Í oguvfiogËsfvho1}"! ¬G¬�#%$'&(&*) )(){�E¨G©1�R ç¤w¨G©�+X �� +y¤,&1¤w©g�G�{©�&.-T� ! �1�/& Æ

�]Æ��5Æ(��ht�w�10kl4xypTÆGÑ!dyfi�{Á0og�~�~htl4xGog�|�/Ç?Æ�2Äui�w¸ghtln�~dy��ÆT��dym;rwfvht}nhe�sht�~�X}n¹whedglnhtm;�`��dglV�wdy�w�çctl~À{r{}ndy¸glIo1rs¹wuicÜ�CogqwfÊ}~�}ndyfvhtlIog�E}k�wuv�«}~lnuvËsq{}nh4�2ctdym;rsq{}nuv�s¸wÆ`���43 ã á��IÒnÒ~å�5�â/6�7/á18�Ó:9wÒ<;>=1Ó:9@?BADCFERxsǼ�"�5xsrsog¸ghe�?Ã��|Ãe�{x[ÃeÅ ���{Æ

�{Æ�wÆG�Ühe�|o1fidg¹#ÆIHsÒ ã 5 J�Ô(KeÕiÒ<?MÒL� ã Ò»ÓNMPOkÔyÕ�ÕvágÓQ�9ÕiÒL�tÓR5LágâS7nÆ0�X¹sz }n¹whe�~uv�exUT�ogfvh��k�su Í htln�~uÊ}�ÀExTÃeÅ �G�EÆ�wÆ/z/Æ>��dy�whe¹�o1�|�@�5Æs�{lIog�s¿]fvuv�#ÆXbRÉ;ceuvhe�E}kÑ!he�whtlIo1}nuvdg�dg�Xp{¹|o�lnh4�I��p{Ç ñ�h»Àw�eÆ`���VE ãW��� ÓçáV� �,X�xw¾#j���pÐÃ4�gÅ1�wxr|og¸ghe�9�E�g���E�y�yÅ]Æ#p{rwlnuv�w¸yhtl~�çóVhtlnfiog¸wx�Ã4ÅgÅG�EÆ

X�X

Page 13: One Round Threshold Discrete-Log Key Generation without Private

�]Æ�wÆ#�0ogm;he�wuv�~c»¹5og�s�Ì�IÆTz�ogm;¸��o1lI��Æ?óVhtlnuʺMo1ËsfvhÈbX�sctl~À{r{}nuidg�Ìog�|�ÌÇkrwrsfvuvc4o1}nuvdg�s��}ndÑklndyqsrÂp{uv¸g�|o1}nq{lnhe��og�s�p{uv¸y�so1}nqwlnhp{¹so1lnuv�s¸{ÆÛÇ Í oguvfiogËwfiho1}�! ¬G¬ #%$'& &*# ! �y�����X ç¤w¨y©*+X �� +g¤>&E¨1����#E¬{£G�E���,&����,&��E���� R  ! ¬*-|� x¼m>o1lncI¹Ã4ÅyÅgÅ{Æ

�{Æ �?Æ��0og�sh»}~}nuLÆ p]heceq{lnuv}¢ÀÄo1�|� ��dym;rMdg�~uÊ}nuidg� dg� �qsfÊ}nuvr|o�l~}�À �Ül~À{r{}ndy¸glIo1rs¹wuic5�Rlndg}ndEcedgfi�eÆ �����]ágä ã â|ÔyÕ�á'8E ãW��� ÓçáyÕvá 6 � x|óVdyfvqsm;h-Ã4�{xwr|o1¸yhe��Ãe�y���]�g�G�EÆ#p{r{lnui�w¸yhtl~�çóVhtlnfiog¸{xM�1�y�y�]Æ

�]Æ;�kÆM�0o1�sht}~}nuCxS�?Æ|Ñ!he�s�so1lnd{xMpMÆUyo1lnhecI¿]uLxsÏ-Æ{ñ�lIoeÁ0ceà»Àw¿Mxsog�s�Ø!ÆS�!o1Ësuv�#ÆVÇk�sogr{}nu Í h�p{htceqwlnuÊ}�À;�½dgl!Ø0¹wlnhe�~¹wdyfi��Ül~Àwr{}ndy�«À{�«}nhem;�eÆR�¢� E ã��W� Óçá � �(�1x|¾�j���pæÃ.� ���{xMrsog¸yht�kÅ����sÃyÃ��EÆ#p{r{lnui�w¸yhtl~�çóVhtlnfiog¸{x#ÃeÅyÅyÅ]Æ

�{Æ�T/ÆGz!d]�wuv�0o1�|�>pTÆ,�uiceogfvuCÆ`�Ro�lIogfvfvhef �kh4�{qsceuvËwuifvuÊ}�À-��d1l0���{��d1lnm>o1}nuvdy�{��Ø0¹whtlnht}nuvc4o1fifÊÀ&p]heceq{lnh���dgm;rsqw}Io�}nuvdy�#ÆT�¢�E ãW��� ÓçáV� =(=1xs¾#j���pÌÃ����y�{xsr|o1¸yhe�!�1���]ÅG�EÆ�p{r{lnuv�s¸yh»l~�¢óVhtlnfiog¸{xM�1�y�g�{Æ

Å{ÆÈ�RÆw�shtfß�{m>og��ÆXÇ r{lIogct}nuvc4o1f[�~cI¹shem;h!�½dgl¼�sdg�w�çuv�E}nhtlIogct}nu Í h Í htlnuʺMo1Ësfvh��~hectlnht}¼�~¹so1lnuv�s¸{ÆÜ�¢�43 ã á��IÒnÒ~å�5�â,6�7?á18�Ó:9wÒ;/�yÓ:9ÐÔgâsâwäsÔgÕ�? ��� � á*7�5½ä � ágâæÓ:9sÒ��[ágä]âMåyÔgÓR5LágâS7?á'8�EVá � � ä]Ó¢Ò ã ? � 5LÒ»â �IÒ»Æ|��bÜbVb9x#Ã4Å��G�]Æ

Ãe�{Æ�T/ÆT�wlIo1�s¿GhtfLxM�RÆTÑ!hem;m;hefCxT�X¹#Æ��o1ceñ�he�sàtuihgx[o1�|� �5Æ TÜqs�s¸{Æ�0!r{}nuvm>ogfÊ� �khe�~uvfvuvhe�scth/�RlndGo1ct}nu Í hÈ�XqsËwfiuvct�çñ�htÀ�Ül~Àwr{}ndy�«À{�«}nhem;�eÆR�¢�43 ã á���Ö��(�yÓ:9�� CFE�?wxsrsog¸yht�k���g���]�yÅg�{ÆT��bÜbVb9x�Ã4ÅgÅG�EÆ

ÃgÃyÆ�T/ÆE�{lIog�s¿yhefCx]�`Æ]Ñ!hem;m;hefCxG�V¹�Æ>��ogceñ�ht�sàeuvhyx{o1�|�I�5Æ(TÜqs�w¸wÆT�RlndGo1ct}nu Í h �!pwÇ�ÆM��� E ã���� Óçá � �,X�xE¾#j���p2Ã4�gÅ1�wxr|og¸ghe�9�y�y���E�G�1�{Æ#p{rwlnuv�w¸yhtl~�çóVhtlnfiog¸wx�Ã4ÅgÅG�EÆ

Ã4�]Æ�T/Æ#�wlIog�w¿GhefCx[�RÆB��ogctñ�he�sàeuvhyx`og�s� �5Æ TÜqs�w¸wÆ>Çk�so1rw}nu Í hefÊÀ]��p{heceq{lnh�0!r{}nuim>o1fÊ� �¼he�~uvfvuvhe�sceh>�RlndGo1ct}nu Í h��!pwÇ?Æ����� 7 5LÔ(� ã��W� Ó�� �(�gxs¾#j���pTÆsp{r{lnuv�s¸yh»l~�¢óVhtlnfiog¸{x#ÃeÅyÅgÅ{Æ

Ãe�{Æ �?Æ�Ñ!he�s�so1lndwxkpMÆ Go�lnhec»¿]uCx�Ï?Æ�ñ�lIoeÁ0ceàtÀ{¿Mx9o1�|�ÄØ!Æ �kogËsuv��Æ p]heceq{lnhÌz!ui�«}~lnuvËwqw}nh4�Äñ�htÀÄÑ!he�shtlIo�}nuvdy�Ä��d1lz�uv�~ctlnht}nht�¢¾#dg¸;�Ül~À{rw}ndg�«À{�«}nhem;�eÆ[�¢� �0ä ã á�� ã��W� Ó�� �(�1xs¾�j���pÃ��1ÅG�Exsrsog¸yht�!�1ÅG�.�]�{Ãe�{ÆMp{rwlnuv�w¸yhtl~�çóVhtlnfiog¸wxMÃeÅyÅgÅ{Æ

Ãt�wÆ/j-ÆwÑ!uvfvËMdGo{ÆRØ�Á0d;�Ro�l~}�ÀI�!pwÇÄñ�htÀ&Ñ!he�whtlIo1}nuvdg�#ÆX��� E ã��W� Óçá � � �gx{¾#j���pÐÃ.� � �]xsrsog¸ghe��ÃyÃ.���|Ã4�gÅ]Æ�p{r{lnui�w¸yhtl~�óÜhtlnfio1¸wx�Ã4ÅyÅgÅ{Æ

Ã4�]Æ;pTÆ]Ñ!dgfi�{Á�o1�~�~htlkog�s�>pTÆ>�uvc4o1fiuCÆ`�XlndgË|ogËwuvfiuv�«}nuvc�bX�sctl~À{r{}nuidg�#Æ��]ágä ã âMÔyÕ�á'8<EVá � � ä]Ó¢Ò ã ÔgâMå�? � 7nÓ¢Ò � ?G� 5çÒ»â �IÒW7nx���{× �g�g���]�gÅgÅ{xRÃ4Å��g�{Æ

Ã.�{Æ;pTÆ,Go�lnhecI¿{u�o1�|�&Ç?Æ]¾TÀw�«ÀEog�s�~¿goeÀ]o{Æ[Ç!�wogr{}nu Í hefÊÀ>p{htceqwlnh!Ø0¹wlnhe�~¹wdyfi���Ül~À{rw}ndg¸glIo1rs¹EÀ�×]���E}~lnd]�{qsceuv�s¸-��dg�sceq{l~�lnhe�sctÀEx>�¼hem;d Í ui�w¸/bRlIog�~q{lnhe�eÆÜ���4�0ä ã á�� ã��W� Ó�� =(=1xs¾#j���pÌÃ��g�G�Ex|r|o1¸yhe�!�y�EÃW�]�1�E�EÆ�p{r{lnuv�s¸yh»l~�¢óVhtlnfiog¸{xM�1�y�g�{Æ

Ã4�]Æ/z/ÆTj�o1cec4ogcI¹sh>o1�|� wÆ`p]}nhtln��ÆÈÇ j!htÁ �Ül~À{rw}ndg�«À{�«}nhem�Ë|o1�~h4�5dg�ÂÏkui¸g¹shtl �¼he�~ui�wqwhe�eÆÈ�¢� 3 ã á���Ö�á'8/Ó:9wÒ��gÓ:9E"E�?sx{r|o1¸yhe�!�gÅ��,� �]ÆTǼ�"��rwlnhe�~�ex�Ã4ÅgÅ �{Æ

Ã.�{ÆÈØ!Æ 0!¿gogm;dg}nd�og�|�PpTÆ0�kc»¹wuÊÀ]ogm>o]ÆéÇ jkhtÁ �VqwËsfvuvcÌñ�h»ÀÄ�Ül~À{rw}ndg�«À{�«}nhem og�Ðp]heceq{lnhæog�2�|ogct}nd1lnuv�s¸wÆò�¢���ä ã á�� ã���� ÓI� � �yxw¾�j���pÌÃt�G�y�]x|rsog¸yht�!�g� ���E�{Ã.�{Æ�p]rwlnuv�s¸ghtl~�çóÜhtlnfio1¸wx�Ã4ÅyÅ��{Æ

ÃeÅ{ÆÈ�RÆs�Roguvfvfvuvhtl4Æk�VqwËsfvuvct�çñ�htÀÐ�Ül~À{r{}ndy�«À{�«}nhem;� �0og�~he�ædg��z�uv�~ctlnht}nh-¾#dg¸Go�lnuv}n¹wm;� �¼he�~ui�wqwhe�eÆ0�¢� �0ä ã á�� ãW��� Ó � �(�1x¾#j���pÐÃ��1ÅG�]ÆMp{r{lnui�w¸yhtl~�çóVhtlnfiog¸{x#ÃeÅyÅyÅ]Æ

�1�{ÆÈØ!Æ �`Æ|�`h4�whtln�~ht�#Æ�Ç Ø0¹wlnht�~¹sdyfi�æ�Ül~À{rw}ndg�«À{�«}nhem Á9uÊ}n¹sdyq{}ko;Ø#lnqs�«}nh4�2�Ro1l~}¢À�ÆÜ��� ��ä ã á�� ãW��� Ó�� ����x�¾#j���p�1�E�Exr|og¸ghe�k�y�g���{�g���]Æ#p{rwlnuv�w¸yhtl~�çóVhtlnfiog¸wx�Ã4ÅgÅ{ÃgÆ

�EÃyÆÈØ!Æ �`ÆV�`h4�{htln�~he��ÆÂjkdy�w�ç�¢�]}nh»lIogct}nu Í h&og�s�����{��dglnm>o�}nuvdy�w�¢Ø0¹whedglnht}nuvc�p{heceq{lnh2óVhtlnuʺMo1Ësfvhp{hectlnh»}>p{¹so1lnuv�s¸{ÆÂ�¢�E ãW��� Óçá � ���1xM¾�j���p�g���]x|r|o1¸yhe��Ã��1Å��sÃe�G�]Æ�p{r{lnuv�s¸yh»l~�¢óVhtlnfiog¸{x#ÃeÅyÅ]ÃyÆ

�g�]Æ;Ñ-ÆG�`dgqsr|o�lI�/o1�|��wÆGp]}nh»ln�#Æ|Ñ!he�shtlIo�}nuvdy�Èd1�#p{¹|o�lnh4���!pwÇèñ�htÀ{�RËEÀ-Ø�Á0d��Ro1l~}nuvhe�eÆs�����F7 5LÔ(� ã���� Ó � � �yxy¾#j���pÃ��]Ãt�wxsr|og¸ghe��ÃyÃW�]�1�{Æ�p{r{lnui�w¸yhtl~�çóVhtlnfiog¸{x#ÃeÅyÅ �]Æ

�1�{Æ;Ñ-ÆE�`dyqwr|o�lI�;og�|� wÆ{p]}nh»ln�#ÆM�soguÊl0bX�sc»l~Àwr{}nuvdy�Èd1���!pwÇÛñ�htÀ{�eÆM����3 ã á��»ÒnÒ~å�5�â/6�7�á18D�0ä ã á�� ãW��� ÓQ;>=(= =1x]¾#htct}nqwlnhj!dg}nht�¼uv����dym;rsq{}nhtlkp{ctuiht�scehyÆ|p{r{lnuv�s¸yh»l~�¢óVhtlnfiog¸{xM�1�y�g�{Æ

� �� O�Vö?ú-ýL�

�/'�& � � 75 ,"� 0#245 243 � � ; ?�� 240 -þtNÿ\4Q(��BÐZEKM\4B]\È_��RBÐ\��`NXZ$�RD�QTNRQTSX\/NRBE_!8-QMD��ÿ\4BEB�è\/_4Q��0BKÂ\4_4D�QTN ��D�B]U[SXACD1B��B]N�_���] BæSX\4B\�SXZ�NRBE_ 8/QMD��é_4Q ZGQ��0B�8&AC_�� �eD1SX\��VALN �PK|_4_�KMZ��`\��d�kH \�A)���ÜJCBÂ\�QTJLSR_�ACQTNéAL\_4Q?��QMD1ZGBèKPþeNXZGQMD�D1S �V_�A��VJCB*+�XACD1WÛ@!K|D1_ � W�þ *>@ Z�_4QO�ÜJLK�èK|_/_��RBB]NXW��(] BÐZEKMJLJV_��XAL\�_��VACD1W2�ÜK|D�_ ���4ALNVZGQMD�D1S �X_�A)�VJCB�Ð\�ALNVZGB�8/BWRQÂNXQM_-D�B]U[SXACD1B2K"�e_4D1SX\4_4B]W1�N�VK|D1_ ��� �VSR_-QTNXJ��2�RQTNXB]\4_��RHÈ_/_��XB0�0B��TALNXNVALN � �T_��XAç\-\4BED"MBEDb�ÜALZ��`\ÈKD1KMNXWRQ(� "sKMJLSXB]QPALN�K M KMNXW ZGQ(�2�èAC_�\Z" W Q�Z;SX\1ALN ��_��RBM�XKM\��:�«SXNXZG_�ACQTN " � *+�RBÌ\4BED"MBED1\��ÜJLK�KMNXWPZGQ(���VSR_4B�p � \ s � D �`HÈ_;_��RB2B]NVW��#_��XBþ *>@ D�B]JLB]KM\4B]\ Qè_4Q�KMJLJ �VJLK�MBEDg\�� *+�RB�\4B]ZGD�BE_`"sKMJçSRBAç\IG\:I �C;$QM��Q[WRm����?KMZ� \4BED�"MBED/ZEKMN ZGQ(���ÜSR_4B&AC_�\�\�XK|D�B>Q��0_��RB&\�B]ZGD�BE_-KM\ I1H7\:I�� H�;$Q���Q`W�m �*+�XAL\;AL\;WVSRBÐ_4Qè_��RB]�kK��MD1KMN �MBÂALN�_4BED��QTJçK|_�ACQTNÄ\�ALNXZGBÐ_��XBæ\�S��)Q���_��RBr�kK��MD1KMN �MB5ZGQ[BJI ZEACB]N#_�\&Aç\

X^

Page 14: One Round Threshold Discrete-Log Key Generation without Private

B]U#SXKMJ9_4QKX��XþeNXWRBEB]W��XA��D@ AL\>KÛ\�S �V\4BE_ÈQ���ZEK|D1WXAçNXKMJLAC_!�RO ; X��

V W c Z \ �H�� O

( OH>S c V W �kZ<�èQ[W�m

*+�RBED�B���QMD�B���A��08-B \��VK|D�BÄ_��RB ZGQTNX\4_�KMN#_2�0QTJ��`NRQ(�èALKMJ-?qW>IdZ<\ X6��QMDèKMJLJ I-��_��RB:"|KMJLSRBÄALN c Aç\KMJ�8/K#�[\OXæKMNXW68/BæQ��X_�KMALN Xn\ ^ H�� O ( OH>S c X��o/QTNX\�B]U#SRB]N#_�J����XA��&8/B/8>D1AC_4B]V W �kZ \ I � H!�

V W c Z�;|Q+\CW � H�� O( OH>S c V W �kZ�Z ;|Q+\ �

H�� O( OH>S c W�V W �kZ ;|Q%Z&��Q`W�m

� 2(? ; &(' þeNP_��XAL\���Q[WXB]J �R\�A)�ÂSXJLK|_�ACQTNX\ÈK��TKMALNV\4_>KMWXK��X_�A�"MB5KMW "MBED1\�K|D1ALB]\>K|D�BæB]KM\��Ä\�AçNXZGB 8-BÌZEKMN�(�Û_��RB�"sKMJçSRB2Q��k_��RB�þ1*&@ AçNÛ_��RB�D1KMNVWRQ(� QMD1KMZEJCB ��Q[WXB]J ��] BæZEKMNP\4BEBÐAC_ÈKM\È_��RBG� �0BED1\�AL\4_4B]N#_�J��ALNXZGQTNX\�Aç\4_4B]N�_ �ÜJLK�MBED ��Q��+BQX�HEF�� 2(? ; �/' �Q`WXAL\�KMNXW|� ALZEKMJLAÈALN B�!HE+�VD�Q#"MB]WÎ_��VK|_èK ZEJLKM\�\�Q��Ð^[B]ZESRD�B OXSVNXZG_�ACQTN � "|KMJLSXK|_�ALQTNWn^`O � ZèD�B�èKMALNX\ÿ\4B]ZESRD1B A��/8/B ZGQ(�2��QT\�B \�A ���VJCB$KMNVW8\4B]ZESXD�B4�VD�QM_4Q[ZGQTJç\ ALN \4B]U[SRB]NXZGB QMDÿAçN�VK|D1KMJLJCB]J�AçNP_��RBæALN ��QMD�èK|_�ACQTNRFn_��RBEQMD�BE_�ALZ/��Q`WRB]J ��*��RB��ÿSV\4BÐ_ 8/Q���Q`WRB]JL\ÈQ��<�VK|DgKMJLJCB]J�D�B]WXSXZEA)�VALJ�FAC_ � W�QMDA�VK|D1KMJLJLB]JkZGQ(���0QT\�AL_�ACQTN Q��W�XD�QM_4Q`ZGQTJL\ Z&_��XK|_Ð_��XB�� ZEKMJLJCB]W ZGQTNVZESRD�D�B]N#_�D�B]WXSXZEA��ÜALJLAC_!�PKMNVW\��[NVZ�RD�QTNXQTSX\æD�B]WVSXZEA��VALJçAC_ ��� *+�XB � �!4 9 .+C+�R247S +�RK� N962956 U 6 S#"òK����VJLACB]\A8��RB]N _��RBÛQMD1WXBED5Q��>\�S��RF�XD�QM_4Q`ZGQTJÂZEKMJçJL\ Aç\$NRQM_éA)���0QMD�_�KMN#_K8��XBED�B]KM\ _��RB � " 4 92)�+ �!4 �! I, +�R-�! 956E926 U 6 S#" K����VJçACB]\?8��XB]N_��RBè\�S �RFF�VD�QM_4Q[ZGQTJç\/�5SX\�_��0B�B �`B]ZESR_4B]W \�A �5SXJL_�KMNRBEQTSX\�J����\*+�RB]ALDD1B]\�SXJC_�\2B�!HEW�RQTJçWéQTNXJ�� AçN _��XB�4ALN ��QMD�èK|_�ACQTN`Fn_��XBEQMD�BE_�ALZ+��Q`WRB]Jx� 80�RBED�B 8/B&KMJLJCQH8 �XD1A�"|K|_4B>Z�VKMNXNRB]JL\�KMNVWÛNRQM_?AçN�_��RBR�4ZGQ(���VSRF_�K|_�ACQTNXKMJ7�èQ[WRB]J �Ð_��XK|_W8/B2NXBEB]WÛALN�QTSXDW�XD�QM_4Q`ZGQTJ �#þtNKB��HEF�(ÈKMNRBE_4_�A7�XD�QH"MB]WÛ_��RB\�K���B>D1B]\�SXJC_�\�AçN_��RBæZGQ(���VSR_�K|_�ALQTNXKMJ ��Q`WRB]J\�VSR_ÈQTNXJ)� ��QMD&ZGQTNXZESRD�D1B]N�_;D�B]WVSXZEA��VALJçAC_ �èKMNXWÄNXQM_ �¢QMD&\��[NXZ$�RD�QTNRQTSV\D�B]WXSXZEA��ÜALJLAC_!���7*+�RBED�B���QMD�B��0_��RB�KM\��`NXZ�XD�QTNRQTSX\�NRBE_!8-QMD��é\�Z$�RB��B�_��XK|_/8/BM�VD�Q��0QT\4BÂAçN$_��XAç\K��XF��B]NVWXA � ZEKMNK��BÐKMJL\�Q2�XD�QH"MB]W SX\�ALN���;KMNRBE_4_�A��v\>_��XBEQMD�B�:�

�/'�� � � 0#2! 4; � ;%5o?�2�� ?��7; , 2 �� =>; � �T? ] �RB]Nò_��RBèN#S7�N�0BED�Q��/\�BED�"MBED1\æAL\�D1B]JLK|_�A�"MB]J�� \��èKMJLJ ��QTSRD/�XD1QM_4Q[ZGQTJ�Aç\ �XD1KMZG_�ALZEKMJ � G2Q#8/B�"MBED�!AC_ZEKMN �0B SVN �XD1KMZG_�ALZEKMJ+8��RB]N _��XB N[S��O��BED�� Q��æ\4BED�"MBED1\5�0B]ZGQ(��B]\ÿJLK|D��MBED�bG&BED�B��b8/BK�XD�QH"[AçWRB��BE_��RQ`WX\?_4QÂD�B]WXSVZGB2_��RB�ZGQ(���VSX_�K|_�ACQTN ZGQT\�_ÈAçNè_��XAL\/\�AC_�SVK|_�ACQTN��e] B �XD1B]\4B]N�_-_��RB�ZGQ(���VSR_�K|_�ACQTNZGQT\4_æALN _4BED� Q��a�ÂSXJC_�A��VJçALZEK|_�ACQTNX\>KMNVW48/B�\��RQH8�_��VK|_æKM\�� �2�X_4QM_�ALZEKMJLJ��ÄQTSXD��VD�QM_4Q[ZGQTJ �VKM\2_��XB\�K���B�QMD1WRBEDÈQ��-�èK��TNVAC_�SXWRB_��XKMNÿQM_��RBED1\��RA �ÊB��&��W�����JCQ��dW��Z�Za�ÂSXJC_�A��VJçALZEK|_�ACQTNX\��(*��XAL\/AL\-KMZ$�XACB�"MB]W����D�B]WXSVZEALN �æKMJLJ7"MBED1AQ�ÜZEK|_�ACQTNV\�Q��0QTSRDW�VD�QM_4Q[ZGQTJV_4Q5_��XD�BEB&ZGQ(���VSX_�K|_�ACQTNX\a8��XALZ$�èK|D�B2SV\4B]WèALNèKMJçJ�XD�QM_4Q`ZGQTJL\��7*+�VAL\ÈJLKM\4_&ZEKMJLZESVJLK|_�ACQTNÄD�B��VD�B]\4B]N#_�\;_��RBN�RB]K#"��6�VK|D1_;Q��!_��XBÌZGQ(���VSR_�K|_�ALQTN ZGQT\4_2KMNVWZEKMNXNRQM_+�0BæK"MQTAçWRB]W$ALNP_��XB/"MBED1AQ�ÜK��VJLB�AçN�_4BED��0QTJLK|_�ALQTN6�7�XKM\4B��

^`ALNXZGB`�VKMW2�VJLK�MBEDg\�QTNXJ��ÂK����0B]K|D?ALNÂD1K|D�B&\1AC_�SXK|_�ACQTNX\� 8/B>KMA)��_4Q5WRB]\�A��TN�BJI ZEALB]N�_ �XD1QM_4Q[ZGQTJL\8��RB]NÄKMJLJ �VJLK#�MBED1\;K|D�BA�RQTNXB]\4_���G&QH8-B�"MBED#�78/BA�5SX\�_b�0BÐK��VJCB�_4QèWRBE_4B]ZG_�8��RB]NRB�"MBED �VKMW6�ÜJLK�MBED1\_4D��5_4QÂZ�RB]K|_/KMNXW�_��RBED�B���QMD�B���8-B>D1B]U#SXALD�B`��KM\4_-WRBE_4B]ZG_�ACQTNèQ��0KMZG_�A�"MB��èKMJLALZEACQTSV\�\4BED�"MBED1\��e] �RB]NÛK�èKMJLALZEACQTSV\?\4BED�"MBEDÈAL\/WRBE_4B]ZG_4B]W�� 8-B�NRBEB]W _4QÂZEK|D1D��èQTSR_-_��RB0�VD�QM_4Q[ZGQTJÜQ��¼\4B]ZG_�ALQTNP�ÌQMD-_4QÂD�B��0Q[QM__��RBÌ\��`\4_4B��KM\&QTSRD+�XD�QM_4Q`ZGQTJ9AL\;\�_�K|_4BGFF�¢D�BEB��

*+�RB5�VD1\�_ÂD1B�èK|D�� AL\Â_��XK|_28/B ZEKMNXNRQM_èK"MQTAçWÎ_��RB ZGQ(���VJLB �`AC_!� �«KMZG_4QMD �RW�� � �(Z$� 8��XBED�B��AL\�_��RB��VAC_eFIJLB]N �M_�� Q�� M z M QMD M )�h M A�^ �-�¢D�Q(� _��XBèZGQ(�2�5SVNXALZEK|_�ACQTNf�0QTALN#_�Q��W"`ACB�8A�9\�ALNVZGB�AçN QTNXBD�QTSXNXW��MKMJLJR\�BED�"MBED1\ �ÂSX\4_<�0B>K��VJCBÈ_4Qæ_4B]\4_W8��RBE_��RBED�QM_��RBED-\4BED�"MBED1\ �VK"MB&ZGQMD�D1B]ZG_�J����VJLK�MB]W �(@/SX_��KM\È_4Q[WXK#�4�v\&NRBE_ 8/QMD��`\+�XK"MBæJçK|D��MB �VKMNXW 8&AçWR_��ÛKMNXW:�VA��(�P\��0BEB]W��0BED���QMD�èKMNVZGB��#_��RB/�0QM_4_�JCB]NXB]Z��

X�

Page 15: One Round Threshold Discrete-Log Key Generation without Private

AL\&NRQM__��RBÂNRBE_ 8/QMD��$ZGQ(�2�ÂSXNXAçZEK|_�ACQTNK�ÜSR_>_��RBÂZGQ(���VSR_�K|_�ACQTNéJCQTKMW �d/QTNX\�B]U#SRB]N#_�J����ÜQTSRD0�èKMAçNQ��d,eB]ZG_�A)"MBÌAL\;_4QÛWXB]ZGD�B]KM\4Bæ_��RB5ZGQ(���VSR_�K|_�ACQTN$ZGQ(���VJCB �RAC_ �5��QMD&WRBE_4B]ZG_�ALN � �VKMW \4BED�"MBEDg\��

þ»_5AL\æ\4_4D1KMA)�(��_���QMD�8ÈK|D1W _4Q \�BEBè_��XK|_Ì_��XBÛJLK|D��MBEDÌZGQ(�2�VJCB �RAC_ �f�«KMZG_4QMDÂZGQ(��B]\N�¢D1Q(� _��RB2"MBED4FAQ�ÜZEK|_�ACQTNX\ÌQ�� s u � h � \ � ` U adc { h ~H>S U ��Q`W�z-� ] B5�XK#"MBP_4Q Z$�RB]Z���� � \1SXZ� B]U#SVK|_�ACQTNX\O8��XALJCB�_��XB�XD�B�"`ACQTSX\>\�Z$�RB��B]\QTNXJ��PD�B]U[SXACD1B�� � G&BED�BM8/BÌD�B]WXSVZGBÌ_��RBÂZGQ(���VSR_�K|_�ACQTN$Q���B]KMZ���VJLK#�MBED2_4Q$���\�SXZ� B]U#SXK|_�ALQTNX\��) *(?@,"� 4;A0 � ' , *�?��>245 ' @/B]JLJLK|D1B�R�S�T�U�VÈALNCBQXYEWXB]\�ZGD1A��0B KMJ��MQMD1AL_����è\�_4Q'��BED�¢QMD� ��KM\4_��VK|_�Z�"MBED1AQ�ÜZEK|_�ACQTN=��QMDf�èQ[WXSVJLK|D$B �d�0QTNRB]N�_�AçK|_�ACQTN KMNVW WXA)�TAC_�KMJ5\1A��TNXK|_�SRD�B]\�&þeN _��XAç\K�VK��0BED�2_��RB���XD�B]\4B]N#_Ä_4B]Z�XNVALU#SXB]\P_4QÎ_4B]\4_?8��RBE_��XBED?�èKMNe� ALNX\4_�KMN#_�ALK|_�ACQTNV\�W>I1Hk��pqH�Z��Hxa<� \�K|_�AL\�� �8_��RB B]U#SVKsF_�ACQTNX\ s��u \:p H ��Q`W�z-� *��RB2NXKMA)"MB0��BE_��RQ`W D�B]U#SVACD�B]\�� B � �0QTNRB]N#_�ALK|_�ACQTNV\���G2Q#8/B�"MBED�XA���8/B2SX\�B�XD�Q��VK��VAçJLAL\4_�ALZ��ÜK|_�Z�Î_4B]\4_�\��_��RBÿ\�B]U#SRB]NVZGBÄQ��0��Q`WXSXJLK|D5B � �0QTNRB]N#_�ALK|_�ACQTNV\ÂZEKMN �0BPZGQ(���VSR_4B]W\�A��TNXAQ��ZEKMN�_�J�����KM\�_4BED>_��XKMNÄ_��RB5NXKMA�"MBÐD�BGFIZGQ(���ÜSR_�K|_�ACQTNK�èBE_��RQ[W �

*+�RB��ÎKMJL\4Q WRB]\�ZGD1A��0B KMN8BJI ZEACB]N#_ÛKMJ��MQMD1AL_���� _4Q ZGQ(���VSR_4B � �Hxa<� Q�� uH 80�RBED�B _��RB ZGQT\4_ Aç\� ;��7��A�^��èQ[WXSVJLK|D0�ÂSXJC_�A��ÜJLALZEK|_�ACQTNX\&A�� 8-B�NRQM_4B��$_��RBO�MD1B]K|_4B]\4_/�VAC_eFIJCB]N��M_��$Q��-_��RB5B]JLB��B]N�_�\� H W � H \ � H B���E �b�b� � H BQXYE>Z$� *��XAL\&N[S��O�0BEDAL\\4_4D1AçZG_�J�� JCB]\�\2_��XKMN�� B �d�0QTNRB]N�_�AçK|_�ACQTNX\��¢QTJçJCQ#8/B]WK� �� N=X6�ÂSXJC_�A��VJçALZEK|_�ACQTNX\N8��RBED�BP_��RB ZGQT\4_�Q���Ké\�ALN �TJLB B �d�0QTNRB]N�_�AçK|_�ACQTN|Q � ZEKMN �0BPB]\4_�A)�èK|_4B]WKM\R�q��A�^��ÂSXJC_�A��VJçALZEK|_�ACQTNX\5A��n� AL\Â_��RB6�VAC_eFIJLB]N �M_�� Q�� � � *+�XAç\5KMJ��MQMDgAC_���� AL\��RBED�B]K���_4BEDÛZEKMJLJLB]WOXKM\4_�� SXJC_��� ��������� � � OXKM\4_�� SXJC_ W�W Q��� � ��Z �b�b�b�7�@W Q � � � � Z�ZQ�9 \ X�

����� l \ ��� ��������� X�� ���� � � \ X ��� ��� � �!� � H�B l�E \ X � �#"!� Q�9 \ Q4� Q H �Q�9 \ Q!��

��" � $�� � Q*+�XAL\ÌKMJ��MQMD1AC_���� WRQ#B]\ ���ÂSXJC_�A��ÜJLALZEK|_�ACQTNX\�ALNò_��RBèQTSR_4BED�JCQ[Q�� KMNXW%�7��A�^K�5SVJC_�A��VJLAçZEK|_�ACQTNX\

QTNò_��RBÛK#"MBED1K��MBPALN _��RBÛAçNXNRBEDæJCQ[Q�� � G2B]NXZGB��-��QMD5ZGQ(���ÜSR_�ALN �$pf8/B2�MBE_5KÄ_4QM_�KMJ-Q�� �F;&�7��A�^�5SXJL_�A��VJLALZEK|_�ALQTNX\��

O�ALNXKMJLJ����Ü_��RB��$KMJL\�Q��XD1Q#"`ALWRB�K �VK|_�Z$�f"MBED1AQ�ÜZEK|_�ALQTN Q��?_��RBO��QTJLJCQH8&ALN ���¢QMD$�:9 �TA)"MB]N Kÿ\4BE_�Q����QTAçN�_�\���WRBE_4BED�èAçNRBN8��XBE_��RBED2_��XBED�B5B �RAL\4_�\�K��0QTJ��[NXQ(�èALKMJ�Q��?KÿZGBED�_�KMALNéWRB��MD1BEB�� 80�XALZ�K�VKM\�\4B]\_��RD�QTS �(�èKMJçJ`_��RB]\4B �0QTALN#_�\�� �$QMD1B+�¢QMD$�èKMJLJ����MJCBE_&@�\ W('���)'

��b�b�b�7�)'+*�Z�WXB]NRQM_4B>Kæ\4BE_�Q�� �0QTALN#_�\��

] B/WRBJ��NRB?_��RB-D�B]JLK|_�ACQTN ���b[-, S ` S � V/. S V , S101010�S V32 � W @ Z \ X/AQP�_��RBED�B-B �`AL\�_�\kK���QTJ)�[NRQ(�ÛALKMJ V W>IdZ�\�SXZ�_��XK|_�_��RBÂWXB��MD�BEB�Q�� V W>IdZ2AL\K|_/��QT\4_�O$�0KMNXW��¢QMDÐKMJLJ � J#HeX �b�b�b���54�N(� V W W(H ZN\6'7H1��KM\�\�S��ÛALN �_��XK|_-KMJLJV_��RB2ZGQ(�2�VSR_�K|_�ACQTNX\/K|D�BZEK|D�D1ACB]WÛQTSR_-ALNÛ_��RB+��NXAC_4B �VB]JçW87:�A�¼BE_?_��RB0�VK|_�Z�ÿALNX\4_�KMNVZGB&Q��_��XAL\+�VD�Q��VJCB� ��BE@<�b�b�b�b�7�C@ � �78��RBED1BE@oH�\LW(' H>S ��b�b�b� �)'7H>S *iZ$� *+�XBA�VK|_�Z�éALNV\4_�KMNXZGB5Aç\&ZGQMD�D�B]ZG_A�� ���`[ , S ` S � V . S101010�S V 2 � W @oHvZ \ XA��QMDKMJLJ�� \ X �b�b�b�7�5� ��ALNXZGQMD�D1B]ZG_&QM_��RBED�82AL\4B��7*+�VAL\;_4B]\4_AL\&ZEKMJLJLB]W9�:<;>=@?+ACBEDF;<G#:<H&IJ?+ALK�DM;>:#N�D(?<;�O�G�P3N �9<*15 6�2��RQ � 5 ;e*10 � 2��&� �>5 *�?��>2o5�� ; �b? ' *+�XAL\kKMJ��MQMD1AC_���� _�K��MB]\�KM\�ALN �ÜSR_<�P\4BE_�\�@<�b�b�b�b�7�C@ �8��RBED�BR@oH/\ W('7H>S �b�b�b�b�7�)' H>S *�Z � W���b�b�b� �/W#*M�#\4B]ZESXD1AC_ ���ÜK|D1K���BE_4BED � �#KMNXWÿKO"sKMJLSXB O�KMNXWÿZ�RB]Z�[\8��RBE_��RBEDb�¢QMDÈKMJLJ � J�HeX �b�b�b���5��N_��RBED1B&B �RAL\4_�\/KN�0QTJ��`NRQ(�èALKMJ(V H W>IdZ?\�SXZ$�Û_��VK|_ � % s W�V H Z ��O�KMNVWV#HXW W���Z \S'7H>S ��b�b�b� � V#H�W W#*iZ \S'7H>S *O�*+�RBæKMJ��MQMD1AL_���� 8-QMD�[\2KM\ �¢QTJçJCQ#8&\9

X��&@?ALZ���%J+TU7^ ��/Q(���VSX_4BWVeH7\ �/� ' � S H�;"�b�b� ; �!'���S H1�(*+�XAç\�ZEKMN2�0B;BJI ZEACB]N#_�J���ZGQ(���VSR_4B]W28&AC_���_��RB+G2QMD1NRBEDKMJ��MQMD1AC_��7�:�

XJD

Page 16: One Round Threshold Discrete-Log Key Generation without Private

� �>þ!�o���b[ , S ` S � V/. S101010�S V32 � WFV � �b�b�b� � V * Z \ X��M_��RB]N�QTSR_��VSX_��4ZGQMD1D�B]ZG_��d�TB]JL\4BÈQTSR_��ÜSR_i�4ALNXZGQMD�D�B]ZG_��d�

�8?>N�:#N D ?>; þ1� V#HXW>IdZ�\CQ�* I * ; �b�b��;�QAc��\8��RBED�B+Q�*G.\ cd�\8-BèWRB]NXQM_4B����"V#HkW>IdZ M ` J � _��XB��QTJ)�[NRQ(�ÛALKMJ Q�* I * ; �b�b��; Q ` J ��I ` J � � /QTNX\4B]U[SRB]N#_�J�������QMD 4 � O$�7V#H�W>IdZ M ` J � �ÂSX\4_/�0B�B]U#SVKMJ_4Q cd�

*+�RB��0QTJ��`NRQ(�èALKMJ��RW>I/Z�\ ^ �Hxa<� � H V#H�W>IdZÄAL\PQ���WRB��MD�BEB K|_K�èQT\4_�OY�>KMNXW��>_��RBED1B��¢QMD�B��2AC_�RQTJLWX\Û_��XK|_ ^ �Hxa<� � H V#H�W>IdZ M ` J � �ÂSX\4_2�0B$B]U[SXKMJ&_4Q�cd�b*+�XAL\ AL\ÛKMN B]U#SXK|_�ALQTN Q��æWRB��MD1BEB � AçN_��RB SXN��[NRQH8&N � KMNVW �RB]NXZGB5�XKM\ÂK|_M��QT\�_ � D1Q#QM_�\��&*+�RBED�B���QMD�B��k_4Q QTSR_��ÜSR_]�MZGQMD�D�B]ZG_���8��XB]NALN ��KMZG_Ä_��RB ALNV\4_�KMNXZGB AL\PALNXZGQMD�D1B]ZG_�� � �ÂSX\4_6�0B QTNRB Q��5_��RBéD�Q[QM_�\PQ��5_��RBéB]U[SXK|_�ACQTN�� *+�VAL\KMJ��MQMD1AC_���� �«KMALJL\<82AC_����XD�Q��ÜK��VALJLAC_!�æK|_a��QT\�_ �� , � ��8��XAçZ��AL\�KÌNRB��TJLA��TA��ÜJCB/U[SXKMN#_�AC_ ����*+�RB;D1SXNVNXALN �_�A)��BÂQ��?_��XAL\�KMJ��MQMDgAC_���� AL\ ��W �U4 Z+8��XALJCB5_��RB�NXKMA�"MB���BE_��RQ`W�8��XALZ$� ZGQTNV\�AL\4_�\�ALN ZGQ(���VSR_�AçN �_��RBN�0QTJ��`NRQ(�èALKMJ¼ALN�_4BED��QTJçK|_�ACQTN:8&AC_�� O<; XN��QTAçN�_�\2KMNXW Z$�RB]Z��`ALN �5��QMD2B]KMZ$� Q���_��XB� D1B]U#SXALD�B]\��W 4 � � Zb�ÂSXJC_�A��VJçALZEK|_�ACQTNX\��� =��>, *(?��>245 ?@2 243 0 ��� ?#37*�? �T2o5 ' O�ACD1\�_ÂQ���KMJLJ �<8/B NRQM_4B _��XK|_�_��XB ZGQ(���VSR_�K|_�ACQTN ZGQT\4_èQ��Z�RB]Z�[ALN��?8��RBE_��RBEDÐ_��XB�� � "|KMJLSRB]\�pqH>S h�B]NXZGD�� �X_ s u�� h � ��D�B]U[SXACD�B � � B �d�0QTNRB]N#_�ALK|_�ACQTNX\��0þeNf��KMZG_��8-B;WRQÐNRQM_�NRBEB]W�_4Q�B �RKMZG_�J��5_4B]\�_&80�RBE_��RBED�_��RB]\4BÈB]U[SXK|_�ACQTNX\<�RQTJçWO�ÜSR_kDgK|_��RBED 8��RBE_��RBED�K�\4BED�"MBED\4B]NXW6�«KMJL\4B�\��XK|D�B]\�� Z ��"`ACQTSX\�J)����B]KMZ� \4BED�"MBED+�ÂSX\4_ "MBED1A)� �ÛAL_�\ÈQ#8&NÄ\��VK|D�B]\`�VSR_;ZEKMNPQTNXJ��ÿZ�RB]Z�8��RBE_��RBED>_��XBÐQM_��RBED1\&K|D1BÌZGQMD�D�B]ZG_+82AC_��:�XA��(�6�XD1Q��VK��VALJLAL_ ���

*¼Q _��XAL\æB]NXW��-8/B ZEKMN SX\4B _��RB 9 :<;<= ?>A BEDF;<G#:<H I ?>A-K DF;<:#N D ?>; O G P3N �-] BPNRBEB]Wò_4QD1SXN _��XAL\�KMJ��MQMD1AC_��7� �4AçN _��XBÂB �d�0QTNRB]N#_�\��PKMNXW _��RB��XD�Q[Q�� �¢QTJçJCQ#8&\���D�Q(� _��RB���KMZG_Ð_��VK|_ s AL\�K�XD1A)�èAL_�A�"MBÌB]JCB�èB]N�_ÌAçN _��XBè\�S ���MD�QTS�� Q�� K�� . Q��-QMDgWRBEDrm ��þtNéQTSRDæ\1AC_�SXK|_�ACQTN��\8/B2�XK"MB "sKMJLSXB]\'7H>S hæZGQMD1D�B]\��0QTNXWP_4Q�pqH>S hÐKMNXW?"sKMJLSXB]\�W(H�_4Q ���

*+�RBæKMJ��MQMDgAC_���� 8/QMD��[\2KM\ ��QTJLJCQ#82\�9

X��&@?ALZ���%J+T7KNM^ ��/Q(���VSX_4B VeHn\ '���� S H %|�b�b� %%'� ��S H � *+�XAç\æZEKMN �0B BJI ZEACB]N#_�J�� ZGQ(���VSR_4B]W'�¢D1Q(�=_��RB�"sKMJLSXB]\

pqH>S � �b�b�b� ��p H>S �ÈSX\�AçN ����_�A ��B]\È_��RBÌOXKM\�_�� SXJL_&KMJ��MQMD1AC_��7�:�� �>þ!� ���b[�� S ` S � ��S101010 S � � WFV���b�b�b� � V � Z \ X��X_��RB]N QTSR_��VSR_��4ZGQMD�D1B]ZG_��d�VB]JL\4BÌQTSR_��VSR_��4ALNVZGQMD�D�B]ZG_��d�

*+�RB"���b[ ZGQTNX\�AL\�_�\ÿAçN8Z$�RB]Z��`ALN ��8��RBE_��RBED6��QMDÄKMJLJ l8\ X �b�b�b�7� ��� s�� � h � \ � ` U adc { h ~� S U

AL\ÿB]U#SXKMJ_4Q Vqh�� *+�RB�"sKMJLSXB]\P{ � S U ZGQMD�D�B]\��0QTNXW8_4QÎ_��RB ZGQ#BJIÿZEACB]N�_�\PQ��5_��RBf�0QTJ��[NXQ(�èALKMJ �KMNXW K|D�B B]U#SVKMJ&_4Q s � � u . } uxw ~ � u \ � � Hxa<� {M� uH>S U �?þeN �«KMZG_�� Vqh$Aç\èB]U[SXKMJ>_4Q p5���� S h %:�b�b� % p � ��S h \s � � h�� � � J 01010 J . � h � �N\ s � � u . � u u�� h�� \ s�� � h�� ��Q`W�z-�

/QTNX\4B]U[SRB]N#_�J����78/BO�VK"MBÌ_4QPZGQ(���VSX_4BÌ_��RB �A"|KMJLSRB]\ V h��Ü_��RB]O ; XN"sKMJçSRB]\ { � S U KMNXW$_��RB �D�B]JLK|_�ACQTNX\N���`[��

*+�XAL\;KMJ)�MQMD1AC_���� �«KMALJL\`8&AL_��6�XD�Q��VK��VAçJLAC_ � K|_���QT\4_ � M 8��VALZ�ÄAL\;KÛNRB��TJLA��TA��ÜJCBU[SXKMN#_�AC_ ���H2\ÈSX\1SXKMJ �(8/B2B]\�_�A)�èK|_4B�O�KM\ �CA�^5KMNXW KMZEZGQMDgWXALN �TJ����#_��RB2ZGQ(�2�VJCB �RAC_ �èQ���_��XB\�Z$�RB��B�ALNè_��XB

N#S��O�0BED;Q�� �5SXJL_�A��VJLALZEK|_�ALQTNX\-Aç\�9

X���*¼QéZGQ(���VSX_4BÛ_��RB5"sKMJçSRB]\�Vqh��&8-BÿNRBEB]W �è_�A ��B]\5ZEKMJçJL\Ì_4Q _��RBÿOXKM\4_�� SXJC_�KMJ��MQMD1AC_���� �¢QMD ��XD�Q`WXSXZG_�\ÌQ�� ��QH8-BEDg\N8��XBED�BÛ_��RBP\�AEDEB Q��;_��RBÛB �d�0QTNRB]N#_�\5K|D�BPALN � M m M �<�RB]NXZGB�� �8% B � M m M ;��� M m M Ed\ ��W���� M m M Z$�

^ ��*¼Q5ZGQ(���VSR_4B2_��RB&ZGQ[BJI ZEACB]N#_�\�Q�� s � � � � �(8/B&NRBEB]W W>O�;�X@Z�ZEKMJLJL\�_4Q5_��RB&OXKM\�_�� SXJL_?KMJ��MQMD1AC_��7��¢QMD �+�XD1Q[WXSVZG_�\�Q�� �0Q#8/BED1\a8��RBED�B2_��RB�\�AEDEBQ���_��RB2B �d�0QTNRB]N#_�\/K|D1BALN M m M � �d�RB]NXZGB��/W>ON; X@Z %B M m M � ; � ,

�M m M Ed\ �RW�� � M m M Z$�

X �

Page 17: One Round Threshold Discrete-Log Key Generation without Private

� ��*¼Q Z$�RB]Z�� _��XBÂD1B]JLK|_�ACQTN[���b[���8-BèNRBEB]W%��ZEKMJLJL\�_4QÄ_��XBèOXKM\4_�� SXJC_æKMJ��MQMD1AL_���� �¢QMDRW>OD; X@Z�XD�Q`WXSXZG_�\¼Q�� ��QH8-BEDg\-8��XBED�B?_��RB/\�AEDEB-Q��X_��RB?B �d�0QTNRB]N#_�\kK|D�BÈALN]O[JCQ��oW��Z ���RB]NXZGB � %AB O`JCQ��4W��@Z�;` � ` J � ��

JCQ��dW��Z Ed\ ��W�� � JLQ��oW��@Z�Z$�*+�XAL\;KMJ)�MQMD1AC_�����D�B]U[SXACD1B]\ ��W�� � M m M ; � � JCQ��oW��Z�Z`�ÂSXJC_�A)�VJLALZEK|_�ACQTNV\��*+�RB2�VD�B�"[ALQTSX\�J��?�VD�Q��0QT\4B]WòKMJ��MQMD1AL_����è\æZEKMNXNXQM_5SX\4B]Wò_��XAL\Ð_4D1AçZ�� KM\æ_��RB����XK#"MB QTNVJ�� QTNXB

"sKMJLSXB$ALN KMJLJ2\4BE_ @dH!�b*+�RBED�B���QMD�B���B]KMZ$� \�BED�"MBED+l��XKM\ _4Q �0BED���QMD� � ZEKMJLJç\è_4Q _��RB$OXKM\4_�� SXJC_KMJ��MQMD1AC_����=_4QK"MBED1A�� �f8��RBE_��RBED p@hR\ � ` Ubadc { h ~H>S U ��QMD ��\ XÛ_4Q ���-*+�XAç\ÐJCB]KMWX\æ_4Q ��_�A)��B]\æ_��XBO5;6Xb�XD1Q[WXSVZG_�\9Q����0Q#8/BED1\&8��RBED1B-_��RBÈ\�AEDEB/Q��X_��RB/B �d��QTNXB]N�_�\�K|D�BÈALN O[JCQ��oW��Z ���RB]NXZGB����(B O[JCQ��dW��Z5;` � ` J � ��

JCQ��oW��@Z Ed\ �RW�� �0JCQ��dW��Z�Z$��þ!� 8-B+�VK"MB&SX\�B]W�_��XAL\ ��BE_��XQ[W�8��XBED�B]KM\�_��RBL9 :<;<= ?>A B�DM;<G :<HIJ?>A-K�DM;<:#N D ?>;�O G�P N:�4ALNP_��RBæB �d�0QTNRB]N�_�\ �d�X_��RBæZGQ(���VJLB �`AC_!��82ALJLJ\�XK"MB5_4Q2�0B ��W�����JCQ��oW��@Z�Z$�

þtN��MB]NRBED1KMJ � M m M \ X��c KMNXW A��a8-Bè_�K��MB��+\L��^G\ ^���� ��JCQ��oW��@Z�\ X��cd�&*+�RBED�B���QMD�B���8��XB]N_��RBÂN[S��O�0BED&Q��?\4BED"MBED�Aç\��MD�B]K|_4BEDÐ_��VKMN ��^ �0QTSRD �VK|_�Z$�4"MBEDgAQ�ÜZEK|_�ACQTN���BE_��RQ`WK�0B]ZGQ(��B]\_4Q6�0B��QMD�BæBJI ZEALB]N�_;_��XKMN$_��RBæ\4_�KMNXWVK|D1W?��BE_��RQ`W��

þtN�QMDgWRBED�_4Q/�0B>\4B]J��¢FIZGQTN�_�KMAçNRB]W���8/B �XD�Q#"`ALWRB �RBED1B>KMN�B]\4_�A)�èK|_�ALQTN�Q��Ü_��RB>ZGQ(�2�VJCB �RAC_ �ÂQ��Ü_��XB�XD�Q[Q���\�� *+�RB/"MBED1AQ��ZEK|_�ACQTNX\>Q���_��RB���� �VD�Q#Q��«\+�XKM\2KÛZGQ(���ÜJCB �`AL_ �ÄNRB��TJLA��TA)�VJCBÐALNÄD�B]JçK|_�ACQTNÄ_4QÛ_��XB�XD�B�"`ACQTSX\2Q���BEDgK|_�ACQTN�� ] BèZEKMNéB]\�\4B]N#_�ALKMJLJ�� \�S7�2�èK|D1AEDEBÂ_��RBM�XD�Q[Q���\�KM\ÐZ$�RB]Z��`ALN �68��RBE_��XBED_��XB�XD�B]ZGQ(���VSX_4B]W�"sKMJLSXB s � AL\�B]U[SXKMJ`_4Q s54 %�p P , ��Q`W�zÛKMNXW:9 � AL\�B]U[SXKMJ`_4Q 9 4 0 * P ,W��Q`W4)%� �] Ba�XK#"MB�_4Q2ZEK|D�D�2QTSR_ � � �XD�Q`WXSXZG_�\9Q��#_!8-Q2QMD9_��RD�BEB?N[S��O�0BED1\\8��RBED�B�_��XB?\�AEDEB�Q��`_��RB�B �d�0QTNRB]N�_�\K|D�BÌALN M { M QMD M ) M �7*+�RBED1B��¢QMD�B��XA)� 8/BæZEKMJLJ�_��RBæOVKM\4_�� SVJC_2KMJ��MQMDgAC_����:�d8/BæQ��X_�KMALN M { M � � �¢QMD>_��XB"MBED1AQ�ÜZEK|_�ACQTNV\ÛALN�K�� . KMNXW M ) M ���K�¢QMD _��RBK�VD�Q#Q��«\ÛAçN )�� �N/QTNX\4B]U[SRB]N#_�J�����_��RB ZGQ(���VSR_�K|_�ACQTNZGQ(���VJCB �RAC_ ��AL\�S����0BED&�0QTSXNVWRB]W����Â_��RB�;2KMNXWRQ(� �kALNRB]K|D /Q(�O�VALNVK|_�ACQTN�*¼B]\�_?ALN�_��RB>B �d�0QTNRB]N#_�¢QMD&KMJçJ�\�Z�RB�èB]\��

X�