Crates.io | wsts |
lib.rs | wsts |
version | 9.1.0 |
source | src |
created_at | 2023-05-08 20:11:24.322453 |
updated_at | 2024-05-21 17:44:02.388859 |
description | Weighted Schnorr Threshold Signatures, based on FROST |
homepage | |
repository | https://github.com/Trust-Machines/wsts/ |
max_upload_size | |
id | 860056 |
size | 442,936 |
WSTS
is a system for making Weighted Schnorr Threshold Signatures
, aka WileyProofs
. It allows a group of signers
, each of whom controls a set of keys
, to make a valid Schnorr
signature, as long as T
(the threshold
) of them complete the protocol honestly. While there are many other threshold signature schemes, WSTS
has several features which make it particularly useful in a cryptocurrency context.
First, it is optimized for a small number of rounds in the common case where there are no byzantine actors present. Since the protocol allows detection any bad actors in the system, it makes sense to optimize for the case where there are none. Such byzantine actors can be sanctioned in a way that severely disincentivezes attempts to subvert the protocol.
Second, in contrast to typical multisig
protocols, WSTS
produces a single aggregate signature which is indistinguisable from a standard Schnorr
signature. Crucially, this signature can be verified the same way as any Schnorr
signature. And since the signature is aggregated, it does not take any more space on chain than any other standard signature, and linearly less than traditional multisig
signatures.
Finally, WSTS
is designed to build aggregate threshold signatures which are weighted, i.e. not all signers control the same number of keys. The threshold
is a function of keys, so a set of signers meets the threshold
if and only if the sum of the number of keys they control equals or exceeds the threshold
.
WSTS
is based on FROST
, i.e. Flexible Round-Optimized Schnorr Threshold
signatures. FROST
provides a system where a number of parties
, each of which controls a single key
, can form an aggregate group signing key, after which a threshold
number of them can cooperate to form a valid Schnorr
signature.
This crate provides a simple implementation of WSTS
in the v1
module, which is an extension of FROST
where each signer
controls a set of parties
, each of which controls a single key
.
This crate also contains a more complex version of WSTS
optimized for the weighted threshold scenario in the v2
module. Like vanilla FROST
, v2
keeps a single polynomial and nonce for each Party
, but allows each Party
to control multiple keys. This allows for order-of-magnitude reductions in data size and number of messages for the distributed key generation (DKG
) and signing parts of the protocol.
This crate uses the Bitcoin secp256k1
curve. But since the C libsecp256k1
library only provides high level interfaces for operations used by Bitcoin, it was necessary to directly expose the scalars and curve points to allow arbitrary mathematical operations outside of sign/verify. So we provide a wrapper crate around libsecp256k1
which wraps the internal interfaces to scalars and points. We call this crate p256k1
, to denote that it is not only the same curve as secp256k1
, but also exposes the curve directly.