Gargos: Threshold Schnorr Signature Scheme

"Preview Talk" (by Team BDLR) @ MPTS 2026, in reply to the NIST Threshold Call

Abstract. In this presentation, I will talk about Gargos, a three-round (t, n)-threshold variant of the Schnorr signature scheme based on the paper titled “Adaptively Secure Three-Round Threshold Schnorr Signatures from DDH”. Gargos achieves full adaptive security under standard assumptions. The three rounds in Gargos consists of commitment, opening, and response phases (in this order), followed by deterministic aggregation into a single Schnorr signature. Signing capability is distributed among n parties such that any subset of at least t+1 participants can generate a valid signature, while smaller subsets cannot do so. The scheme assumes a trusted-dealer setup for key generation and is proven adaptively secure against adversaries that may corrupt participants over time. Security is established in the random oracle model under the decisional Diffie–Hellman assumption.

Joint work: Renas Bacho, Sourav Das, Julian Loss, Ling Ren

[Slides] Suggested readings:

• Preview Writeup: Gargos: Threshold Schnorr Signature Scheme

• Adaptively Secure Three-Round Threshold Schnorr Signatures from DDH (ia.cr/2025/1009)