"Preview Talk" (by team Pilaf) @ TCPT3, in reply to the NIST Threshold Call
Abstract: In this presentation, we will introduce Pilaf, a two-round threshold signature scheme with complete message-independent preprocessing, and outline our planned submission to the NIST Threshold Call. Pilaf allows a set of signing parties to prepare its entire first-round output, state, and randomness before the message is known, leaving the second round to process the subsequently chosen message. Its security relies on the decisional Diffie-Hellman assumption in the classical random-oracle model, without bilinear pairings or the algebraic group model. We highlight that our construction achieves level-two threshold-signature unforgeability (TS-UF-2) type security under adaptive corruptions that reveal the corrupted participants' secret shares and complete historical randomness without secure erasure, including the conditions under which preprocessing and partial signing interactions on the eventual forgery target are allowed. We will also describe the tight security reduction, whose multiplicative loss is independent of the number of users, signing threshold, instances, and oracle queries. Finally, we will discuss communication costs and implementation considerations, including centralized key generation, signer sets fixed before preprocessing, and single-use preprocessing states.
Joint work: Hao Cheng, Zengpeng Li, Chen Qian, Puwen Wei, Quan Yuan, Xingyu Zhao.
Suggested readings
- Preview Writeup (PDF): Pilaf: Fully Tight Two-Round Threshold Signatures: Adaptive, Pairing-Free Threshold Signing from MDDH
- FROST: Flexible Round-Optimized Schnorr Threshold Signatures (ia.cr/2020/852)
- Twinkle: Threshold Signatures from DDH with Full Adaptive Security (ia.cr/2023/1482)
- Dazzle: Improved Adaptive Threshold Signatures from DDH (ia.cr/2025/264)
