FIPS 204-Compatible Threshold ML-DSA via Shamir Nonce DKG
Fuente:
arXiv
Salvato in:
| Autore principale: | |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2026
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866914367228870656 |
|---|---|
| author | Kao, Leo |
| author_facet | Kao, Leo |
| contents | We present the first threshold ML-DSA (FIPS 204) scheme achieving nonce share privacy (conditional min-entropy guarantee; no computational assumptions) with arbitrary thresholds, while producing standard 3.3 KB signatures verifiable by unmodified implementations. Our primary technique, Shamir nonce DKG, generates the signing nonce as a degree-$(T-1)$ Shamir sharing, matching the structure of the long-term secret. This gives each honest party's nonce share conditional min-entropy exceeding $5\times$ the secret-key entropy for signing sets of size at most 17. In coordinator-based profiles (P1, P3+), this removes the two-honest requirement ($|S| \geq T$ suffices); in the fully distributed profile (P2), mask-hiding additionally requires $|S \setminus C| \geq 2$. Key privacy of the aggregate signature is an open problem, analogous to single-signer ML-DSA. As a secondary technique, pairwise-canceling PRF masks handle three challenges unique to lattice-based threshold signing: commitment binding, the r0-check predicate, and response aggregation. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_20917 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | FIPS 204-Compatible Threshold ML-DSA via Shamir Nonce DKG Kao, Leo Cryptography and Security 94A60, 94A62 E.3; C.2.4; D.4.6 We present the first threshold ML-DSA (FIPS 204) scheme achieving nonce share privacy (conditional min-entropy guarantee; no computational assumptions) with arbitrary thresholds, while producing standard 3.3 KB signatures verifiable by unmodified implementations. Our primary technique, Shamir nonce DKG, generates the signing nonce as a degree-$(T-1)$ Shamir sharing, matching the structure of the long-term secret. This gives each honest party's nonce share conditional min-entropy exceeding $5\times$ the secret-key entropy for signing sets of size at most 17. In coordinator-based profiles (P1, P3+), this removes the two-honest requirement ($|S| \geq T$ suffices); in the fully distributed profile (P2), mask-hiding additionally requires $|S \setminus C| \geq 2$. Key privacy of the aggregate signature is an open problem, analogous to single-signer ML-DSA. As a secondary technique, pairwise-canceling PRF masks handle three challenges unique to lattice-based threshold signing: commitment binding, the r0-check predicate, and response aggregation. |
| title | FIPS 204-Compatible Threshold ML-DSA via Shamir Nonce DKG |
| topic | Cryptography and Security 94A60, 94A62 E.3; C.2.4; D.4.6 |
| url | https://arxiv.org/abs/2601.20917 |