Institute of Information Science, Academia Sinica

Threshold cryptography is a standard technique for distributing trust by splitting cryptographic keys into multiple shares held by different parties. Normally, in threshold cryptography, we assume there is a trusted dealer who distributes the shares to different parties or that the parties participate in an interactive distributed key-generation protocol to derive their individual shares. In recent years, several works have proposed a new model where users independently choose their public key, and there is a deterministic function that derives the joint public key associated with a group of users from their individual keys. Schemes with this silent (i.e., non-interactive) setup allow us to have the utility of threshold cryptography without needing a trusted dealer or an interactive setup. In this talk, I will describe a new pairing-based approach for constructing threshold signatures and encryption schemes with silent setup. Our techniques allow us to support expressive policies (including threshold policies) while only relying on simple algebraic tools. This yields constructions with shorter signatures and ciphertexts compared to previous pairing-based constructions. Concretely, the signature size in our threshold signature scheme is 3 group elements and the ciphertext size in our threshold encryption scheme is 4 group elements.