On Tue, Mar 10, 2015 at 8:19 AM, Watson Ladd <watsonbl...@gmail.com> wrote: > > Threshold Schnorr can directly get any linear sharing > scheme with linear storage cost, while threshold ECDSA requires > enumerating all sets that are allowed.
OK, so it's similar to the threshold RSA of [1] which turns a distributed scheme into an m-of-n scheme by sharing the private key n-choose-m times, e.g. k-of-k = 1 share 2-of-3 = 3 shares 3-of-5 = 10 shares 4-of-7 = 35 shares 5-of-10 = 252 shares (worst case for n <= 10) That seems fine for typical uses. Trevor [1] http://crypto.stanford.edu/~dabo/papers/ittc.pdf _______________________________________________ Curves mailing list Curves@moderncrypto.org https://moderncrypto.org/mailman/listinfo/curves