Private Collaborative Custody with FROST [combined summary]



Individual post summaries: Click here to read the original discussion on the bitcoin-dev mailing list

Published on: 2023-08-30T12:16:28+00:00


Summary:

The email discusses the concept of private collaborative custody services for Bitcoin. It mentions that with multiparty computation multisignatures like FROST, it is possible to create a collaborative custodian service that ensures privacy for users. Currently, collaborative custodians can access a user's entire wallet history and have the power to censor signature requests. However, with FROST, a private collaborative custodian can hold a key to a multisig without being aware of the public key or wallet that they help control.In the scenario where a private collaborative custodian is required to sign a transaction, it can be done blindly. By remaining blind to the transaction request and unaware of past onchain behavior, these custodians have no practical information to enact censorship requests or non-cooperation. This is in contrast to non-private custodians who can easily be coerced into not collaborating with users.The email also discusses the process of enrolling a private collaborative custodian. Each signer in a FROST multisig controls a point belonging to a joint polynomial. Existing participants can collaborate to securely generate a new point on this shared polynomial and communicate it to the new custodian. The custodian should then share their own public point so that other parties can verify its authenticity.Furthermore, the email explains the concept of blind collaborative signing. Once the custodian controls a point belonging to the FROST key, they can help sign messages. The server follows a scheme similar to blind Schnorr signatures, producing a signature compatible with partial signatures from other FROST participants. The server signs under a single nonce and the nonce contributions from other signers blind the signature. The challenge is also blinded with a factor that includes the necessary Lagrange coefficient, allowing the partial signature to combine correctly with other FROST signatures.It is noted that the collaborative custodian does not need to know they are participating in FROST. The email addresses concerns about the server signing arbitrary challenges by stating that each secret share is unique to a specific FROST key, and the custodian should protect the service with user authentication and potential cooperation from other parties.Overall, the email discusses the benefits of private collaborative custody services for Bitcoin and explains the process of enrolling custodians and performing blind collaborative signing.


Updated on: 2023-08-31T01:57:49.992613+00:00