1. An efficient threshold RSA digital signature scheme
Source：Applied Mathematics and Computation, Volume
166, Issue 1, 6 July 2005, Pages Author：Qiu-Liang Xu, Tzer-Shyong Chen
Speaker：李士勳
Date：2005,12,14

2. Outline Introduction Descriptions of the scheme
Analysis of security and efficiency
Conclusions

3. Introduction Resisting conspiracy attack
(t,n) threshold signature scheme

4. Introduction 1991：Desmedt and Frankel fist proposed
the threshold signature scheme
1994：Li et al. presented two (t,n)
threshold signature schemes
1997：Michels and Horster proved
them insecure
1998：Wang et al. presented two (t,n)

5. Descriptions of the scheme
p and q are large primes

6. Descriptions of the scheme
represent the set of all members in the system

7. Initialization phase
Key Dealing Center(KDC) must establish four parameters
RSA parameters
Lagrange interpolation parameters
Parameters used in modulus convention
Parameters used in partial signature verification

8. RSA parameters
p,q,n,e and d to generatethe group signature, where n=p*q, p and p are two safe primes, (n,e) is the public key, and d is the private key
P,Q,N,E and D which is used by the signature generator(SG), where N=P*Q>n, P and Q are also two safe primes, (N,E) is the public key, and D is the private key

9. Lagrange interpolation parameters
Select a large public prime r>n
Select a random polynomial f(x), d=f(0)

10. Parameters used in modulus convention
Consider a sample message , so that the order of in group is
Compute
Make public

11. Parameters used in partial signature verification
Select randomly an element of order
compute i=1,2,…,n and send publicly v and to the signature generator SG

12. Signature phase
Chaum-Pedersen zero-knowledge protocol

13. Chaum-Pedersen zero-knowledge protocol
One-way hash function H(), and a random number u, compute
z=xc+u
(z,c) proves , the verifier acepts the proof if and only if
Clearly, when ,the proof holds

14. Signature phase
denotes the t shareholders who participate in signing

15. Signature phase Select a random number Compute , Send to SG , ,
, ,
(m,s(m),S(m)) is the signature on message m

16. Signature phase If
then (m,s(m),S(m)) is appetped as a valid signature

17. Analysis of security and efficiency
The fist step of the initialization phase builds only the RSA cryptosystem, without providing any extra information
The second step is to establish a (t,n) threshold system based on Lagrange interpolation
The third and forth step is hard to slove the discrete logarithm problem

18. Conclusions
Resisting conspiracy attack