bitcoin-dev

Combined summary - BIP Draft: "ChillDKG: Distributed Key Generation for FROST"

Combined summary - BIP Draft: "ChillDKG: Distributed Key Generation for FROST"

Recent updates to a draft Bitcoin Improvement Proposal (BIP) have been shared, detailing numerous changes, improvements, and cleanups since its initial announcement.

Significant amendments include fixing a security vulnerability concerning the CertEq signature not covering the entire message, adding blame functionality for identifying faulty parties with an investigation phase, making the threshold public key Taproot-safe by default, and allowing participants to encrypt the secret share intended for themselves. This encryption uses a symmetric approach to avoid the computational overhead of ECDH computations. The full draft of the BIP is accessible for review and feedback, with a particular interest in hearing from potential users and applications, such as wallets, regarding the design decisions, the API's fit, and possible improvements. The document is hosted on GitHub, available at this link. Feedback is actively sought, especially on specifying the wire format and adding test vectors. Collaboration is ongoing with siv2r, author of another BIP draft for FROST signing, to ensure compatibility between proposals. Discussions are also open regarding how to best include the "secp256k1proto" package necessary for running the reference implementation, with current preference leaning towards keeping a "git-subtree" in the BIPs repo for completeness and archival purposes.

Privacy concerns associated with recovery data in distributed key generation (DKG) processes are highlighted, pointing out the risks of sensitive information being stored in plaintext, such as long-term "host" public keys and the final threshold public key. The threat model considers adversaries accessing this data, potentially linking on-chain transactions to individuals and compromising privacy. Currently, the protocol does not require encryption of recovery data before backup, based on the premise that encryption is a local operation and does not affect communication protocols within the DKG framework. However, feedback suggests revisiting this stance for better clarity and guidance in the BIP, proposing the use of the DKG protocol seed to derive an encryption key, thereby enhancing security and privacy without adding complexity for participants.

Dave raises a question regarding the privacy implications of making public recovery data accessible in the ChillDKK protocol. He draws parallels with cryptocurrency security practices, particularly comparing the exposure levels of BIP32 HD paths and xpub data in terms of privacy impact. Dave's inquiry seeks to understand whether ChillDKG's approach to publishing recovery data more closely resembles the relatively benign disclosure of an HD path or the more concerning privacy issues associated with revealing an xpub.

Jonas, Nick, and Tim are working on a draft BIP focused on Distributed Key Generation for FROST Threshold Signatures, aiming to introduce it to the community for feedback and discussion. This draft includes design considerations, usage instructions, and a Python-based reference implementation, aiming to serve as the definitive specification for the proposal. The team invites the community to review their work hosted on GitHub, emphasizing the need for feedback on several underdeveloped aspects such as the wire format, test vectors, and formalizing secp256k1proto as an official Python package. This effort reflects the ongoing initiatives to enhance cryptographic practices within the Bitcoin ecosystem, highlighting the collaborative nature of developing secure and efficient distributed key generation mechanisms.

Discussion History

0
Tim RuffingOriginal Post
July 8, 2024 20:05 UTC
1
July 16, 2024 16:43 UTC
2
July 16, 2024 17:31 UTC
3
December 19, 2024 10:56 UTC