Reposted by François Dupressoir
Been at FUTURES discovery day today at We the Curious in Bristol with @compscibristol.bsky.social Thank especially to @fdupress and Alma Oracevic who have been spreading the joy of cracking codes alongside me all day!
François Dupressoir
@francois.dupressoir.eu
109 followers 66 following 69 posts
Proof nerd, dad, computer scientist.
![Abstract. Threshold signatures enable multiple participants to collaboratively produce a digital signature, ensuring both fault tolerance and decentralization. As we transition to the post-quantum era, lattice-based threshold constructions have emerged as promising candidates. However, existing approaches often struggle to scale efficiently, lack robustness guarantees, or are incompatible with standard schemes — most notably, the NIST-standard ML-DSA. In this work, we explore the design space of Fiat-Shamir-based lattice threshold signatures and introduce the two most practical schemes to date. First, we present an enhanced TRaccoon-based [DKM+24] construction that supports up to 64 participants with identifiable aborts, leveraging novel short secret-sharing techniques to achieve greater scalability than previous state-of-the-art methods. Second — and most importantly — we propose the first practical ML-DSA-compatible threshold signature scheme, supporting up to 6 users. We provide full implementations and benchmarks of our schemes, demonstrating their practicality and efficiency for real-world deployment as protocol messages are computed in at most a few milliseconds, and communication cost ranges from 10.5 kB to 525 kB depending on the threshold.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fwa55bujvdrwlwlwgqmmxmuf/bafkreig6agg6pu6cl7s65czcnwu7eg74avis272jmcgxlsqokddotarkuy)
![Abstract. Suppose you have a supersingular ℓ-isogeny graph with vertices given by j-invariants defined over 𝔽_(p²), where p = 4 ⋅ f ⋅ ℓ^(e) − 1 and ℓ ≡ 3 (mod 4). We give an explicit parametrization of the maximal orders in B_(p, ∞) appearing as endomorphism rings of the elliptic curves in this graph that are ≤ e steps away from a root vertex with j-invariant 1728. This is the first explicit parametrization of this kind and we believe it will be an aid in better understanding the structure of supersingular ℓ-isogeny graphs that are widely used in cryptography. Our method makes use of the inherent directions in the supersingular isogeny graph induced via Bruhat-Tits trees, as studied in [1]. We also discuss how in future work other interesting use cases, such as ℓ = 2, could benefit from the same methodology.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fwa55bujvdrwlwlwgqmmxmuf/bafkreifgbrui6i5iqeu5dvou3d2l6cpu7ce2amymv4agkf3erhwpqagxli)
