hinTS threshold signatures for Hiero blocks

[tinker-michaelj]

Summary

Hiero networks sign blocks in the v6 record stream by each node signing the hash of every record file it produces with a RSA signing key published in the network state (specifically, in the NodeAddressBook message encoded in system file 0.0.102). The network's collective "signature" on block N is thus any combination of node signatures where the weight of the signing nodes is at least 1/3 of the total network weight.

The main virtue of this scheme is its simplicity. But it is not very efficient, since,

1. A verifier must know the current contents of file 0.0.102.
2. Both the size and the verification cost of a signature grow linearly with the number of nodes in the network.

Also, verifying RSA signatures in the EVM is impractical since there are no native precompiles to do the verification. This prevents inter-ledger communication between Hiero networks and EVM chains.

The hinTS threshold signature scheme in [1] offers a much more efficient approach. A hinTS verifier can verify network signatures under a single BLS key (the verification key), as each hinTS signature comes with a zk-SNARK proving it is an honest aggregation of BLS signatures from nodes holding a threshold amount of weight.

Of course, we must also prove the verification key corresponds to an address book in the network's chain of trust. We can do this by also publishing, for each verification key, a recursive zk-SNARK that proves the verification key was adopted as part of the network's chain of address book rotations that began with the genesis address book (which must be trusted for its own sake).

We propose to migrate Hiero networks to hinTS signatures at the same time the block stream is adopted.

References

1. Garg, S., Jain, A., Mukherjee, P., Sinha, R., Wang, M., & Zhang, Y. (2023). hinTS: Threshold Signatures with Silent
   Setup. Cryptology ePrint Archive, Paper 2023/567. Retrieved from https://eprint.iacr.org/2023/567