The hinTS threshold signature scheme

[tinker-michaelj]

Abstract

Hiero networks sign blocks in the V6 record stream by each node in the network publishing an RSA signature on the hash of every block it produces as specified in HIP-415. The network's aggregate signature on block N is any combination of valid RSA partial signatures from nodes holding at least 1/3 of the network stake.

This scheme is simple but inefficient. Verifiers must track the node RSA keys published in the network state, which is fairly costly. Assuming a roughly uniform stake distribution, the aggregate signature size and verification work needed both grow linearly with the number of nodes in the network. And verifying RSA signatures on EVM chains is impractical, since there
is no native precompile support.

We propose Hiero networks adopt the hinTS threshold signature scheme (TSS) from [1] in tandem with adopting the block stream proposed in HIP-1056. The hinTS scheme uses a single BLS aggregate signature that can be cheaply verified by an EVM smart contract. It achieves this by pairing each signature with a zk-SNARK proving the signature is a valid aggregation of partial signatures from BLS keys in the network address book for nodes with a threshold amount of weight.

Verifiers will verify Hiero hinTS signatures under a sequence of BLS verification keys specific to each network, corresponding to the chain of address books that network has adopted. Starting with the genesis address book, each time the network adopts a new address book, it will publish a recursive zk-SNARK in the block stream that proves the new address book's verification key belongs to the network's chain of trust.

References

1. Garg, S., Jain, A., Mukherjee, P., Sinha, R., Wang, M., & Zhang, Y. (2023). hinTS: Threshold Signatures with Silent
   Setup. Cryptology ePrint Archive, Paper 2023/567. Retrieved from https://eprint.iacr.org/2023/567

[tinker-michaelj]

Note - this draft will evolve a bit once it is finalized what part of a Hiero network will do the heavy lifting to create/compress chain-of-trust proofs.