Documentation threshold ecdsa

From the paper abstract:

it works with n parties with up to f < n/3 Byzantine corruptions;

And from the paper introduction:

Our new protocol is, in fact, an (f + 1)-out-of-n threshold signature scheme

So the threshold is less than 1/3 of the nodes.

when we run this test with node = 10 , threshold = 6 , and number_of_dealings_corrupted = 0

With 10 nodes you can have at most threshold 3+1, so threshold 6 is too high. One reason is that in the multiplication protocol we are trying to get shares for the product of 2 previously shared secrets, which essentially involves computing the product of the two polynomials used in the secret sharing. Since you use threshold 6, the two polynomials have degree 5 and their product has degree 10. To interpolate this polynomial we need at least 11 points, which means collecting 11 dealings. However, since you only have 10 nodes you cannot get enough dealings to successfully reconstruct the correct polynomial.

Another remark: the number_of_dealings_corrupted is the number of dealings we actively corrupt within the test, it is not the number of corrupt dealers we can tolerate in the protocol.

3 Likes