Setup Phase

In the drand setup phase, you create a collective private and public key pair shared among participants. This is done through a -of- Distributed Key Generation (DKG) process and results in each participant receiving a copy of the collective public key plus a private key share of the collective private key no individual node knows the collective private key. Each private key share can then be used to perform cryptographic threshold computations, such as generating threshold signatures, where at least contributions produced using the individual private key shares are required to successfully finish the collective operation.

A DKG is performed in a fully distributed manner, avoiding any single points of failure. This is an overview of the different sub-components of the drand DKG implementation.

Secret sharing is an important technique many advanced threshold cryptography mechanisms rely on.

Secret sharing allows you to split a secret value into shares 1,, so that can only be reconstructed if a threshold of shares is available.

The SSS scheme is one of the most well-known and widely used secret sharing approaches, and a core component of drand. SSS works over an arbitrary finite field, but a simplistic approach uses the integers modulo , denoted by . Let denote the secret to share.

To share , a dealer first creates a polynomial, ()=0+1++11 with 0= and (random) for =1,,1 and then creates one share for each participant by evaluating () at the integer and setting =(,()).

To recover the secret , collect at least shares, then uniquely reconstruct () using Lagrange interpolation and obtain as =0=(0).

Note that you can use any subset of -of- shares to perform Lagrange interpolation and uniquely determine ; however, having a subset of less than shares does not allow to learn anything about .

SSS scheme assumes that the dealer is honest, but this may not always hold in practice. A Verifiable Secret Sharing (VSS) scheme protects against malicious dealers by enabling participants to verify that their shares are consistent with those dealt to other nodes, ensuring that the shared secret can be correctly reconstructed later.

drand uses Feldmans VSS scheme, an extension of SSS. Let denote a cyclic group of prime order in which computing discrete logarithms is intractable. A cyclic group means there exists a generator, , so that any element can be written as = for some {0,,1}.

In addition to distributing shares of the secret to participants, the dealer also broadcasts commitments to the coefficients of the polynomial () of the form (0,1,,1)=(,1,,1). These commitments enable individual participants, , to verify that their share =(,()) is consistent with respect to the polynomial () by checking that ()=1=0() holds.

The recovery of secret works the same as regular SSS, except that verified to be valid shares are used.

Although VSS schemes protect against a malicious dealer, the dealer still knows the secret. To create a collectively shared secret so no individual node gets any information about it, participants can use a DKG protocol. drand uses Pedersens DKG scheme, which runs instances of Feldmans VSS in parallel and on top of additional verification steps.

Individual participants, , create a (random) secret, , and share it all participants using VSS, sending a share, , to each and broadcasts the list of commitments (,0,,1,,,1) to everyone.

verifies the shares received as prescribed by Feldmans VSS scheme. If receives an invalid share, ,, from , then broadcasts a complaint. must reveal the correct share , or they are considered an invalid dealer.

At the end of the protocol, the final share of is =, for all valid participants , that is, for all s not excluded during the verification phase.

The collective public key associated with the valid shares can be computed as =,0 for all valid s.

Note: Even though the secret created using Pedersens DKG can be biased, it is safe to use for threshold signing as shown by Rabin et al.