This document specifies the signing protocol.
The protocol is split into two phases, a pre-signing phase and a signing phase.

*Note: Due to the complexity of generating presignatures using multiplicative triples, this protocol shifts from the signing formulae stated in [Preliminaries](../preliminaries.md) and computes* $R$ *as in* $R\gets \frac{1}{k}\cdot G$ *and* $s$ *as in* $s \gets k \cdot (H(m) + rx)$*. These formulae do not require changes to be done on the verifier's end*

### Note: the threshold $t = \mathsf{MaxMalicious} + 1$

# Presigning

In this phase, a set of parties $\mathcal{P}_1 \subseteq \mathcal{P}_0$
of size $N_1 \geq t$ wishes to generate a threshold $t' = t$ sharing
of a pre-signature.

The inputs to this phase are:

1) The secret key share $x_i$.
2) The public key $X$ corresponding to the master secret key $x$
3) Two multiplicative (Beaver) triples private shares $(a_i, b_i, c_i)$ and $(k_i, d_i, e_i)$ **generated by the same set of parties $\mathcal{P}_ 0$**
4) Two public triples commitments $(A, B, C)$ and $(K, D, E)$
resp. associated to the (master) Beaver triples $(a, b, c)$ and $(k, d, e)$

*Note: neither* $d_i$ *nor* $C$ *are actually used in the algorithm.*


**Round 1:**

1. Each $P_i$ linearizes their shares, setting:

$$
\begin{aligned}
(k'_i, \_, e_i) &\gets \lambda(\mathcal{P}_1)_i \cdot (k_i, \_ , e_i)\cr
(a'_i, b'_i, c'_i) &\gets \lambda(\mathcal{P}_1)_i \cdot (a_i, b_i, c_i)\cr
x'_i &\gets \lambda(\mathcal{P}_1)_i \cdot x_i\cr
\end{aligned}
$$

2. $\star$ Each $P_i$ sends $e_i$ to every party.
3. $\bullet$ Each $P_i$ waits to receive $e_j$ from each $P_j$.
4. Each $P_i$ sets $e \gets \sum_j e_j$.
5. $\blacktriangle$ Each $P_i$ *asserts* that $e \cdot G = E$.

**Round 2:**

1. Each $P_i$ sets:

$$
\begin{aligned}
&\alpha_i \gets k'_i + a'_i\cr
&\beta_i \gets x'_i + b'_i\cr
\end{aligned}
$$

2. $\star$ Each $P_i$ sends $\alpha_i$ and $\beta_i$ to every party.

3. $\bullet$ Each $P_i$ waits to receive $\alpha_j$ and $\beta_j$ from from every party $P_j$.
4. Each $P_i$ sets $\alpha \gets \sum_j \alpha_j$ and $\beta \gets \sum_j \beta_j$.
5. $\blacktriangle$ Each $P_i$ asserts that:

$$
\begin{aligned}
\alpha \cdot G &= K + A\quad \text{(in fact $\alpha = \sum_j \alpha_j =  \sum_j (k'_i + a'_i) = k + a$)}\cr
\beta \cdot G &= X + B \quad \text{(in fact $\beta = \sum_j \beta_j =  \sum_j (x'_i + b'_i) = x + b$)}
\end{aligned}
$$

6. Each $P_i$ sets: $R \gets \frac{1}{e} \cdot D$. (Recall that Beaver triple $(k,d,e)$ is computed s.t. $e = k\cdot d$ )
7. Each $P_i$ sets $\sigma_i \gets \alpha \cdot x_i - \beta \cdot a_i + c_i$, which is already threshold shared.

**Output:** The presignature $(R, k_i, \sigma_i)$

# Signing
In this phase, a set of parties $\mathcal{P}_2 \subseteq \mathcal{P}_1$
of size $N_2 \geq t$ wishes to generate an ECDSA signature.

The inputs to this phase are:
1) The presignature $(R, k_i, \sigma_i)$
2) The public key $X$
3) A "fresh" public source of entropy $\rho$
4) A tweak $\epsilon$ used during key derivation
5) The message hash $h= H(m)$

**Rerandomization & Key Derivation:**
1. Each $P_i$ derives a randomness $\delta \gets \mathsf{HKDF}(X, \epsilon, h, R, \rho)$
2. Each $P_i$ rerandomizes the following elements:

    * $R  \gets R^\delta$
    * $\sigma_i \gets (\sigma_i + \epsilon \cdot k_i) \cdot \delta^{-1}$
    * $k_i \gets k_i \cdot \delta^{-1}$

**Round 1:**

1. Each $P_i$ linearizes their share of $k$, setting $k_i \gets \lambda(\mathcal{P}_2)_i \cdot k_i$.
2. Each $P_i$ linearizes their share of $\sigma$, setting $\sigma_i \gets \lambda(\mathcal{P}_2)_i \cdot \sigma_i$.
3. Each $P_i$ sets $s_i \gets h \cdot k_i + R_\mathsf{x} \cdot \sigma_i$ where $R_\mathsf{x}$ is the x coordinate of $R$
4. $\star$ Each $P_i$ sends $s_i$ **only to the coordinator**.


**Round 1 (Coordinator):**

5. $\bullet$ The coordinator waits to receive $s_j$ from every party.
6. The coordinator sums the received elements $s \gets \sum_j s_j$.
7. Perform the low-S normalization, i.e. $s \gets -s$ if $s\in\\{\frac{q}{2}..~q-1\\}$
8. $\blacktriangle$ The coordinator asserts that $(R, s)$ is a valid ECDSA signature for $h$.

**Output:** the signature $(R, s)$.

---
>  [click to see the Notation reference](../../network-layer.md#documentation-notation).