Cryptographic Vulnerabilities in Threshold Wallets
summary
Analysis of threshold ECDSA implementations shows concrete attacks on Lindell-style two‑party protocols using Paillier homomorphic encryption and zero-knowledge proofs: a flawed rotation step gives oracle-like signature validity checks that leak bits of the other party’s secret, enabling full key recovery after many rotations. Implementations dropped or misused ZK proofs, used weak Paillier parameters and JavaScript, and required repeated paper revisions; recent optimised builds report multi-party signing in milliseconds but real systems needed protocol fixes or full rekeying to be safe.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:35Outline
- 1:15A Wallet
- 1:37Threshold Signatures
- 3:06Threshold ECDSA
- 5:47ThresholdSig MultiSig?
- 7:09Threshold Wallet - System
- 9:13Focus
- 10:48Lindell 2P-Signing
- 11:07P-Keygen [L17]
- 12:07P-Signing [L17]
- 14:10Paillier CryptoSystem
- 15:22Getting Dirty
- 15:48DO NOT OPTIMIZE #1
- 17:31DO NOT OPTIMIZE #2
- 17:46ZK in MPC
- 18:34#2 DO NOT OPTIMIZE
- 18:58ZK Confusion
- 20:51Work In Progress
- 21:59Bad Ways to Achieve Efficiency
- 23:11Good Ways to Achieve Efficiency
- 24:23Breaking a Threshold Wallet
- 26:032P-Rotation zk-Paillier
- 27:28Breaking 2P-Keygen
- 28:25Mitigation
- 30:42Questions?
related talks
36mSmall Leaks, Billions Of Dollars: Practical Cryptographic Exploits That Undermine Crypto Wallets
01h 06mFrom Theory to Practice - Threshold Cryptography
49mDigital Signatures
39mWhen Is a Proof Actually Not?
27mTSSHOCK: Breaking MPC Wallets and Digital Custodians for $BILLION$ Profit
26mConstant-Time Callees with Variable-Time Callers
01h 05mExplaining the Security of Zcash
41mFault Attacks & Side Channels