Quote from: Crowex on March 05, 2014, 03:29:52 AM

Quote from: gmaxwell on March 04, 2014, 11:58:12 PM

If your system was not anonymous but had predefined membership then you could have a distributed secret but there is no known way to do an ECDSA threshold signature directly.

http://oleganza.com/blind-ecdsa-draft-v2.pdf

I know you commented on the original proposal of this but it was changed by the author and, as far as I can see, it now works. I just thought I'd link to it because I thought it was a clever idea that got buried in the forum.
In some sense it is a 2 of 2 threshold signature with one of the signatories blinded. However this signature could be performed unblinded and there may be ways to extend it to different threshold schemes.
I don't know if this would be considered as doing an ECDSA threshold signature directly? and there might be problems with the idea that I don't understand but it is an interesting idea.

That's a neat idea, to use oleganza's scheme as a threshold signature. However, you can't simply execute this scheme unblindedly. If the blindsigner knows all of a, b, c and d then he can determine the entire private key and create signatures all on his own. But if he doesn't know all of those, there is no way that he can be sure of what he is signing (or even of the public key that he is signing with). So this is a threshold signature in some sense... but a very unnatural sense.