{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,17]],"date-time":"2026-08-17T15:14:28Z","timestamp":1786979668811,"version":"build-2736575974"},"reference-count":91,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cryptol"],"published-print":{"date-parts":[[2022,4]]},"DOI":"10.1007\/s00145-022-09425-3","type":"journal-article","created":{"date-parts":[[2022,4,13]],"date-time":"2022-04-13T12:03:19Z","timestamp":1649851399000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":38,"title":["Two-Round n-out-of-n and Multi-Signatures and Trapdoor Commitment from Lattices"],"prefix":"10.1007","volume":"35","author":[{"given":"Ivan","family":"Damg\u00e5rd","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Claudio","family":"Orlandi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Akira","family":"Takahashi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mehdi","family":"Tibouchi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,4,13]]},"reference":[{"key":"9425_CR1","doi-asserted-by":"crossref","unstructured":"H.K. Alper, J.\u00a0Burdges, Two-round trip schnorr multi-signatures via delinearized witnesses. in CRYPTO\u00a02021, Part\u00a0I, vol. 12825 of LNCS, Virtual Event, (Springer, Heidelberg, 2021), pp. 157\u2013188","DOI":"10.1007\/978-3-030-84242-0_7"},{"key":"9425_CR2","doi-asserted-by":"crossref","unstructured":"M.\u00a0Abe, S.\u00a0Fehr, Adaptively secure feldman VSS and applications to universally-composable threshold cryptography. in CRYPTO\u00a02004, vol. 3152 of LNCS, (Springer, Heidelberg, 2004), pp. 317\u2013334","DOI":"10.1007\/978-3-540-28628-8_20"},{"issue":"3","key":"9425_CR3","doi-asserted-by":"publisher","first-page":"597","DOI":"10.1007\/s00145-015-9203-7","volume":"29","author":"M Abdalla","year":"2016","unstructured":"M.\u00a0Abdalla, P.-A. Fouque, V.\u00a0Lyubashevsky, M.\u00a0Tibouchi, Tightly secure signatures from lossy identification schemes. Journal of Cryptology, 29(3), 597\u2013631, (2016)","journal-title":"J. Cryptol."},{"key":"9425_CR4","unstructured":"N.\u00a0Bindel, S.\u00a0Akleylek, E.\u00a0Alkim, P.S.L.M. Barreto, J.\u00a0Buchmann, E.\u00a0Eaton, G.\u00a0Gutoski, J.\u00a0Kramer, P.\u00a0Longa, H.\u00a0Polat, J.\u00a0E. Ricardini, G.\u00a0Zanon, qTESLA. Technical report, National Institute of Standards and Technology, 2019. available at https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/round-2-submissions"},{"key":"9425_CR5","doi-asserted-by":"crossref","unstructured":"G.\u00a0Barthe, S.\u00a0Bela\u00efd, T.\u00a0Espitau, P.-A. Fouque, B.\u00a0Gr\u00e9goire, M.\u00a0Rossi, M.\u00a0Tibouchi, Masking the GLP lattice-based signature scheme at any order. in EUROCRYPT\u00a02018, Part\u00a0II, vol. 10821 of LNCS, (Springer, Heidelberg, 2018), pp. 354\u2013384","DOI":"10.1007\/978-3-319-78375-8_12"},{"key":"9425_CR6","doi-asserted-by":"crossref","unstructured":"G.\u00a0Barthe, S.\u00a0Bela\u00efd, T.\u00a0Espitau, P.-A. Fouque, M.\u00a0Rossi, and M.\u00a0Tibouchi, GALACTICS: Gaussian sampling for lattice-based constant- time implementation of cryptographic signatures, revisited. in ACM CCS 2019, (ACM Press, 2019), pp. 2147\u20132164","DOI":"10.1145\/3319535.3363223"},{"key":"9425_CR7","doi-asserted-by":"crossref","unstructured":"A.\u00a0Bagherzandi, J.H. Cheon, S.\u00a0Jarecki, Multisignatures secure under the discrete logarithm assumption and a generalized forking lemma. in ACM CCS 2008, (ACM Press, 2008), pp. 449\u2013458","DOI":"10.1145\/1455770.1455827"},{"key":"9425_CR8","doi-asserted-by":"crossref","unstructured":"F.\u00a0Benhamouda, J.\u00a0Camenisch, S.\u00a0Krenn, V.\u00a0Lyubashevsky, G.\u00a0Neven, Better zero-knowledge proofs for lattice encryption and their application to group signatures. in ASIACRYPT\u00a02014, Part\u00a0I, vol. 8873 of LNCS, (Springer, Heidelberg, 2014), pp. 551\u2013572","DOI":"10.1007\/978-3-662-45611-8_29"},{"key":"9425_CR9","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, W.\u00a0Dai, Chain reductions for multi-signatures and the HBMS scheme. in Advances in Cryptology - ASIACRYPT 2021 - 27th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 6-10, 2021, Proceedings, Part IV, vol. 13093 of Lecture Notes in Computer Science, (Springer, 2021), pp. 650\u2013678","DOI":"10.1007\/978-3-030-92068-5_22"},{"key":"9425_CR10","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, H.\u00a0Davis, F.\u00a0G\u00fcnther. Separate your domains: NIST PQC KEMs, oracle cloning and read-only indifferentiability. in EUROCRYPT\u00a02020, Part\u00a0II, vol. 12106 of LNCS, (Springer, Heidelberg, 2020), pp. 3\u201332","DOI":"10.1007\/978-3-030-45724-2_1"},{"key":"9425_CR11","doi-asserted-by":"crossref","unstructured":"C.\u00a0Baum, I.\u00a0Damg\u00e5rd, V.\u00a0Lyubashevsky, S.\u00a0Oechsner, C.\u00a0Peikert, More efficient commitments from structured lattice assumptions. in SCN 18, vol. 11035 of LNCS, (Springer, Heidelberg, 2018), pp. 368\u2013385","DOI":"10.1007\/978-3-319-98113-0_20"},{"key":"9425_CR12","doi-asserted-by":"crossref","unstructured":"D.\u00a0Boneh, R.\u00a0Gennaro, S.\u00a0Goldfeder, A.\u00a0Jain, S.\u00a0Kim, P.\u00a0M.\u00a0R. Rasmussen, A.\u00a0Sahai, Threshold cryptosystems from threshold fully homomorphic encryption. in CRYPTO\u00a02018, Part\u00a0I, vol. 10991 of LNCS, (Springer, Heidelberg, 2018), pp. 565\u2013596","DOI":"10.1007\/978-3-319-96884-1_19"},{"key":"9425_CR13","doi-asserted-by":"crossref","unstructured":"F.\u00a0Benhamouda, S.\u00a0Krenn, V.\u00a0Lyubashevsky, K.\u00a0Pietrzak, Efficient zero-knowledge proofs for commitments from learning with errors over rings. In ESORICS\u00a02015, Part\u00a0I, vol. 9326 of LNCS, (Springer, Heidelberg, 2015), pp. 305\u2013325","DOI":"10.1007\/978-3-319-24174-6_16"},{"key":"9425_CR14","doi-asserted-by":"crossref","unstructured":"R.\u00a0Bendlin, S.\u00a0Krehbiel, C.\u00a0Peikert, How to share a lattice trapdoor: Threshold protocols for signatures and (H)IBE. in ACNS 13, vol. 7954 of LNCS, (Springer, Heidelberg, 2013), pp. 218\u2013236","DOI":"10.1007\/978-3-642-38980-1_14"},{"key":"9425_CR15","doi-asserted-by":"crossref","unstructured":"J.\u00a0Bootle, V.\u00a0Lyubashevsky, G.\u00a0Seiler, Algebraic techniques for short(er) exact lattice-based zero-knowledge proofs. in CRYPTO\u00a02019, Part\u00a0I, vol. 11692 of LNCS, (Springer, Heidelberg, 2019), pp. 176\u2013202","DOI":"10.1007\/978-3-030-26948-7_7"},{"key":"9425_CR16","doi-asserted-by":"crossref","unstructured":"M.\u00a0Bellare, G.\u00a0Neven, Multi-signatures in the plain public-key model and a general forking lemma. in ACM CCS 2006, (ACM Press, 2006), pp. 390\u2013399","DOI":"10.1145\/1180405.1180453"},{"key":"9425_CR17","unstructured":"K.\u00a0Boudgoust, A.\u00a0Roux-Langlois, Compressed linear aggregate signatures based on module lattices. IACR Cryptol. ePrint Arch., p. 263, 2021"},{"key":"9425_CR18","doi-asserted-by":"crossref","unstructured":"S.\u00a0Bettaieb, J.\u00a0Schrek, Improved lattice-based threshold ring signature scheme. in Post-Quantum Cryptography - 5th International Workshop, PQCrypto 2013, (Springer, Heidelberg, 2013), pp. 34\u201351","DOI":"10.1007\/978-3-642-38616-9_3"},{"key":"9425_CR19","doi-asserted-by":"crossref","unstructured":"G.\u00a0Castagnos, D.\u00a0Catalano, F.\u00a0Laguillaumie, F.\u00a0Savasta, I.\u00a0Tucker. Two-party ECDSA from hash proof systems and efficient instantiations. in CRYPTO\u00a02019, Part\u00a0III, vol. 11694 of LNCS, (Springer, Heidelberg, 2019), pp. 191\u2013221","DOI":"10.1007\/978-3-030-26954-8_7"},{"key":"9425_CR20","doi-asserted-by":"crossref","unstructured":"G.\u00a0Castagnos, D.\u00a0Catalano, F.\u00a0Laguillaumie, F.\u00a0Savasta, I.\u00a0Tucker. Bandwidth-efficient threshold EC-DSA. in PKC\u00a02020, Part\u00a0II, vol. 12111 of LNCS, (Springer, Heidelberg, 2020), pp. 266\u2013296","DOI":"10.1007\/978-3-030-45388-6_10"},{"key":"9425_CR21","doi-asserted-by":"crossref","unstructured":"R.\u00a0Canetti, R.\u00a0Gennaro, S.\u00a0Goldfeder, N.\u00a0Makriyannis, U.\u00a0Peled, UC non-interactive, proactive, threshold ECDSA with identifiable aborts. In ACM CCS 2020, (ACM Press, 2020), pp. 1769\u20131787","DOI":"10.1145\/3372297.3423367"},{"key":"9425_CR22","doi-asserted-by":"crossref","unstructured":"D.\u00a0Cash, D.\u00a0Hofheinz, E.\u00a0Kiltz, C.\u00a0Peikert, Bonsai trees, or how to delegate a lattice basis. in EUROCRYPT\u00a02010, vol. 6110 of LNCS, (Springer, Heidelberg, 2010), pp. 523\u2013552","DOI":"10.1007\/978-3-642-13190-5_27"},{"key":"9425_CR23","unstructured":"R.\u00a0Choi, K.\u00a0Kim, Lattice-based multi-signature with linear homomorphism. in 2016 Symposium on Cryptography and Information Security (SCIS 2016), 2016"},{"key":"9425_CR24","doi-asserted-by":"crossref","unstructured":"P.\u00a0Cayrel, R.\u00a0Lindner, M.\u00a0R\u00fcckert, R.\u00a0Silva, A lattice-based threshold ring signature scheme. in LATINCRYPT 2010, vol. 6212 of LNCS, (Springer, 2010), pp. 255\u2013272","DOI":"10.1007\/978-3-642-14712-8_16"},{"key":"9425_CR25","doi-asserted-by":"crossref","unstructured":"M.\u00a0Ciampi, R.\u00a0Ostrovsky, L.\u00a0Siniscalchi, I.\u00a0Visconti, Delayed-input non-malleable zero knowledge and multi-party coin tossing in four rounds. in TCC\u00a02017, Part\u00a0I, vol. 10677 of LNCS, (Springer, Heidelberg, 2017), pp. 711\u2013742","DOI":"10.1007\/978-3-319-70500-2_24"},{"key":"9425_CR26","doi-asserted-by":"crossref","unstructured":"M.\u00a0Ciampi, R.\u00a0Ostrovsky, L.\u00a0Siniscalchi, I.\u00a0Visconti, Four-round concurrent non-malleable commitments from one-way functions. in CRYPTO\u00a02017, Part\u00a0II, vol. 10402 of LNCS, (Springer, Heidelberg, 2017), pp. 127\u2013157","DOI":"10.1007\/978-3-319-63715-0_5"},{"key":"9425_CR27","doi-asserted-by":"crossref","unstructured":"M.\u00a0Ciampi, G.\u00a0Persiano, A.\u00a0Scafuro, L.\u00a0Siniscalchi, I.\u00a0Visconti, Improved OR-composition of sigma-protocols. in TCC\u00a02016-A, Part\u00a0II, vol. 9563 of LNCS, (Springer, Heidelberg, 2016), pp. 112\u2013141","DOI":"10.1007\/978-3-662-49099-0_5"},{"key":"9425_CR28","doi-asserted-by":"crossref","unstructured":"D.\u00a0Cozzo, N.\u00a0P. Smart, Sharing the LUOV: Threshold post-quantum signatures. in 17th IMA International Conference on Cryptography and Coding, vol. 11929 of LNCS, (Springer, Heidelberg, 2019), pp. 128\u2013153","DOI":"10.1007\/978-3-030-35199-1_7"},{"key":"9425_CR29","doi-asserted-by":"crossref","unstructured":"I.\u00a0Damg\u00e5rd, Efficient concurrent zero-knowledge in the auxiliary string model. in EUROCRYPT\u00a02000, vol. 1807 of LNCS, (Springer, Heidelberg, 2000), pp. 418\u2013430","DOI":"10.1007\/3-540-45539-6_30"},{"key":"9425_CR30","doi-asserted-by":"crossref","unstructured":"L.\u00a0Ducas, A.\u00a0Durmus, T.\u00a0Lepoint, V.\u00a0Lyubashevsky, Lattice signatures and bimodal Gaussians. in CRYPTO\u00a02013, Part\u00a0I, vol. 8042 of LNCS, (Springer, Heidelberg, 2013), pp. 40\u201356","DOI":"10.1007\/978-3-642-40041-4_3"},{"key":"9425_CR31","doi-asserted-by":"crossref","unstructured":"M.\u00a0Drijvers, K.\u00a0Edalatnejad, B.\u00a0Ford, E.\u00a0Kiltz, J.\u00a0Loss, G.\u00a0Neven, I.\u00a0Stepanovs. On the security of two-round multi-signatures. in 2019 IEEE Symposium on Security and Privacy, (IEEE Computer Society Press, 2019), pp. 1084\u20131101","DOI":"10.1109\/SP.2019.00050"},{"key":"9425_CR32","unstructured":"Y.\u00a0Dor\u00f6z, J.\u00a0Hoffstein, J.H. Silverman, B.\u00a0Sunar, Mmsat: A scheme for multimessage multiuser signature aggregation. Cryptology ePrint Archive, Report 2020\/520, 2020. https:\/\/eprint.iacr.org\/2020\/520"},{"key":"9425_CR33","doi-asserted-by":"crossref","unstructured":"I.\u00a0Damg\u00e5rd, T.P. Jakobsen, J.B. Nielsen, J.I. Pagter, M.B. \u00d8stergaard, Fast threshold ECDSA with honest majority. In SCN 20, vol. 12238 of LNCS, (Springer, Heidelberg, 2020), pp. 382\u2013400","DOI":"10.1007\/978-3-030-57990-6_19"},{"key":"9425_CR34","doi-asserted-by":"crossref","unstructured":"J.\u00a0Doerner, Y.\u00a0Kondi, E.\u00a0Lee, a.\u00a0shelat. Secure two-party threshold ECDSA from ECDSA assumptions. in 2018 IEEE Symposium on Security and Privacy, (IEEE Computer Society Press, 2018), pp. 980\u2013997","DOI":"10.1109\/SP.2018.00036"},{"key":"9425_CR35","doi-asserted-by":"crossref","unstructured":"J.\u00a0Doerner, Y.\u00a0Kondi, E.\u00a0Lee, a.\u00a0shelat, Threshold ECDSA from ECDSA assumptions: The multiparty case. in 2019 IEEE Symposium on Security and Privacy, (IEEE Computer Society Press, 2019), pp. 1051\u20131066","DOI":"10.1109\/SP.2019.00024"},{"key":"9425_CR36","unstructured":"L.\u00a0Ducas, T.\u00a0Lepoint, V.\u00a0Lyubashevsky, P.\u00a0Schwabe, G.\u00a0Seiler, D.\u00a0Stehl\u00e9. Crystals\u2013dilithium: Digital signatures from module lattices. 2018, https:\/\/repository.ubn.ru.nl\/bitstream\/handle\/2066\/191703\/191703.pdf"},{"key":"9425_CR37","doi-asserted-by":"crossref","unstructured":"R.\u00a0del Pino, V.\u00a0Lyubashevsky, G.\u00a0Seiler. Lattice-based group signatures and zero-knowledge proofs of automorphism stability. In ACM CCS 2018, (ACM Press, 2018), pp. 574\u2013591","DOI":"10.1145\/3243734.3243852"},{"key":"9425_CR38","doi-asserted-by":"crossref","unstructured":"L.\u00a0Ducas, D.\u00a0Micciancio, Improved short lattice signatures in the standard model. in CRYPTO\u00a02014, Part\u00a0I, vol. 8616 of LNCS, (Springer, Heidelberg, 2014), pp. 335\u2013352","DOI":"10.1007\/978-3-662-44371-2_19"},{"key":"9425_CR39","doi-asserted-by":"crossref","unstructured":"A.P.K. Dalskov, C. Orlandi, M. Keller, K. Shrishak, H.\u00a0Shulman, Securing DNSSEC keys via threshold ECDSA from generic MPC. in ESORICS\u00a02020, Part\u00a0II, vol. 12309 of LNCS, (Springer, Heidelberg, 2020), pp. 654\u2013673","DOI":"10.1007\/978-3-030-59013-0_32"},{"key":"9425_CR40","doi-asserted-by":"crossref","unstructured":"M.F. Esgin, O.\u00a0Ersoy, Z.\u00a0Erkin, Post-quantum adaptor signatures and payment channel networks. in ESORICS\u00a02020, Part\u00a0II, vol. 12309 of LNCS, (Springer, Heidelberg, 2020), pp. 378\u2013397","DOI":"10.1007\/978-3-030-59013-0_19"},{"key":"9425_CR41","doi-asserted-by":"crossref","unstructured":"R.\u00a0El Bansarkhani, J.\u00a0Sturm, An efficient lattice-based multisignature scheme with applications to bitcoins. in CANS 16, vol. 10052 of LNCS, (Springer, Heidelberg, 2016), pp. 140\u2013155","DOI":"10.1007\/978-3-319-48965-0_9"},{"key":"9425_CR42","doi-asserted-by":"crossref","unstructured":"M.F. Esgin, R.\u00a0Steinfeld, J.K. Liu, D.\u00a0Liu, Lattice-based zero-knowledge proofs: New techniques for shorter and faster constructions and applications. in CRYPTO\u00a02019, Part\u00a0I, vol. 11692 of LNCS, (Springer, Heidelberg, 2019), pp. 115\u2013146","DOI":"10.1007\/978-3-030-26948-7_5"},{"key":"9425_CR43","doi-asserted-by":"crossref","unstructured":"M.\u00a0F. Esgin, R.\u00a0Steinfeld, A.\u00a0Sakzad, J.\u00a0K. Liu, D.\u00a0Liu, Short lattice-based one-out-of-many proofs and applications to ring signatures. In ACNS 19, vol. 11464 of LNCS, (Springer, Heidelberg, 2019), pp. 67\u201388","DOI":"10.1007\/978-3-030-21568-2_4"},{"key":"9425_CR44","doi-asserted-by":"crossref","unstructured":"M.\u00a0Fukumitsu, S.\u00a0Hasegawa. A tightly-secure lattice-based multisignature. in APKC@AsiaCCS 2019, (ACM, 2019), pp. 3\u201311","DOI":"10.1145\/3327958.3329542"},{"key":"9425_CR45","doi-asserted-by":"crossref","unstructured":"M.\u00a0Fukumitsu, S.\u00a0Hasegawa, A lattice-based provably secure multisignature scheme in quantum random oracle model. in ProvSec 2020, vol. 12505 of LNCS, (Springer, Heidelberg, 2020), pp. 45\u201364","DOI":"10.1007\/978-3-030-62576-4_3"},{"key":"9425_CR46","doi-asserted-by":"crossref","unstructured":"R.\u00a0Gennaro, S.\u00a0Goldfeder, Fast multiparty threshold ECDSA with fast trustless setup. in ACM CCS 2018, (ACM Press, 2018), pp. 1179\u20131194","DOI":"10.1145\/3243734.3243859"},{"key":"9425_CR47","unstructured":"R.\u00a0Gennaro, S.\u00a0Goldfeder, One round threshold ecdsa with identifiable abort. Cryptology ePrint Archive, Report 2020\/540, 2020. https:\/\/eprint.iacr.org\/2020\/540"},{"key":"9425_CR48","doi-asserted-by":"crossref","unstructured":"R.\u00a0Gennaro, S.\u00a0Goldfeder, A.\u00a0Narayanan, Threshold-optimal DSA\/ECDSA signatures and an application to bitcoin wallet security. in ACNS 16, vol. 9696 of LNCS, (Springer, Heidelberg, 2016), pp. 156\u2013174","DOI":"10.1007\/978-3-319-39555-5_9"},{"issue":"1","key":"9425_CR49","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1007\/s00145-006-0347-3","volume":"20","author":"R Gennaro","year":"2007","unstructured":"R.\u00a0Gennaro, S.\u00a0Jarecki, H.\u00a0Krawczyk, T.\u00a0Rabin, Secure distributed key generation for discrete-log based cryptosystems. Journal of Cryptology, 20(1), 51\u201383, (2007).","journal-title":"J. Cryptol."},{"key":"9425_CR50","unstructured":"A.\u00a0Gagol, J.\u00a0Kula, D.\u00a0Straszak, M.\u00a0Swietek, Threshold ecdsa for decentralized asset custody. Cryptology ePrint Archive, Report 2020\/498, (2020). https:\/\/eprint.iacr.org\/2020\/498"},{"key":"9425_CR51","doi-asserted-by":"crossref","unstructured":"T.\u00a0G\u00fcneysu, V.\u00a0Lyubashevsky, T.\u00a0P\u00f6ppelmann, Practical lattice-based cryptography: A signature scheme for embedded systems. in CHES\u00a02012, vol. 7428 of LNCS, (Springer, Heidelberg, 2012), pp. 530\u2013547","DOI":"10.1007\/978-3-642-33027-8_31"},{"key":"9425_CR52","doi-asserted-by":"crossref","unstructured":"N.\u00a0Genise, D.\u00a0Micciancio, Faster Gaussian sampling for trapdoor lattices with arbitrary modulus. in EUROCRYPT\u00a02018, Part\u00a0I, vol. 10820 of LNCS, (Springer, Heidelberg, 2018), pp. 174\u2013203","DOI":"10.1007\/978-3-319-78381-9_7"},{"key":"9425_CR53","doi-asserted-by":"crossref","unstructured":"C.\u00a0Gentry, C.\u00a0Peikert, V.\u00a0Vaikuntanathan, Trapdoors for hard lattices and new cryptographic constructions. in 40th ACM STOC, (ACM Press, 2008), pp. 197\u2013206","DOI":"10.1145\/1374376.1374407"},{"key":"9425_CR54","doi-asserted-by":"crossref","unstructured":"C.\u00a0Gentry, A.\u00a0Sahai, B.\u00a0Waters, Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster, attribute-based. in CRYPTO\u00a02013, Part\u00a0I, vol. 8042 of LNCS, (Springer, Heidelberg, 2013), pp. 75\u201392","DOI":"10.1007\/978-3-642-40041-4_5"},{"key":"9425_CR55","doi-asserted-by":"crossref","unstructured":"S.\u00a0Gorbunov, V.\u00a0Vaikuntanathan, D.\u00a0Wichs, Leveled fully homomorphic signatures from standard lattices. in 47th ACM STOC, (ACM Press, 2015), pp. 469\u2013477","DOI":"10.1145\/2746539.2746576"},{"key":"9425_CR56","doi-asserted-by":"crossref","unstructured":"N.\u00a0Howgrave-Graham, A.\u00a0Joux, New generic algorithms for hard knapsacks. in EUROCRYPT\u00a02010, vol. 6110 of LNCS, (Springer, Heidelberg, 2010), pp. 235\u2013256","DOI":"10.1007\/978-3-642-13190-5_12"},{"key":"9425_CR57","doi-asserted-by":"crossref","unstructured":"M.\u00a0Kansal, R.\u00a0Dutta, Round optimal secure multisignature schemes from lattice with public key aggregation and signature compression. In AFRICACRYPT 20, vol. 12174 of LNCS, (Springer, Heidelberg, 2020), pp. 281\u2013300","DOI":"10.1007\/978-3-030-51938-4_14"},{"key":"9425_CR58","doi-asserted-by":"crossref","unstructured":"C.\u00a0Komlo, I.\u00a0Goldberg, FROST: flexible round-optimized schnorr threshold signatures. in Selected Areas in Cryptography - SAC 2020 - 27th International Conference, Halifax, NS, Canada (Virtual Event), October 21-23, 2020, Revised Selected Papers, vol. 12804 of Lecture Notes in Computer Science, (Springer, 2020), pp. 34\u201365","DOI":"10.1007\/978-3-030-81652-0_2"},{"key":"9425_CR59","doi-asserted-by":"crossref","unstructured":"E.\u00a0Kiltz, V.\u00a0Lyubashevsky, C.\u00a0Schaffner, A concrete treatment of Fiat-Shamir signatures in the quantum random-oracle model. in EUROCRYPT\u00a02018, Part\u00a0III, vol. 10822 of LNCS, (Springer, Heidelberg, 2018), pp. 552\u2013586","DOI":"10.1007\/978-3-319-78372-7_18"},{"key":"9425_CR60","unstructured":"V.\u00a0Lyubashevsky, L.\u00a0Ducas, E.\u00a0Kiltz, T.\u00a0Lepoint, P.\u00a0Schwabe, G.\u00a0Seiler, D.\u00a0Stehl\u00e9, CRYSTALS-DILITHIUM. Technical report, National Institute of Standards and Technology, 2019. available at https:\/\/csrc.nist.gov\/projects\/post-quantum-cryptography\/round-2-submissions."},{"key":"9425_CR61","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Lindell, Fast secure two-party ECDSA signing. in CRYPTO\u00a02017, Part\u00a0II, vol. 10402 of LNCS, (Springer, Heidelberg, 2017), pp. 613\u2013644","DOI":"10.1007\/978-3-319-63715-0_21"},{"key":"9425_CR62","doi-asserted-by":"crossref","unstructured":"Y.\u00a0Lindell, A.\u00a0Nof, Fast secure multiparty ECDSA with practical distributed key generation and applications to cryptocurrency custody. in ACM CCS 2018, (ACM Press, 2018), pp. 1837\u20131854","DOI":"10.1145\/3243734.3243788"},{"key":"9425_CR63","doi-asserted-by":"crossref","unstructured":"B.\u00a0Libert, K.\u00a0Nguyen, B.H.M. Tan, H.\u00a0Wang, Zero-knowledge elementary databases with more expressive queries. in PKC\u00a02019, Part\u00a0I, vol. 11442 of LNCS, (Springer, Heidelberg, 2019), pp. 255\u2013285","DOI":"10.1007\/978-3-030-17253-4_9"},{"key":"9425_CR64","doi-asserted-by":"crossref","unstructured":"V.\u00a0Lyubashevsky, C.\u00a0Peikert, O.\u00a0Regev, A toolkit for ring-LWE cryptography. in EUROCRYPT\u00a02013, vol. 7881 of LNCS, (Springer, Heidelberg, 2013), pp. 35\u201354","DOI":"10.1007\/978-3-642-38348-9_3"},{"key":"9425_CR65","doi-asserted-by":"crossref","unstructured":"V.\u00a0Lyubashevsky, G.\u00a0Seiler, Short, invertible elements in partially splitting cyclotomic rings and applications to lattice-based zero-knowledge proofs. in EUROCRYPT\u00a02018, Part\u00a0I, vol. 10820 of LNCS, (Springer, Heidelberg, 2018), pp. 204\u2013224","DOI":"10.1007\/978-3-319-78381-9_8"},{"key":"9425_CR66","unstructured":"Z.-Y. Liu, Y.-F. Tseng, R.\u00a0Tso, Cryptanalysis of a round optimal lattice-based multisignature scheme. Cryptology ePrint Archive, Report 2020\/1172, 2020. https:\/\/eprint.iacr.org\/2020\/1172"},{"key":"9425_CR67","doi-asserted-by":"crossref","unstructured":"V.\u00a0Lyubashevsky, Fiat-Shamir with aborts: Applications to lattice and factoring-based signatures. in ASIACRYPT\u00a02009, vol. 5912 of LNCS, (Springer, Heidelberg, 2009), pp. 598\u2013616","DOI":"10.1007\/978-3-642-10366-7_35"},{"key":"9425_CR68","doi-asserted-by":"crossref","unstructured":"V.\u00a0Lyubashevsky, Lattice signatures without trapdoors. in EUROCRYPT\u00a02012, vol. 7237 of LNCS, (Springer, Heidelberg, 2012), pp. 738\u2013755","DOI":"10.1007\/978-3-642-29011-4_43"},{"key":"9425_CR69","unstructured":"V.\u00a0Lyubashevsky, Lattice-based zero-knowledge and applications. CIS 2019, 2019. https:\/\/crypto.sjtu.edu.cn\/cis2019\/slides\/Vadim.pdf"},{"key":"9425_CR70","doi-asserted-by":"publisher","first-page":"179765","DOI":"10.1109\/ACCESS.2019.2958816","volume":"7","author":"C Ma","year":"2019","unstructured":"C.\u00a0Ma, M.\u00a0Jiang, Practical lattice-based multisignature schemes for blockchains. IEEE Access, 7, 179765\u2013179778, (2019)","journal-title":"IEEE Access"},{"key":"9425_CR71","doi-asserted-by":"crossref","unstructured":"S.\u00a0Micali, K.\u00a0Ohta, L.\u00a0Reyzin, Accountable-subgroup multisignatures: Extended abstract. in ACM CCS 2001, (ACM Press, 2001), pp. 245\u2013254","DOI":"10.1145\/501983.502017"},{"key":"9425_CR72","doi-asserted-by":"crossref","unstructured":"D.\u00a0Micciancio, C.\u00a0Peikert, Trapdoors for lattices: Simpler, tighter, faster, smaller. in EUROCRYPT\u00a02012, vol. 7237 of LNCS, (Springer, Heidelberg, 2012), pp. 700\u2013718","DOI":"10.1007\/978-3-642-29011-4_41"},{"key":"9425_CR73","doi-asserted-by":"crossref","unstructured":"D.\u00a0Micciancio, C.\u00a0Peikert, Hardness of SIS and LWE with small parameters. in CRYPTO\u00a02013, Part\u00a0I, vol. 8042 of LNCS, (Springer, Heidelberg, 2013), pp. 21\u201339","DOI":"10.1007\/978-3-642-40041-4_2"},{"issue":"9","key":"9425_CR74","doi-asserted-by":"publisher","first-page":"2139","DOI":"10.1007\/s10623-019-00608-x","volume":"87","author":"G Maxwell","year":"2019","unstructured":"G.\u00a0Maxwell, A.\u00a0Poelstra, Y.\u00a0Seurin, P.\u00a0Wuille, Simple schnorr multi-signatures with applications to bitcoin. Des. Codes Cryptogr., 87(9), 2139\u20132164, (2019)","journal-title":"Des. Codes Cryptogr."},{"issue":"2","key":"9425_CR75","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1007\/s10623-009-9313-z","volume":"54","author":"C Ma","year":"2010","unstructured":"C.\u00a0Ma, J.\u00a0Weng, Y.\u00a0Li, R.H. Deng, Efficient discrete logarithm based multi-signature scheme in the plain public key model. Des. Codes Cryptogr., 54(2), 121\u2013133, (2010)","journal-title":"Des. Codes Cryptogr."},{"key":"9425_CR76","doi-asserted-by":"crossref","unstructured":"N.K. Nguyen, On the non-existence of short vectors in random module lattices. in ASIACRYPT\u00a02019, Part\u00a0II, vol. 11922 of LNCS, (Springer, Heidelberg, 2019), pp. 121\u2013150","DOI":"10.1007\/978-3-030-34621-8_5"},{"key":"9425_CR77","unstructured":"A.\u00a0Nicolosi, M.N. Krohn, Y.\u00a0Dodis, D.\u00a0Mazi\u00e8res, Proactive two-party signatures for user authentication. in NDSS\u00a02003. (The Internet Society, 2003)"},{"key":"9425_CR78","doi-asserted-by":"crossref","unstructured":"J.\u00a0Nick, T.\u00a0Ruffing, Y.\u00a0Seurin, MuSig2: Simple two-round Schnorr multi-signatures. in CRYPTO\u00a02021, Part\u00a0I, vol. 12825 of LNCS, (Virtual Event, 2021. Springer, Heidelberg), pp. 189\u2013221","DOI":"10.1007\/978-3-030-84242-0_8"},{"key":"9425_CR79","doi-asserted-by":"crossref","unstructured":"J.\u00a0Nick, T.\u00a0Ruffing, Y.\u00a0Seurin, P.\u00a0Wuille, MuSig-DN: Schnorr multi-signatures with verifiably deterministic nonces. in ACM CCS 2020, (ACM Press, 2020), pp. 1717\u20131731","DOI":"10.1145\/3372297.3417236"},{"key":"9425_CR80","doi-asserted-by":"crossref","unstructured":"R.\u00a0Pass, On deniability in the common reference string and random oracle model. in CRYPTO\u00a02003, vol. 2729 of LNCS, (Springer, Heidelberg, 2003), pp. 316\u2013337","DOI":"10.1007\/978-3-540-45146-4_19"},{"key":"9425_CR81","doi-asserted-by":"crossref","unstructured":"T.P. Pedersen, Non-interactive and information-theoretic secure verifiable secret sharing. in CRYPTO\u201991, vol. 576 of LNCS, (Springer, Heidelberg, 1992), pp. 129\u2013140","DOI":"10.1007\/3-540-46766-1_9"},{"key":"9425_CR82","doi-asserted-by":"crossref","unstructured":"C.\u00a0Peikert, An efficient and parallel Gaussian sampler for lattices. in CRYPTO\u00a02010, vol. 6223 of LNCS, (Springer, Heidelberg, 2010), pp. 80\u201397","DOI":"10.1007\/978-3-642-14623-7_5"},{"issue":"3","key":"9425_CR83","doi-asserted-by":"publisher","first-page":"361","DOI":"10.1007\/s001450010003","volume":"13","author":"D Pointcheval","year":"2000","unstructured":"D.\u00a0Pointcheval, J.\u00a0Stern, Security arguments for digital signatures and blind signatures. Journal of Cryptology, 13(3), 361\u2013396, (2000)","journal-title":"J. Cryptol."},{"key":"9425_CR84","doi-asserted-by":"crossref","unstructured":"C.-P. Schnorr, Efficient identification and signatures for smart cards. in CRYPTO\u201989, vol. 435 of LNCS, (Springer, Heidelberg, 1990), pp. 239\u2013252","DOI":"10.1007\/0-387-34805-0_22"},{"key":"9425_CR85","doi-asserted-by":"crossref","unstructured":"D.R. Stinson, R.\u00a0Strobl, Provably secure distributed Schnorr signatures and a $$(t, n)$$ threshold scheme for implicit certificates. in ACISP 01, vol. 2119 of LNCS, (Springer, Heidelberg, 2001), pp. 417\u2013434","DOI":"10.1007\/3-540-47719-5_33"},{"key":"9425_CR86","doi-asserted-by":"crossref","unstructured":"E.\u00a0Syta, I.\u00a0Tamas, D.\u00a0Visher, D.I. Wolinsky, P.\u00a0Jovanovic, L.\u00a0Gasser, N.\u00a0Gailly, I.\u00a0Khoffi, B.\u00a0Ford, Keeping authorities \u201chonest or bust\u201d with decentralized witness cosigning. in 2016 IEEE Symposium on Security and Privacy, (IEEE Computer Society Press, 2016), pp. 526\u2013545","DOI":"10.1109\/SP.2016.38"},{"key":"9425_CR87","unstructured":"R.\u00a0Toluee, T.\u00a0Eghlidos, An efficient and secure ID-based multi-proxy multi-signature scheme based on lattice. Cryptology ePrint Archive, Report 2019\/1031, 2019. https:\/\/eprint.iacr.org\/2019\/1031"},{"key":"9425_CR88","doi-asserted-by":"publisher","first-page":"182916","DOI":"10.1109\/ACCESS.2019.2959943","volume":"7","author":"R Tso","year":"2019","unstructured":"R.\u00a0Tso, Z.\u00a0Liu, Y.\u00a0Tseng, Identity-based blind multisignature from lattices. IEEE Access, 7, 182916\u2013182923, (2019)","journal-title":"IEEE Access"},{"key":"9425_CR89","unstructured":"W.A. Torres, R.\u00a0Steinfeld, A.\u00a0Sakzad, V.\u00a0Kuchta, Post-quantum linkable ring signature enabling distributed authorised ring confidential transactions in blockchain. Cryptology ePrint Archive, Report 2020\/1121, 2020. https:\/\/eprint.iacr.org\/2020\/1121"},{"key":"9425_CR90","doi-asserted-by":"crossref","unstructured":"D.\u00a0Wagner, A generalized birthday problem. in CRYPTO\u00a02002, vol. 2442 of LNCS, (Springer, Heidelberg, 2002), pp. 288\u2013303","DOI":"10.1007\/3-540-45708-9_19"},{"key":"9425_CR91","doi-asserted-by":"crossref","unstructured":"R.\u00a0Yang, M.\u00a0H. Au, Z.\u00a0Zhang, Q.\u00a0Xu, Z.\u00a0Yu, W.\u00a0Whyte, Efficient lattice-based zero-knowledge arguments with standard soundness: Construction and applications. in CRYPTO\u00a02019, Part\u00a0I, vol. 11692 of LNCS, (Springer, Heidelberg, 2019), pp. 147\u2013175","DOI":"10.1007\/978-3-030-26948-7_6"}],"container-title":["Journal of Cryptology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-022-09425-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00145-022-09425-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-022-09425-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,25]],"date-time":"2022-04-25T14:08:19Z","timestamp":1650895699000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00145-022-09425-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4]]},"references-count":91,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2022,4]]}},"alternative-id":["9425"],"URL":"https:\/\/doi.org\/10.1007\/s00145-022-09425-3","relation":{},"ISSN":["0933-2790","1432-1378"],"issn-type":[{"value":"0933-2790","type":"print"},{"value":"1432-1378","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4]]},"assertion":[{"value":"18 October 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 March 2022","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 March 2022","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 April 2022","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"14"}}