Kampa et al. proposed a non-interactive DKG protocol, NI-DKG, in their paper, using ZK proofs to eliminate dispute phases and leveraging blockchain as a coordination layer, simplifying key generation. Kampa等人在论文中提出了一种非交互式DKG协议NI-DKG,通过ZK证明消除争议阶段,利用区块链作为协调层,简化了密钥生成流程。
Notes
NI-DKG uses ZK proofs to ensure contribution correctness, eliminating dispute phases in traditional DKG
Relies on Shamir secret sharing, Feldman commitments, hashed ElGamal, and Chaum-Pedersen proofs
Uses smart-contract blockchains as timed public bulletin boards for non-interactive coordination
Provides EVM-compatible implementation with circuit specs for key generation and threshold decryption
Discusses EVM verifier constraints on public inputs and solutions
On-chain zk-SNARK verification improves trustworthiness and attack resistance
Why does NI-DKG not require commit-reveal? 为什么 NI-DKG 不需要 commit-reveal 两轮?
NI-DKG uses a zk-SNARK to prove consistency of polynomial, commitments, and encrypted shares in one step, compressing commit, reveal, and verification into a single interaction. NI-DKG 用 zk-SNARK 一次性证明多项式、commitment 和加密 shares 的一致性,把 commit、reveal 和验证压缩成一步,避免多轮交互。
Yes. An adversary can adapt inputs after observing others, similar to batch evaluation. However, as long as one honest contribution is random, the final result remains unpredictable. 会。攻击者可以根据他人提交再选择输入,类似 batch evaluation 的自适应输入。但只要存在 honest 随机贡献,最终结果仍不可预测。
What does NI-DKG give up in its threat model? NI-DKG 在 threat model 上放弃了什么?
It drops protection against last-mover bias and allows adaptive choice, so it does not ensure unbiased randomness but still guarantees correctness and key security. 它放弃了对 last-mover bias 的防护,不再限制自适应选择,因此不保证无偏随机性,但仍保证正确性和密钥安全。