Constructing Robust Threshold Signature Schemes: Classical vs. Post-Quantum Approaches
A $(t,n)$-threshold signature scheme distributes a signing key among $n$ participants so that any set of $t$ or more can collaboratively produce a valid signature under a public key, while any set of fewer than $t$ cannot. These schemes fall into three categories: (i) "robust" schemes, which always produce a signature provided at least $t$ parties are honest; (ii) "identifiable-abort (IA)" schemes, which may fail to produce a signature but identify at least one misbehaving signer; and (iii) "simple" schemes, which guarantee neither robustness nor identifiable abort.In this talk, I will first review threshold signature schemes and these robustness notions. I will then discuss FORST as a practical IA threshold scheme, and ROAST as a generic technique for compiling IA threshold schemes into robust ones. Finally, I will briefly survey post-quantum lattice-based threshold signature schemes and outline the high-level idea behind a new robust threshold signature construction based on lattice assumptions.

