arXiv 2602.097072026-02cs.CR

upTPM: Schnorr多签名的无界预处理

upTPM: Unbounded Preprocessing for Schnorr Multi-Signatures on TPM

College of Computing, University Mohammed VI Polytechnic（穆罕默德六世理工大学计算机学院）

Yunusa Simpa Abdulsalam, Mustapha Hedabou

备注：: This version substantially revises the earlier PiTPM design. The protocol and security model were redesigned to remove the earlier dependences and security flaws

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

upTPM通过TPM存储单个32字节密钥实现无界预处理，支持异步补充电量和硬件认证，提升TPM2.0设备的离线签名效率与安全性。

摘要：

基于Schnorr的多签名方案支持离线预处理非随机承诺以减少在线签名至单轮。然而，预处理本质上是有限的：每个预处理的nonce对消耗签名方存储，一旦耗尽，需交互式承诺轮次补充。此限制对TPM 2.0设备尤为严重，其中可用NVRAM通常为6-16 KB且连接性不连续。本文提出upTPM框架，实现无界预处理与常数存储。每个TPM存储单个32字节秘密种子，从中确定性生成无限序列的nonce承诺。承诺在使用前发布给不可信协调器；nonce标量永不离开TPM。我们正式化三个现有方案未提供的属性：(1) 无界确定性预处理与常数存储；(2) 异步承诺补充，允许任一签名方单方面扩展其承诺池；(3) TPM认证承诺，一种硬件背书的完整性和状态绑定机制，增强对主机软件妥协的抵抗力。我们在随机预言模型下，基于离散对数假设和伪随机函数（PRF）安全性和证明EU-CMA安全性，通过TPM硬件状态强制单次使用不变性。我们扩展构造至(t,n)-阈值签名并提供协调器信任、崩溃恢复和性能评估的详细分析。

英文摘要：

Schnorr-based multi-signature schemes support offline preprocessing of nonce commitments to reduce online signing to a single round. However, preprocessing is inherently bounded: each preprocessed nonce pair consumes signer-side storage, and once exhausted, an interactive commitment round is required to refill. This limitation is particularly severe for TPM~2.0 devices, where usable NVRAM is typically 6--16\,KB and connectivity is intermittent. This paper presents upTPM, a framework that achieves unbounded preprocessing with constant signer storage. Each TPM stores a single 32-byte secret seed from which an unlimited sequence of nonce commitments is deterministically derived. Commitments are published to an untrusted coordinator before use; nonce scalars never leave the TPM. We formalize three properties not provided by existing schemes: (1)~unbounded deterministic preprocessing with constant storage; (2)~asynchronous commitment refill, allowing any signer to unilaterally extend its commitment pool; and (3)~TPM-attested commitments, a hardware-backed authenticity and state-binding mechanism that strengthens resistance to host-software compromise. We prove EU-CMA security in the random oracle model under the discrete logarithm assumption and Pseudo Random Function (PRF) security, with a one-time-use invariant enforced by TPM hardware state. We extend the construction to $(t,n)$-threshold signatures and provide a detailed analysis of coordinator trust, crash recovery, and performance evaluations.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。