Paper 2017/552

Fast Secure Two-Party ECDSA Signing

Yehuda Lindell


ECDSA is a standard digital signature schemes that is widely used in TLS, Bitcoin and elsewhere. Unlike other schemes like RSA, Schnorr signatures and more, it is particularly hard to construct efficient threshold signature protocols for ECDSA (and DSA). As a result, the best-known protocols today for secure distributed ECDSA require running heavy zero-knowledge proofs and computing many large-modulus exponentiations for every signing operation. In this paper, we consider the specific case of two parties (and thus no honest majority) and construct a protocol that is approximately two orders of magnitude faster than the previous best. Concretely, our protocol achieves good performance, with a single signing operation for curve P-256 taking approximately 37ms between two standard machine types in Azure (utilizing a single core only). Our protocol is proven secure for sequential composition under standard assumptions using a game-based definition. In addition, we prove security by simulation under a plausible yet non-standard assumption regarding Paillier. We show that partial concurrency (where if one execution aborts then all need to abort) can also be achieved.

Note: In the Journal of Cryptology, 34:44, 2021. This is the full version of the paper at CRYPTO 2017.

Available format(s)
Publication info
A major revision of an IACR publication in CRYPTO 2017
distributed signingECDSADSAsecure computationconcrete efficiency
Contact author(s)
lindell @ biu ac il
2021-10-31: last of 12 revisions
2017-06-08: received
See all versions
Short URL
Creative Commons Attribution


      author = {Yehuda Lindell},
      title = {Fast Secure Two-Party ECDSA Signing},
      howpublished = {Cryptology ePrint Archive, Paper 2017/552},
      year = {2017},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.