Universally Composable DKG with Linear Number of Exponentiations

Until now no distributed discrete-logarithm key generation (DKG) protocol is known to be universally composable. We extend Feldman’s verifiable secret sharing scheme to construct such a protocol. Our result holds for static adversaries corrupting a minority of the parties under the Decision Diffie-Hellman assumption in a weak common random string model in which the simulator does not choose the common random string. Our protocol is optimistic. If all parties behave honestly, each party computes O(3.5k) exponentiations, and otherwise each party computes O(k) exponentiations, where k is the number of parties. In previous constructions each party always computes Ω(k) exponentiations.