The Latency Price of Threshold Cryptosystem in Blockchains

TL;DR

This paper investigates the latency costs of threshold cryptosystems in blockchain protocols, proposing mechanisms to eliminate or reduce delays, especially in proof-of-stake systems, with real-world implementation on Aptos showing significant latency improvements.

Contribution

It introduces a mechanism to eliminate latency overhead in blockchain-native threshold cryptosystems with tight thresholds and proposes a method to minimize delay in systems with ramp thresholds, validated on Aptos.

Findings

Latency overhead can be eliminated for tight threshold cryptosystems.

Additional delay is unavoidable for ramp threshold cryptosystems.

Optimistic protocol reduces latency by 71% on Aptos mainnet.

Abstract

Threshold cryptography is essential for many blockchain protocols. For example, many protocols rely on threshold common coin to implement asynchronous consensus, leader elections, and provide support for randomized applications. Similarly, threshold decryption and threshold time-lock puzzles are often necessary for privacy. In this paper, we study the interplay between threshold cryptography and a class of blockchains that use Byzantine-fault tolerant (BFT) consensus protocols with a focus on latency. More specifically, we focus on blockchain-native threshold cryptosystem, where the blockchain validators seek to run a threshold cryptographic protocol once for every block with the block contents as an input to the threshold cryptographic protocol. All existing approaches for blockchain-native threshold cryptosystems introduce a latency overhead of at least one message delay for running the threshold cryptographic protocol. In this paper, we first propose a mechanism to eliminate this overhead for blockchain-native threshold cryptosystems with tight thresholds, i.e., in threshold cryptographic protocols where the secrecy and reconstruction thresholds are the same. However, many real-world proof-of-stake-based blockchain-native threshold cryptosystems rely on ramp thresholds, where reconstruction thresholds are strictly greater than secrecy thresholds. For these blockchains, we formally demonstrate that the additional delay is unavoidable. We then introduce a mechanism to minimize this delay in the optimistic case. We implement our optimistic protocol for the proof-of-stake distributed randomness scheme on the Aptos blockchain. Our measurements from the Aptos mainnet show that the optimistic approach reduces latency overhead by 71%.