REVIEW 2 major objections 2 minor
upTPM: Unbounded Preprocessing for Schnorr Multi-Signatures on TPM
T0 review · 2 major / 2 minor · reviewed 2026-05-16 · grok-4.3
Pith's one-line read A single 32-byte seed on each TPM generates unlimited nonce commitments for Schnorr multi-signatures while keeping all scalars inside the hardware.
desk verdict upTPM shows how to get unbounded nonce preprocessing for Schnorr multisigs on TPMs from one 32-byte seed with deterministic derivation and hardware attestation, which is new and practical, but the proof's handling of all TPM-host interactions is the part that needs checking. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
Deterministic derivation of nonce commitments from a constant-size secret seed combined with TPM hardware state that enforces one-time use of each derived nonce.
What would settle it
A concrete forgery in the EU-CMA game that succeeds after an adversary reuses a published commitment or extracts a nonce scalar from the TPM would falsify the security claim.
Extended reading notes
Core claim
upTPM stores a single 32-byte secret seed on each TPM from which an unlimited sequence of nonce commitments is deterministically derived; commitments are published to the coordinator before use, nonce scalars never leave the TPM, and one-time-use is enforced by TPM hardware state, yielding EU-CMA security under the discrete logarithm assumption and PRF security.
Load-bearing premise
The TPM hardware must correctly maintain state to block nonce reuse and the derivation function must act as a secure PRF.
Editorial extensions
If this is right
- Any signer can unilaterally extend its own commitment pool without an interactive round with other signers.
- The scheme supports (t,n)-threshold signatures while preserving constant storage and unbounded preprocessing.
- Coordinator trust is limited to storing and forwarding commitments because the underlying scalars stay protected inside each TPM.
- Crash recovery and performance remain practical even with intermittent device connectivity.
Reading between the lines
- The same seed-derivation pattern could be applied to other hardware security modules that offer protected state but limited storage.
- Asynchronous refill removes a practical bottleneck for multi-party signing protocols that must operate across unreliable networks.
- Hardware attestation of commitments creates a stronger binding between the published value and the protected seed than software-only methods provide.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper presents upTPM, a framework for unbounded preprocessing in Schnorr multi-signature schemes on TPM 2.0 devices. Each TPM stores a single 32-byte secret seed from which an unlimited sequence of nonce commitments is derived deterministically via a PRF; commitments are published to an untrusted coordinator while nonce scalars remain inside the TPM. The construction claims three new properties: unbounded deterministic preprocessing with constant storage, asynchronous commitment refill, and TPM-attested commitments. It proves EU-CMA security in the random oracle model under the discrete-logarithm and PRF assumptions, with one-time-use enforced by TPM hardware state, and extends the scheme to (t,n)-threshold signatures while analyzing coordinator trust, crash recovery, and performance.
Significance. If the security reduction is valid and the TPM state-machine assumptions hold, the result removes a fundamental storage bound that has limited practical deployment of offline-preprocessed Schnorr multi-signatures on resource-constrained hardware. Constant signer storage and unilateral asynchronous refill would be a meaningful engineering improvement for TPM-based wallets and threshold protocols.
major comments (2)
- [Security Proof] Security Proof section: The EU-CMA reduction treats the one-time-use invariant as an external assumption on TPM hardware state (seed + monotonic counter) but does not explicitly model the full host-TPM command interface. Sequences such as counter reset, counter read without attestation, or attestation bypass are not analyzed; any such sequence would allow a host to force reuse of a previously committed nonce scalar, breaking the discrete-log extraction in the simulator.
- [Threshold Extension] Threshold Extension: The extension to (t,n)-threshold signatures is stated but the security argument is only sketched by reduction to the single-signer case. No separate game sequence or simulator is provided for the threshold setting, leaving open whether the one-time-use invariant and coordinator interactions compose correctly under t-out-of-n corruption.
minor comments (2)
- [Introduction] The abstract and introduction use 'TPM-attested commitments' without a forward reference to the precise TPM command sequence or attestation format used; a short table or figure would clarify the binding.
- [Performance Evaluation] Performance evaluation reports only aggregate timings; per-operation breakdown (seed derivation, commitment generation, attestation) would help readers assess the overhead of the unbounded mechanism.
Simulated Author's Rebuttal
We thank the referee for the constructive feedback on the security proof and threshold extension. We address each major comment below and will revise the manuscript to strengthen the presentation while preserving the core contributions.
read point-by-point responses
-
Referee: [Security Proof] Security Proof section: The EU-CMA reduction treats the one-time-use invariant as an external assumption on TPM hardware state (seed + monotonic counter) but does not explicitly model the full host-TPM command interface. Sequences such as counter reset, counter read without attestation, or attestation bypass are not analyzed; any such sequence would allow a host to force reuse of a previously committed nonce scalar, breaking the discrete-log extraction in the simulator.
Authors: We agree that explicitly modeling the host-TPM command interface would improve clarity. In the revision we will add a dedicated subsection describing the relevant TPM 2.0 commands (e.g., TPM2_GetRandom, TPM2_Hash, TPM2_Quote for attestation, and monotonic counter operations) and formally state the one-time-use invariant as a hardware-enforced property. Under the standard trusted-hardware assumption, any counter reset or attestation bypass requires breaking the TPM's own security guarantees, which lies outside the adversary model; the simulator can therefore safely extract the discrete log when a nonce is reused. We will update the EU-CMA proof to reference this interface explicitly. revision: yes
-
Referee: [Threshold Extension] Threshold Extension: The extension to (t,n)-threshold signatures is stated but the security argument is only sketched by reduction to the single-signer case. No separate game sequence or simulator is provided for the threshold setting, leaving open whether the one-time-use invariant and coordinator interactions compose correctly under t-out-of-n corruption.
Authors: The threshold construction lets each signer independently derive and attest its own commitments using its local TPM, so the one-time-use invariant remains per-signer. In the revision we will supply a full game sequence for the (t,n) setting that reduces directly to the single-signer EU-CMA game. The simulator will handle t-out-of-n corruption by forwarding queries to the single-signer challenger for honest signers while simulating corrupted signers' commitments; coordinator interactions are already modeled as untrusted in the single-signer case and carry over unchanged. A detailed simulator description will be included. revision: yes
Circularity Check
No circularity in derivation chain
full rationale
The paper's core construction derives an unbounded sequence of nonce commitments deterministically from a fixed 32-byte seed via PRF, with commitments published externally and nonce scalars retained inside the TPM. Security is reduced to the discrete logarithm assumption and PRF security in the random oracle model, treating the one-time-use invariant as an explicit hardware assumption rather than deriving it from the scheme itself. No equations or steps reduce by construction to fitted parameters, self-citations, or renamed inputs; the derivation remains independent of the target security claim and relies on standard external primitives.
Assumptions & free parameters
assumptions (3)
- domain assumption Discrete Logarithm assumption
- domain assumption PRF security
- standard math Random Oracle Model
Cite this review
Pith. "Pith review of upTPM: Unbounded Preprocessing for Schnorr Multi-Signatures on TPM." pith.science (2026). https://pith.science/paper/2602.09707
@misc{pith2026260209707,
author = {Pith},
title = {Pith review of: upTPM: Unbounded Preprocessing for Schnorr Multi-Signatures on TPM},
year = {2026},
howpublished = {\url{https://pith.science/paper/2602.09707}},
note = {Machine review of arXiv:2602.09707}
}
abstract
Schnorr-based multi-signature schemes support offline preprocessing of nonce commitments to reduce online signing to a single round. However, preprocessing is inherently bounded: each preprocessed nonce pair consumes signer-side storage, and once exhausted, an interactive commitment round is required to refill. This limitation is particularly severe for TPM~2.0 devices, where usable NVRAM is typically 6--16\,KB and connectivity is intermittent. This paper presents upTPM, a framework that achieves unbounded preprocessing with constant signer storage. Each TPM stores a single 32-byte secret seed from which an unlimited sequence of nonce commitments is deterministically derived. Commitments are published to an untrusted coordinator before use; nonce scalars never leave the TPM. We formalize three properties not provided by existing schemes: (1)~unbounded deterministic preprocessing with constant storage; (2)~asynchronous commitment refill, allowing any signer to unilaterally extend its commitment pool; and (3)~TPM-attested commitments, a hardware-backed authenticity and state-binding mechanism that strengthens resistance to host-software compromise. We prove EU-CMA security in the random oracle model under the discrete logarithm assumption and Pseudo Random Function (PRF) security, with a one-time-use invariant enforced by TPM hardware state. We extend the construction to $(t,n)$-threshold signatures and provide a detailed analysis of coordinator trust, crash recovery, and performance evaluations.
Lean theorems connected to this paper
-
IndisputableMonolith/Foundation/RealityFromDistinction.leanreality_from_one_distinction unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
Each TPM stores a single 32-byte secret seed from which an unlimited sequence of nonce commitments is deterministically derived... one-time-use invariant enforced by TPM hardware state.
-
IndisputableMonolith/Cost/FunctionalEquation.leanwashburn_uniqueness_aczel unclear?
unclearRelation between the paper passage and the cited Recognition theorem.
We prove EU-CMA security in the random oracle model under the discrete logarithm assumption and Pseudo Random Function (PRF) security
What do these tags mean?
- matches
- The paper's claim is directly supported by a theorem in the formal canon.
- supports
- The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
- extends
- The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
- uses
- The paper appears to rely on the theorem as machinery.
- contradicts
- The paper's claim conflicts with a theorem or certificate in the canon.
- unclear
- Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.
Reviewed May 16, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.