Hong-Sheng Zhou

Threshold ECDSA schemes distribute the capability of issuing signatures to multiple parties. They have been used in practical MPC wallets holding cryptocurrencies. However, most prior protocols are not robust, wherein even one misbehaving or non-responsive party would mandate an abort. Robust schemes have been proposed (Wong et al., NDSS ’23, ’24), but they do not match state-of-the-art number of rounds which is only three (Doerner et al., S&P ’24). In this work, we propose robust threshold ECDSA schemes RompSig-Q and RompSig-L that each take three rounds (where the first two are broadcasts, whereas the non-robust scheme of Doerner et al. uses no broadcasts). Building on the works of Wong et al. and further optimized towards saving bandwidth, they respectively take each signer (1.0t + 1.6) KiB and 3.0 KiB outbound broadcast communication, and thus exhibit bandwidth efficiency that is competitive in practical scenarios where broadcasts are natively handled. RompSig-Q preprocesses multiplications and features fast online signing; RompSig-L leverages threshold CL encryption for scalability and dynamic participation.

We present Areon, a family of latency-friendly, stake-weighted, multi-proposer proof-of-stake consensus protocols. By allowing multiple proposers per slot and organizing blocks into a directed acyclic graph (DAG), Areon achieves robustness under partial synchrony. Blocks reference each other within a sliding window, forming maximal antichains that represent parallel ``votes'' on history. Conflicting subDAGs are resolved by a closest common ancestor (CCA)-local, window-filtered fork choice that compares the weight of each subDAG -- the number of recent short references -- and prefers the heavier one. Combined with a structural invariant we call Tip-Boundedness (TB), this yields a bounded-width frontier and allows honest work to aggregate quickly. We formalize an idealized protocol (Areon-Ideal) that abstracts away network delay and reference bounds, and a practical protocol (Areon-Base) that adds VRF-based eligibility, bounded short and long references, and application-level validity and conflict checks at the block level. On top of DAG analogues of the classical common-prefix, chain-growth, and chain-quality properties, we prove a backbone-style $(k,\varepsilon)$-finality theorem that calibrates confirmation depth as a function of the window length and target tail probability. We focus on consensus at the level of blocks; extending the framework to richer transaction selection, sampling, and redundancy policies is left to future work. Finally, we build a discrete-event simulator and compare Areon-Base against a chain-based baseline (Ouroboros Praos) under matched block-arrival rates. Across a wide range of adversarial stakes and network delays, Areon-Base achieves bounded-latency finality with consistently lower reorganization frequency and depth.

The random oracle methodology has proven to be a powerful tool for designing and reasoning about cryptographic schemes. In this paper, we focus on the basic problem of correcting faulty or adversarially corrupted random oracles, so that they can be confidently applied for such cryptographic purposes. We prove that a simple construction can transform a "subverted" random oracle which disagrees with the original one at a small fraction of inputs into an object that is indifferentiable from a random function, even if the adversary is made aware of all randomness used in the transformation. Our results permit future designers of cryptographic primitives in typical kleptographic settings (i.e., those permitting adversaries that subvert or replace basic cryptographic algorithms) to use random oracles as a trusted black box.