A Shoup-Aligned Post-Finalization Single-Round Threshold Schnorr Prototype for UAV Swarms

1. Introduction

The low cost, portability, and mobility of Unmanned Aerial Vehicle UAV swarms make them convenient and effective across fields, particularly in high-risk and contested areas. These low-resource vehicles are capable of inspecting and monitoring infrastructure, performing tactical reconnaissance, and making independent or collective decisions based on collected data, following a command-and-control architecture. However, achieving secure decentralized decision-making is challenging and a critical barrier to adopting this architecture, due to UAVs’ hardware constraints and to unstable and limited connectivity. In this context, cryptographic schemes that enable agreement on commands received from a Ground Control Station (GCS) and on autonomous decisions are required under distributed trust. To this end, threshold signature schemes let a quorum of t out of n nodes to cooperate to produce a valid group signature, preventing any single compromised node from authorising a decision. On the one hand, based on bilinear pairings [1], BLS achieves a single-round signing phase, in which each node emits one partial signature, aggregated, and the result is verifiable against the group public key using the pairing equation. This non-interactive structure makes BLS resilient to network degradation, whereas pairing-based verification is computationally expensive and requires careful consideration when selecting a Pairing-friendly curve. On the other hand, The Flexible Round-Optimized Schnorr Threshold (FROST) protocol [2] leverages the standard Schnorr signature to achieve faster verification. The signature shares are aggregated and the result is verifiable against the group public key. However, FROST signing phase requires two interactive rounds, a nonce commitment broadcast followed by a signature-share broadcast, making it sensitive to network degradation. Thus, for a decentralized low-hardware UAV swarm network to be practical, signing must be resilient in contested low-bandwidth environments that may incur packet delays or loss, and verification must be fast.

Given this context, we implement and evaluate the SRTS scheme. This scheme follows Shoup’s modular threshold-Schnorr framework in the random-oracle and Elliptic-Curve Generic-Group (EC-GGM) model [3]. It moves interactive cryptographic preparation to an offline phase and generates P one-time presignature slots from the verifiable contributions of Q UAVs. Batch preprocessing amortizes communication costs across multiple commands and eliminates repeated distributed preparation. After command finalization, the scheme requires a single round to collect locally computed signature shares. Consensus binds each command to a unique unused slot before revealing the rerandomization shift, thereby preventing reuse and adaptive selection. Finally, the scheme produces a compact Schnorr signature with constant size and verification cost, independent of the number of participating UAVs.

1.1. Contributions

This work implements and evaluates a batched, post-finalization, single-round threshold Schnorr construction for command authorization in decentralised UAV swarms. The construction is a Shoup-aligned threshold Schnorr [3] composed to improve resilience under unstable connectivity, limited bandwidth, and constrained computation. Its main contributions are as follows:

• Resilience to network degradation: The construction moves interactive cryptographic preparation to an offline phase. During this phase, Q UAVs contribute verifiable shared ephemeral inputs, which are transformed through public linear extraction into P one-time presignature slots. Hence, preparing these slots in batches amortizes the communication cost across multiple future commands and avoids repeating distributed preprocessing.
• Low-latency online authorization: When a command is finalized, each selected UAV computes its response share locally from an assigned presignature slot. Only one signature-share round is required after finalization, with no further interaction among UAVs. This reduces online communication, limits exposure to packet loss and link delays, and makes authorization more suitable for low-bandwidth or intermittently connected UAV networks.
• Secure presignature-slot assignment: Consensus binds each command to exactly one unused presignature slot before the finalization certificate and its associated rerandomization shift are revealed. This ordering prevents presignature reuse and stops an adversary from adaptively selecting or influencing a slot after observing the shift.
• Efficient verification: The distributed signing process produces a compact Schnorr signature whose size and verification cost are independent of the number of participating UAVs. Then, the verifier checks one final aggregate signature rather than individual response shares or the distributed signing transcript, enabling efficient command verification.

1.2. Organization of This Paper

The remainder of this paper is organized as follows. Section 2 reviews related UAV security and threshold signature schemes. Section 3 introduces the notation, cryptographic foundations, system model, and assumptions. Section 4 presents the SRTS long-term key generation, batch presignature extraction, post-finalization signing, and public verification procedures. Section 5 summarizes the main scheme properties and operational requirements. Section 6 defines the security model and analyzes unforgeability, share confidentiality, one-use state, and malformed-share handling. Section 7 describes the experimental methodology and compares SRTS with FROST, tBLS, and MuSig2. Finally, Section 8 discusses the results, limitations, and future work, while Section 9 concludes the paper.

2. Related Work

[4] uses a simple threshold predicate stating that a signer qualifies if it holds at least `k` of a target attribute set. A default attribute set lets `k` change later without redefining the scheme. The scheme is secure following two CDH reductions in the random oracle model, one for an attacker holding the proxy key and one for an attacker holding the original signer’s key. The costs are estimated based on pairing on a desktop CPU, not on UAV hardware. The estimates count threshold attributes inside one signer’s policy. Following the same security model and assuming a trusted GCS, [5] checks that `d` attributes are shared between each pair of parties in a delegation chain instead of checking against one fixed policy. Dropping the default attribute set removes the flexibility, and the resulting signatures are longer and more expensive to verify compared to [4]. [6] introduces Expressive Attribute-Based Proxy Signature (EABPS) to replace flat predicates in [4,5] with a tree-structured access policy. Thus, each leaf carries its own threshold, so the scheme can express branching authorization rules instead of one attribute count. Both signers must independently satisfy the same tree, and verification recomputes it recursively through Lagrange interpolation before a final pairing check. However, threshold of these previous schemes [4,5,6] are governed with which attributes qualify a signer, not how many signers must agree. [7] proposes pairwise UAV authentication using X.509 ECC certificates, ECDSA, ECDH session-key establishment, and an SHA-1 consistency check intended to detect computation or packet-loss-induced key disagreement. Authors ported an OpenSSL implementation to VxWorks 6.9 on LYS-IMX6Q boards in a four-drone wireless as the authenticated session test environment. [8] combines SDN-controller access control, an OTP challenge, ECC/ECDH-oriented channel protection, and layered controller/firewall enforcement for UAV users to achieve authenticated access rather than collective UAV authorization on two Ubuntu 18.04 virtual machines, Mininet 2.2.2, and an ODL controller. [9] combines Latin-square communication scheduling, BLS signature aggregation, and repeated ECDH operations so registered UAVs can authenticate and derive a common group key without calling the GCS in negotiation. This achieves authenticated group-key negotiation with aggregated individual signatures secure under CDH/ECDLP assumptions. (not a `t`-of-`n` authorization signature.) This work is simulated using PyCryptodome and pypbc on an Intel i7-11800H model, and groups between 16 and 128. [10] provides segmented identity and key management. It defines separate authentication and session-key mechanisms for soldier–drone, drone–CA, and drone–drone communication in a military IoD using ECC, ECDH, group keys, timestamps, hop counts, and UWB-assisted location checks. However, computation is estimated from prior NXP LPC1788 primitive timings rather than a complete deployment, yielding an author-reported 3,280-bit total exchange and 0.456 ms per drone-to-drone link. [11] proposes NC2S, a zero-trustC3 Command, Control, and Communication architecture that separates X.509/ECDSA identity from commander-signed, mission-scoped authorization and supports credential renewal, revocation, and GCS control handover. NC2S directly protects delegated commands through hierarchical credentials and channels rather than a quorum signature. The results are taken from a four-node Windows prototype using Getac/Surface computers, Wi-Fi, and Rohde & Schwarz HR-5000H tactical radios. [12] proposes a PUF–P-256 anonymous group signature. This scheme allows a UAV to produce an anonymous signature, and the GCS verifies it as a trusted party. [13] optimizes Falcon verification for broadcast-heavy UAV settings using signed Plantard arithmetic, packed coefficients, DSP instructions, layer merging, and lazy reduction. It evaluates independent post-quantum signatures, rather than aggregated or threshold authorization on a 20 MHz NUCLEO-L4R5ZI Cortex-M4 with 2 MiB flash and 640 KiB SRAM. Whereas the batch key-agreement scheme called BAKAF [14] allows many vehicles, in the VANET context, to request a session key from one fog node in a short window, with no threshold command signature. A fog node aggregates requests and forwards one batched message to a trusted control center, which builds one interpolated line per vehicle so the vehicle and fog node can each recover a shared session key. This scheme is described as a single round of operations, although it takes four message-transmission stages. Despite its batching claim, the output is a pairwise session key, not a signature under a group key. Besides, [15,16] allow a group of participants to authenticate each other or agree on a shared key, but neither produces a single signature.

In contrast, threshold signature schemes let a quorum of t out of n nodes to cooperate to produce a valid one group signature to authorise a decision. Threshold GDH/BLS [17] extends the single-signer BLS [1] scheme with dealerless distributed key generation and threshold reconstruction. The setup assumes broadcast and secure communication channels among signers. During signing, each shareholder broadcasts one message-dependent share. Then an elected reconstructor validates the shares and combines the qualified subset. The scheme doesn’t include a nonce-coordination round, and its proven secure under the random oracle model against static active corruption when fewer than half the signers are corrupt, and doesn’t include a nonce-coordination round. FROST [2] is considered the reference point for threshold Schnorr. Key generation uses a two-round Pedersen-style protocol, and the design assumes reliable delivery and authenticated participants. It supports two signing modes. In the ordinary mode, signers exchange nonces and responses across two full rounds per signature. In the preprocessed mode, each signer instead publishes batches of single-use nonce commitments in advance. Then, when a message arrives, an aggregator picks unused commitments, and each selected signer returns just one response share. A malformed share triggers identification, exclusion, and a restart, rather than the robustness guarantee threshold GDH/BLS claims. Reusing a nonce can expose a signer’s long-term key share, so nonce handling sits inside the security boundary, not outside it. FROST’s preprocessed mode moves nonce or presignature work offline so only one response stays online. Moreover MuSig2 [18] reaches a one-response signature. The scheme is a two-round multi-signature for a fixed set of `n` independent keys, not a `t`-of-`n` threshold scheme, requiring all parties (UAVs) to take part. The first round can run before knowing the message and signer set, leaving one non-preprocessable response round once both are fixed. Each signer combines a set of its own nonces rather than coordinating with the group on a shared nonce. The scheme could call for an optional untrusted aggregator to collect responses to reduce communication cost. Similar to FROST, reusing nonce state, including through a rollback, can leak a signer’s secret key.

Nevertheless, [19] is the only work that compares true threshold signature schemes in the wide context of secure UAVs. The study tested seven open-source cryptographic libraries focusing on Messaging Layer Security (MLS) and threshold signatures (FROST/FROST-like/BLS), notably highlighting OpenMLS and Cisco MLSpp for group key exchange alongside the Zcash FROST implementation for consensus. The authors acknowledged the preprocessed FROST but compared only FROST’s ordinary two-round mode against one-round threshold BLS on a Windows laptop with WSL.

3. Preliminaries

In this section, we introduce the notations and the required definitions and assumptions, communication and evaluation model we adopt throughout this work.

3.1. Notations

Table 1 summarizes the notation. The security parameter is $\lambda \in \mathbb{N}$, and $\mathsf{negl}\left(\lambda \right)$ denotes a negligible function. We write $x\stackrel{\$}{\leftarrow }S$ for uniform sampling from a finite set S, $x\stackrel{\$}{\leftarrow }\mathcal{D}$ for sampling from a distribution, and $y\leftarrow A\left(x\right)$ for one execution of a probabilistic algorithm with fresh randomness.

The parameter constraints enforced by the prototype are

$$0\le f<t\le n-f,n>3f,Q=n-f,P=n-2f.$$

The direct Shoup-style sharing profile maps Shoup’s corruption parameter to our f and therefore uses $t=f+1$. The implementation additionally evaluates a majority profile $t=\lceil n/2\rceil$. Measurements at thresholds other than $f+1$ are sensitivity experiments: their distributed-security interpretation remains conditional on a VSS/MPC realization secure for the chosen $(f,t,n)$. In both beacon integration modes, the prototype sets the finalization threshold to the high value

$$t_{\beta }=Q=n-f.$$

3.2. Public Parameters, State, and Transcript Binding

The public parameters $\mathsf{pp}$ is defined by:

$$\mathsf{pp}=(\mathbb{G},N,G,n,f,t,Q,P,t_{\beta },W,H_{\mathrm{batch}},H_{\mathrm{assignment}},H_{\mathrm{beacon}},H_{\delta },H_c)$$

such that we set $W_{k,j}=x_j^{k-1}modN,x_j=j,k\in \left[P\right],j\in \left[Q\right],$ so every P-column square submatrix is a nonsingular Vandermonde matrix.

All five functions are domain-separated SHA-256 hashes with length-prefixed inputs. $H_{\mathrm{batch}}$ takes $(n,t,f,D,I,\left\{{\overline{R}}_k\right\})$ and outputs $\mathsf{batchID}$ to identify and bind the batch, $H_{\mathrm{assignment}}$ takes $(\mathsf{requestID},m,\mathsf{batchID},k)$ and outputs a to bind the command to its slot, $H_{\mathrm{beacon}}$ takes a and outputs the beacon-signed digest ${\mu }_{\beta }$, $H_{\delta }$ takes $({\sigma }_{\beta },D,\mathsf{batchID},k,\mathsf{requestID},m)$ and outputs $\delta \in {\mathbb{Z}}_N$ to rerandomize the slot, and $H_c$ takes $(D,R^{\prime },m)$ and outputs the Schnorr challenge $h\in {\mathbb{Z}}_N$.

Let ${enc}_4$ and ${enc}_8$ be unsigned big-endian encodings of four and eight bytes. Matching the implementation, the public transcript is bound by

$$\begin{array}{cc}\hfill \mathsf{batchID}& =H_{\mathrm{batch}}\left({enc}_4\left(n\right),{enc}_4\left(t\right),{enc}_4\left(f\right),D,{enc}_4\left(i_1\right),\dots ,{enc}_4\left(i_Q\right),{\overline{R}}_1,\dots ,{\overline{R}}_P\right),\hfill \\ \hfill a& =H_{\mathrm{assignment}}\left(\mathsf{requestID},m,\mathsf{batchID},{enc}_8\left(k\right)\right),\hfill \\ \hfill {\mu }_{\beta }& =H_{\mathrm{beacon}}\left(a\right),\hfill \\ \hfill \delta & =H_{\delta }\left({\sigma }_{\beta },D,\mathsf{batchID},{enc}_8\left(k\right),\mathsf{requestID},m\right)modN,\hfill \\ \hfill R^{\prime }& ={\overline{R}}_k+\left[\delta \right]G,h=H_c(D,R^{\prime },m)modN.\hfill \end{array}$$

Here ${\sigma }_{\beta }$ denotes the unique signature component of the verified certificate. The certificate is accepted only if it signs ${\mu }_{\beta }$, has at least $t_{\beta }$ distinct valid signer identifiers, and verifies under the public beacon key.

Table 2 classifies the construction state according to its lifetime, visibility, and required protection. In particular, epoch state is reusable only while the committee and its long-term keys remain unchanged, whereas each batch supplies one-use presignature state. The request state binds one slot to one message, and the persistent state transition prevents that slot’s secret share from being released or used more than once.

3.3. System and Trust Model

We consider a fixed mission epoch with a known signing committee $\mathcal{P}=\{P_1,\dots ,P_n\}$. A change in committee membership starts a new epoch, with a new distributed key-generation execution and a new presignature inventory. The roles in one epoch are:

• Signing UAVs: UAV $P_i$ holds a long-term signing share $d_i$ and one secret share ${\overline{r}}_{k,i}$ for every available presignature slot k. A selected set $\mathcal{S}$ of t UAVs produces signature shares.
• Requester: A GCS, mission service, or autonomous UAV may submit $(\mathsf{requestID},m)$. This input is not trusted merely because it originated at the GCS; authorization results from consensus assignment followed by threshold signing.
• Consensus/finalization service: This assumed service orders requests, irrevocably binds one globally unused slot to one request, and supplies a unique publicly verifiable finalization certificate. It may be run by the same UAV committee, but it is a separate interface in the security and performance models.
• Combiner: A UAV, GCS process, or other service verifies signature shares and aggregates t valid shares. The combiner is not trusted with any long-term or presignature scalar, and malformed output is rejected by public verification.
• Verifier: Any UAV, GCS, recipient, or auditor knowing only $(D,m,\sigma )$ verifies the final ordinary Schnorr equation.

It is worth noting that the GCS role may coordinate the pre-mission process. It may authenticate the mission committee, provide network connectivity, distribute public parameters, record the agreed public key and qualified set, and confirm that provisioning is complete. In addition, we use the term dealer to refer to the construction participants’ UAVs and GCS and its depends on the context. It refers to every committee UAV $P_i$ distributing a verifiable sharing of its private contribution to the long-term key during the Long-Term DKG Section 4.1, and the same during the Offline Presignature-Batch Generation Section 4.2 to distribute A verifiable sharing of one ephemeral scalar $r_i$, or to the GCS who may play the complete key sharing, assuming the the GCS the the trusted dealer or party.

3.4. Elliptic Curve Groups

Definition 1

(Elliptic curve group). Anelliptic curve group$\mathbb{G}=E\left({\mathbb{F}}_p\right)$ is the set of affine points satisfying $y^2=x^3+ax+b(modp)$ (together with the point at infinity $\mathcal{O}$), equipped with the chord-and-tangent group law. When $\left|\mathbb{G}\right|=N$ is a large prime, $\mathbb{G}$ is cyclic and every non-identity element is a generator.

We instantiate $\mathbb{G}$ as the secp256k1 elliptic curve, defined over ${\mathbb{F}}_p$ with

$$p=2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1,$$

and group order

$$N=\mathtt{0}\mathtt{xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBA}\mathtt{AEDCE}\mathtt{6}\mathtt{AF}\mathtt{48}\mathtt{A}\mathtt{03}\mathtt{BBFD}\mathtt{25}\mathtt{E}\mathtt{8}\mathtt{CD}\mathtt{0364141}.$$

This curve is also used by Bitcoin and Ethereum and is supported by production-level libraries (libsecp256k1, coincurve).

3.5. Hardness and Idealized-Model Assumptions

Definition 2

(Discrete Logarithm Problem — DLP). Let $\mathbb{G}$ be a cyclic group of prime order N with generator G. Thediscrete logarithm problemis: given $Y=\left[x\right]G$ for a uniformly random $x\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$, compute x. We say the DLP is$(\mathcal{T},\epsilon )$-hardin $\mathbb{G}$ if every probabilistic algorithm $\mathcal{A}$ running in time $\mathcal{T}$ satisfies $Pr\left[\mathcal{A}\right(G,Y)=x]\le \epsilon$.

3.6. Schnorr Signatures

Definition 3

(Schnorr signature scheme). ASchnorr signature schemeover group $\mathbb{G}=\langle G\rangle$ of order N is a triple $(\mathsf{KeyGen},\mathsf{Sign},\mathsf{Verify})$:

• $\mathsf{KeyGen}\left(1^{\lambda }\right)$: sample $d\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$, output $(d,D)=(d,[d\left]G\right)$.
• $\mathsf{Sign}(d,m)$: sample $r\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$; let $R=\left[r\right]G$, $h=\mathcal{H}\left(D\parallel R\parallel m\right)$, $z=r+h·dmodN$; output $(R,z)$.
• $\mathsf{Verify}(D,m,\sigma )$: parse $\sigma =(R,z)$; let $h=\mathcal{H}(D\parallel R\parallel m)$; accept iff $\left[z\right]G=R+\left[h\right]D$.

Schnorr signatures are existentially unforgeable under chosen-message attack (EUF-CMA) in the random oracle model under the DLP assumption [20]. The verification equation $\left[z\right]G=R+\left[h\right]D$ is the algebraic identity underlying the correctness proof of SRTS (Proposition 1).

3.7. Secret Sharing and Distributed Key Generation

Definition 4

($(t,n)$-Shamir secret sharing). A$(t,n)$-Shamir secret sharingof $s\in {\mathbb{Z}}_N$ samples a uniformly random polynomial $\varphi \left(X\right)={\sum }_{a=0}^{t-1}{\varphi }_a{X}^a\in {\mathbb{Z}}_N\left[X\right]$ with $\varphi \left(0\right)=s$, and gives $s_i=\varphi \left(i\right)$ to $P_i$. Any t shares determine s; any set of fewer than t shares is statistically independent of s. The symbol ϕ avoids overloading the corruption bound f.

Definition 5

(Lagrange interpolation in ${\mathbb{Z}}_N$). For $\mathcal{S}\subseteq \left[n\right]$, $\left|\mathcal{S}\right|=t$, and evaluations ${\left\{(i,s_i)\right\}}_{i\in \mathcal{S}}$ of ϕ,

$$\varphi \left(0\right)=\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{s}_{i}modN,{\lambda }_{i,\mathcal{S}}=\prod _{\begin{array}{c}j\in \mathcal{S}\\ j\ne i\end{array}}{\displaystyle \frac{j}{j-i}}modN.$$

Applying the formula to the constant polynomial 1 gives ${\sum }_{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}=1modN$.

Definition 6 (Verifiable Secret Sharing —VSS)A VSS protocol augments secret sharing with commitments, verification, and complaint/disqualification rules so honest parties either retain shares consistent with one committed polynomial or reject the dealer. Whether verification evidence is public, privately checked, or revealed during complaints depends on the concrete VSS scheme. In this paper VSS is a required interface; the centralized Feldman in the prototype is not a deployed maliciously secure VSS service.

3.8. Threshold Signature Schemes

Definition 7

($(t,n)$-threshold signature scheme). A $(t,n)$-threshold signature scheme distributes one signing key among n parties and provides setup/key-generation, share generation, share verification/combination, and public verification algorithms. It satisfies:

(i)

Correctness: when at least t valid shares are generated for an authorized request, combination yields a publicly valid signature.

(ii)

Threshold unforgeability: under the stated corruption and signing-query experiment, an adversary controlling fewer than t shares cannot produce a valid signature on an unrequested message.

(iii)

Threshold privacy, when claimed: fewer than t shares reveal no signing scalar beyond the prescribed public outputs.

Producing the same signature format as an ordinary single-party scheme is a construction-specific property. SRTS has this property because its output is an ordinary Schnorr pair $(R^{\prime },z)$; it is not part of the generic definition of threshold unforgeability.

3.9. Adversary and Operational Assumptions

The adversary statically selects $\mathcal{C}$, with $\left|\mathcal{C}\right|\le f<t$, before setup. It learns corrupted parties’ long-term and ephemeral shares, controls their protocol messages and scheduling, and may choose corrupted dealers’ ephemeral inputs after observing honest public inputs. It may equivocate where an assumed broadcast/consensus service does not prevent equivocation, withhold shares, trigger aborts, and attempt replay or slot reuse. The cryptographic claim assumes:

(A1)

authenticated private channels and an authenticated reliable-broadcast mechanism for the chosen DKG/VSS realization;

(A2)

a secure VSS/MPC interface supporting verifiable input sharing, local linear operations, and the openings required by the construction;

(A3)

agreement on one ordered set I of $Q=n-f$ completed ephemeral inputs;

(A4)

consensus safety and persistence for a globally unique assignment A, committed while slot k is available and before $\beta$ is revealed;

(A5)

a unique publicly verifiable certificate with threshold $t_{\beta }=n-f$, unpredictable before the assignment is fixed;

(A6)

secure random-number generation, authenticated persistent state, atomic slot transitions, rollback protection, and rejection of every previously assigned or consumed slot.

Adaptive or mobile corruption, accumulation of shares across epochs, side channels, physical capture, secure hardware erasure, storage rollback, compromised random-number generators, and radio-frequency jamming are not covered. A Byzantine party may always deny its own share; the signature layer alone does not guarantee progress. Liveness additionally requires enough responsive parties and terminating realizations of the assumed services.

3.10. Communication and Evaluation Model

We deliberately separate three layers:

(i)

Security-service layer: DKG/VSS, common-subset, and consensus/finality are assumed interfaces. They may be instantiated by asynchronous or partially synchronous protocols. The condition $n>3f$ is inherited from the selected common-subset/finality resilience target not derived from a synchronously bounded UAV radio channel.

(ii)

Post-finalization signing layer: After consensus has committed A and supplied a verified $\beta$, selected UAVs compute and transmit signature shares independently in one response transmission stage. Cryptographic safety does not require a known delivery bound $\Delta$, although unavailable shares may prevent completion.

(iii)

Evaluation layer: The reported network results use a deterministic discrete-event model with configured latency, jitter, bandwidth, independent packet loss, and profile-specific retries. This layer estimates behavior under those inputs; it is not a physical UAV channel measurement and supplies no cryptographic security assumption.

4. Construction: Shoup-Aligned Post-Finalization Single-Round Threshold Schnorr

This section specifies the phases and the cryptographic algorithms that this construction implements. In general, this construction has four epochs. First, a long-term key-generation algorithm gives each UAV a signing share and establishes the group public key. Second, the offline presignature-batch generation algorithm that verifiably shares ephemeral inputs, agrees on an ordered qualified set, and extracts a batch of one-time presignature slots. Third, consensus assigns one unused slot to one request and reveals a qualifying finalization certificate; the selected UAVs then send one stage of signature shares. Finally, any party verifies the resulting ordinary Schnorr signature. Thus, “post-finalization single round” refers to a single signature-share response stage; it does not include long-term setup, presignature generation, request agreement, or finalization.

4.1. Long-Term Key-Generation

On success, ${\mathsf{KeyGen}}_{t,n}$ allows every UAV party $P_i$ to obtain $d_i$ privately, while all parties obtain the same D, public verification shares $\left\{D_i\right\}$, a qualified set, and an epoch identifier. On failure, honest UAV parties abort, with no party receiving d or another honest party’s share. The term long-term only distinguishes the reusable signing shares $d_i$, which authorize many signatures, from the one-time presignature shares ${\overline{r}}_{k,i}$, and it does not mean that the key is permanent.

$$\left(D,{\left\{(d_i,D_i)\right\}}_{i=1}^n\right)\leftarrow {\mathsf{KeyGen}}_{t,n}(\mathsf{pp},\mathcal{P}),D_i=\left[d_i\right]G.$$

For every signer set $\mathcal{S}\subseteq \mathcal{P}$ containing t distinct parties with valid shares, the Lagrange coefficients at zero satisfy

$$\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{d}_i=d(modN),\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{D}_i=D.$$

The first equality expresses reconstruction of the shared signing scalar, although the protocol never needs to reconstruct d explicitly. The second follows by linearity of scalar multiplication and ensures that the public verification shares are consistent with the group public key. The present prototype realizes the corresponding Feldman/Pedersen algebra centrally. Authenticated communication, complaint resolution, agreement on qualified parties, and maliciously secure distributed execution remain requirements of the external DKG realization. Once this phase succeeds, D, $D_i$, and $d_i$ remain fixed while the parties repeatedly generate the offline presignature batches described next.

4.2. Offline Presignature-Batch Generation

Long-term key generation and ephemeral presignature generation have different security roles. For the latter, our scheme uses Shoup’s $\mathsf{InputKey}$, ACS, and batch-randomness-extraction  [3]. Honest UAVs choose uniform ephemeral inputs, while corrupted dealers may choose theirs after observing honest public inputs. The resulting points are therefore called biased presignatures; security relies on the full-rank linear-bias model and the later request-specific rerandomization, not on an independence claim.

No ephemeral scalar $r_i$, extracted scalar ${\overline{r}}_k$, or long-term scalar d is opened by Algorithm 1. The matrix $W\in {\mathbb{Z}}_N^{P\times Q}$ is the deterministic Vandermonde matrix defined in Section 3.2. Because I contains $Q=n-f$ UAVs and at most f are corrupted, it contains at least $P=n-2f$ honest contributions. Every set of P columns of W is linearly independent, which provides the full-rank honest component required by Shoup’s bias model. The prototype performs the VSS checks, deterministic selection of the first Q valid UAVs, and all matrix operations centrally. Accordingly, its VSS and ACS timings are algebraic/model timings rather than measurements of deployed distributed services.

Algorithm 1: SRTS Offline Presignature Batch via Assumed VSS/MPC and ACS

Require:  Public parameters $\mathsf{pp}$, group key D; secure VSS/MPC input-sharing interface; ACS interface Ensure:  Public $\mathsf{Batch}=(\mathsf{batchID},I,{\left\{{\overline{R}}_k\right\}}_{k=1}^P)$; at each $P_{\ell }$, secret shares ${\left\{{\overline{r}}_{k,\ell }\right\}}_{k=1}^P$ and verification shares ${\left\{{\overline{R}}_{k,\ell }\right\}}_{k=1}^P$   Verifiably shared ephemeral inputs 1: for each dealer $P_i$, $i\in \left[n\right]$ do 2:     Sample $r_i\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$ and invoke the assumed input-sharing interface 3:     On successful completion, publish $R_i=\left[r_i\right]G$; each $P_{\ell }$ retains a verified share $r_{i\to \ell }$ and the coefficient commitments ${\left\{C_{i,a}\right\}}_{a=0}^{t-1}$ 4: end for 4: Agreement and share-local extraction 5: Invoke ACS to agree on one ordered set $I=(i_1,\dots ,i_Q)$ of $Q=n-f$ completed inputs 6: for each extraction row $k\in \left[P\right]$ do 7:     for each coefficient $a=0,\dots ,t-1$ do 8:         Compute the public combined commitment ${\overline{C}}_{k,a}={\sum }_{j=1}^Q{W}_{k,j}{C}_{i_j,a}$ 9:     end for 10:     Each $P_{\ell }$ locally computes ${\overline{r}}_{k,\ell }={\sum }_{j=1}^Q{W}_{k,j}{r}_{i_j\to \ell }modN$ 11:     Set ${\overline{R}}_k={\overline{C}}_{k,0}$ and derive ${\overline{R}}_{k,\ell }={\sum }_{a=0}^{t-1}{\ell }^a{\overline{C}}_{k,a}$ 12:     Check $\left[{\overline{r}}_{k,\ell }\right]G={\overline{R}}_{k,\ell }$ 13: end for 13: Batch binding and one-use state 14: Compute $\mathsf{batchID}$ with $H_{\mathrm{batch}}$ over the exact transcript specified in Section 3.2 15: Publish $\mathsf{Batch}$; initialize every slot as $\mathsf{AVAILABLE}$

4.3. Post-Finalization Signature-Share Stage

For an available slot k, consensus first commits $A=(\mathsf{requestID},m,\mathsf{batchID},k)$ and changes its persistent state from $\mathsf{AVAILABLE}$ to $\mathsf{ASSIGNED}$ in one atomic action. Afterward, the finalization service may reveal a certificate $\beta =({\mu }_{\beta },{\sigma }_{\beta },{\mathcal{S}}_{\beta })$. Then, every signer checks that $\beta$ verifies the digest of this exact assignment, contains at least $t_{\beta }=n-f$ distinct valid certificate signers, and is bound to the same epoch and batch. The online signature-share computation is then as follows.

An assigned slot never returns to X, even if too few responses arrive or the combination fails. Once a share is released, the slot must be deleted before permitting recovery or retry. Moreover, the signer-to-combiner responses in Algorithm 2 constitute the post-finalization online communication measured as the primary the construction path.

Algorithm 2:SRTS Post-Finalization Signing—One Signature-Share Stage

Require:  Committed assignment $A=(\mathsf{requestID},m,\mathsf{batchID},k)$; verified certificate $\beta =({\mu }_{\beta },{\sigma }_{\beta },{\mathcal{S}}_{\beta })$; public $D,{\overline{R}}_k,\{D_i,{\overline{R}}_{k,i}\}$; at $P_i$, secrets $d_i,{\overline{r}}_{k,i}$ Ensure:  Ordinary Schnorr signature $\sigma =(R^{\prime },z)$ 1: Reject unless A is the unique committed assignment for slot k, the local slot state is $\mathsf{ASSIGNED}$, and $\beta$ verifies for A 2: Compute $$\delta =H_{\delta }({\sigma }_{\beta },D,\mathsf{batchID},{enc}_8\left(k\right),\mathsf{requestID},m)modN$$ 3: Compute $R^{\prime }={\overline{R}}_k+\left[\delta \right]G$ and $h=H_c(D,R^{\prime },m)modN$ 3: Independent signer responses 4: for each responding signer $P_i$ do 5:     Compute $z_i={\overline{r}}_{k,i}+\delta +h{d}_{i}modN$ 6:     Check $\left[z_i\right]G={\overline{R}}_{k,i}+\left[\delta \right]G+\left[h\right]D_i$ 7:     Atomically record release for A, delete the stored ${\overline{r}}_{k,i}$, and never serve another assignment with slot k 8:     Send $(i,z_i)$ to the untrusted combiner 9: end for 9: Public share checking and combination 10: Let $\mathcal{S}$ be the identifiers of the first t distinct responses satisfying $\left[z_i\right]G={\overline{R}}_{k,i}+\left[\delta \right]G+\left[h\right]D_i$ 11: Compute $z={\sum }_{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{z}_{i}modN$ 12: Reject unless $\left[z\right]G=R^{\prime }+\left[h\right]D$; otherwise output $\sigma =(R^{\prime },z)$ 13: Finalize the persistent transition $\mathsf{ASSIGNED}\to \mathsf{CONSUMED}$ at every honest node

Proposition 1

(Correctness of SRTS signing). If the combiner accepts t shares consistent with the committed long-term and presignature shares, Algorithm 2 outputs a signature satisfying $\left[z\right]G=R^{\prime }+\left[h\right]D$.

Proof. 

For the accepted set $\mathcal{S}$, Shamir reconstruction and the constant polynomial identity give

$$\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{\overline{r}}_{k,i}={\overline{r}}_k,\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}{d}_i=d,\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}=1.$$

Hence

$$z=\sum _{i\in \mathcal{S}}{\lambda }_{i,\mathcal{S}}({\overline{r}}_{k,i}+\delta +h{d}_i)={\overline{r}}_k+\delta +hd(modN),$$

and therefore $\left[z\right]G={\overline{R}}_k+\left[\delta \right]G+\left[h\right]D=R^{\prime }+\left[h\right]D$.    □

4.4. Public Signature Verification

After the combiner aggregates t valid signature shares, it publishes the ordinary Schnorr signature $\sigma =(R^{\prime },z)\in \mathbb{G}\times {\mathbb{Z}}_N$. Any UAV, GCS, mission service, or external auditor that possesses the authenticated group public key D can verify the signature without interacting with the signers or the combiner. Unlike signature-share verification, public verification does not require the verification shares $D_i$, presignature verification shares ${\overline{R}}_{k,i}$, signer identifiers, assignment, or finalization certificate. Algorithm 3 describes this public verification procedure.

For an honestly generated signature, $z={\overline{r}}_k+\delta +hdmodN$ and $R^{\prime }={\overline{R}}_k+\left[\delta \right]G$. Therefore,

$$\left[z\right]G=[{\overline{r}}_k+\delta +hd]G={\overline{R}}_k+\left[\delta \right]G+\left[h\right]D=R^{\prime }+\left[h\right]D$$

so Algorithm 3 returns $\mathsf{Accept}$.

Algorithm 3: SRTS Public Schnorr Signature Verification

Require:  Authenticated group public key D, message m, and signature $\sigma =(R^{\prime },z)$ Ensure:  $\mathsf{Accept}$ or $\mathsf{Reject}$ 1: Reject unless D and $R^{\prime }$ are valid canonically encoded elements of $\mathbb{G}$ and z is a canonical element of ${\mathbb{Z}}_N$ 2: Compute $h=H_c(D,R^{\prime },m)modN$ 3: if$\left[z\right]G=R^{\prime }+\left[h\right]D$then 4:     return $\mathsf{Accept}$ 5: else 6:     return $\mathsf{Reject}$ 7: end if

The published signature contains only the Schnorr pair $(R^{\prime },z)$. Neither the signature nor the public verification input encodes the reconstruction threshold t, signer set $\mathcal{S}$, presignature batch or slot, finalization certificate $\beta$, or individual shares. Acceptance establishes that $\sigma$ is a valid Schnorr signature on m under D; by itself, it does not prove to an external verifier which UAVs participated, which presignature slot was consumed, or whether the internal assignment and one-use state transitions were executed correctly. Those properties are enforced during threshold signature generation and by the assumed consensus and persistent-state services.

5. Scheme Properties

This section gives the properties of the SRTS scheme against the three other constructions, FROST  [2], tBLS [17], and MuSig  [18]. Table 3 highlights that the four approaches provide different functionality and use different interaction boundaries. SRTS, FROST, and tBLS support a flexible t-of-n signer model, whereas ordinary MuSig2 requires all n registered signers. SRTS has one signer-to-combiner response stage only after consensus has assigned a presignature slot and supplied a qualifying finalization certificate. tBLS likewise requires one signature-share response stage once the message is fixed, and its final verification is pairing-based. FROST and MuSig2 require per-signature nonce material and additional signing interaction, although part of their nonce generation can be moved to preprocessing. SRTS, FROST, and MuSig2 produce Schnorr-family outputs whose final verification cost is independent of the committee size, while tBLS produces a BLS signature. Finally, the setup rows are not equivalent trust models: SRTS assumes the secure long-term key-generation interface specified in Section 4.1, FROST and tBLS require an external sharing or DKG realization, and MuSig2 aggregates independently generated public keys.

5.1. Post-Finalization Signature-Share Stage

Once the consensus/finalization service has supplied a verified certificate $\beta$ after committing

$$A=(\mathsf{requestID},m,\mathsf{batchID},k),$$

each selected signer independently computes one share $z_i$ and sends it to a combiner. Thus, the SRTS claim is one post-finalization signer-response stage. It excludes request dissemination, assignment agreement, certificate production, long-term setup, and offline inventory generation. A standalone beacon adds its own protocol stages and is reported as a separate integration mode. This is an interaction-structure claim, not unconditional one-round liveness. Withholding parties may force the system to contact additional UAVs or prevent completion, and the assumed services must themselves terminate.

5.2. Presignature Inventory and Amortization

For the fixed conservative parameters used by SRTS, one accepted set of $Q=n-f$ verifiably shared inputs produces $P=n-2f$ one-use slots. If the corresponding offline execution costs $C_{\mathrm{off}}(n,f)$, the accounting identity is

$$C_{\mathrm{off},\mathrm{slot}}(n,f)={\displaystyle \frac{C_{\mathrm{off}}(n,f)}{n-2f}}.$$

(1)

This identity does not make preprocessing $O\left(1\right)$, and it does not include inventory persistence, replenishment, or distributed VSS/ACS communication.

The combiner needs t accepted shares. If a known responsive set of exactly t UAVs is selected, the response stage uses $O\left(t\right)$ point-to-point transmissions. A fallback that solicits the full committee can cause up to $O\left(n\right)$ attempted responses; all-to-all dissemination would instead cause quadratic transmission growth. These are transmission counts, not additional claims about consensus rounds or radio delivery.

5.3. One-Use State and Nonce-Reuse Safety

Public rerandomization does not make reuse of ${\overline{r}}_k$ safe. For two responses $z_j={\overline{r}}_k+{\delta }_j+h_{j}d$, $j\in \{1,2\}$, with $h_1\ne h_2$, the public transcripts reveal

$$d=(z_1-z_2-{\delta }_1+{\delta }_2){(h_1-h_2)}^{-1}modN.$$

Consequently, durable non-reuse is a safety invariant: an assigned slot never returns to $\mathsf{AVAILABLE}$, and release of any signature share must be preceded by a persistent burn record that survives retry, crash, and rollback.

The prototype tests assignment-before-certificate, rejects reassignment and successful-path reuse, detects malformed shares, clears the in-process share dictionary after a successful aggregate, and moves the slot to $\mathsf{CONSUMED}$. It does not implement a replicated crash-safe store, consume-before-release across processes, rollback-resistant hardware, or physical memory erasure. Physical erasure limits later compromise exposure, but the formal static-corruption claim below relies first on irrevocable one-time protocol state.

5.4. Ordinary Schnorr Output

The output $(R^{\prime },z)$ satisfies $\left[z\right]G=R^{\prime }+\left[h\right]D$ under the group public key. Public verification therefore needs no knowledge of the threshold, signer set, presignature batch, assignment certificate, or individual shares. This algebraic format statement does not establish distributional indistinguishability under every side channel, nor interoperability with a particular external encoding such as BIP340. Byte sizes in the evaluation refer to the concrete encodings used by the compared implementations rather than universal scheme constants.

5.5. Assumed Long-Term Key Generation

SRTS requires the secure long-term key-generation interface of Section 4.1. The construction deliberately leaves its DKG or VSS realization modular and does not present the prototype’s centralized Feldman or Pedersen algebra as malicious-secure distributed key generation. Accordingly, setup availability, latency, and dealer-freedom depend on the external realization selected for deployment.

5.6. Static Security Within a Fixed Mission Epoch

The inherited argument permits at most $f<t$ parties to be corrupted before setup and assumes the corrupted set remains fixed for the epoch. This is a well-defined baseline for a fixed committee and bounded mission epoch, but it does not model an adversary that captures different UAVs over time and accumulates their shares. A membership change starts a new epoch with fresh long-term material and a fresh presignature inventory; shortening epochs can limit exposure but does not itself prove adaptive security.

Long-duration deployment under cumulative physical compromise would require a separately analyzed mechanism such as proactive share refresh, adaptively secure VSS/MPC, forward-secure state evolution, or protected hardware erasure. These mechanisms introduce communication, storage, recovery, and proof obligations and are neither implemented nor claimed here.

5.7. Public Verification and the Safety–Liveness Boundary

Verification of the final SRTS signature is constant in n and t and uses the pairing-free Schnorr equation. This describes final-output verification only: a standalone threshold-BLS beacon or BLS-backed consensus service still incurs BLS12-381 operations before SRTS signing begins.

Public verification shares allow a combiner to reject malformed responses and the final equation prevents acceptance of an invalid aggregate. These are safety properties. They do not guarantee progress: liveness additionally requires at least t responsive valid signers, consistent persistent state, and terminating DKG/VSS/ACS and consensus/finalization services.

6. Security Analysis

In this section we identify the signature-level attack game inherited from Shoup [3].

6.1. Security Model

The adversary statically corrupts a set $\mathcal{C}$ of at most f parties before setup, where $f<t$, $n>3f$, $Q=n-f$, and $P=n-2f$. It learns the corrupted long-term and ephemeral shares, controls corrupted messages and scheduling, may withhold responses, and may choose corrupted dealers’ ephemeral inputs after observing the honest public inputs.

The conditional distributed interpretation assumes the following ideal or securely realized services:

(i)

the long-term key-generation interface of Section 4.1, with a uniformly distributed group signing scalar as required by Shoup’s attack game;

(ii)

verifiable input sharing and local linear operations over consistent shares, together with agreement on a single ordered set $I=(i_1,\dots ,i_Q)$;

(iii)

Consensus safety and persistence for one assignment is fixed while the slot is available and before certificate revelation $A=(\mathsf{requestID},m,\mathsf{batchID},k)$;

(iv)

A unique, unpredictable, publicly verifiable certificate with a reconstruction threshold $t_{\beta }=n-f$; and

(v)

durable one-use state that never releases shares for two assignments of the same slot.

For the inherited signature-level argument, the domain-separated functions $H_{\delta }$ and $H_c$ are modeled as independent random oracles with range ${\mathbb{Z}}_N$. The transcript functions $H_{\mathrm{batch}}$, $H_{\mathrm{assignment}}$, and $H_{\mathrm{beacon}}$ are treated as collision-resistant canonical transcript bindings; alternatively, all five may be represented as independent domain-separated random oracles. The concrete implementation uses SHA-256 with length-prefixed inputs and reduction modulo N; treating this as a random oracle into ${\mathbb{Z}}_N$ abstracts the small modulo-reduction bias and the usual concrete hash assumption, both of which must be included in a concrete instantiation analysis.

6.2. Existential Unforgeability Under Chosen-Message Attacks

We formalize here the signature security of SRTS as existential unforgeability under chosen-message attacks (EUF-CMA). The experiment extends the standard EUF-CMA game to include static corruption, batch-extracted biased presignatures, certificate-derived rerandomization, and one-use presignature slots.

Definition 8 

(SRTS EUF-CMA experiment).

Let $\mathcal{Ch}$ denote the challenger and let $\mathcal{A}$ be a probabilistic polynomial-time adversary.

Setup.Before setup, $\mathcal{A}$ statically selects a corrupted set

$$\mathcal{C}\subseteq \mathcal{P},\left|\mathcal{C}\right|\le f<t.$$

The challenger executes the long-term threshold key-generation interface

$$\left(D,{\left\{(d_i,D_i)\right\}}_{i=1}^n\right)\leftarrow {\mathsf{KeyGen}}_{t,n}(\mathsf{pp},\mathcal{P}),D_i=\left[d_i\right]G.$$

It gives $\mathcal{A}$ the public state

$${\mathsf{st}}_{\mathrm{pub}}=\left(\mathsf{pp},D,{\left\{D_i\right\}}_{i=1}^n,{\mathsf{vk}}_{\beta }\right)$$

and the long-term shares of the corrupted parties,

$${\mathsf{st}}_{\mathcal{C}}=\{d_i:P_i\in \mathcal{C}\}.$$

The signing scalar d satisfying $D=\left[d\right]G$ is never given to $\mathcal{A}$ or reconstructed by the protocol.

Presignature-batch queries.The adversary may make many presignature-batch queries. For batch number b, the challenger executes Algorithm 1 and obtains

$${\mathsf{Batch}}^{\left(b\right)}=\left({\mathsf{batchID}}^{\left(b\right)},I^{\left(b\right)},{\left\{{\overline{R}}_k^{\left(b\right)}\right\}}_{k=1}^P\right),$$

where

$$I^{\left(b\right)}=(i_1^{\left(b\right)},\dots ,i_Q^{\left(b\right)}),Q=n-f.$$

The challenger gives $\mathcal{A}$ the public batch state

$${\mathsf{st}}_{\mathrm{batch}}^{\left(b\right)}=\left({\mathsf{Batch}}^{\left(b\right)},{\left\{{\overline{R}}_{k,i}^{\left(b\right)}\right\}}_{\begin{array}{c}k\in \left[P\right]\\ i\in \left[n\right]\end{array}}\right)$$

and the extracted shares held by corrupted parties,

$$\left\{{\overline{r}}_{k,i}^{\left(b\right)}:k\in \left[P\right],P_i\in \mathcal{C}\right\}.$$

During generation of batch b, $\mathcal{A}$ observes the honest public ephemeral inputs

$$R_i^{\left(b\right)}=\left[r_i^{\left(b\right)}\right]G$$

and may choose the inputs of corrupted dealers after observing these values. Let

$${\overline{\mathbf{r}}}^{\left(b\right)}={({\overline{r}}_1^{\left(b\right)},\dots ,{\overline{r}}_P^{\left(b\right)})}^{\mathsf{T}}$$

denote the extracted presignature-scalar vector. Its adversarial bias must admit the representation

$${\overline{\mathbf{r}}}^{\left(b\right)}=U^{\left(b\right)}{\mathbf{r}}_{\mathrm{H}}^{\left(b\right)}+{\mathbf{u}}^{\prime \left(b\right)}(modN),$$

where ${\mathbf{r}}_{\mathrm{H}}^{\left(b\right)}$ contains the selected honest ephemeral inputs, $U^{\left(b\right)}$ has full row rank P, and ${\mathbf{u}}^{\prime \left(b\right)}$ is the affine offset induced by corrupted inputs. This is the full-rank bias condition used in Shoup’s combined game.

Signing queries.The adversary may also make many signing queries. A signing query has the form

$$A=\left(\mathsf{requestID},m,{\mathsf{batchID}}^{\left(b\right)},k\right),$$

where slot k of batch b is in state $\mathsf{AVAILABLE}$. The ideal assignment service first irrevocably commits A and changes the slot state to $\mathsf{ASSIGNED}$. It computes

$$a=H_{\mathrm{assignment}}\left(\mathsf{requestID},m,{\mathsf{batchID}}^{\left(b\right)},{enc}_8\left(k\right)\right)$$

and

$${\mu }_{\beta }=H_{\mathrm{beacon}}\left(a\right).$$

Only after the assignment is committed does the finalization service reveal the unique certificate

$$\beta =({\mu }_{\beta },{\sigma }_{\beta },{\mathcal{S}}_{\beta }),\left|{\mathcal{S}}_{\beta }\right|\ge t_{\beta }=n-f,$$

which verifies under ${\mathsf{vk}}_{\beta }$. The challenger then derives

$$\delta =H_{\delta }\left({\sigma }_{\beta },D,{\mathsf{batchID}}^{\left(b\right)},{enc}_8\left(k\right),\mathsf{requestID},m\right)modN,$$

sets

$$R^{\prime }={\overline{R}}_k^{\left(b\right)}+\left[\delta \right]G,h=H_c(D,R^{\prime },m)modN,$$

and returns the resulting Schnorr signature

$$\sigma =(R^{\prime },z),z={\overline{r}}_k^{\left(b\right)}+\delta +hd(modN).$$

The slot is then permanently marked $\mathsf{CONSUMED}$ and cannot be used in another signing query.

Forgery.Finally, $\mathcal{A}$ outputs

$$(m^{★},{\sigma }^{★}),{\sigma }^{★}=(R^{★},z^{★}).$$

The adversary wins if

$$\mathsf{Verify}(D,m^{★},{\sigma }^{★})=\mathsf{Accept},$$

equivalently, if, for $h^{★}=H_c(D,R^{★},m^{★})modN,$

$$\left[z^{★}\right]G=R^{★}+\left[h^{★}\right]D,$$

and $m^{★}$ was not the message of any previous successful signing query.

For a probabilistic polynomial-time adversary $\mathcal{A}$, define its SRTS EUF-CMA advantage by

$${Adv}_{\mathrm{SRTS}}^{\mathrm{euf}-\mathrm{cma}}\left(\mathcal{A}\right):=Pr\left[{\mathsf{Exp}}_{\mathrm{SRTS}}^{\mathrm{euf}-\mathrm{cma}}\left(\mathcal{A}\right)=1\right],$$

where the probability is taken over the randomness of the challenger, the honest parties, the assumed ideal services, and the random oracles. We say that SRTS is conditionally EUF-CMA secure in the rerandomized biased-presignature model if this advantage is negligible for every probabilistic polynomial-time adversary satisfying the corruption bound in Section 6.1.

Corollary 1 

(Conditional EUF-CMA security of SRTS). Assume that:

(i)

at most $f<t$ parties are statically corrupted;

(ii)

the long-term DKG, verifiable input-sharing, ACS, consensus, finalization, and one-use-state services satisfy the requirements of Section 6.1;

(iii)

for every batch b, the honest-column submatrix $U^{\left(b\right)}$ of the extraction matrix has row rank P;

(iv)

every assignment A is irrevocably committed before its unique certificate β becomes predictable;

(v)

every presignature slot is used at most once; and

(vi)

$H_c,H_{\delta }:{\{0,1\}}^{*}\to {\mathbb{Z}}_N$ are independent random oracles.

Then the experiment of Definition 8 maps to Shoup’s enhanced attack game for batch randomness extraction with rerandomized presignatures. Consequently, in the EC-GGM and the random-oracle model,

$${Adv}_{\mathrm{SRTS}}^{\mathrm{euf}-\mathrm{cma}}\left(\mathcal{A}\right)=O\left({\displaystyle \frac{q_{\mathrm{qry}}^2}{N}}+{\displaystyle \frac{q_{\mathrm{qry}}}{M_c}}\right),$$

where $q_{\mathrm{qry}}$ bounds the adversary’s total relevant query budget and $M_c=|Range\left(H_c\right)|$. When $Range\left(H_c\right)={\mathbb{Z}}_N$, this simplifies to $O(q_{\mathrm{qry}}^2/N)$.

Proof 

(Mapping to Shoup’s enhanced attack game). The agreed honest ephemeral inputs are uniform, while corrupted inputs may depend on their public values. Because every P-column submatrix of W is nonsingular and I contains at least $Q-f=P$ honest inputs, let ${\mathcal{H}}^{\left(b\right)}$ denote the positions of the honest dealers in $I^{\left(b\right)}$ and set $U^{\left(b\right)}=W_{[:,{\mathcal{H}}^{\left(b\right)}]}$. This matrix has row rank P and gives the honest linear component required by Shoup’s bias model; corrupted columns contribute the adversarial affine offset ${\mathbf{u}}^{\prime \left(b\right)}$. Algorithm 1 therefore realizes the fixed-P instance of the batch-bias interface in Shoup’s Section 4.1.

For a signing request, A and its unused slot are fixed before the unique certificate signature becomes predictable. On the corresponding fresh $H_{\delta }$ input, the derived $\delta$ has the ideal random-shift distribution, and $R^{\prime }={\overline{R}}_k+\left[\delta \right]G$. The slot is then removed permanently, and $H_c(D,R^{\prime },m)$ supplies the Schnorr challenge. These are precisely the full-rank bias, fresh random-beacon rerandomization, and one-use conditions of the enhanced attack game. SRTS uses a distinct shift for each assigned request and is therefore a special case of that game.

Shoup’s Section 4.2 gives the random-oracle reduction for this combined mode, while the EC-GGM analysis summarized in Section 4.3.1 inherits the concrete bound of Shoup’s Theorem 2. Appendix C.3 describes its threshold realization using a random beacon, and Appendix C.3.1 gives the consensus-piggybacked unique-threshold-signature interpretation used by the primary SRTS scenario. Therefore a successful adversary in Definition 8 induces an adversary in Shoup’s game with the stated EC-GGM+ROM bound.

The mapping is conditional on the ideal services. Replacing them by real protocols adds their distinguishing advantages or failure probabilities.    □

For bookkeeping, if ${\epsilon }_{\mathrm{ext}}$ denotes the sum of the failure or distinguishing terms of the selected key-generation, VSS/MPC, ACS, finalization, one-use storage, transcript-binding, and hash-to-scalar realizations, a real-system statement can only have the schematic form

$${Adv}_{\mathrm{SRTS},\mathrm{real}}^{\mathrm{euf}}\le {Adv}_{\mathrm{Shoup}}^{\mathrm{CMA}-\mathrm{BRE}}+{\epsilon }_{\mathrm{ext}}.$$

No concrete value for ${\epsilon }_{\mathrm{ext}}$ is claimed until those services are instantiated and analyzed.

6.3. Conditional Share Confidentiality

Share confidentiality is inherited from the assumed long-term DKG and ephemeral input-sharing functionalities; it is not a separate security property proved by the SRTS signing layer. For a fixed corrupted set $\mathcal{C}$ with $\left|\mathcal{C}\right|<t$, degree-$(t-1)$ Shamir shares held by $\mathcal{C}$ reveal no additional information about the shared scalar beyond the prescribed public transcript and outputs of the sharing functionality. Local linear extraction preserves the sharing degree and therefore does not lower the reconstruction threshold.

This statement is information-theoretic only for the Shamir shares considered without public scalar commitments. In the complete construction, the public points $D=\left[d\right]G$, $D_i=\left[d_i\right]G$, ${\overline{R}}_k=\left[{\overline{r}}_k\right]G$, and the Feldman-style coefficient commitments hide their corresponding scalars computationally under the discrete-logarithm assumption. The statement also assumes protected honest-party storage and does not cover mobile corruption, side-channel leakage, rollback, or the accumulation of t shares over time.

6.4. Security-Critical Rerandomization and One-Use

The following results isolate the ordering and persistent-state assumptions used in Corollary 1.

Lemma 1 

(Conditional fresh-shift property). Suppose an unused slot and its complete assignment are irrevocably fixed before the unique certificate signature is predictable. If the resulting input to the independent random oracle $H_{\delta }$ has not previously been queried, then δ is fresh in ${\mathbb{Z}}_N$ from the adversary’s view at assignment time and $R^{\prime }={\overline{R}}_k+\left[\delta \right]G$ has the shifted distribution required by Shoup’s game.

Ordering alone is insufficient: naming a public hash a beacon does not make its input unpredictable. Certificate prediction, equivocal assignments, transcript collisions, or pre-querying the eventual $H_{\delta }$ input must be excluded or charged to the corresponding external failure term.

Proposition 2 

(Nonce reuse remains fatal). If the same presignature scalar $\overline{r}$ is used in two accepted transcripts with distinct challenges $h_1\ne h_2$, then public rerandomization does not protect the signing key. From $z_j=\overline{r}+{\delta }_j+h_{j}d$, $j\in \{1,2\}$, one computes

$$d=(z_1-z_2-{\delta }_1+{\delta }_2){(h_1-h_2)}^{-1}modN.$$

Therefore, persistent non-reuse is mandatory.

6.5. Malformed-Share Detection and Liveness Limitations

Given authenticated signer identities and the verification shares $D_i=\left[d_i\right]G$ and ${\overline{R}}_{k,i}=\left[{\overline{r}}_{k,i}\right]G$, the combiner rejects a response $(i,z_i)$ unless

$$\left[z_i\right]G={\overline{R}}_{k,i}+\left[\delta \right]G+\left[h\right]D_i.$$

It aggregates only t distinct responses satisfying this equation and accepts the aggregate only if the final Schnorr verification equation holds. This provides malformed-share detection and prevents an invalid response from corrupting an accepted aggregate. Within an authenticated protocol, the failed check also identifies the signer index associated with the rejected response, but it does not by itself provide public nonrepudiation or a punishment mechanism.

These checks do not guarantee availability. Corrupted or unavailable parties may withhold responses, and signing cannot complete unless at least t valid responses arrive. A responsive selected set uses $O\left(t\right)$ signer-to-combiner transmissions, while committee-wide fallback may solicit up to $O\left(n\right)$ responses. If fewer than t valid shares arrive, or an assumed service fails to terminate, the safe outcome is to abort while keeping the assigned slot permanently unavailable for reuse.

7. Performance Evaluation

This section evaluates SRTS prototype with respect to cryptographic computation, modeled network behavior, analytical message accounting, and external service assumptions. Only cryptographic computation is measured directly on the recorded host. Network delay and completion status are outputs of the deterministic simulator, whereas rounds, transmissions, and encoded byte counts are derived from analytical protocol traces. The consensus assignment and unique finalization certificate required by the primary SRTS view are treated as external assumptions and therefore contribute neither measured computation nor modeled network delay to that view. Consequently, results from these components must not be combined or interpreted as measurements of end-to-end latency, availability, or energy consumption in a deployed UAV system.

7.1. Implementation, Boundaries, and Experimental Design

SRTS, FROST, and MuSig2 use secp256k1 through coincurve, which invokes native libsecp256k1 operations. tBLS and the optional SRTS beacon use BLS12-381 through the pure-Python py-ecc backend. The SRTS code centrally executes share creation and checking, qualification, batch extraction, slot transitions, and signing in one Python process. It does not implement mutually distrustful executions of malicious-secure DKG/VSS/MPC, ACS, Byzantine consensus, or crash-safe persistent storage. Experiments ran under Python 3.11.15 on the recorded arm64 macOS host.

We evaluate $n\in \{3,5,10,20,50,100\}$, set $f=\lfloor (n-1)/3\rfloor$, and use $Q=n-f$ completed inputs and $P=n-2f$ one-use SRTS slots. Flexible-threshold protocols are tested with strict-Shoup $t=f+1$, majority $t=\lceil (n+1)/2\rceil$, and high $t=n-f$ profiles. Ordinary MuSig2 is evaluated only at $t=n$. Each cryptographic cell has five excluded warmups followed by 30 measurements with secure, unseeded cryptographic randomness.

For a signer stage, participants are modeled as executing in parallel, so that stage contributes the slowest measured signer rather than the sum of all signers. The estimated distributed critical path sums these slowest-signer stages and sequential coordinator stages. Total work instead sums every measured signer and coordinator operation. This accounting avoids equating serial Python execution with distributed latency, but it cannot capture scheduling, contention, or heterogeneous UAV processors.

More precisely, let $\mathcal{S}$ and $\mathcal{C}$ be the ordered signer and coordinator phases, and let $T_{\varphi ,i}$ be signer i’s measured time in signer phase $\varphi$. The two reported computation views are

$$W=\sum _{\varphi \in \mathcal{S}}\sum _{i\in I_{\varphi }}{T}_{\varphi ,i}+\sum _{\varphi \in \mathcal{C}}{T}_{\varphi },C=\sum _{\varphi \in \mathcal{S}}\underset{i\in I_{\varphi }}{max}{T}_{\varphi ,i}+\sum _{\varphi \in \mathcal{C}}{T}_{\varphi },$$

(2)

where W is total work and C is the estimated distributed critical path. For a selected quorum of size t, the SRTS online signer work is $O\left(1\right)$ per selected UAV, coordinator share checking and aggregation are $O\left(t\right)$, final Schnorr verification is $O\left(1\right)$, and the response payload and number of response transmissions are $O\left(t\right)$. These bounds describe the post-finalization cryptographic path, not the excluded agreement services or offline construction.

Because the evaluated schemes do not begin from identical lifecycle states, Table 4 records the exact start of each reported online timing and the material excluded from it. In the “Signers” column, $x/y$ means that x responses are required from a committee of y parties

7.2. Post-Finalization Online Computation

In Figure 1, the left panel sums all measured participant and coordinator work, whereas the right panel estimates the distributed critical path by treating signer computations within a stage as parallel. Both panels use a logarithmic vertical scale. Under the stated boundaries, all implementations require more computation as n increases; SRTS remains below the native FROST and MuSig2 paths, while the much higher tBLS curve primarily reflects the evaluated pure-Python py-ecc backend.

As Table 5 shows, at $n=100$, where $f=33$, $t=51$, and $P=34$, the post-finalization SRTS median is 34.89% below preprocessed FROST. It is 59.01% below ordinary 100-of-100 MuSig2. Thirty observations permit reporting an empirical p95 but are insufficient for a credible p99 estimate or a deadline guarantee.

The separately retained tBLS diagnostic has a median critical path of $27,143.428396$ ms, p95 of $27,422.522510$ ms, median total work of $34,998.476313$ ms, one induced response round, and 51 transmissions. This result characterizes the selected pure-Python py-ecc adapter. It is not used to claim that SRTS is faster than an optimized tBLS implementation. Such a comparison requires a native BLS12-381 threshold implementation measured on the same host and with the same accounting rules.

Figure 2 compares the measured signer critical path as the reconstruction threshold changes from the strict-Shoup setting $t=f+1$, through the majority setting $t=\lceil (n+1)/2\rceil$, to the high setting $t=n-f$. The comparison applies only to implementations with a configurable threshold t-of-n (not including MuSig2). Thus, higher t increases signer and coordinator verification work for all three flexible-threshold implementations. Changing t does not change the SRTS corruption constraint $f<n/3$ or its batch size $P=n-2f$.

7.3. Centralized Setup and Recurring Offline Work

In Figure 3, the left panel reports the median total cost of preparing one recurring offline batch as the committee size n increases, whereas the right panel reports the corresponding amortized cost per one-use slot after division by the common inventory size $P=n-2f$. tBLS is absent from both panels because it does not use a signing-nonce inventory. Figure 4 instead reports the centralized one-time or epoch-level key-setup workloads exercised by the evaluated implementations.

Table 6 gives the exact $n=100$ medians underlying the setup and recurring-offline comparisons, including the number of one-use records in the SRTS batch.

The short SRTS response path is purchased with substantial finite preprocessing. At $n=100$, SRTS needs a median 57.82 s to produce 34 slots, or 1.70066 s per slot. The corresponding prototype medians are 6.48 ms per FROST nonce record and 6.77 ms per MuSig2 nonce record, making SRTS about 262 and 251 times more expensive per offline record, respectively. The 45.55 s SRTS setup value is centralized share-generation/checking algebra plus beacon key setup, not a measurement of a distributed malicious-secure DKG.

Table 7 decomposes the measured SRTS batch cost into ephemeral VSS creation and checking, modeled ACS selection and rechecking, and Vandermonde extraction with verification-share generation. It shows where this implementation spends time. We didn’t separate elliptic-curve operation counts from other code operations. In particular, the modeled ACS path rechecks candidate deals in the same process. Because no distributed VSS/ACS message exchange is implemented, the artifact supplies neither offline radio bandwidth nor deployed offline latency.

7.4. Storage Costs

The following storage estimates are based on encoded cryptographic payloads. They assume 32-byte scalars, 33-byte compressed secp256k1 points, (n=100), (Q=67), and (P=34).

Table 8 applies these assumptions to the secret, public, and metadata components of one SRTS batch and identifies where each component is intended to reside.

Each UAV requires at least 1,120 bytes of secret scalar per batch, of which 32 bytes correspond to its long-term share. This lower bound excludes assignment records, secret-consumption tracking, rollback protection, storage-system overhead, replicas, and erasure mechanisms. The prototype stores all participants’ batch secrets in centralized dictionaries and deletes them once used. It does not implement isolated per-UAV storage or protection against secret reuse following a crash.

Let $T_{\mathrm{batch}}$ denote the median time to generate P new slots and let $\lambda$ be the command-signing demand in requests per second. The observed single-process provisioning rate and the no-restoration drain cost are

$${\mu }_{\mathrm{prov}}={\displaystyle \frac{P}{T_{\mathrm{batch}}}}={\displaystyle \frac{34}{57.8226}}\approx 0.588\mathrm{slots}/\mathrm{s},T_{\mathrm{drain}}={\displaystyle \frac{P}{\lambda }}.$$

(3)

A 1-request/s workload drains 34 slots in 34 s, which is faster than this prototype produces the next batch; at 0.5 request/s, the nominal drain time is 68 s. These are capacity illustrations, not mission demand measurements. Sustainable pre-provisioning would require x plus the ability to overlap the real distributed offline service with signing. Thus, when the adapter has no available slot, it rejects the signing attempt rather than reusing consumed state.

7.5. Modeled Network Behavior

The network models messages within a round concurrently and rounds sequentially, using configured latency, jitter, bandwidth, packet loss, retry, and timeout parameters, but we exclude correlated fading, interference, shared-medium contention, mobility, routing changes, and a deployed Byzantine consensus service. Figure 5 compares the simulated delay of successful online traces across the different network profiles and committee sizes. It isolates network delay from cryptographic computation and from any external consensus or beacon service.

Under the satellite profile and $n=100$, the median successful trace delay is 1.679 s for SRTS, 1.688 s for tBLS, 2.292 s for FROST, and 3.430 s for MuSig2. This ordering follows the one-round versus two-round trace structure and serialized payloads. Figure 6 complements the successful-trace latency results by reporting how often each protocol trace completes under the stated independent-loss and retry model, with error bars are Wilson 95% intervals over 1,000 paired-seed trials.

With the configured retries at 5% independent loss, SRTS and tBLS complete 1,000/1,000 trials, while FROST and MuSig2 complete 999/1,000. The Wilson intervals overlap, so this one-event difference does not support a robustness advantage. It reports only the behavior of the stated simulator, trace boundaries, and retry policy.

7.6. Communication Cost and Beacon Boundary

Figure 7 shows how induced online rounds, transmissions, and encoded application payload scale after the common committed request. Table 9 then gives the exact $n=100$ payload totals under coordinator unicast and under the analytical single-copy-package view, making the accounting assumption behind each byte comparison explicit.

Under coordinator unicast, SRTS uses 99.31% fewer encoded payload bytes than FROST and 99.75% fewer than MuSig2. If each identical coordinator package is counted once, the corresponding differences are approximately 73.7% and 83.0%. SRTS uses 64.0% fewer payload bytes than tBLS in both views. It also has half as many unicast transmissions as FROST and 74.5% fewer than MuSig2. These are application-payload calculations: real wireless multicast requires a radio- and link-layer-specific treatment of headers, reliability, retransmission, contention, and receiver diversity.

To expose the cost hidden by the primary post-finalization boundary, Figure 8 separates SRTS signature-share computation from an optional standalone tBLS beacon and compares the resulting critical paths across committee sizes.

In Figure 8, the left panel decomposes the standalone integration into its tBLS beacon and Schnorr components, while the right panel compares that integration with the primary post-finalization computational cost. The beacon component dominates the evaluated standalone path at every committee size. The primary scope accepts a consensus-supplied assignment and unique finalization certificate; it does not generate a standalone beacon. In the separate standalone scenario, beacon shares, aggregation, certificate delivery, and Schnorr shares induce three rounds after the common-request boundary. At $n=100$, the standalone median critical path is 2,338.94 ms (median 95% CI $[2,328.02,2,371.17]$ ms), and its empirical p95 is 2,438.845 ms. This is 299.50 times the 7.81 ms primary median, with the beacon contributing for 99.665% of the median per-observation fraction. Thus “post-finalization single round” denotes the post-finalization signature-share response, not end-to-end consensus, beacon generation, and signing.

7.7. UAV Deployment Interpretation and Limitations

The evaluation demonstrates the behavior of a cryptographic component prototype under explicit synthetic conditions. It does not validate a deployable UAV security system. Table 10 makes the remaining gaps operationally explicit.

SRTS is attractive only when the deployment already produces a qualifying unique finalization certificate and can safely maintain unused one-use inventory. In that boundary, it returns an ordinary pairing-free Schnorr signature after one response round and has a short measured native secp256k1 component path. It does not have a round-count advantage over tBLS, and the present evidence cannot compare its speed with an optimized BLS12-381 threshold implementation. Its offline workload and persistent one-use state also create lifecycle costs absent from tBLS.

8. Discussion

SRTS is most plausible when a swarm already produces a qualifying unique finalization certificate, can provision presignatures before demand, and can enforce atomic one-time consumption. In that setting, the selected UAVs send only response shares after finalization, and the verifier receives an ordinary Schnorr-form signature. When those services or the protected inventory are unavailable, the short measured response path does not describe the whole system. The alternatives expose the decision boundary. On the one hand, preprocessed FROST requires an additional online delivery stage under this paper’s common boundary. Still, its preprocessing records are much cheaper in the evaluated implementation, and its established design may simplify deployment. On the other hand, tBLS has the same one-response-round structure and no per-command Schnorr nonce inventory, at the cost of pairing-friendly-curve operations and a different signature ecosystem. The present pure-Python tBLS timings cannot rank that alternative against native secp256k1 code. MuSig2 is a useful all-signers reference, but its (n)-of-(n) policy is not a substitute for a Byzantine-tolerant threshold policy. Moreover, the evaluation separates feasibility from deployment. It demonstrates the centralized execution of the cryptographic operations, state transitions, response timing, encoded payload cost, and behavior of deterministic network traces. It does not demonstrate mutually distrustful DKG/VSS/MPC or ACS executions, Byzantine consensus latency, crash-safe erasure, adaptive-corruption security, embedded-UAV energy use, or performance under correlated radio loss and mobility. Consequently, the reported milliseconds and synthetic-network outcomes should be read as reproducible prototype results, not tactical-system bounds.

9. Conclusions

This paper specifies and evaluates SRTS, a Shoup-aligned, batch-extracted threshold Schnorr construction that assigns each presignature slot before revealing a unique finalization certificate. Its main contribution is a concrete secp256k1 prototype with explicit one-use state management and a reproducible comparison with FROST, tBLS, and MuSig2. At $n=100$, post-finalization SRTS achieved a 7.81 ms median critical path, compared with 11.99 ms for FROST and 19.05 ms for MuSig2, while requiring one response round and 51 transmissions. Moreover, its final signature is a standard, pairing-free Schnorr signature. However, this online advantage requires expensive preprocessing: 57.82 s for 34 slots, or 1.70 s per slot. In addition, standalone beacon integration increased the median critical path to 2.34 s, while the tBLS results remain backend-specific diagnostics. Therefore, SRTS offers low post-finalization latency and communication at the cost of finite presignature storage, secure one-time state management, and reliance on assumed DKG, ACS/MPC, consensus, and finalization services. Future work should instantiate these services and evaluate the complete system on representative UAV hardware and networks.