OciorBLSts: Fast Composite Threshold Signatures

• OciorBLSts is a cryptographic threshold-signature layer that composes standard TS and layered TS schemes to accelerate certificate formation in asynchronous BFT protocols.
• It employs a dual-path aggregation mechanism where fast layered aggregation offers low-latency performance while the fallback TS ensures robust correctness under adverse conditions.
• The system integrates adaptive key generation and epoch-based refresh to safeguard against Byzantine faults and maintain stable liveness in distributed consensus.

Searching arXiv for the specified paper and closely related threshold-signature / asynchronous BFT context. OciorBLSts is a fast, non-interactive threshold-signature layer introduced as the cryptographic core of the Ocior asynchronous Byzantine fault-tolerant consensus protocol. It is designed for an asynchronous network with reliable authenticated point-to-point channels and an adaptive Byzantine adversary that may corrupt up to $t$ of the $n$ consensus nodes, with the resilience target $n \ge 3t+1$. Rather than being a single conventional threshold BLS construction, it is a composition of two compatible signing systems over the same pairing-based BLS setup: a standard threshold signature scheme $TS$ and a layered threshold signature scheme $LTS$. The composition lets the protocol aggregate votes immediately in the common case while retaining a standard threshold-combine fallback in harder cases, thereby supporting short attested proof of seal (APS) certificates, linear communication, and two-round finality in the good case (Chen, 1 Sep 2025).

1. System model and design objective

OciorBLSts is defined within a system model that combines asynchrony, Byzantine faults, and adaptive corruption. The adversary may choose whom to corrupt during execution, provided that it never exceeds the budget $t$. The signature layer therefore targets adaptive chosen-message security, robustness, and what the paper calls “stable liveness,” meaning that progress is preserved despite adaptive corruptions (Chen, 1 Sep 2025).

The threshold used throughout the signature layer is

$k=\left\lceil \frac{n+t+1}{2}\right\rceil.$

This same threshold is used for both $TS$ and $LTS$. The stated rationale is that any valid final signature must contain enough honest participation to prevent conflicting finality certificates. In operational terms, OciorBLSts is the mechanism that converts asynchronously arriving votes into a short threshold certificate that can be disseminated and verified efficiently.

A central design goal is low-latency certificate formation without surrendering worst-case correctness. The system therefore separates the fast path from the guaranteed path. The fast path is the layered $LTS$ aggregation procedure, which attempts to combine partial signatures incrementally as they arrive. The guaranteed path is the ordinary threshold $n$0 combine, which is slower but works once enough valid shares have been collected. This dual-path structure is the defining architectural feature of OciorBLSts.

2. Composite structure: $n$1 and $n$2

OciorBLSts is explicitly described as a composition layer. Every signer computes a $n$3 vote and an $n$4 vote on the same message in parallel, and every verifier checks both shares in parallel. The two components use the same pairing-based BLS foundation and matching public-key material, including the identity $n$5, but they differ in aggregation behavior and system role (Chen, 1 Sep 2025).

Component	Aggregation mode	Role
$n$6	Standard threshold combine over $n$7 valid shares	Fallback for correctness and liveness
$n$8	Layered incremental aggregation as shares arrive	Fast path for Instantaneous TS Aggregation

The $n$9 component is the familiar BLS threshold construction. It supports the ordinary threshold semantics: any valid set of size $n \ge 3t+1$0 can be combined into a final signature by Lagrange interpolation. The $n \ge 3t+1$1 component is a layered threshold signature scheme whose purpose is not to replace the standard threshold scheme but to accelerate the common case. In the layered design, signatures are combined inside small groups at one layer and then propagated upward as partial signatures for parent groups. The paper characterizes this as “Instantaneous TS Aggregation,” because the aggregator does not wait for all $n \ge 3t+1$2 votes before attempting combination.

A common misconception is to treat OciorBLSts as merely a BLS threshold signature with an optimized implementation. The paper states the opposite: it is not a single conventional threshold BLS construction, but a composition of two compatible signing systems. Another important distinction is that the robustness guarantee of $n \ge 3t+1$3 is explicitly weaker than that of $n \ge 3t+1$4: it is “good-case robust” rather than universally robust. This means that successful layered reconstruction depends on the partial-signature collection having the required structure across layers.

3. Pairing-based foundation and threshold mechanics

The cryptographic foundation is standard pairing-based BLS. Public setup chooses a cyclic group $n \ge 3t+1$5 of prime order $n \ge 3t+1$6, a generator $n \ge 3t+1$7, a target group $n \ge 3t+1$8, and a computable non-degenerate bilinear pairing

$n \ge 3t+1$9

satisfying bilinearity $TS$0, non-degeneracy, and efficient computability. Messages are hashed with a random-oracle hash

$TS$1

This is the common algebraic substrate for both $TS$2 and $TS$3 (Chen, 1 Sep 2025).

In the basic threshold construction, a shared secret $TS$4 is distributed through a degree-$TS$5 polynomial. Each node $TS$6 obtains a share $TS$7, and the corresponding public keys are

$TS$8

A partial signature on message $TS$9 is

$LTS$0

with verification

$LTS$1

A final signature is formed from any chosen index set $LTS$2 of size $LTS$3 by Lagrange interpolation: $LTS$4 Final verification is

$LTS$5

This is the exact threshold machinery used by the fallback $LTS$6 component.

The layered system retains the same BLS-type signature semantics at the algebraic level, but organizes signers into a tree of groups. A group signature at one layer is reused as a partial signature at the next layer. This suggests that OciorBLSts should be read as a threshold-signature architecture rather than as a single standalone primitive: its innovation lies in how compatible BLS-based mechanisms are arranged to trade off best-case latency against worst-case guarantees.

4. Key generation, adaptive security, and epoch refresh

The paper gives two key-generation options: a trusted-dealer version, $LTS$7, and a distributed version, $LTS$8. Both produce matching keypairs for the $LTS$9 and $t$0 parts, with the required identity

$t$1

and the same underlying secret $t$2 (Chen, 1 Sep 2025).

In the dealer version, a degree-$t$3 polynomial is sampled for $t$4, and a family of degree-$t$5 polynomials is sampled for the layered $t$6, subject to

$t$7

with

$t$8

The layered shares are arranged in a tree of groups, with group $t$9 at layer $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$0 corresponding to

$k=\left\lceil \frac{n+t+1}{2}\right\rceil.$1

and with the index maps

$k=\left\lceil \frac{n+t+1}{2}\right\rceil.$2

The distributed key-generation procedure $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$3 is the mechanism used to obtain adaptive security. It is built from three ingredients: a strictly-hiding verifiable secret sharing mechanism $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$4 instantiated via a polynomial-commitment primitive $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$5, an asynchronous partial vector agreement $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$6 protocol, and witness reconstruction. Each node samples a secret $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$7, masks it as $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$8 for a random witness $k=\left\lceil \frac{n+t+1}{2}\right\rceil.$9, and shares both the masked secret and the witness using commitments. The $TS$0 commitment is

$TS$1

where $TS$2 for a degree-$TS$3 polynomial $TS$4.

After share verification, acknowledgments, and agreement on the honest share-distributors via $TS$5, honest nodes reconstruct the witness $TS$6, subtract $TS$7, and derive the actual secret shares and public keys: $TS$8

$TS$9

The paper’s stated claim is that this ADKG is adaptively secure in the algebraic group model under the one-more discrete logarithm assumption.

Epoch-based key refresh is part of the security model. Old private shares are erased when an epoch changes, and node indices for the $LTS$0 are reshuffled each epoch using a random seed generated by a threshold coin/seed protocol. The stated purpose is to improve the odds that Byzantine nodes are evenly spread across groups, thereby making successful layered aggregation more likely in the good case.

5. Instantaneous aggregation and fallback combine

Every signer computes both signatures in parallel: $LTS$1 Every verifier checks both in parallel: $LTS$2 The core operational distinction lies in aggregation (Chen, 1 Sep 2025).

For $LTS$3, the aggregator stores incoming votes according to their layer-$LTS$4 group and local index, then repeatedly checks whether a group has exactly $LTS$5 valid shares. If so, it combines them using

$LTS$6

for a chosen local set $LTS$7 of size $LTS$8, and inserts the result into the next layer’s buffer. This process continues upward until layer $LTS$9 is reached, in which case the final signature is returned. If an intermediate layer does not have enough shares, the procedure stops immediately and returns failure. Because $LTS$0 and $LTS$1 are fixed finite parameters, the paper notes that all relevant Lagrange coefficients for each layer can be precomputed and stored. This is presented as the main reason the best-case aggregation cost drops to $LTS$2.

For the fallback $LTS$3 path, the aggregator stores valid $LTS$4 votes in a dictionary ts[ID]. Once it has collected $LTS$5, it waits for a fixed delay to allow more $LTS$6 shares to arrive; if no $LTS$7 final signature has been produced, it computes

$LTS$8

and delivers the result. This fallback is explicitly described as essential for correctness and liveness, because the $LTS$9 path may fail to satisfy its local thresholds under adversarial or unlucky schedules.

The security proof structure mirrors this decomposition. For $n$00, the adversary should not be able to produce a valid final signature on a fresh message without obtaining at least $n$01 relevant shares. For $n$02, the analogous win condition applies to the layered final signature, but the robustness guarantee is weaker: successful reconstruction is guaranteed only when the layered collection has the required parent structure. The full composition is then argued secure by combining the security of the two underlying schemes with ADKG refresh, epoch-based key erasure, and the requirement that the same message pass both verifications before aggregation.

6. Consensus role, performance claims, and interpretive boundaries

OciorBLSts is the certificate engine for Ocior’s consensus workflow. In the protocol, a proposer sends a [VOTE](https://www.emergentmind.com/topics/vote) message containing both partial signatures. The proposer first attempts instantaneous $n$03 aggregation; if that succeeds, it immediately outputs an APS of the form $n$04. If $n$05 does not complete quickly enough, the proposer falls back to the $n$06 path after collecting $n$07 votes and a short delay. In either case, the final APS is a short threshold signature on the proposal content, and final verification is a single pairing check: $n$08 Because the certificate is a single BLS-style group element, the communication cost is stated to remain linear in $n$09 (Chen, 1 Sep 2025).

The paper attributes several asymptotic properties to this design. Ocior tolerates up to $n$10 faulty nodes for $n$11; the total expected communication per transaction is $n$12; the total computation per transaction is $n$13 in the best case or $n$14 in the worst case; and a legitimate two-party transaction can be finalized with a good-case latency of two asynchronous rounds. That latency bound depends on the threshold layer being able to produce the certificate quickly from arriving votes, which is precisely the role of layered aggregation.

The paper also specifies implementation-oriented parameter choices. Multiple parallel $n$15 instances can be used to increase the probability that at least one layered aggregation succeeds. The parameters $n$16 and $n$17 should be small enough to make coefficient precomputation practical. An explicit example is given with $n$18, $n$19, $n$20, $n$21, $n$22, and $n$23, $n$24, $n$25, yielding $n$26.

Two interpretive boundaries are important. First, the performance discussion is asymptotic rather than benchmark-based: the paper argues that $n$27, ADKG, and signature-broadcast overheads become negligible for sufficiently large transaction volume, but it does not frame the contribution as an empirical microbenchmark study. Second, the fast path is not unconditional. The paper’s own terminology—“good-case robust” and “good-case latency”—indicates that the strongest latency claim relies on favorable partial-signature arrival patterns and successful layered threshold satisfaction. This suggests that OciorBLSts is best understood as a hybrid threshold-signature architecture whose significance lies in reconciling aggressive best-case responsiveness with standard threshold guarantees under adaptive Byzantine faults.