This document specifies the Flexible Round-Optimized Schnorr Threshold (FROST) signing protocol.
FROST signatures can be issued after a threshold number of entities cooperate to
compute a signature, allowing for improved distribution of trust and
redundancy with respect to a secret key. FROST depends only on a prime-order group and cryptographic
hash function. This document specifies a number of ciphersuites to instantiate FROST using different
prime-order groups and hash functions. One such ciphersuite can be used to produce signatures
that can be verified with an Edwards-Curve Digital Signature Algorithm (EdDSA, as defined in RFC8032)
compliant verifier. However, unlike EdDSA, the signatures produced by FROST are not deterministic.
This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.