The parties operate synchronously over pairwise secure channels and authenticated broadcast. A polynomial-time mixed adversary may passively observe and actively control parties within each phase, and its corrupted set may move between refresh periods.

1. threat model

   Separate secrecy, correctness, fairness, and robustness thresholds

   defined

   The paper assigns distinct multi-thresholds to secrecy, correctness, fairness, and robustness; a claim at one threshold must not be read as establishing the others. Robustness is generally limited to one or two active faults.

   Network, mixed adversary, and security properties · Robustness, threshold, batching, and synchrony boundaries
2. assumption

   Commitment and erasure assumptions

   computational assumption

   Active-fault checking uses Pedersen-style homomorphic commitments and computational security under discrete-log hardness; proactive security also relies on phase separation, reset or recovery, and disposal of obsolete state.

   Commitments and bivariate-polynomial assumptions · Network, mixed adversary, and security properties

A degree-d bivariate polynomial stores secrets at public diagonal points. A party holds a univariate slice, enabling the batch to be refreshed, recovered, reconstructed, and redistributed without exposing the embedded secrets.

1. scheme

   Sublinear threshold loss under batching

   specified

   The bivariate encoding replaces the usual linear loss in corruption tolerance with a square-root dependence on batch size and supports up to n minus 2 embedded secrets in the maximum batch.

   Problem, contributions, and asymptotic comparison · Static batched-PSS correctness, secrecy, and communication
2. protocol

   Share, Recover, Reconstruct, and Refresh

   specified

   Share distributes polynomial slices; Recover replaces a missing slice with blinded assistance; Reconstruct builds a gradual ladder for fair release; and Refresh adds a zero-encoding random bivariate sharing to rerandomize state.

   Bivariate Share, Recover, Reconstruct, and Refresh
3. protocol

   Dynamic membership protocols

   specified

   Increase and Decrease adjust the sharing degree as parties join or cooperate in leaving, while DecreaseCorrupt handles one non-participating failed or corrupted departure; Redistribute composes these operations for group changes.

   Increase, Decrease, DecreaseCorrupt, and Redistribute

Theorems establish static and dynamic PSS correctness and secrecy under stated mixed-adversary thresholds, together with fairness and amortized communication results.

1. claim

   O(n squared) amortized communication

   asymptotic theorem

   With a maximum-size batch, the paper reports O(n squared) communication per secret overall, versus O(n cubed) for its single-secret specialization and O(n to the fourth) for the compared prior dishonest-majority construction.

   Problem, contributions, and asymptotic comparison · Static batched-PSS correctness, secrecy, and communication · Increase, Decrease, DecreaseCorrupt, and Redistribute
2. claim

   Mixed-adversary security and fairness

   proved under model

   The theorem statements give secrecy and correctness thresholds with a square-root batch-size loss and a separate gradual-reconstruction fairness region; they do not claim robustness at the full dishonest-majority threshold.

   Static batched-PSS correctness, secrecy, and communication · Ideal functionalities, simulators, and full proofs · Robustness, threshold, batching, and synchrony boundaries
3. claim

   Dynamic redistribution preserves the shared secret

   proved under model

   Theorem 3 composes the five principal protocols into a dynamic PSS scheme whose new group receives a fresh sharing of the same batch, subject to the old and new phases satisfying the stated thresholds.

   Increase, Decrease, DecreaseCorrupt, and Redistribute · Ideal functionalities, simulators, and full proofs

The construction is synchronous and computational, assumes secure channels and authenticated broadcast, loses threshold as the batch grows, is not robust against a general active dishonest majority, and offers asymptotic analysis rather than an implementation or deployment evaluation.

1. limitation

   Departure constraints

   explicitly scoped

   Cooperative Decrease requires leaving parties to participate, while DecreaseCorrupt handles only one non-participating departure at a time; broader churn behavior is not established by that subprotocol.

   Increase, Decrease, DecreaseCorrupt, and Redistribute