ROPSCON: Linear BFT from Schnorr Threshold Signatures

Existing linear Byzantine fault-tolerant (BFT) protocols heavily rely on Threshold Signatures (TS) to reduce communication complexity. The threshold signatures used and implemented in these BFT protocols should be non-interactive and all such schemes rely on heavy pairing operations. Threshold signatures using no pairings such as Schnorr TS are computationally more efficient but require multiple rounds of interaction and lack robustness. There has been a long-standing question on whether one could build more efficient BFT protocols from such pairing-free signatures. In this paper, we develop a novel approach that allows using threshold signatures like Schnorr TS in linear BFT protocols in an effective manner. In this approach, we can significantly reduce the interaction overhead caused by Schnorr TS while maintaining its computational efficiency. We instantiate a HotStuff-style BFT protocol called ROPSCON and show that ROPSCON achieves up to 2.2× higher throughput compared to both HotStuff protocols using pairings as well as ones with directly aggregated signatures. The improvement is particularly evident in high-delay and lowbandwidth environments.