Cómo a Usar Threshold Signatures

问题

Un single signing clave es un single point de failure — si compromised, un attacker puede forge signatures. You necesitar threshold signatures donde un privado clave es dividir among n parties, y any t-de-n parties debe cooperate a sign, mientras no subset de t-1 parties puede sign.

Requisitos previos

• Understanding of digital signatures (ECDSA, EdDSA)
• Familiarity with Shamir's Secret Sharing
• Knowledge of distributed systems and consensus

Pasos

1. 1. Choose the threshold signature scheme

   Select between FROST (Flexible Round-Optimized Schnorr Threshold) for Schnorr/EdDSA signatures, threshold ECDSA (GG18, GG20, CMP20 protocols), or BLS threshold signatures (natural aggregation via pairing). FROST is efficient with 2 rounds. Threshold ECDSA supports existing ECDSA infrastructure but is more complex. BLS threshold is elegant but requires pairing-friendly curves. Choose t-of-n: e.g., 3-of-5 means any 3 of 5 parties can sign. Use the ECC and modular arithmetic tools to understand the math.

   entrada

   scheme: FROST | threshold: 3-of-5 | curve: Ed25519

   输出

   parties: 5 | signers needed: 3 | rounds: 2

2. 2. Run distributed key generation (DKG)

   Each party runs Distributed Key Generation to jointly create the shared key without any party ever knowing the full private key. Each party generates a random polynomial, shares commitments and evaluations, and derives their key share. The public key is known to all; each party holds only their private key share. No single party can reconstruct the full key. The DKG protocol prevents a malicious party from biasing the key. Use the random generator and hash tools for the protocol.

   entrada

   5 parties run DKG protocol

   输出

   public_key: known to all | key_shares: sk_1, sk_2, ..., sk_5 (one per party, secret)

3. 3. Coordinate threshold signing

   To sign a message, at least t parties must participate. A coordinator (can be one of the signers) collects partial signatures from t parties. Each party computes a partial signature using their key share and the message. The coordinator combines the partial signatures into a valid threshold signature. The signature is indistinguishable from a regular signature by the aggregate key. If fewer than t parties participate, no valid signature can be produced. Use the hash tool to compute the message digest.

   entrada

   message: transaction data | signers: parties 1, 3, 5 (3 of 5)

   输出

   partial_sigs: σ_1, σ_3, σ_5 | combined: σ (valid threshold signature)

4. 4. Verify and handle dynamic committees

   Verify the threshold signature against the aggregate public key — it validates like a normal signature. For dynamic committees (adding/removing parties): run a refresh/resharing protocol where existing t parties cooperate to generate new shares for the new committee without changing the aggregate key. Proactive refresh periodically updates shares (without changing the key) to limit cumulative exposure. Implement accountability to identify which parties participated in each signature. Use the hash-compare tool for verification.

   entrada

   signature: σ | public_key: pk | message: m

   输出

   verify(pk, m, σ) = true | signers: {1, 3, 5} | threshold met

Resultado esperado

Un threshold firma sistema donde un privado clave es distributed across n parties, requiring t-de-n a sign, con no single point de compromise y signatures indistinguishable de estándar signatures.

Errores comunes

Using Shamir's Secret Sharing to split an existing key

This requires the key to exist whole at some point, creating a single point of compromise. Use Distributed Key Generation (DKG) where the key is never assembled in one place.

Not protecting against malicious parties

Use robust threshold schemes with verifiable secret sharing and abort conditions that detect malicious behavior. FROST and CMP20 include malicious security.

Trusting the coordinator with too much information

The coordinator should only see partial signatures, not key shares. Use a rotating coordinator or have each party broadcast partials to all others to avoid a trusted coordinator.

Solución de problemas指引

• If signing fails, verify that at least t parties participated, their key shares are from the same DKG, and the message hash is consistent across all parties.
• For network communication, use authenticated channels between parties to prevent man-in-the-middle attacks during the signing protocol.
• If a party is offline, the remaining parties can still sign if at least t are available. For critical operations, ensure more than t parties are available for redundancy.

Límites de seguridad

• Threshold signatures protect against key compromise but not against t parties colluding — if t or more parties are compromised, the key is effectively compromised.
• All signing operations happen locally at each party; no party ever reveals their key share to others.
• The communication channel between parties must be authenticated and encrypted to prevent protocol manipulation.