Comment en Utiliser Threshold Signatures

问题

Un single signing clé est un single point de failure — si compromised, un attacker peut forge signatures. You besoin threshold signatures où un privé clé est diviser among n parties, et any t-de-n parties doit cooperate en sign, pendant que aucun subset de t-1 parties peut sign.

Prérequis

• Understanding of digital signatures (ECDSA, EdDSA)
• Familiarity with Shamir's Secret Sharing
• Knowledge of distributed systems and consensus

Étapes

1. 1. Choose the threshold signature scheme

   Select between FROST (Flexible Round-Optimized Schnorr Threshold) for Schnorr/EdDSA signatures, threshold ECDSA (GG18, GG20, CMP20 protocols), or BLS threshold signatures (natural aggregation via pairing). FROST is efficient with 2 rounds. Threshold ECDSA supports existing ECDSA infrastructure but is more complex. BLS threshold is elegant but requires pairing-friendly curves. Choose t-of-n: e.g., 3-of-5 means any 3 of 5 parties can sign. Use the ECC and modular arithmetic tools to understand the math.

   entrée

   scheme: FROST | threshold: 3-of-5 | curve: Ed25519

   输出

   parties: 5 | signers needed: 3 | rounds: 2

2. 2. Run distributed key generation (DKG)

   Each party runs Distributed Key Generation to jointly create the shared key without any party ever knowing the full private key. Each party generates a random polynomial, shares commitments and evaluations, and derives their key share. The public key is known to all; each party holds only their private key share. No single party can reconstruct the full key. The DKG protocol prevents a malicious party from biasing the key. Use the random generator and hash tools for the protocol.

   entrée

   5 parties run DKG protocol

   输出

   public_key: known to all | key_shares: sk_1, sk_2, ..., sk_5 (one per party, secret)

3. 3. Coordinate threshold signing

   To sign a message, at least t parties must participate. A coordinator (can be one of the signers) collects partial signatures from t parties. Each party computes a partial signature using their key share and the message. The coordinator combines the partial signatures into a valid threshold signature. The signature is indistinguishable from a regular signature by the aggregate key. If fewer than t parties participate, no valid signature can be produced. Use the hash tool to compute the message digest.

   entrée

   message: transaction data | signers: parties 1, 3, 5 (3 of 5)

   输出

   partial_sigs: σ_1, σ_3, σ_5 | combined: σ (valid threshold signature)

4. 4. Verify and handle dynamic committees

   Verify the threshold signature against the aggregate public key — it validates like a normal signature. For dynamic committees (adding/removing parties): run a refresh/resharing protocol where existing t parties cooperate to generate new shares for the new committee without changing the aggregate key. Proactive refresh periodically updates shares (without changing the key) to limit cumulative exposure. Implement accountability to identify which parties participated in each signature. Use the hash-compare tool for verification.

   entrée

   signature: σ | public_key: pk | message: m

   输出

   verify(pk, m, σ) = true | signers: {1, 3, 5} | threshold met

Résultat attendu

Un threshold signature système où un privé clé est distributed across n parties, requiring t-de-n en sign, avec aucun single point de compromise et signatures indistinguishable de standard signatures.

Erreurs courantes

Using Shamir's Secret Sharing to split an existing key

This requires the key to exist whole at some point, creating a single point of compromise. Use Distributed Key Generation (DKG) where the key is never assembled in one place.

Not protecting against malicious parties

Use robust threshold schemes with verifiable secret sharing and abort conditions that detect malicious behavior. FROST and CMP20 include malicious security.

Trusting the coordinator with too much information

The coordinator should only see partial signatures, not key shares. Use a rotating coordinator or have each party broadcast partials to all others to avoid a trusted coordinator.

Dépannage指引

• If signing fails, verify that at least t parties participated, their key shares are from the same DKG, and the message hash is consistent across all parties.
• For network communication, use authenticated channels between parties to prevent man-in-the-middle attacks during the signing protocol.
• If a party is offline, the remaining parties can still sign if at least t are available. For critical operations, ensure more than t parties are available for redundancy.

Limites de sécurité

• Threshold signatures protect against key compromise but not against t parties colluding — if t or more parties are compromised, the key is effectively compromised.
• All signing operations happen locally at each party; no party ever reveals their key share to others.
• The communication channel between parties must be authenticated and encrypted to prevent protocol manipulation.