閾値署名を使う方法

问题

単一の署名鍵は単一障害点です。漏えいすれば攻撃者は署名を偽造できます。秘密鍵を n 者に分割し、そのうち t 者が協力すれば署名できる一方、t-1 者以下では署名できない閾値署名が必要です。

前提条件

• デジタル署名（ECDSA、EdDSA）の理解
• Shamir のシークレット共有への習熟
• 分散システムとコンセンサスに関する知識

ステップ

1. 1. Choose the threshold signature scheme

   Select between FROST (Flexible Round-Optimized Schnorr Threshold) for Schnorr/EdDSA signatures, threshold ECDSA (GG18, GG20, CMP20 protocols), or BLS threshold signatures (natural aggregation via pairing). FROST is efficient with 2 rounds. Threshold ECDSA supports existing ECDSA infrastructure but is more complex. BLS threshold is elegant but requires pairing-friendly curves. Choose t-of-n: e.g., 3-of-5 means any 3 of 5 parties can sign. Use the ECC and modular arithmetic tools to understand the math.

   入力

   scheme: FROST | threshold: 3-of-5 | curve: Ed25519

   输出

   parties: 5 | signers needed: 3 | rounds: 2

2. 2. Run distributed key generation (DKG)

   Each party runs Distributed Key Generation to jointly create the shared key without any party ever knowing the full private key. Each party generates a random polynomial, shares commitments and evaluations, and derives their key share. The public key is known to all; each party holds only their private key share. No single party can reconstruct the full key. The DKG protocol prevents a malicious party from biasing the key. Use the random generator and hash tools for the protocol.

   入力

   5 parties run DKG protocol

   输出

   public_key: known to all | key_shares: sk_1, sk_2, ..., sk_5 (one per party, secret)

3. 3. Coordinate threshold signing

   To sign a message, at least t parties must participate. A coordinator (can be one of the signers) collects partial signatures from t parties. Each party computes a partial signature using their key share and the message. The coordinator combines the partial signatures into a valid threshold signature. The signature is indistinguishable from a regular signature by the aggregate key. If fewer than t parties participate, no valid signature can be produced. Use the hash tool to compute the message digest.

   入力

   message: transaction data | signers: parties 1, 3, 5 (3 of 5)

   输出

   partial_sigs: σ_1, σ_3, σ_5 | combined: σ (valid threshold signature)

4. 4. Verify and handle dynamic committees

   Verify the threshold signature against the aggregate public key — it validates like a normal signature. For dynamic committees (adding/removing parties): run a refresh/resharing protocol where existing t parties cooperate to generate new shares for the new committee without changing the aggregate key. Proactive refresh periodically updates shares (without changing the key) to limit cumulative exposure. Implement accountability to identify which parties participated in each signature. Use the hash-compare tool for verification.

   入力

   signature: σ | public_key: pk | message: m

   输出

   verify(pk, m, σ) = true | signers: {1, 3, 5} | threshold met

期待される結果

秘密鍵を n 者に分散し、t-of-n での署名を必要とするしきい値署名システム。単一の侵害点がなく、署名は標準の署名と区別できません。

よくあるエラー

Using Shamir's Secret Sharing to split an existing key

This requires the key to exist whole at some point, creating a single point of compromise. Use Distributed Key Generation (DKG) where the key is never assembled in one place.

Not protecting against malicious parties

Use robust threshold schemes with verifiable secret sharing and abort conditions that detect malicious behavior. FROST and CMP20 include malicious security.

Trusting the coordinator with too much information

The coordinator should only see partial signatures, not key shares. Use a rotating coordinator or have each party broadcast partials to all others to avoid a trusted coordinator.

トラブルシューティング指引

• If signing fails, verify that at least t parties participated, their key shares are from the same DKG, and the message hash is consistent across all parties.
• For network communication, use authenticated channels between parties to prevent man-in-the-middle attacks during the signing protocol.
• If a party is offline, the remaining parties can still sign if at least t are available. For critical operations, ensure more than t parties are available for redundancy.

セキュリティ上の制限

• Threshold signatures protect against key compromise but not against t parties colluding — if t or more parties are compromised, the key is effectively compromised.
• All signing operations happen locally at each party; no party ever reveals their key share to others.
• The communication channel between parties must be authenticated and encrypted to prevent protocol manipulation.