如何Use Threshold Signatures

问题

单个签名键 是单个 point 的失败 — 如果 compromised, attacker 能够 forge signatures. 你 need 阈值 signatures where 私有键 是拆分之中 n parties, 和任何 t-of-n parties 必须 cooperate 到 sign, while 否子集的 t-1 parties 能够 sign.

前置条件

• Understanding 的 digital signatures (ECDSA, EdDSA)
• 熟悉Shamir's Secret Sharing
• Knowledge 的 distributed systems 和 consensus

步骤

1. 1. Choose the threshold signature scheme

   Select between FROST (Flexible Round-Optimized Schnorr Threshold) for Schnorr/EdDSA signatures, threshold ECDSA (GG18, GG20, CMP20 protocols), or BLS threshold signatures (natural aggregation via pairing). FROST is efficient with 2 rounds. Threshold ECDSA supports existing ECDSA infrastructure but is more complex. BLS threshold is elegant but requires pairing-friendly curves. Choose t-of-n: e.g., 3-of-5 means any 3 of 5 parties can sign. Use the ECC and modular arithmetic tools to understand the math.

   输入

   scheme: FROST | threshold: 3-of-5 | curve: Ed25519

   输出

   parties: 5 | signers needed: 3 | rounds: 2

2. 2. Run distributed key generation (DKG)

   Each party runs Distributed Key Generation to jointly create the shared key without any party ever knowing the full private key. Each party generates a random polynomial, shares commitments and evaluations, and derives their key share. The public key is known to all; each party holds only their private key share. No single party can reconstruct the full key. The DKG protocol prevents a malicious party from biasing the key. Use the random generator and hash tools for the protocol.

   输入

   5 parties run DKG protocol

   输出

   public_key: known to all | key_shares: sk_1, sk_2, ..., sk_5 (one per party, secret)

3. 3. Coordinate threshold signing

   To sign a message, at least t parties must participate. A coordinator (can be one of the signers) collects partial signatures from t parties. Each party computes a partial signature using their key share and the message. The coordinator combines the partial signatures into a valid threshold signature. The signature is indistinguishable from a regular signature by the aggregate key. If fewer than t parties participate, no valid signature can be produced. Use the hash tool to compute the message digest.

   输入

   message: transaction data | signers: parties 1, 3, 5 (3 of 5)

   输出

   partial_sigs: σ_1, σ_3, σ_5 | combined: σ (valid threshold signature)

4. 4. Verify and handle dynamic committees

   Verify the threshold signature against the aggregate public key — it validates like a normal signature. For dynamic committees (adding/removing parties): run a refresh/resharing protocol where existing t parties cooperate to generate new shares for the new committee without changing the aggregate key. Proactive refresh periodically updates shares (without changing the key) to limit cumulative exposure. Implement accountability to identify which parties participated in each signature. Use the hash-compare tool for verification.

   输入

   signature: σ | public_key: pk | message: m

   输出

   verify(pk, m, σ) = true | signers: {1, 3, 5} | threshold met

预期结果

阈值签名系统 where 私有键 是 distributed across n parties, requiring t-of-n 到 sign, 具有否 单个 point 的 compromise 和 signatures indistinguishable 从标准 signatures.

常见错误

Using Shamir's Secret Sharing to split an existing key

This requires the key to exist whole at some point, creating a single point of compromise. Use Distributed Key Generation (DKG) where the key is never assembled in one place.

Not protecting against malicious parties

Use robust threshold schemes with verifiable secret sharing and abort conditions that detect malicious behavior. FROST and CMP20 include malicious security.

Trusting the coordinator with too much information

The coordinator should only see partial signatures, not key shares. Use a rotating coordinator or have each party broadcast partials to all others to avoid a trusted coordinator.

排障指引

• If signing fails, verify that at least t parties participated, their key shares are from the same DKG, and the message hash is consistent across all parties.
• For network communication, use authenticated channels between parties to prevent man-in-the-middle attacks during the signing protocol.
• If a party is offline, the remaining parties can still sign if at least t are available. For critical operations, ensure more than t parties are available for redundancy.

安全限制

• Threshold signatures protect against key compromise but not against t parties colluding — if t or more parties are compromised, the key is effectively compromised.
• All signing operations happen locally at each party; no party ever reveals their key share to others.
• The communication channel between parties must be authenticated and encrypted to prevent protocol manipulation.