Threshold Signature Schemes: Concepts

Traditional digital signatures use a single private key held by one party. If that key is compromised, stolen, or lost, all signatures made with it are potentially forged and the key cannot be recovered. High-value signing operations — code signing for operating systems, certificate authority key ceremonies, cryptocurrency wallet control — require stronger protection than any single party can provide.

Shamir's Secret Sharing (SSS), invented in 1979, splits a secret s into n shares such that any t shares can reconstruct s, but fewer than t shares reveal nothing. The scheme uses polynomial interpolation over a finite field: s is the constant term of a random degree-(t-1) polynomial, and the shares are evaluations of this polynomial at distinct points. SSS is information-theoretically secure.

A naive approach to threshold signing would use SSS to split a private key, have t parties reconstruct it, and sign. This defeats the purpose: reconstructing the private key means it exists in one place and is vulnerable. True threshold signatures allow t parties to collaboratively produce a signature without any party ever learning or assembling the full private key. The key is never reconstructed.

A (t, n) threshold signature scheme involves n parties each holding a share of a private key. A signature can be produced by any t parties working together through an interactive protocol. The resulting signature is identical to what a regular signature would look like (verifiable with the group public key). An adversary learning up to t-1 shares learns nothing about the private key.

Interactive threshold signing requires multiple rounds of communication between the signing parties. Parties exchange commitments, proofs, and partial signatures that are then combined. Non-interactive variants (where parties pre-compute certain values) reduce the online signing round to a single message. For applications like hardware wallets where latency matters, minimizing rounds is important.

Standard SSS provides no way for a share holder to verify their share is correct — a malicious dealer could distribute inconsistent shares. Verifiable Secret Sharing (VSS) adds commitments to the polynomial coefficients, allowing each share holder to verify their share is consistent with the public commitment without learning other shares. Feldman VSS and Pedersen VSS are the standard constructions.

Threshold signatures require a distributed key generation (DKG) protocol to set up the shared key without any single party knowing the full private key. Without DKG, a trusted dealer would generate the key and split it, creating a trusted party who knows the key. DKG eliminates this trusted dealer requirement, which is critical for trustless applications like blockchain custody.

Institutional cryptocurrency custody is the highest-value deployment of threshold signatures today. Coinbase, Fireblocks, and Anchorage use multi-party computation (MPC) wallets based on threshold ECDSA to secure billions of dollars in assets. Instead of a single hardware security module holding a private key, the key is split across multiple geographically distributed servers. No single breach compromises the funds.

The DNSSEC root zone Key Signing Key (KSK) ceremony uses a variant of secret sharing with HSM clusters and a quorum of trusted community members. The ceremony requires a physical quorum (7 of 14 worldwide cryptographic officers) to sign the root zone. Nuclear command authorization systems use similar split-key principles where multiple authorized parties must cooperate to authorize sensitive operations.

Blockchain platforms support on-chain multi-signature: a transaction requires signatures from t of n specified public keys, all verified on-chain. This is transparent, simple, and secure but reveals the multi-sig structure and requires multiple on-chain operations. Threshold ECDSA produces a single signature from a single apparent public key, hiding the threshold structure completely and using only one on-chain operation.

Threshold signature security is analyzed against a static or adaptive adversary who can corrupt up to t-1 parties. A static adversary chooses which parties to corrupt before the protocol begins; an adaptive adversary chooses based on observed messages. Adaptive security is harder to achieve and requires more complex protocols. Most deployed threshold ECDSA protocols prove security against static adversaries.

Why is Shamir's Secret Sharing alone insufficient for a secure threshold signature scheme?

Threshold signatures allow t-of-n parties to sign without reconstructing the private key. Shamir's Secret Sharing alone is insufficient because it requires key reconstruction. True threshold schemes use multi-party computation where the key is never assembled. Applications include institutional crypto custody (Coinbase, Fireblocks), DNSSEC key ceremonies, and critical infrastructure. Threshold ECDSA produces a standard single signature, unlike on-chain multi-sig which reveals threshold structure.