Skip to content
ecdsa.com

Threshold signatures

Schemes in which a private key is split among n parties so that any t of them can jointly produce one ordinary-looking signature while any smaller group learns nothing about the key.
Also written asthreshold signatureFROSTMPC signingt-of-n signatures

Unlike multisig, where n separate signatures are checked by a script or policy, a threshold signature verifies against a single public key with an unmodified verifier, so the signing policy is invisible on-chain or on the wire. Key generation is either distributed (DKG, so the full key never exists anywhere) or done by a trusted dealer who splits a key with Shamir secret sharing.

For Schnorr-family signatures the standard is FROST (RFC 9591, June 2024, Informational): two-round signing with ciphersuites for Ed25519, ristretto255, Ed448, P-256 and secp256k1, producing signatures that ordinary verifiers accept. Threshold ECDSA (protocols such as GG18/GG20, CGGMP21 and DKLs) is much more involved because of the nonce inverse, yet it is common in MPC wallets and custody products. BLS signatures support thresholds almost for free.

The hard parts are operational: nonce handling across concurrent sessions (naive multi-party Schnorr falls to the ROS attack, which MuSig2 and FROST are designed to avoid), identifying a misbehaving participant, refreshing shares without changing the public key, and auditing that the DKG really ran.

Standards and references

All terms