Skip to content
hashkey.bond

Archivecryptography

Threshold Signatures Remove Single Points of Key Failure

t-of-n parties produce one signature without ever assembling the full private key.

Published
Reading time
1 min read

A threshold signature scheme splits a signing key into n shares so that any t can sign, but fewer cannot. The output is a normal signature verifiable with one public key.

Why it matters

  • No key assembly: the private key never exists in one place, even during signing.
  • Fault tolerance: lose up to n - t shares without losing signing ability.
  • Policy: approvals from separate services or regions instead of one HSM.

Constructions

  • FROST (Schnorr): efficient, two rounds, common for Bitcoin-style keys.
  • Threshold ECDSA: more complex, needed for compatibility with existing chains.
  • BLS threshold: constant-size shares and aggregation, pairing-based.

Operational details

  • Session nonces must never be reused; a repeated nonce leaks the key as in plain ECDSA.
  • Share refresh lets you rotate without changing the public key.
  • The coordinator must be authenticated, or a malicious one can mount denial of service.

Takeaway: threshold signing is how you remove the single key without giving up a standard signature. Nonce discipline is still the critical invariant.