BA-02 · LESSON 08

Threshold cryptography

KEY DEFINITIONS

Terms used in this lesson

FROST: Flexible Round-Optimized Schnorr Threshold signing: a protocol in which a required subset produces one group signature.
Schnorr signature: Bitcoin’s Taproot signature scheme, whose algebra supports compact verification and advanced multi-party signing.

Threshold signing divides authority among several participants. A required number can create one valid group signature without combining their secret shares.

65 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · cryptographyFrom secret material to a verifiable commitmentSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
INPUTMessage or scalar
The exact byte string or private scalar is the starting state.
02
DOMAINTag and encoding
Domain separation and serialization decide which bytes the primitive commits to.
03
PRIMITIVEThreshold cryptography
This lesson isolates the exact operation used by Threshold cryptography.
04
ARTIFACTDigest, point, or signature
The result is fixed-size and can be passed to a verifier.
05
CHECKSame bytes, same rule
A changed message, domain, key, or encoding must fail the intended verification.

Rule shown: One-way operations expose a checkable result without exposing the secret input.

STAGE 1 OF 5INPUT: Message or scalar

The exact byte string or private scalar is the starting state.

Governing relationship: One-way operations expose a checkable result without exposing the secret input. Complete path: 1. INPUT, Message or scalar. The exact byte string or private scalar is the starting state. 2. DOMAIN, Tag and encoding. Domain separation and serialization decide which bytes the primitive commits to. 3. PRIMITIVE, Threshold cryptography. This lesson isolates the exact operation used by Threshold cryptography. 4. ARTIFACT, Digest, point, or signature. The result is fixed-size and can be passed to a verifier. 5. CHECK, Same bytes, same rule. A changed message, domain, key, or encoding must fail the intended verification.

1. State transitionWhat exists, what changes, and what results

BEFORE

Participants A, B, and C hold shares. A transaction requires one signature under their group public key.

MECHANISM

A dealer or distributed key generation protocol gives each participant a share related to one group public key. No single share equals the group private key.

AFTER

Threshold signing removes a single key holder, not the need for honest policy or an available threshold.

Text equivalent: Starting from Participants A, B, and C hold shares. A transaction requires one signature under their group public key. The mechanism begins when A dealer or distributed key generation protocol gives each participant a share related to one group public key. No single share equals the group private key. The resulting lesson is Threshold signing removes a single key holder, not the need for honest policy or an available threshold.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 6

Create distributed shares

A dealer or distributed key generation protocol gives each participant a share related to one group public key. No single share equals the group private key.

Complete path: 1. Create distributed shares: A dealer or distributed key generation protocol gives each participant a share related to one group public key. No single share equals the group private key. 2. Choose a signing subset: At least t available participants agree on the exact message and participant list for one signing session. 3. Commit fresh nonces: Each signer creates session-specific secret nonces and publishes commitments. Binding nonces to the message and participant set prevents replay and substitution. 4. Produce signature shares: Each participant combines its key share, nonce, challenge, and interpolation weight into a verifiable contribution. An interpolation weight is the coefficient that lets the selected subset's shares reconstruct the correct group equation without reconstructing the secret key. 5. Aggregate one signature: Valid shares combine into one standard signature under the group public key. Fewer than t shares cannot produce it under the scheme's assumptions. 6. Separate custody from policy: Threshold signing limits unilateral key use, but t malicious or mistaken signers can still authorize a bad message. Each signer needs independent policy checks.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

At least t message- and participant-bound, individually verified shares must aggregate under the group public key.

CHANGED CONDITION

Below-threshold availability stalls signing, one bad share blocks aggregation, and a malicious qualifying quorum can still authorize a bad message.

Important distinction: A t-of-n threshold signature requires reconstructing the private key whenever t signers participate. Modern threshold signing combines signature shares while the complete private key remains unreconstructed. Reconstructing it would create an unnecessary single point of compromise.

Text equivalent: The accepted path is enforced by At least t message- and participant-bound, individually verified shares must aggregate under the group public key. If the required condition changes, Below-threshold availability stalls signing, one bad share blocks aggregation, and a malicious qualifying quorum can still authorize a bad message.

Loading lesson visuals...

Learn the idea

Threshold cryptography splits authority across participants so any qualifying subset can perform an operation while smaller subsets cannot. A t-of-n threshold requires at least t of n participants. Shamir secret sharing encodes one secret as points on a polynomial so a threshold can reconstruct it; modern threshold signing instead uses related shares to produce one signature without reconstructing the whole private key. FROST (Flexible Round-Optimized Schnorr Threshold signatures) is one such multi-party protocol; this lesson's small arithmetic trace teaches the shape of a round, not production FROST.

GUIDED EXPLANATION1/6 ideas inspected

Create distributed shares

A dealer or distributed key generation protocol gives each participant a share related to one group public key. No single share equals the group private key.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A t-of-n threshold signature requires reconstructing the private key whenever t signers participate.”

Modern threshold signing combines signature shares while the complete private key remains unreconstructed. Reconstructing it would create an unnecessary single point of compromise.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.