BA-07 · LESSON 08

FROST

KEY DEFINITIONS

Terms used in this lesson

FROST: Flexible Round-Optimized Schnorr Threshold signing: a protocol in which a required subset produces one group signature.
Schnorr signature: Bitcoin’s Taproot signature scheme, whose algebra supports compact verification and advanced multi-party signing.
CFRG: Crypto Forum Research Group: the Internet Research Task Force group that develops and reviews cryptographic guidance.
RFC9591: The published CFRG document specifying two-round FROST threshold Schnorr signing and its ciphersuites.
BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.

Flexible Round-Optimized Schnorr Threshold signing coordinates nonce commitments and signature shares from a threshold subset.

65 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · taproot treeAn internal key and hidden script tree commit one Taproot outputSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
INTERNAL KEYX-only point P
The internal public key is combined with a tagged commitment to the script tree.
02
TAPTREETapLeaf and TapBranch
Leaf scripts are hashed and branches are ordered before hashing.
03
TWEAKH(P || root)
The tagged TapTweak hash becomes a scalar added to the internal key.
04
OUTPUT KEYFROST
The FROST lesson identifies which committed data must be reconstructed.
05
SPENDSignature or leaf proof
Key path reveals no script; script path reveals one leaf and its Merkle siblings.

Rule shown: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key.

STAGE 1 OF 5INTERNAL KEY: X-only point P

The internal public key is combined with a tagged commitment to the script tree.

Governing relationship: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key. Complete path: 1. INTERNAL KEY, X-only point P. The internal public key is combined with a tagged commitment to the script tree. 2. TAPTREE, TapLeaf and TapBranch. Leaf scripts are hashed and branches are ordered before hashing. 3. TWEAK, H(P || root). The tagged TapTweak hash becomes a scalar added to the internal key. 4. OUTPUT KEY, FROST. The FROST lesson identifies which committed data must be reconstructed. 5. SPEND, Signature or leaf proof. Key path reveals no script; script path reveals one leaf and its Merkle siblings.

1. State transitionWhat exists, what changes, and what results

BEFORE

A, B, and C have identifiers 1, 2, and 3. A and C approve message M.

MECHANISM

A dealer or distributed key generation creates shares and one group public key. Each participant verifies the setup evidence required by the chosen FROST suite.

AFTER

Subset flexibility comes from share interpolation, while transcript and nonce binding prevent shares from being safely reused elsewhere.

Text equivalent: Starting from A, B, and C have identifiers 1, 2, and 3. A and C approve message M. The mechanism begins when A dealer or distributed key generation creates shares and one group public key. Each participant verifies the setup evidence required by the chosen FROST suite. The resulting lesson is Subset flexibility comes from share interpolation, while transcript and nonce binding prevent shares from being safely reused elsewhere.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 6

Establish key shares

A dealer or distributed key generation creates shares and one group public key. Each participant verifies the setup evidence required by the chosen FROST suite.

Complete path: 1. Establish key shares: A dealer or distributed key generation creates shares and one group public key. Each participant verifies the setup evidence required by the chosen FROST suite. 2. Select a qualifying subset: The coordinator and signers agree on at least t unique participant identifiers and one exact message. 3. Round one commits nonces: Each signer generates fresh hiding and binding nonces, retains them secretly, and publishes corresponding commitments. 4. Build the signing package: The package contains the message, participant set, and commitments. Binding factors and the group challenge depend on this common transcript. 5. Round two creates shares: Each signer uses its key share, nonces, binding factor, and Lagrange coefficient to produce one signature share. 6. Verify and aggregate: Invalid shares are rejected. A qualifying set of valid shares sums to a Schnorr signature checked under the group public key.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

Pinned RFC9591 FROST checks a qualifying participant set, two nonce commitments, binding factors, Lagrange coefficients, share equations, and final suite signature.

CHANGED CONDITION

An insufficient or changed subset, reused nonce, or bad share aborts; RFC9591 secp256k1 encoding is not mislabeled as a BIP340 Taproot signature.

Important distinction: FROST makes the coordinator a trusted holder of the group private key. The coordinator assembles public commitments and signature shares. It should never receive the complete private key, though it can still threaten liveness or try transcript manipulation that signers must detect.

Text equivalent: The accepted path is enforced by Pinned RFC9591 FROST checks a qualifying participant set, two nonce commitments, binding factors, Lagrange coefficients, share equations, and final suite signature. If the required condition changes, An insufficient or changed subset, reused nonce, or bad share aborts; RFC9591 secp256k1 encoding is not mislabeled as a BIP340 Taproot signature.

Loading lesson visuals...

Learn the idea

FROST is Flexible Round-Optimized Schnorr Threshold signing. The Crypto Forum Research Group, or CFRG, develops and reviews cryptographic guidance. RFC9591 is its published document specifying two-round FROST and its ciphersuites. A t-of-n group holds shares of one signing key, and any qualifying subset can cooperate to produce one Schnorr signature. Each session binds participant identifiers, nonce commitments, the message, and Lagrange coefficients so the selected shares combine correctly without reconstructing the private key.

GUIDED EXPLANATION1/6 ideas inspected

Establish key shares

A dealer or distributed key generation creates shares and one group public key. Each participant verifies the setup evidence required by the chosen FROST suite.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“FROST makes the coordinator a trusted holder of the group private key.”

The coordinator assembles public commitments and signature shares. It should never receive the complete private key, though it can still threaten liveness or try transcript manipulation that signers must detect.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.