Threshold Encryption

The private key is never constructed in a single location. Instead, n distinct parties independently generate key shares using a Distributed Key Generation (DKG) protocol. The full private key exists only as a virtual entity defined by the collective shares. This eliminates the single point of compromise inherent in traditional public-key infrastructure. The corresponding public key is computed collaboratively and published, allowing anyone to encrypt messages without knowing the identities or locations of the key shareholders.

Decryption requires active participation from at least t out of n shareholders, where t is the pre-defined threshold. This t-of-n access structure provides robust fault tolerance:

• If up to n - t shareholders are unavailable or destroyed, the ciphertext remains recoverable.
• If fewer than t shareholders are compromised, the adversary gains no information about the plaintext. The reconstruction typically uses Lagrange interpolation to mathematically combine partial decryption shares without ever assembling the full private key in memory.

Threshold encryption schemes inherit the semantic security of their underlying public-key cryptosystem, typically ElGamal or pairing-based constructions. A ciphertext reveals no partial information about the plaintext to any adversary with fewer than t key shares. This property holds even against computationally unbounded adversaries in the information-theoretic variants. The security proof reduces to standard hardness assumptions such as the Decisional Diffie-Hellman (DDH) problem.

To defend against mobile adversaries that slowly compromise shareholders over time, threshold systems support proactive secret sharing. In periodic refresh cycles:

• Each shareholder generates a new random polynomial with the same secret value.
• New shares are distributed, rendering previously exfiltrated shares cryptographically useless.
• The global public key remains unchanged, so ciphertexts do not need re-encryption. This ensures long-term confidentiality even under continuous partial compromise.

In adversarial settings, a malicious shareholder might submit an invalid partial decryption to sabotage the protocol. Verifiable threshold encryption attaches a non-interactive zero-knowledge proof to each decryption share, allowing any observer to verify correctness without knowing the share itself. Invalid shares are publicly detectable and excludable, ensuring robustness—the correct plaintext is recovered as long as at least t honest shareholders participate.

In federated learning, threshold encryption enables a server to decrypt the aggregate model update only after receiving contributions from a sufficient number of clients. Individual client updates remain encrypted during transmission and server-side accumulation. The server cannot decrypt any single client's gradient. This property is foundational to protocols like SecAgg+ and Flame, where the decryption threshold enforces participation minimums while preserving client-level privacy against an honest-but-curious aggregator.

Threshold encryption is the cryptographic backbone of secure aggregation in federated learning. Clients encrypt their model updates under a joint public key. The central server aggregates the ciphertexts homomorphically, computing a global model update without ever seeing individual contributions. Only when a threshold of clients cooperates can the aggregated result be decrypted, preventing the server or any single compromised client from inspecting private gradients. This protects against gradient leakage attacks that reconstruct training data from individual updates.

Multiple hospitals can jointly train diagnostic models without exposing patient data. Each institution encrypts its model updates using threshold encryption before transmission. A trusted third party or distributed committee holds key shares. The aggregated model is only decryptable when a quorum of institutions—satisfying the threshold—authorizes the release. This satisfies HIPAA and GDPR requirements by ensuring no single hospital, researcher, or cloud provider can access another institution's patient-derived gradients.

Threshold encryption eliminates the single point of failure inherent in traditional public-key cryptography. The private key is never reconstructed in a single location. Key shares are distributed across independent security domains—separate cloud providers, hardware security modules, or geographically dispersed data centers. Decryption requires m-of-n parties to participate, providing resilience against key compromise, insider threats, and infrastructure failures. This architecture is critical for production ML pipelines handling sensitive enterprise data.

In real-world federated learning, clients frequently disconnect or fail mid-round. Threshold encryption schemes are designed with dropout resilience—the protocol proceeds correctly even when some parties are unavailable. By setting the threshold t < n, the system tolerates up to n - t client failures without blocking decryption. This is achieved through techniques like Shamir Secret Sharing, where any t shares suffice to reconstruct the decryption capability, ensuring operational robustness in unreliable network environments.

Advanced threshold encryption schemes incorporate zero-knowledge proofs to provide verifiable decryption. Each key shareholder can prove they correctly performed their partial decryption without revealing their key share. This enables public auditability—any observer can verify that the decrypted aggregate is correct and that no shareholder misbehaved. This property is essential for regulatory compliance, allowing external auditors to confirm that privacy guarantees were maintained throughout the computation.

Traditional threshold encryption based on RSA or elliptic curve cryptography is vulnerable to quantum attacks. Modern implementations leverage lattice-based cryptography, specifically the Learning With Errors (LWE) problem, to construct threshold fully homomorphic encryption schemes. These post-quantum constructions enable secure aggregation that remains secure against adversaries with large-scale quantum computers, future-proofing privacy-preserving ML pipelines for long-term data protection requirements.