Threshold Cryptography

The foundational primitive for threshold cryptography, introduced independently by Adi Shamir and George Blakley in 1979. A dealer splits a secret into n shares, distributing them to participants. Any t or more shares can reconstruct the secret, while any t-1 shares reveal absolutely no information. Shamir's scheme uses polynomial interpolation over a finite field, where the secret is the constant term of a random polynomial of degree t-1. This is the core mechanism enabling distributed key generation and threshold signing without a trusted dealer.

An enhancement of standard secret sharing that protects against malicious dealers. In VSS, the dealer distributes shares along with cryptographic commitments that allow each participant to verify the consistency and validity of their share without revealing the secret itself. This prevents a corrupt dealer from distributing inconsistent shares that would prevent reconstruction or lead to different recovered secrets. Feldman's VSS uses homomorphic commitments over discrete logarithms, while Pedersen's VSS provides information-theoretic secrecy with computational binding.

A protocol that allows a set of parties to jointly generate a cryptographic key pair without any single party ever holding the complete private key. Each participant contributes randomness, and the private key is defined as the sum of these contributions, existing only in a virtual, secret-shared form. The corresponding public key is computed and published. DKG eliminates the single point of failure inherent in centralized key generation. Key properties include:

• No trusted dealer: No party ever knows the full private key
• Byzantine fault tolerance: Protocols like GJKR can tolerate malicious participants
• Applications: Threshold signing for blockchain validators, certificate authorities, and DNSSEC

A digital signature scheme where the signing key is secret-shared among n parties, and any subset of t parties can collaboratively produce a valid signature. No single party ever reconstructs the full private key. Threshold ECDSA and threshold BLS are the two dominant schemes:

• Threshold ECDSA: Computationally intensive, requiring multi-round MPC for the nonce inversion. Used by major crypto custody providers.
• Threshold BLS: Elegant and pairing-based, allowing simple signature aggregation. Signatures are unique and deterministic, ideal for consensus protocols.
• Use cases: Institutional crypto wallets, blockchain consensus (e.g., Dfinity, Ethereum 2.0 validator keys), and certificate transparency logs.

A security mechanism that defends against mobile adversaries—attackers who can compromise different parties over time but never exceed the threshold simultaneously. PSS periodically refreshes all shares without changing the underlying secret. Each party generates a new random polynomial with a zero constant term and distributes sub-shares. After combining, old shares become cryptographically useless. This ensures an adversary must compromise t parties within a single epoch to breach security. Essential for long-lived keys in high-security systems.

Combines threshold cryptography with fully homomorphic encryption to enable collaborative computation on encrypted data where decryption requires a quorum. Multiple parties hold shares of the FHE secret key. After evaluating a circuit on encrypted inputs, the parties run a lightweight MPC protocol to jointly decrypt the result without any party learning the key. This is critical for:

• Confidential smart contracts: Multiple validators compute over encrypted state
• Private multi-party analytics: Joint computation on combined encrypted datasets
• Decentralized key management: No single point of compromise for FHE keys