Threshold FHE

The fundamental property distinguishing Threshold FHE from standard FHE. A secret key is split into n shares using a threshold secret-sharing scheme. Homomorphic evaluation proceeds on ciphertexts encrypted under a common public key, but decryption requires at least t-of-n parties to collaborate. No single party ever holds the complete secret key, eliminating the single-point-of-compromise inherent in traditional FHE deployments. The decryption protocol typically involves each party computing a partial decryption share using their key fragment, which are then combined to reconstruct the plaintext.

Threshold FHE schemes support computation on ciphertexts encrypted under different public keys from distinct participants. This enables a powerful collaborative paradigm: multiple data owners independently encrypt their inputs under their own keys, an untrusted evaluator performs homomorphic computation on the combined ciphertexts, and only a joint decryption involving a threshold of the original data owners reveals the result. This is distinct from single-key FHE where all data must be encrypted under one party's key, which would grant that party unilateral decryption power.

Most practical Threshold FHE constructions require a one-time trusted setup phase to generate a Common Reference String (CRS). This CRS is a public set of parameters—including a shared public key and evaluation keys—used by all parties for encryption and computation. The security of the system depends on the assumption that the setup was executed honestly. Advanced implementations mitigate this trust requirement through distributed key generation (DKG) protocols, where the CRS is produced via an interactive MPC ceremony, ensuring no single entity knows the full secret at any point during initialization.

The security guarantee that the plaintext remains confidential even if a coalition of up to t-1 parties is malicious and colludes to recover it. The threshold parameter t defines the exact number of adversaries the system tolerates. In a (3,5)-threshold scheme, even if two participants are fully compromised and share their key shares, the underlying plaintext cannot be reconstructed. This property is cryptographically enforced by the underlying linear secret sharing scheme, typically Shamir's Secret Sharing over polynomial rings, ensuring that fewer than t shares reveal zero information about the secret.

The interactive protocol where each participant independently computes a partial decryption of the common ciphertext using their private key share. These partial results are broadcast to a combiner node—which may be one of the participants or an external entity—that aggregates them using Lagrange interpolation to recover the plaintext. Critically, the partial decryption shares are publicly verifiable in robust schemes, allowing any observer to detect malicious parties submitting invalid shares. This verification is achieved through non-interactive zero-knowledge proofs attached to each share.

Threshold FHE enables a privacy-preserving machine learning architecture where a model owner and a data owner jointly compute inference without exposing their assets. The model owner encrypts the model weights under their key, the data owner encrypts their input under their key, and homomorphic evaluation produces a ciphertext of the prediction. Decryption requires both parties to cooperate, ensuring the model owner never sees the raw input and the data owner never extracts the model weights. This is the foundational primitive for confidential multi-party AI marketplaces.

Threshold FHE enables the creation of sealed-bid auction and dark pool trading venues on public blockchains. Traders submit encrypted orders to a smart contract. The contract homomorphically computes the clearing price and matching engine logic over the encrypted order book. Settlement occurs atomically on-chain, but no individual node, validator, or observer can see the order flow. A threshold of network validators must collaborate to decrypt only the final, matched trade results, preventing front-running and Miner Extractable Value (MEV) attacks.

• Sealed-bid privacy: Order sizes and prices remain hidden during matching.
• MEV resistance: Eliminates transaction reordering attacks.
• On-chain verifiability: Settlement logic is publicly auditable without revealing positions.

A consortium of hospitals can jointly train a diagnostic AI model on their combined patient data without violating HIPAA or GDPR. Each hospital encrypts its local dataset under a common threshold FHE public key. The model is trained homomorphically on the aggregated encrypted data. The final encrypted model weights are only decrypted when a governance-defined threshold of hospitals (e.g., 7 out of 10) provides their partial decryption shares. No single hospital can unilaterally extract the model or access another's patient records.

• Federated learning without a central aggregator: Raw data never leaves each hospital's secure enclave.
• Model co-ownership: The trained model is a shared asset, accessible only by consortium agreement.
• Regulatory compliance: Satisfies strict data residency and patient privacy mandates.

A multinational corporation can process data globally while guaranteeing that plaintext results are only accessible within a specific legal jurisdiction. Data is encrypted under a threshold FHE scheme where the decryption key is split into shares held by Hardware Security Modules (HSMs) in different geographic regions. A policy is set requiring that a threshold of shares from, for example, EU-based HSMs must participate in decryption. This cryptographically enforces data sovereignty, ensuring that even if a foreign data center is compromised, ciphertext cannot be decrypted without the requisite jurisdictional quorum.

• Geofenced decryption: Plaintext access is cryptographically bound to physical locations.
• Policy-driven key shares: Governance rules are embedded in the cryptographic protocol.
• Supply chain security: Prevents foreign administrative access to sensitive corporate IP.

Pharmaceutical companies and research labs can perform Private Set Intersection (PSI) and genome-wide association studies on their proprietary genomic databases without exposing the raw sequences. Each party encrypts its genomic variant database using a threshold FHE scheme. A joint query—such as identifying common variants associated with a disease—is computed homomorphically over the union of the encrypted databases. The final, aggregated statistical result is decrypted only when a pre-agreed threshold of all participating institutions authorizes the release, protecting each organization's intellectual property and patient privacy.

• Encrypted cohort discovery: Find overlapping patient populations without revealing non-matching records.
• IP protection: Proprietary genomic libraries remain private.
• Collaborative science: Enables research across competing institutions with zero data leakage.

A DAO can manage its treasury and execute salary payments or grant distributions using threshold FHE. The DAO's financial state—including balances, payment amounts, and recipient addresses—is stored on-chain in encrypted form. Members submit encrypted votes on budget proposals. The smart contract homomorphically tallies the votes and, if the proposal passes, computes the encrypted payment transaction. The transaction is only decrypted and broadcast to the network when a threshold of designated DAO signers provides their partial decryption shares, enforcing the DAO's governance rules at the cryptographic level.

• Encrypted treasury state: Financial positions are hidden from public view.
• Cryptographic governance: Spending authorization is mathematically bound to vote outcomes.
• Private payroll: Employee compensation amounts and recipients remain confidential.

Institutional-grade cryptocurrency custody solutions use threshold FHE to eliminate the single point of compromise inherent in traditional Multi-Party Computation (MPC) wallets. Instead of generating a transaction signature in the clear at the moment of signing, the entire transaction construction and signing process is performed homomorphically. The private key material is never reconstructed, even in memory, on any single machine. A threshold of geographically distributed, air-gapped signers must each evaluate their share of the homomorphic signing function. The final signed transaction is only output when the threshold is met, preventing insider attacks and malware from exfiltrating key material.

• No key reconstruction: Private keys are never assembled in a single memory space.
• Air-gapped signing: Signers can operate in physically isolated environments.
• Insider threat resistance: A compromised signer below the threshold cannot forge a transaction.