Threshold Signature Scheme

A threshold signature scheme (TSS) is a cryptographic method in which the power to sign is divided among several parties, so that any group of at least a set size can together produce a valid digital signature, while a smaller group cannot. The private key never exists in one place: each party holds only a share, and the signature is computed jointly from the shares. A scheme is described as t-of-n, for example 2-of-3 or 3-of-5.

Threshold signatures are a specialised form of multi-party computation and are the main technology behind multi-party computation custody of digital assets. Exchanges, custodians, payment firms and wallet providers use them to remove the single point of failure that a lone key represents. They are often compared with multi-signature arrangements, which pursue the same goal by different means.

A scheme has three stages:

• Key generation. The parties run a distributed key generation protocol. Each contributes randomness and ends up with a secret share, and all of them learn the single public key that corresponds to the shared secret. No trusted dealer ever sees the whole key.
• Signing. When a transaction needs to be authorised, at least the threshold number of parties exchange messages in one or more rounds, each using its share, and the output is an ordinary signature. Parties learn nothing about one another's shares.
• Verification. Anyone can check the signature against the public key in the usual way. A blockchain network cannot tell that the signature was produced by several parties.

Many schemes also support share refresh, in which the parties periodically replace their shares with new ones for the same key. An attacker must then compromise the threshold number of parties within one refresh period, because old shares become useless. Shares can also be reissued to add or remove a participant without changing the public key or moving funds.

In a multi-sig wallet, each signer has a complete, independent key and the blockchain itself checks that enough separate signatures are present. The approval policy is visible on-chain, which aids transparency but costs more in transaction fees, reveals the signing structure and depends on each blockchain's own support for such scripts or contracts. A threshold scheme works off-chain and yields one standard signature, so it can be used on almost any network and the signer set can change without a new address.

Shamir's secret sharing also splits a secret into shares with a threshold, and many threshold schemes build on it. Used alone, however, it requires the key to be reassembled in one place before signing, which recreates a single point of failure at that moment. A threshold signature scheme never reconstructs the key.

The difficulty of building a threshold version depends on the signature algorithm. The elliptic curve algorithm used by Bitcoin and Ethereum, ECDSA, is awkward to distribute, and practical multi-party protocols for it appeared only from around 2017 onwards, with several generations of designs reducing the number of communication rounds and adding the ability to identify a misbehaving participant. Schnorr-type signatures are simpler to share; FROST, a threshold Schnorr protocol, has been published as an RFC through the Internet Research Task Force. BLS signatures can be combined easily and are used for validators in some proof of stake networks, including through distributed validator technology.

Custodians typically spread shares across different servers, data centres, cloud providers or organisations, and may give one share to the client. Shares are often kept inside a hardware security module or secure enclave. The cryptographic threshold is combined with a policy engine that decides whether a transaction should be signed at all, based on amount limits, approved destinations and the number of human approvers. This layer of rules is part of wallet governance, and it matters as much as the mathematics, since the scheme only guarantees that a signature needs enough shares, not that the request was legitimate.

Threshold protocols are complex, and flaws in their design or coding can be severe. In 2023 security researchers disclosed weaknesses in several widely used implementations of threshold ECDSA that could, in some conditions, have allowed key extraction, and vendors issued fixes. Independent review and prompt patching are therefore essential.

Other limits are practical. Because the approval rules sit off-chain, outsiders cannot verify them, and accountability depends on the operator's logs and controls. If every share is run by the same company on similar systems, the separation is weaker than it appears. Backup and recovery of shares must be planned carefully as part of key management, since losing more shares than the scheme tolerates makes the assets unrecoverable.

• NIST: Multi-Party Threshold Cryptography