Threshold cryptosystem

A threshold cryptosystem, the basis for the field of threshold cryptography, is a cryptosystem in which the secret key is split into a number of pieces that are given to different parties. Several parties (more than some threshold number) can then cooperate to use the cryptosystem.

More precisely, let n {\displaystyle n} be the number of parties. A cryptosystem is called (t,n)-threshold, if at least t of these parties can cooperate to perform the desired operation (usually sign a message or decrypt a ciphertext), while any subset of fewer than t parties cannot.^[1]

Threshold cryptography allows to store secrets in multiple locations to prevent the capture of the secret and the subsequent cryptanalysis of that system. This makes the method a primary trust sharing mechanism, besides its safety of storage aspects.

Constructions for threshold cryptosystems often combine an existing non-threshold cryptosystem with a secret sharing.

Perhaps the first system with complete threshold properties for a trapdoor function (such as RSA) and a proof of security was published in 1994 by Alfredo De Santis, Yvo Desmedt, Yair Frankel, and Moti Yung.^[2]

Historically, only organizations with very valuable secrets, such as certificate authorities, the military, and governments made use of this technology. One of the earliest implementations was done in the 1990s by Certco for the planned deployment of the original Secure electronic transaction.^[3] However, in October 2012, after a number of large public website password ciphertext compromises, RSA Security announced that it would release software to make the technology available to the general public.^[4]

In March 2019, the National Institute of Standards and Technology (NIST) conducted a workshop on threshold cryptography to establish consensus on applications, and define specifications.^[5] In July 2020, NIST published "Roadmap Toward Criteria for Threshold Schemes for Cryptographic Primitives" as NIST IR 8214A^[6]. In August 2022, NIST published an initial public draft for "Notes on Threshold EdDSA/Schnorr Signatures" as NIST IR 8214B.^[7] In January 2023, NIST published an initial public draft for the "NIST First Call for Multi-Party Threshold Schemes" as NIST IR 8214C, followed by a second public draft in March 2025.^[8]

In a (t,n) threshold signature scheme, a signing key is split into n shares, each share being given to a party. Any subset of at least t of the n parties behaving honestly can cooperate to jointly sign a message. On the other hand, every subset of fewer than t parties cannot forge a signature, even if they collude.

There is a trivial way to create a threshold signature scheme using any signature scheme. Each of the n parties generates its own secret signing key, and publishes the corresponding verification key. A party willing to sign a message simply signs it with its own individual key, and publishes its signature. A signature for the threshold signature scheme is a concatenation of (at least) t individual signatures, and can be verified by verifying the individual signatures one by one. The downside of this trivial approach is that the size of the signature and the time needed for verification grows linearly with t. Usually, it is desired that the size of the signature and the time needed for verification are constant in t and n.

Many existing signature schemes have been thresholdized, notably Schnorr signatures^[9], ECDSA^[10][11][12], and BLS^[13].

Similarly to threshold signatures, public-key encryption schemes can be thresholdized, so that at least t parties must cooperate to decrypt a message.

Such threshold versions have been defined by the above and for the following schemes:

• Damgård–Jurik cryptosystem^[14][15]
• ElGamal
• Paillier cryptosystem^[16]
• RSA

• Broadcast encryption
• Distributed key generation
• Secret sharing
• Secure multi-party computation
• Shamir's Secret Sharing
• Threshold (disambiguation)