Threshold Signatures Explained: How Distributed Key Management Works
How threshold signatures distribute authority without reconstructing private keys.
Written by
Berwin D
Learn
Jun 20, 2026
A threshold signature scheme (TSS) allows a group of participants to collectively produce a valid digital signature without any individual participant ever holding the complete private key. The key is generated as distributed shares. A minimum number of shares (the threshold) must coordinate to sign. Below the threshold, no combination of shares can produce a signature or reconstruct the key.
The result is a standard cryptographic signature. On a blockchain, it looks identical to a signature produced by a single key. The distributed nature of the signing process is invisible to verifiers.
Threshold signatures are the cryptographic foundation of MPC-based digital asset custody, wallet infrastructure, and distributed key management.
The Core Idea
In standard cryptography, a private key is a single secret. Whoever holds it can sign. Protecting that secret is the entire security challenge.
Threshold signatures reframe the problem. Instead of protecting one secret, the system generates n shares of the secret and distributes them across n parties. Any t of those n parties (the threshold) can coordinate to produce a valid signature. Fewer than t parties cannot.
This is called a (t, n) threshold scheme. A (2, 3) scheme distributes 3 shares and requires any 2 to sign. A (3, 5) scheme distributes 5 shares and requires any 3.
The critical property: the complete private key is never assembled at any point during key generation or signing. It exists only as a mathematical relationship between the shares.
How TSS Differs from Multisig
Multisig and threshold signatures both distribute signing authority across multiple parties. They differ in where the distribution happens.
Multisig creates multiple independent full private keys. Each signer holds a complete key. The blockchain enforces the quorum: it requires m-of-n valid signatures before executing the transaction. The authorization logic lives on-chain.
Threshold signatures create one key split into shares. No signer holds a complete key. The signers coordinate off-chain to produce one standard signature. The blockchain sees a single signature and has no knowledge that multiple parties were involved. The authorization logic lives in the cryptographic protocol.
This distinction has practical consequences. Multisig requires chain-level support (Bitcoin script, Ethereum smart contracts). TSS works on any chain that accepts standard ECDSA or Schnorr signatures. Multisig transactions are larger and cost more in gas. TSS transactions are standard-size single-signature transactions. For a deeper comparison, see MPC vs Multisig.
Key Generation (Distributed Key Generation, DKG)
Before any signing can happen, the shares must be created. This is Distributed Key Generation (DKG).
In a DKG protocol, all participants interact to jointly generate a public key and their individual private key shares. Each participant ends up with one share. The public key is known to everyone. No participant learns any other participant's share.
The public key corresponds to a private key that exists only as a mathematical relationship across the shares. It was never computed as a whole number on any device.
DKG is a one-time setup step. After DKG, the shares are stored independently. Key refresh protocols can rotate the shares (generating new shares for the same key) without changing the public key or wallet address.
Signing (Threshold Signing Protocol)
When a transaction needs to be signed, t participants engage in a multi-round interactive protocol.
Each participant uses their share to compute partial values. These partial values are exchanged across the participants through secure channels. Through the protocol's mathematical structure, the partial values combine to produce a valid signature without any participant learning the other participants' shares or the combined private key.
The output is a standard ECDSA, EdDSA, or Schnorr signature. Any verifier (including the blockchain) can validate it using the public key. The signature is indistinguishable from one produced by a single private key.
Protocol Families
The main threshold ECDSA protocol families in production are:
DKLs (2018, 2019, 2023)
The DKLs protocol series was developed by Yehuda Lindell, Aashish Kondi (DKLs18/19) and further by Yashvanth Kondi and collaborators (DKLs23). DKLs23 was published at IEEE S&P 2024, one of the most selective venues in security research.
DKLs23 uses oblivious transfer (OT) as its core building block. This eliminates the need for Paillier homomorphic encryption, which has been a source of implementation vulnerabilities in other protocol families. Trail of Bits assessed that OT-based systems are "generally less error-prone than Paillier-based systems".
DKLs23 operates at constant bandwidth overhead, meaning the communication cost does not grow with the security parameter. This makes it one of the most efficient two-party threshold ECDSA protocols available.
Silent Shard from Silence Laboratories implements DKLs23. Yashvanth Kondi, VP Cryptography at Silence Laboratories, is a co-inventor of the protocol. The team that designed the protocol builds and maintains the production library.
DKLs23 powers custody infrastructure at BitGo, with earlier DKLs variants in production at Copper.co, Utila, Vultisig, Visa, and Coinbase.
CGGMP (2020, 2021)
The CGGMP protocol (Canetti, Gennaro, Goldfeder, Makriyannis, Peled) supports arbitrary (t, n) thresholds and uses Paillier encryption for range proofs. It is the protocol behind Fireblocks' MPC implementation and several other managed custody platforms.
CGGMP provides strong security guarantees, but its reliance on Paillier cryptography has created a larger implementation attack surface. The BitForge vulnerability disclosure (August 2023) and the TSSHOCK disclosure affected wallet providers running Paillier-based implementations across CGGMP and earlier GG variants.
Lindell17
Lindell17 is a two-party ECDSA threshold signing protocol. It was one of the first practical threshold ECDSA protocols and is used in production by several wallet providers. Silence Laboratories implements L17 as the protocol powering the MetaMask Snap integration.
GG18 / GG20
The Gennaro-Goldfeder protocols (2018, 2020) were among the earliest practical threshold ECDSA schemes. GG20 added support for identifiable abort. Both use Paillier encryption and have been affected by the BitForge and TSSHOCK vulnerability classes.
Security Properties
Unforgeability. Fewer than t parties cannot produce a valid signature. This is the core security property.
Key privacy. No party learns any other party's share through the signing protocol. The shares remain private throughout key generation, signing, and key refresh.
Identifiable abort. If the signing protocol fails (a party misbehaves or goes offline), the protocol can identify which party caused the failure. This is critical for institutional settings where accountability and audit trails are required. DKLs23 supports identifiable abort.
Key refresh. Shares can be rotated (replaced with new shares for the same key) without changing the public key or wallet address. This allows signer rotation, device replacement, and governance updates without asset migration.
Real-World Applications
Digital asset custody. Threshold signatures are the foundation of MPC-based custody. BitGo, Fireblocks, Copper, and ZenGo all use threshold signatures for institutional wallet security. Silent Shard provides the DKLs23 implementation that powers BitGo's custody infrastructure.
Consumer wallets. Okto (CoinDCX) uses Silent Shard across 17 million wallets. MetaMask uses the L17 protocol via the Silence Laboratories Snap integration. Threshold signatures enable consumer wallet security without requiring the user to manage a seed phrase.
Stablecoin payments. Silent Pay uses threshold signatures to secure the signing infrastructure for stablecoin payment platforms. Every payment authorization runs through a threshold signing ceremony.
Validator key management. EigenLayer uses Silent Shard for distributed validator key security, preventing single-point compromise of validator signing keys.
Post-Quantum Threshold Signatures
Standard threshold ECDSA and Schnorr signatures are vulnerable to quantum computing attacks via Shor's algorithm. NIST finalized post-quantum standards with classical algorithm deprecation by 2030.
Silence Laboratories offers Post Quantum MPC, post-quantum MPC wallet infrastructure that brings threshold cryptography to NIST-standardized post-quantum signatures. BitGo completed the first post-quantum MPC transaction simulation by a regulated custodian in collaboration with Silence Laboratories.
Related Reading
FAQ
What is a threshold signature? A threshold signature is a digital signature produced by a group of participants who each hold a share of the private key. A minimum number of participants (the threshold) must coordinate to sign. The complete key is never assembled. The output is a standard signature indistinguishable from a single-key signature.
What is DKLs23? DKLs23 is a two-party ECDSA threshold signing protocol published at IEEE S&P 2024. It uses oblivious transfer instead of Paillier encryption, eliminating a class of implementation vulnerabilities. Yashvanth Kondi, VP Cryptography at Silence Laboratories, is a co-inventor.
How is a threshold signature different from multisig? Multisig uses multiple independent full keys with on-chain quorum enforcement. Threshold signatures use one key split into shares with off-chain cryptographic coordination. TSS works on any chain, produces standard-size transactions, and never creates a complete key at any point.
What happened with BitForge and TSSHOCK? BitForge (August 2023) and TSSHOCK were vulnerability disclosures affecting wallet providers running Paillier-based MPC implementations (GG18, GG20, CGGMP). 15+ wallet providers were affected. OT-based protocols like DKLs23 are not affected by these vulnerability classes.
Can threshold signatures be made quantum-resistant? Yes. Post-quantum threshold signatures apply threshold cryptography to NIST-standardized post-quantum schemes. Silence Laboratories offers Post Quantum MPC for this. Standard ECDSA threshold signatures are vulnerable to quantum attacks and will need to be replaced before NIST's 2030 deprecation deadline.
SHARE