Athreshold cryptosystem, the basis for the field ofthreshold cryptography, is acryptosystem in which the secret key is split into a number of pieces that are given to different parties. Several parties (more than some threshold number) can then cooperate to use the cryptosystem.
More precisely, let be the number of parties. A cryptosystem is called(t,n)-threshold, if at leastt of these parties can cooperate to perform the desired operation (usually sign a message or decrypt a ciphertext), while any subset of fewer thant parties cannot.[1]
Threshold cryptography allows to store secrets in multiple locations to prevent the capture of the secret and the subsequentcryptanalysis of that system. This makes the method a primary trust sharing mechanism, besides its safety of storage aspects.
Constructions for threshold cryptosystems often combine an existing non-threshold cryptosystem with asecret sharing.
Perhaps the first system with complete threshold properties for atrapdoor function (such asRSA) and a proof of security was published in 1994 by Alfredo De Santis, Yvo Desmedt, Yair Frankel, andMoti Yung.[2]
Historically, only organizations with very valuable secrets, such ascertificate authorities, the military, and governments made use of this technology. One of the earliest implementations was done in the 1990s byCertco for the planned deployment of the originalSecure electronic transaction.[3]However, in October 2012, after a number of large public website password ciphertext compromises,RSA Security announced that it would release software to make the technology available to the general public.[4]
In March 2019, the National Institute of Standards and Technology (NIST) conducted a workshop on threshold cryptography to establish consensus on applications, and define specifications.[5] In July 2020, NIST published "Roadmap Toward Criteria for Threshold Schemes for Cryptographic Primitives" as NIST IR 8214A[6]. In August 2022, NIST published an initial public draft for "Notes on Threshold EdDSA/Schnorr Signatures" as NIST IR 8214B.[7] In January 2023, NIST published an initial public draft for the "NIST First Call for Multi-Party Threshold Schemes" as NIST IR 8214C, followed by a second public draft in March 2025.[8]
In a(t,n) threshold signature scheme, a signing key is split inton shares, each share being given to a party. Any subset of at leastt of then parties behaving honestly can cooperate to jointly sign a message. On the other hand, every subset of fewer thant parties cannot forge a signature, even if they collude.
There is a trivial way to create a threshold signature scheme using anysignature scheme. Each of then parties generates its own secret signing key, and publishes the corresponding verification key. A party willing to sign a message simply signs it with its own individual key, and publishes its signature. A signature for the threshold signature scheme is a concatenation of (at least)t individual signatures, and can be verified by verifying the individual signatures one by one. The downside of this trivial approach is that the size of the signature and the time needed for verification grows linearly witht. Usually, it is desired that the size of the signature and the time needed for verification are constant int andn.
Many existing signature schemes have been thresholdized, notablySchnorr signatures[9],ECDSA[10][11][12], andBLS[13].
Similarly to threshold signatures, public-key encryption schemes can be thresholdized, so that at leastt parties must cooperate to decrypt a message.
Such threshold versions have been defined by the above and for the following schemes:
