MPC Wallets: TSS, DKG & Secure Custody

Learning Goal: Implementing Multi-Party Computation (MPC) Wallets: Designing Threshold Signature Schemes (TSS) and Distributed Key Generation for Secure Cryptographic Custody.

This curriculum provides a mathematically sound, production-oriented path to understanding, designing, and engineering institutional-grade digital asset custody systems. By progressing from standard public-key cryptography to multi-party computation protocols, you will master how to eliminate the single point of failure (the private key) while maintaining compatibility with legacy blockchains.

Prerequisites: Basic linear algebra (finite fields, polynomial interpolation), familiarity with public-key cryptography (RSA, ECC), and basic reading competence in system programming languages (Rust or Go).
Estimated Total Study Time: 24 Hours

Module 1: Foundations of Cryptography & Digital Signatures

Before diving into distributed systems and multi-party cryptographic protocols, you must master the fundamental building blocks of digital signature architectures. This module establishes the mathematical foundation of Elliptic Curve Cryptography (ECC) and the Elliptic Curve Digital Signature Algorithm (ECDSA)—the standard signing scheme behind Bitcoin, Ethereum, and many other layer-1 protocols.

Knowledge Checkpoint

Understand why ECC provides a stronger cryptographic density than RSA and how $256$ -bit keys are utilized in systems like secp256k1.
Define the roles of the base point $G$ , scalar multiplication, and the discrete logarithm problem (DLP) in public key derivation.
Write down the mathematical steps for ECDSA signature generation $(r, s)$ and verify how an ephemeral key $k$ is used.
Explain why reusing an ephemeral key $k$ in ECDSA allows an attacker to easily reconstruct the private key.

Module 2: Secret Sharing & Introduction to MPC

With standard digital signature fundamentals in place, we move into the mechanics of splitting secrets. In this module, you will learn the mathematical foundation of Shamir’s Secret Sharing (SSS) and how it generalizes into Secure Multi-Party Computation (MPC), enabling collaborative computations without any participant revealing their secret inputs.

Knowledge Checkpoint

Formulate a random polynomial of degree $t-1$ to share a secret scalar $s$ among $n$ participants.
Reconstruct a secret from a set of threshold shares using Lagrange basis polynomials.
Explain why a standard Shamir's Secret Sharing scheme requires a centralized "dealer" to initially split the secret, and point out why this dealer represents a single point of failure.
Differentiate between passive (honest-but-curious) and active (malicious) adversary security models in MPC.

Module 3: Distributed Key Generation (DKG)

To eliminate the centralized "dealer" vulnerability inherent in Shamir's Secret Sharing, we must utilize Distributed Key Generation (DKG). In DKG, multiple decentralized parties collaboratively generate a public-private key pair. At no point in time does any single party ever hold, know, or generate the complete private key.

Algorithmic Depth & Coverage Gaps

While standard video resources cover high-level DKG, you must understand the mathematical protocols underpinning Feldman's Verifiable Secret Sharing (VSS) and Pedersen’s Distributed Key Generation algorithm to construct these systems.

1. Feldman's VSS Protocol

In Feldman's scheme, the dealer distributes shares $s_i = f(i)$ of a polynomial $f(x) = \sum_{j=0}^{t-1} a_j x^j$ . To make this verifiable, the dealer publishes commitments to the polynomial coefficients using elliptic curve points: $C_j = a_j \cdot G \quad \text{for } j \in [0, t-1]$ Each participant $i$ can independently verify that their private share $s_i$ is correct by checking: $s_i \cdot G = \sum_{j=0}^{t-1} i^j \cdot C_j$

2. Pedersen's DKG Protocol

Pedersen's DKG addresses the centralized dealer issue by running $n$ parallel instances of Feldman's VSS. Each participant $i$ acts as a dealer, generating their own secret polynomial $f_i(x)$ with constant term $z_i$ .

Each participant distributes sub-shares $s_{i,j} = f_i(j)$ to every participant $j$ , and publishes commitments $C_{i,k} = a_{i,k} \cdot G$ .
Every participant $j$ verifies their incoming sub-shares against the corresponding commitments.
If no complaints are raised, the joint private key share of participant $j$ is the sum of the validated sub-shares: $u_j = \sum_{i=1}^n s_{i,j}$ .
The collaborative public key is derived as: $Y = \sum_{i=1}^n C_{i,0}$ .

Independent Study Search Terms:

"Feldman Verifiable Secret Sharing mathematical proof"

"Pedersen Distributed Key Generation adversary bias prevention"

"GJKR Distributed Key Generation protocol" (which repairs the security flaws in Pedersen's original scheme under malicious conditions)

Knowledge Checkpoint

Explain how Feldman's VSS uses homomorphic encryption properties to verify that a private scalar share matches a public commitment.
Diagram the step-by-step messaging sequence of Pedersen's DKG.
Explain why a standard Pedersen DKG is vulnerable to a malicious party biasing the final public key, and how the GJKR99 protocol resolves this by running a preliminary protocol to lock commitments.
Draft a recovery strategy for when a participant fails to provide their VSS commitments during the key generation round.

Module 4: Threshold Signature Schemes (TSS)

Threshold Signature Schemes (TSS) represent the operational phase of an MPC wallet. They allow a defined threshold of key share holders to interactively generate a single, standard digital signature (such as ECDSA or Schnorr) without ever reconstructing the private key on any machine.

Protocol Gaps: GG18 & GG20 deep dives

The video pool lacks granular, step-by-step explanations of GG18 and GG20 protocols. These are the dominant multi-party threshold ECDSA protocols in production today.

   GG18 / GG20 Threshold ECDSA Core Phases:
   
   +-------------------------------------------+
   |   Phase 1: Phase Key Derivation & Commit  |
   |   Parties generate ephemeral key shares   |
   +----------------------++-------------------+
                          ||
                          \/
   +-------------------------------------------+
   |   Phase 2: Multiplicative-to-Additive    |
   |   (MtA) conversion using Paillier/OT      |
   +----------------------++-------------------+
                          ||
                          \/
   +-------------------------------------------+
   |   Phase 3: Range Proofs & Verification    |
   |   Verify secret scalars lie in range      |
   +----------------------++-------------------+
                          ||
                          \/
   +-------------------------------------------+
   |   Phase 4: Signature Reconstruction       |
   |   Combine components to output (r, s)     |
   +-------------------------------------------+

To sign an ECDSA message threshold-wise without reconstructing $w = \sum w_i$ or $k = \sum k_i$ , parties must evaluate the multiplication of secret shares: $s = k^{-1}(m + r \cdot w) \pmod q$ Because $k$ and $w$ are additively shared, calculating $k^{-1} \cdot w$ requires a Multiplicative-to-Additive (MtA) conversion protocol. This is accomplished in GG18/GG20 via Paillier Homomorphic Encryption or Oblivious Transfer (OT).

GG18 utilizes a zero-knowledge range proof to ensure no participant uses out-of-range scalars that could leak the private key shares during the MtA step.
GG20 reduces the round complexity and communication overhead of GG18 by optimizing these zero-knowledge proofs and committing to the ephemeral parameters earlier in the protocol.

Independent Study Search Terms:

"GG18 threshold ECDSA protocol specification"

"GG20 threshold signature scheme paper Gennaro Goldfeder"

"Multiplicative to Additive (MtA) protocol Paillier homomorphic"

Knowledge Checkpoint

Differentiate between on-chain Multi-Signature (MultiSig) and cryptographic Threshold Signatures (TSS) in terms of fee efficiency and privacy.
Explain how FROST reduces signature generation to a single, non-interactive round in the optimistic path.
Describe the purpose of the Multiplicative-to-Additive (MtA) conversion step in Threshold ECDSA protocols.
Identify where Paillier encryption and zero-knowledge range proofs are used in the GG18 signing flow.

Module 5: Engineering Secure MPC Custody Systems

Designing an institutional custody system requires wrapping raw cryptographic primitives into a resilient, production-ready, secure enclave infrastructure. In this final module, we shift focus to backend software engineering, key rotation schemes, proactive secret sharing, and secure backup mechanics.

Production Engineering Gaps & Implementation Guidelines

To transition this theory into production code (Rust or Go), you must address several design patterns not covered in promotional wallet materials.

1. Proactive Secret Sharing (PSS) & Key Refresh

To prevent an adversary from slowly compromising $t$ nodes over a long period (perpetual leakage), you must implement PSS.

The Math: During a refresh cycle, each node $i$ generates a random polynomial $g_i(x)$ of degree $t-1$ such that the constant term is zero: $g_i(0) = 0$ .
Node $i$ distributes sub-shares $u_{i,j} = g_i(j)$ to node $j$ .
Each node $j$ updates their existing secret share $s_j$ : $s_j^{\text{new}} = s_j^{\text{old}} + \sum_{i=1}^n u_{i,j}$
Because the sum of all constants added is zero, the master secret key (and thus the public key) remains unchanged, but all historical key shares are completely invalidated.

2. Production Codebases to Study

Do not write custom cryptography from scratch for production systems. Instead, audit and integrate established open-source libraries:

Rust:
- multi-party-sig (maintained by ZenGo): Comprehensive implementation of GG18, GG20, and modern two-party ECDSA.
- frost-dalek: A modular Rust implementation of the FROST threshold signature scheme over Ed25519 and Ristretto.
Go:
- multi-party-sig (Go ports): Highly audited and used in decentralized node network integrations.

Independent Study Search Terms:

"Proactive Secret Sharing update protocol mathematics"

"ZenGo multi-party-sig Rust repository"

"Implementing Threshold ECDSA in Secure Enclaves AWS Nitro Enclaves"

Knowledge Checkpoint

Explain how Proactive Secret Sharing (PSS) updates private shares without altering the master public address.
Design a disaster recovery model for a 2-of-3 MPC wallet where one client device is permanently lost or compromised.
Explain why standard memory management bugs (e.g., buffer overflows) are critical in cryptography, and how Rust's borrow checker mitigates these risks.
Outline how to implement a network protocol that manages asynchronous messaging rounds required for a GG18 signing transaction.

Course Map

This flowchart maps the logical dependencies of the modules and shows how theoretical fundamentals lead to advanced system engineering.

Key People Index

Understanding the primary researchers in threshold cryptography helps you track academic publications and state-of-the-art standards.

Adi Shamir: Co-inventor of RSA and creator of Shamir's Secret Sharing (1979), establishing the foundation of secret partitioning.
Yehuda Lindell: Co-founder of Unbound Security, pioneer in fast threshold ECDSA protocols, and leading academic in the commercialization of MPC wallets.
Torben Pryds Pedersen: Inventor of the Pedersen Commitment scheme and Pedersen Distributed Key Generation protocol, essential for decentralized coordinate setups.
Rosario Gennaro & Steven Goldfeder: Authors of the GG18 and GG20 protocols, which established standard frameworks for highly efficient Threshold ECDSA signatures.
Dan Boneh: Head of the Stanford Applied Cryptography Group, leading researcher in pairings-based cryptography, and vocal authority on practical security practices in decentralized networks.
Tal Rabin: Prominent cryptographer, co-inventor of Proactive Security and numerous Verifiable Secret Sharing protocols, driving secure-distributed database research.

Final Self-Assessment

To verify your mastery of this curriculum, complete the following comprehensive engineering and theoretical challenge items:

Explore Further

Related Blockchain & Crypto Roadmaps

View All→

blockchain-and-crypto

MPC Wallets: TSS, DKG & Secure Custody

Module 1: Foundations of Cryptography & Digital Signatures

Recommended Videos

Knowledge Checkpoint

Module 2: Secret Sharing & Introduction to MPC

Recommended Videos

Knowledge Checkpoint

Module 3: Distributed Key Generation (DKG)

Recommended Videos

Algorithmic Depth & Coverage Gaps

1. Feldman's VSS Protocol

2. Pedersen's DKG Protocol

Knowledge Checkpoint

Module 4: Threshold Signature Schemes (TSS)

Recommended Videos

Protocol Gaps: GG18 & GG20 deep dives

Knowledge Checkpoint

Module 5: Engineering Secure MPC Custody Systems

Recommended Videos

Production Engineering Gaps & Implementation Guidelines

1. Proactive Secret Sharing (PSS) & Key Refresh

2. Production Codebases to Study

Knowledge Checkpoint

Course Map

Key People Index

Final Self-Assessment

Related Blockchain & Crypto Roadmaps

ERC-4626: Yield Aggregators & Leverage

DePIN: IoT Registries, Proofs & Rewards

Building EigenLayer AVS: Operators & Contracts

fhEVM: FHE Smart Contracts & Private Tokens