What Is the Threshold Signature Scheme?

A Threshold Signature Scheme or TSS is a type of digital signature protocol used by Mutli-party Computation (MPC) wallets to authorize transactions. It’s a preferred solution by many businesses and organizations as it gives greater security for transactions. 

Because, you know, the one who holds the key holds the coins! 

There are other popular security methods such as single-sig and multi-sig. In this article, we will explore what makes a Threshold Signature Scheme the best key management system and what other benefits does it provides. 

How Do Digital Signature Schemes Work? 

At the core of blockchain and cryptocurrencies is the concept of digital signatures. At a basic level, digital signatures are constructed from a key pair: a private key and a public key. These keys are large numerical values used to encrypt and decrypt data.  

A digital signature scheme (DSS) is a set of algorithms that take you through a three-stage process: 

KeyGen: Generation of a public and private key pair. The private key allows a user to authorize transactions and proves ownership; the public key allows anyone to send digital assets to it. 

Sign: This algorithm, when given a message and a private key, generates a signature. 

Verify: The verification algorithm checks the message, public and private keys, and will verify the signature. It will either accept or reject it depending on authenticity.  

The TSS method replaces the KeyGen and Sign algorithms with an interactive protocol that distributes the generation of key shares and signing across multiple parties that create the signature. In this method, the Verify algorithm remains the same. 

What Is Multi-Party Computation? 

Multi-Party Computation (MPC) is a cryptography technology utilized for key management on the blockchain. With MPC, the private key is derived from individual key fragments (or shares) separately generated by multiple non-trusting parties (or nodes) without sharing data. This means that in its essence, MPC is a keyless technology, as there are no private keys shared over the network, just separate key shares which together make the signature.  

The advantage of MPC is that authorization can occur without the parties ever disclosing their private input and no single party ever holds all key-parts. Its security is based on the fact that there is no shared data or leaks, and no single point of failure. 

How Does Threshold Signature Scheme Work with MPC? 

As mentioned above, the Threshold Signature Scheme is a Digital Signature Scheme in which the KeyGen and Sign algorithms are distributed across multiple parties. 

In a TSS certain criteria, namely, a threshold must be met before a transaction can be authorized. The threshold refers to the number of key-share holders who can sign on behalf of the entire group. The general rule or access structure of TSS is often referred to as “t of n”. 

For example, say you have a group of 7 active signers (n).  

In order for a successful key transaction (access), a threshold or number of signers must be met (t). In this case, let’s say 4.  

Therefore, t of n = 4 of 7 signers.  

When any four active signers provide their key share, the transaction will be approved. Since there is no way to know which four signatories signed, security and privacy are ensured.  

Key Benefits of the Threshold Signature Scheme

Signing with TSS is much more efficient than other key management systems since it only generates one signature instead of multiple as multi-sig does, for example. 

Increased Security 

TSS technology uses distributed computation meaning the private key is no longer held by a single point of failure. TSS splits the signature between multiple devices or nodes, so no single person has access to the whole, which prevents internal and external compromises. 

Smaller Transaction Size and Lower Cost  

TSS transactions are data light since they contain the same amount of data as a normal single signature transaction. Being data light means they are faster and cheaper to verify with lower transaction fees (mining fees or gas).  

Easy Key-Share Refresh  

When it comes to key management security, it is best practice to change private keys at frequent intervals to avoid hacking. With multi-sig, changing or replacing the private key requires an on-chain transaction to synchronize the key pair and the accounts. The process is highly complex resulting in additional transaction fees. With MPC-Threshold Signatures, you can easily generate a huge number of different distributed key share combinations that represent the same private key, without the need to change it.  

Operational Flexibility 

Because MPC technology means that the whole private key is never disclosed to the key holders, it is much easier to adjust the signature scheme to changing requirements. You can easily extend the existing private key to new members who join the signing group without the need to reveal or change the key pair. So as your business grows, you can easily add new signing members to the group without exposing any part of the private key. 

Why is a Threshold Signature Scheme Better than Multi-Sig? 

The multi-sig method requires multiple signatures of two or more private keys to approve a transaction. Each signer holds an independent private key that corresponds to an independent lock.  

All of the private keys are needed to authorize the transaction meaning all signers must be online at the same time. This means exposing the number of signers and leaving traces as to who signed, weakening security.  

This on-chain access structure also means higher transactions fees. Mutli-sig requires more power as all participants have separate signatures which need to be individually checked by the network.  

In comparison, Threshold Signature Scheme happens off-chain. Each party owns a secret share of the key and when each individual share is entered, they create one single signature. So, on-chain, it’s indistinguishable as to whether it is signed by one or multiple people. 

This also means less data to be verified by the network, which in turn means it is cheaper and faster to execute, and much more secure. 

It’s also worth mentioning that multi-sig is also not very flexible for securing your crypto wallet. It has pre-set features that mean it has to be reimplemented for every blockchain. Even then, the vast majority of blockchains don’t support multi-sig, and the few that do vary in implementation which drives up costs, training requirements, and in turn increases security risks.

Threshold Signature Scheme Use Case: Crypto APIs’ Wallet as a Service

Our Wallet as a Service enables small and medium businesses, enterprises, and institutions to make use of blockchain technology without the time and cost of running nodes or designing their own key storage or security solutions.  

To ensure the most secure, scalable, and affordable digital wallet, Crypto APIs’ Wallet as a Service adopts blockchain agnostic MPC technology, with Threshold Signature Scheme, third-party escrow, and governance layer. 

TSS allows us to offer the lowest transaction fees possible while also keeping signatures hidden off-chain. If you’re looking for a secure and efficient way to manage and transfer your cryptocurrency funds then contact us to find out more about our digital wallet types and how you can benefit from the automation, performance, and security they provide.