Threshold Signatures (TSS)

Threshold signatures let a group jointly produce one signature without ever assembling the full private key in one place. They are widely used by custodians and MPC wallets.

One Signature On-Chain Can Still Be Many People Off-Chain

TSS (threshold signature schemes) lets n parties hold key shares such that any t of them can run an interactive protocol to emit one ECDSA/EdDSA signature. The chain sees a normal single-sig address. That is the feature (privacy, fees, compatibility) and the opacity (you cannot see the policy on-chain). Multisig scripts, by contrast, often show m-of-n on-chain.

Shamir's Secret Sharing reconstructs a secret in one place at use time unless combined with extra protocol. TSS aims not to reconstruct the full key at all. If a vendor says Shamir when they mean TSS or vice versa, ask again. Education only. Not a custody recommendation.

1. History that still binds TSS

Classic on-chain multisig (Bitcoin script, Ethereum contracts) is older and more visible. Threshold ECDSA was the hard one because ECDSA was not designed for it; research (GG18/GG20 and successors) made MPC wallets a product. Institutions liked 'one address, many people' for exchange rails and OTC.

Retail 'MPC wallets' arrived as seed-phrase alternatives. That can be good (no single napkin) or bad (you now a vendor's share and an app). History is littered with both honest MPC and marketing MPC.

2. Shares, refresh, and versus multisig

Keygen is distributed: no dealer should ever see the full key (dealerless DKG). Signing is interactive: latency, liveness of t parties, and abort handling matter. Proactive refresh reshuffles shares so old shares die. Without refresh, stolen old shares wait.

On-chain multisig: transparent policy, higher fees, contract risk on Ethereum, script risk on Bitcoin. TSS: opaque policy, single-sig fees, vendor and protocol risk. Neither deletes human policy risk (who is allowed to be one of the t).

3. How operators actually use TSS

Honest jobs: exchange hot wallets with 3-of-5 among HSMs and people; fund operations; retail MPC with a share on device and a share at vendor if you accept that trust. Dishonest jobs: 'no seed so no risk'; TSS as a reason to skip withdrawals testing.

Illustration only: 3-of-5 TSS, two shares in vendor cloud, two in staff HSMs, one in CEO laptop. That is not 3-of-5 of independent planets. It is 3-of-5 of a org chart. Map the org chart. If two cloud shares plus a phished laptop suffice, you did not have 5. The custody models is for unusual prints and price action, not for discovering that Threshold Signatures (TSS) exists.

4. Failure modes

Malformed DKG, share leakage, no refresh, vendor outage freezing t, phishing the mobile share, and people who cannot recover because 'there is no seed' and the vendor is gone. Also: confusing TSS with Shamir reconstruction on a laptop. Related structure: Gemini.

5. Mistakes, limits, takeaways

Mistakes: TSS as magic multisig; hiding policy; no recovery drill. Limits: schemes evolve. Education only.

Not a recommendation to use a TSS wallet. Run a recovery drill before you need one.

What matters most

• TSS: t-of-n produce one chain signature without assembling the key.
• On-chain it can look like a single key.
• Policy opacity is a feature and a risk.
• Refresh shares; drill recovery.

The honest one-sentence object is: t-of-n MPC signing that emits a single standard signature. ECDSA threshold signing is interactive; EdDSA has different protocol families. Dealerless DKG is the grown-up keygen. Educational only.

It is for custody designers who can draw the share map. It is not for users who think no seed phrase means no failure mode. On-chain Bitcoin multisig is visible; TSS BTC addresses need not be.

A vendor holding 2 of 3 is a custodian with extra words. Gemini/Coinbase institutional stacks may mix HSM, TSS and policies, so ask them and make no assumptions.

Chain and venue context for Threshold Signatures (TSS): off-chain MPC plus on-chain single-sig compatibility. Mobile MPC shares are still phishable UX.

It only changes how fast collusion, vendor freeze, or a Shamir-style reconstruct on a compromised box can arrive. Abort attacks and nonce bugs have been academic and practical topics.

Shamir reconstructs while TSS signs without reconstructing, so keep the verbs straight.

Common misread: treating Threshold Signatures (TSS) as users who think no seed phrase means no failure mode would treat it. Recovery phrases in 'MPC' apps sometimes exist anyway; read the doc.

Legal control of shares is a policy document, not a curve point. Coupons expire.

Latency of t parties is a withdrawal clock.

Audit reports of the protocol are not audits of your org chart.