Digital Asset Custody with Multi-Party Computation (MPC) Threshold Schemes

Digital asset custody with Multi-Party Computation (MPC) threshold schemes is a cryptographic approach to securing digital assets in which a private key is never stored or used in full by any single entity. Instead, the key is mathematically split into shares distributed across multiple independent parties, and cryptographic protocols enable joint computation of signatures-such as ECDSA or EdDSA-only when a predefined threshold of parties collaborates. This ensures that no single party, or even a subset below the threshold, can reconstruct the key or unilaterally authorize transactions.

The scheme operates under a (t, n) threshold structure: n parties hold shares of the key, and any subset of at least t parties can jointly produce a valid signature, while any subset of fewer than t parties gains no information about the key. This model eliminates single points of failure and reduces exposure to insider threats, external breaches, and key theft, making it suitable for institutional-grade custody of cryptocurrencies and other digital assets.

• Key Share Generation: The private key is divided using a secret sharing scheme (e.g., additive or Shamir’s Secret Sharing), producing n shares such that any t shares can reconstruct the key, but fewer than t reveal nothing.
• Threshold Signing Protocol: A distributed signing algorithm (e.g., GG18 or GG20 for ECDSA) allows participants to collaboratively compute a signature without reconstructing the key. Each party computes a partial signature using its share and public randomness, then aggregates the partials into a standard cryptographic signature.
• Reconstruction Avoidance: The core security guarantee is that the private key is never reconstructed in plaintext. Even during signing, shares remain private and only intermediate cryptographic values are exchanged.
• Fault Tolerance and Liveness: Protocols include mechanisms for party recovery, share re-sharing, and rotation to maintain liveness when parties go offline or are replaced.

• Threshold Signature Schemes (TSS): A subclass of MPC where the output is a standard cryptographic signature (e.g., ECDSA), compatible with existing blockchain ecosystems. TSS protocols such as GG18 and GG20 are widely adopted for blockchain custody.
• Signature-Agnostic MPC Custody: Recent advances decouple the signing logic from the underlying signature scheme, enabling support for multiple algorithms (e.g., ECDSA, EdDSA, BLS) using the same MPC infrastructure.
• Dynamic Threshold Schemes: Allow the threshold t to be adjusted over time without reissuing key shares, supporting evolving governance or risk models.

Institutional custodians deploy MPC threshold schemes to manage hot, warm, and cold storage for digital assets. A typical configuration uses a (2, 3) or (3, 5) structure: for example, one share resides with the custodian’s secure infrastructure, another with a hardware security module (HSM) or cloud provider, and a third with the asset owner’s device or a separate trusted third party. To initiate a withdrawal, the custodian and the owner each contribute a partial signature; the blockchain network receives a standard ECDSA signature, indistinguishable from one produced by a single key.

This enables non-custodial control patterns where the custodian cannot act unilaterally, and the owner cannot act alone-both must cooperate, and even then, only if the threshold is met. This model supports regulatory compliance, auditability, and operational resilience while preserving cryptographic security guarantees.

1. Setup: A private key K is split into three shares (K₁, K₂, K₃) using additive sharing: K = K₁ + K₂ + K₃ (mod q), where q is the curve order. Each share is held by a distinct party.
2. Signing Request: A transaction is submitted for signing. Parties 1 and 2 agree to proceed (e.g., via policy-based approval).
3. Partial Signature Computation: Each participating party computes a partial signature using its share, the transaction hash, and public randomness. For example, party i computes sᵢ = k⁻¹(m + r·xᵢ) mod q, where xᵢ is its share, k is a shared nonce derived via MPC, m is the message hash, and r is derived from a joint commitment.
4. Aggregation: The partial signatures are combined: s = s₁ + s₂ mod q. The resulting (r, s) pair is a valid ECDSA signature, verifiable on-chain without knowledge of the underlying shares.
5. Key Reconstruction Avoidance: At no point is K computed; only the final signature (r, s) is exposed.

• Network and Communication Assumptions: MPC protocols assume secure communication channels and synchronous or partially synchronous networks. Delays or partitioning can affect liveness.
• Protocol Complexity: Implementation errors in threshold signing (e.g., nonce reuse, improper randomness) can lead to full key compromise. Rigorous formal verification and audits are essential.
• Replay and Sybil Risks: If share holders are not authenticated, an attacker may impersonate a legitimate participant. Authentication and revocation mechanisms are required.
• Upgrade and Recovery Overhead: Changing the threshold or replacing a party requires secure re-sharing of key shares, which must be performed without reconstructing the key-adding operational complexity.

• MPC is equivalent to multi-signature: Multi-signature relies on multiple full keys; MPC uses distributed key shares and joint computation. The security models and failure modes differ significantly.
• MPC eliminates all risk: While MPC reduces exposure to key theft, it does not eliminate risks from insider collusion above the threshold, implementation flaws, or social engineering targeting participants.
• Any MPC implementation is secure: Security depends on the protocol choice (e.g., GG18 vs. GG20), implementation quality, and operational controls. Not all MPC custody solutions are equal.