Threshold & MPC Cryptography — Foundations & Family Index
The shared foundations every Lux threshold/MPC primitive builds on (t-of-n threshold, honest- vs dishonest-majority, DKG, the no-information-below-threshold security definition) plus the canonical index of the per-scheme LPs. Read this before any individual primitive LP. Permanent supersedence anchor for LP-019 and LP-076.
Abstract
This LP teaches the shared foundations of the Lux threshold / multi-party-computation (MPC) family and indexes the per-scheme LPs. It is the entry point a newcomer reads before any individual primitive LP. It deliberately does not define any scheme's behavior — each scheme's algorithm, parameters, gas table, and vectors live in its own LP (see the index). This document owns the vocabulary and the map, not the primitives.
Foundations — the model every primitive shares
Threshold cryptography lets n parties jointly produce a single
cryptographic output (a signature, a key, or a shared secret) such that
any honest t-of-n subset can advance the protocol, while any
coalition of t-1 parties learns nothing about the secret and
cannot forge. Two numbers define a scheme: t (the threshold) and n
(the party count).
Secret sharing is the substrate
Every scheme here rests on secret sharing — splitting a secret s
into shares so that t shares reconstruct s and fewer reveal nothing.
Lux uses Shamir / linear secret sharing (a degree-t-1 polynomial
f with f(0)=s; shares are f(i); any t points recover f by
Lagrange interpolation). The full treatment — including verifiable
secret sharing (Feldman/Pedersen commitments that let a party check its
share without revealing it) — is LP-7103.
Read it first.
Distributed key generation (DKG)
A dealer who knows s is a single point of failure. DKG removes
the dealer: parties jointly run verifiable secret sharing so the group
key exists only as shares — no party ever holds the full secret, not
even at setup. This is the difference between "trusted-dealer keygen"
(deprecated in Lux) and "dealerless DKG" (canonical). Some Lux legs go
further to no-reconstruct signing, where the secret is never formed
even transiently during signing (see Pulsar LP-4450, Corona LP-4440).
Adversary model — honest vs dishonest majority
- Honest-majority protocols assume fewer than
tparties are corrupt and rely on that for both safety and liveness (typical for DKG-style ceremonies). - Dishonest-majority protocols (e.g. UC-secure threshold ECDSA,
CGGMP21) tolerate up to
n-1corruptions for safety (no forgery), losing only liveness — and add identifiable abort so a cheating party can be named and excluded.
When you read a primitive LP, pin down which model it claims; it determines what a compromise actually buys an attacker.
The security definition (informal)
A threshold scheme is correct if any t honest parties produce a valid
output, and secure (EUF-CMA / privacy) if any t-1 colluding parties
(i) cannot forge and (ii) learn no information about the key beyond the
public key. Post-quantum legs additionally forbid classical assumptions
(no DLOG, no pairings, no trusted setup) so a quantum adversary gains
nothing by breaking them.
Family index
| Concept | Scheme | Canonical LP |
|---|---|---|
| Secret-sharing foundation | Shamir / linear SS + VSS | LP-7103 |
| Schnorr / EdDSA threshold | FROST (family root) | LP-4710 |
| — Ed25519 ciphersuite | FROST-Ed25519 (RFC 9591 §6.2) | LP-4711 |
| — secp256k1 / Taproot ciphersuite | FROST-secp256k1 (RFC 9591 §6.5, BIP-340/341) | LP-4712 |
| ECDSA threshold | CGGMP21 (UC, non-interactive) | LP-4720 |
| Dynamic resharing (algorithm) | LSS-MPC resharing | LP-7323 |
| Signer rotation (on-chain) | Dynamic signer rotation | LP-4730 |
| Per-asset key management | Per-asset threshold keys | LP-4740 |
| PQ lattice threshold (ML-DSA) | Pulsar (Module-LWE, byte-equal FIPS-204) | LP-4450 |
| PQ lattice threshold (Ringtail) | Corona (Module-LWE) | LP-4440 |
| PQ hash threshold | Magnetar (SLH-DSA, FIPS-205) | LP-4540 |
| Threshold pre-signing | Batch presign kernel | LP-166 |
| Reference library (Go) | github.com/luxfi/threshold | LP-7340 |
| Reference SDK (TypeScript) | @luxfi/threshold | LP-7341 |
Assumption diversity (read this): Corona and Pulsar are both Module-LWE — they are construction/parameter-diverse, not assumption-diverse. A Module-LWE break hits both. Magnetar (hash-based, SLH-DSA) is the real assumption diversifier. The Aurora and Polaris cert profiles (LP-4900, LP-4910) bundle these legs.
Where these run
The MPC ceremonies that use these primitives for bridge custody of external wallets run on M-Chain (LP-7100). The consensus-signing Pulsar ceremony runs on Q-Chain (distinct — see LP-134). For the guided reading order across the whole threshold/MPC/FHE/chains stack, start at LP-10006.
Supersedence anchors consolidated here
- LP-019 (legacy short-number — Threshold MPC for Bridge Signing) → this LP
- LP-076 (legacy short-number — Unified Threshold Cryptography Framework) → this LP
Original content preserved at archive/LP-019-pre-2026-05-18.md and
archive/LP-076-pre-2026-05-18.md.
Test invariant
Per CRYPTO-CANONICAL.md: CPU == Metal == CUDA == WGSL byte-for-byte on
every deterministic threshold output. RFC 9591 vectors gate FROST;
CGGMP21 paper §6 vectors gate threshold ECDSA.
Copyright
Copyright and related rights waived via CC0.