Threshold cryptography: Shamir and MPC
Split trust so that no single party, including your own provider, ever holds a complete key.
An HSM removes the key from your application, but someone still operates the HSM. Threshold cryptography addresses the remaining question: what if you do not want any single party to hold the whole key?
Shamir's Secret Sharing splits a secret into n shares such that any t of them reconstruct it, and any t-1 reveal nothing at all. Not 'less information': mathematically nothing.
- 2-of-2: both shares required. Maximum control, no fault tolerance.
- 2-of-3: any two of three. Survives losing one share, still tolerates one compromise.
- The threshold t is the real security parameter; n only buys availability.
A t-1 set of Shamir shares leaks nothing. This is information-theoretic, not computational; it does not weaken as computers get faster.
Shamir has one weakness: reconstruction. To use the key, the shares come together somewhere, and at that instant the complete key exists in one place. Multi-party computation removes even that moment.
In threshold MPC the parties jointly produce a signature through a protocol, each using only its own share. The complete private key is never assembled anywhere, at any time. There is no instant to attack.
- Split across providers: shares held by different HSM vendors, so no single vendor can act alone.
- Client custody: one share held by you, so the provider mathematically cannot act without you.
Threshold schemes raise the operational cost of every signature and add real failure modes: lost shares, unavailable parties, protocol version drift. Use them where the trust assumption genuinely matters, not everywhere.
Check your understanding
3 questionsWhat do t-1 Shamir shares reveal about the secret?
What does threshold MPC provide that Shamir sharing alone does not?
In a 2-of-3 split, what does n = 3 buy you?