Paper 2025/297

Practical Zero-Trust Threshold Signatures in Large-Scale Asynchronous Networks

Abstract

Threshold signatures are a fundamental primitive in applied cryptography, primarily used to mitigate the custodial risk involved in managing keys. However, existing constructions rely on synchronous communication assumptions and fixed participant sets, limiting their applicability to real-world networks. In addition, as the committees managing those keys serve an ever-growing number of clients and assets, they become lucrative targets for attacks. This issue is often called the Honeypot Problem. A recent work proposed the 2PC-MPC paradigm, in which a client and a decentralized network jointly generate signatures, aiming to mitigate this issue. In this work, we present the first asynchronous 2PC-MPC protocol for ECDSA signatures, designed to operate over reliable broadcast channels as implemented in modern blockchains. Our protocol tolerates dynamic, post-determined quorums whose participants may change between rounds. This allows the protocol to align with asynchronous consensus layers while providing identifiable abort, public verifiability, guaranteed output delivery (assuming completeness of the broadcast channel) and censorship resistance for the client. We introduce global presigns, which are generated autonomously by the network and remain client-agnostic until signing. This enables effective background preprocessing, and results in sub-second online signing network-side latency for dozens of concurrent clients. From a technical perspective, our asynchronous design eliminates commitment rounds, yielding one-round client interaction for both key generation and signing. We also remove the need for zero-knowledge proofs toward the client. This results in a client complexity independent of network size, without proof aggregation (which is particularly challenging over asynchronous channels). Our constructions are proven UC-secure in the asynchronous setting. To achieve concrete security over 256-bit elliptic curves, we introduce the Slightly-Enhanced ECDSA Unforgeability assumption and provide a tight reduction in the EC-GGM model. Beyond theoretical analysis, we implement our protocols and evaluate them in both a local benchmark and a live permissionless deployment with dozens of validators, demonstrating practical performance and robustness under heterogeneous execution speeds.

Note: Major revision. This is the full version of the paper published at ACNS 2026. The protocol has been redesigned around a single global network key share and global presigns, which are client-agnostic until the online signing step; the security analysis has been revised and corrected for this multi-key setting, and the claim of additive key derivation (BIP32) support has been adjusted. The reconfiguration protocols of the previous version have been removed, as the global key share design makes resharing straightforward, and the title has been updated accordingly. The experimental evaluation has been redone with a constant-time class-group implementation and now includes a live permissionless deployment with dozens of validators.