Threshold Call Preview Talks

“Preview Talk” (by Team Trout) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this talk, we will present Trout++, a two-round threshold ECDSA signing protocol which may be used to achieve a robust, asynchronous protocol for arbitrary thresholds. Our protocol works with no additional prior setup/secure storage, offers a prover with complexity independent to the signing set, and avoids the complexity of the Asynchronous Common Subset problem via the extremely straightforward, yet still efficient, ROAST transformation. Our focus with Trout++ has been an exceptionally practical scheme, with comprehensive coverage of the concerns which are raised when actually deploying a threshold signature scheme, as we will discuss in this talk. We will also discuss our planned future work to ensure Trout++ is a leading candidate for standardization.

Joint work: Luke Parker, Hila Dahari-Garbian, Ariel Nof

Suggested readings:

• Preview Writeup (PDF): Trout++: Two-Round Threshold ECDSA Composable with ROAST
• Trout: Two-Round Threshold ECDSA from Class Groups (ia.cr/2025/1666)
• Linearly Homomorphic Encryption from DDH (ia.cr/2015/047)

“Preview Talk” (by Team Twig) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this talk, I will present Twig, a multi-party threshold ECDSA scheme that takes only two rounds of interaction for signing, which our team plans to submit to the NIST threshold call. The signing protocol features a small message size of 1.2-1.9 KiB at 128-bit security and follows an online/offline paradigm with a lightweight online phase. The protocol makes use of 1) a Non-Interactive Multiplication gadget instantiated using class groups in the Castagnos–Laguillaumie (CL) framework, originating from research on Homomorphic Secret Sharing, and 2) a presignature re-randomization technique inspired by recent work of Adjedj et al. (PKC '26). I will discuss the protocol design and provide information on its implementation and performance.

Joint work: Yingjie Lyu, Zengpeng Li, Xudong Deng, Hong-Sheng Zhou, Mei Wang, Puwen Wei, Chen Qian

Suggested readings:

• Preview Writeup (PDF): Twig: Two-Round Threshold ECDSA
• “Threshold ECDSA in Two Rounds” (ia.cr/2025/1696)

Preview Talk” (by Team Dfns-KU) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this presentation, we introduce KU, an honest-majority threshold ECDSA protocol submitted to Category N1.2 of the NIST Threshold Call. While recent standardization efforts have heavily favored the dishonest-majority setting, the goal of this talk is to advocate for the compelling architectural advantages of honest-majority protocols in Key Management Networks (KMNs). In KMNs, a fixed set of servers secures millions of keys across independent trust domains, making an honest-majority assumption highly practical. By embracing this assumption, KU achieves two interesting practical properties: key-independent presignatures and the highly efficient batch generation of these presignatures. These properties enable a highly optimized division between the offline and online signing phases. During the offline phase, KU generates a single global pool of presignatures in massive batches, drastically reducing amortized network costs. Unlike state-of-the-art protocols that require provisioning key-dependent presignatures for every individual key, this shared pool eliminates massive management bottlenecks. Then, during the non-interactive online phase, a presignature from this pool can be consumed instantly for any requested key. We will present benchmarks demonstrating an amortized offline generation cost of 1.3 ms per presignature and a sustained, very high online throughput.

Joint work: Antoine Urban, Jonathan Katz, Denis Varlakov, Nikita Sorokovikov

Suggested readings:

• Preview Writeup (PDF): Coordinated MPC: Message delivery protocol designed for MPC systems with a central Coordinator 
• "Honest-Majority Threshold ECDSA with Batch Generation of Key-Independent Presignatures" (ia.cr/2024/2011)
• “Fast Large-Scale Honest-Majority MPC for Malicious Adversaries” (ia.cr/2018/570)

“Preview Talk” (by Team Dfns-Coord) @ TCPT2, in reply to the NIST Threshold Call

Abstract: This presentation dives into challenges of production deployment of Multi-Party Computation (MPC) protocols in production, specifically the message delivery layer that enables parties of the protocol to communicate. Its role is crucial: it has to fulfill strict security properties, with the security of the entire system at stake if they are not met. Implementing own delivery layer is error-prone, especially when other requirements are taken into account: such as operational simplicity, zero-downtime, and in-depth security. We will present the Coordinated MPC, the Transport Layer for MPC protocols that is designed and optimized for real-world MPC deployment and provides MPC-specific features, such as 1-round consensus on list of participants, globally unique execution nonce derivation, provable attribution of decryption. We will show the architecture of our Transport Layer which uses a central party (the coordinator) to relay messages. The coordinator is designed to be trustless, an adversary that fully controls it is limited to Denial-of-Service attacks only. Finally, we will discuss how the security of the protocol is proven in the Universally Composable (UC) model, allowing it to be safely composed with other UC protocols.

Joint work: Denis Varlakov, Antoine Urban, Nikita Sorokovikov

Suggested readings:

• Preview Writeup (PDF): Coordinated MPC: Message delivery protocol designed for MPC systems with a central Coordinator

“Preview Talk” (by Team FaFROST) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this presentation we present FaFROST, a two-round Schnorr threshold signature scheme that achieves full adaptive security together with identifiable aborts under the Algebraic One-More Discrete Logarithm (AOMDL) assumption alone. Our construction builds on FROST (Flexible Round-Optimized Schnorr Threshold Signatures), one of the leading two-round candidates in the ongoing standardization of threshold signatures. Recent work has shown that proving FROST adaptively secure under standard assumptions is difficult, and existing solutions each give up an important property: they either rely on an additional non-standard assumption, require an extra communication round, or forgo identifiable aborts. Identifiable aborts allow honest parties to identify a misbehaving signer whenever a signing attempt fails, so that the responsible signer can be excluded and the protocol keeps making progress. Given that without identifiable aborts even a single misbehaving signer can stall protocol execution indefinitely, we view them as deployment-critical. To our knowledge, FaFROST is the first two-round threshold Schnorr signature to combine all three: full adaptive security, reliance on the well-established AOMDL assumption alone, and identifiable aborts. It preserves FROST's communication and computation efficiency for honest signing: an additional identification protocol runs only when a signing session fails, enabling efficient fault attribution at nearly no cost to successful executions.

Joint work: Paul Gerhart, Ruben Baecker, Davide Li Calsi, Luigi Russo, Dominique Schröder, Arkady Yerukhimovich

Suggested readings:

• Preview Writeup (PDF): FaFROST: Fully Adaptive FROST with Identifiable Aborts Without the LDVR Assumption
• “On the Adaptive Security of FROST” (ia.cr/2025/1061)
• Fully Adaptive FROST in the Algebraic Group Model From Falsifiable Assumptions (ia.cr/2025/1950)

“Preview Talk” (by Team TALUS) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this presentation, we introduce TALUS, a threshold signing protocol for ML-DSA (FIPS 204) that achieves one-round online signing by filtering nonces offline. The core technique is the Boundary Clearance Condition (BCC): a publicly verifiable predicate on the nonce vector that geometrically guarantees the secondary rejection check will pass, eliminating the only secret-dependent abort in ML-DSA's signing loop. For ML-DSA-65, approximately 31.7% of random nonces satisfy BCC, meaning roughly three offline attempts produce a usable nonce in expectation. We present two deployment models. TALUS-TEE uses a Trusted Execution Environment to hold the aggregate nonce, enabling single-round signing with 1.52 ms end-to-end latency at a 3-of-5 threshold. TALUS-MPC removes the hardware trust assumption via a fully distributed protocol using carry elimination and masked broadcast, achieving 4.09 ms with honest majority. Both models produce standard FIPS 204 signatures verifiable by any unmodified ML-DSA verifier.

Joint work: Leo Kao, Raymond Chang

Suggested readings:

• Preview Writeup (PDF): TALUS: Threshold ML-DSA with One-Round Online Signing
• "TALUS: Threshold ML-DSA with One-Round Online Signing via Boundary Clearance and Carry Elimination" (arXiv:2603.22109)

“Preview Talk” (by Team Lemur) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this talk, we present Lemur, a non-interactive synchronized multi-signature scheme based on lattice cryptography, designed for large-scale distributed systems such as blockchain protocols. Lemur builds on the ideas introduced in Squirrel and Chipmunk but fundamentally redesigns the cryptographic foundations of the framework to achieve improved efficiency. A central contribution is the introduction of the Dual Hint-MLWE assumption, a new lattice assumption that we show is at least as hard as the standard Module-LWE problem. Leveraging this assumption, Lemur redesigns the underlying key-homomorphic one-time signature (KOTS) component, resulting in significantly improved compactness and scalability, with up to an order-of-magnitude reduction in KOTS size compared with Chipmunk. We also revisit the homomorphic vector commitment layer, moving from Ring-SIS to Module-SIS assumptions and extending commitment domain from vectors to matrices, further improving aggregation efficiency. Together, these advances enable Lemur to reduce aggregate signature sizes by roughly a factor of two while supporting extremely large signer sets, making it a practical post-quantum solution for synchronized multi-signature applications. Concretely, at 128-bit post-quantum security, the current Rust implementation profile yields an aggregate of about 380 KB for one million individual signatures (versus Chipmunk’s ∼728 KB), while keeping stateful signing millisecond-scale and aggregated verification in the tens of milliseconds for 1024 signers.

Joint work: Yini Lin, Muhammed F. Esgin, Markku-Juhani O. Saarinen, Amin Sakzad, Ron Steinfeld

Suggested readings:

• Preview Writeup (PDF): Lemur: Scalable Post-Quantum Synchronized Multi-Signatures (see also ia.cr./2026/1161)
• Chipmunk: Better Synchronized Multi-Signatures from Lattices (ia.cr./2023/1820)
• Squirrel: Efficient Synchronized Multi-Signatures from Lattices (ia.cr/2022/694)

“Preview Talk” (by Team LoTRS) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this presentation, we will introduce LoTRS, a lattice-based post-quantum structured threshold ring signature scheme. A threshold ring signature lets a quorum jointly sign while hiding which eligible signers participated. LoTRS formalizes a structured version of this primitive: public keys are arranged in a table, and a valid quorum consists of one hidden column, with one signer from each row. This captures settings where the approval pattern is public, such as one delegate per organization, role, or precinct, but the actual approving column should remain private. The construction separates threshold signing from the anonymity mechanism: a two-round lattice-based multi-signature proves that the quorum signed, while a one-out-of-many zero-knowledge proof hides which column was used. To the best of our knowledge, LoTRS is the first construction in which a TRS variant is obtained by combining these primitives. We will describe the new structured threshold ring signature model, the LoTRS construction, and our implementation results. For the headline setting with 50 rows and 100 candidate columns, LoTRS produces signatures of about 35 KB, roughly 3.5 times smaller than the previous best lattice-based threshold ring signature, with signing and verification wall-clock times of 789 ms and 250 ms, respectively. Our work includes Python and Rust implementations, deterministic test vectors, parameter-estimation scripts, and benchmarks.

Joint work: Nikai Jagganath, Muhammed Esgin, Ron Steinfeld, Amin Sakzad, Markku-Juhani O. Saarinen, Dongxi Liu

Suggested readings:

• Preview Writeup (PDF): LoTRS: Practical Post-Quantum Structured Threshold Ring Signatures from Lattices (see also ia.cr/2026/974)
• DualMS: Efficient Lattice-Based Two-Round Multi-Signature with Trapdoor-Free Simulation (ia.cr/2023/263)
• Short Lattice-based One-out-of-Many Proofs and Applications to Ring Signatures, (ia.cr/2018/773)

“Preview Talk” (by Team LaZer) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this talk we present LaZer, our Category S6 submission to the NIST First Call for Multi-Party Threshold Schemes: a lattice-based, non-interactive, transparent (no trusted setup) zero-knowledge argument of knowledge for statements about secrets in module lattices. The defining feature of LaZer is that it proves lattice relations natively - that is, directly in module-ring arithmetic, without first arithmetizing them into a circuit. This lets the proof system share lattice arithmetic (such as the NTT) with the application it certifies, express statements in their natural language of ring equalities and norm bounds, and reduce security to the very same Module-SIS and Module-LWE assumptions that already underpin the primitive being proven - introducing no new assumptions. Security is computational and plausibly post-quantum, at the 128-bit level, obtained via the Fiat–Shamir transform of a public-coin interactive argument.
The talk provides an overview of the type of statements that can be proved, how this is done using a hand full of core techniques, and potential improvements and updates that are being explored.

Joint work: Patrick Steuer, Ngoc Khanh Nguyen, Vadim Lyubashevsky, Michał Osadnik, Gregor Seiler

Suggested readings:

• Preview Writeup (PDF): Lattice-Based Zero-Knowledge Arguments for Lattice Relations
• The LaZer Library: Lattice-Based Zero Knowledge and Succinct Proofs for Quantum-Safe Privacy (ia.cr/2024/1846)
• Lattice-Based Zero-Knowledge Proofs and Applications: Shorter, Simpler, and More General (ia.cr/2022/284)

“Preview Talk” (by Team Threshcon) @ TCPT2, in reply to the NIST Threshold Call

Abstract: In this talk, we present the planned package submission for Threshcon, a protocol family developed to securely evaluate the Ascon lightweight symmetric cryptography suite within a multi-party threshold context. Our submission covers the Ascon-AEAD128 authenticated encryption and decryption scheme, as well as the Ascon-Hash256 and Ascon-CXOF128 modes, and guarantees strict functional equivalence with the standard NIST primitives. Threshcon is set in the preprocessing model and is designed for an n-party setting with an honest supermajority, providing information-theoretic security against active malicious adversaries that corrupt up to t < n/3 parties. Beyond Shamir secret sharing, we rely on Reverse Multiplication-Friendly Embeddings (RMFEs) to align the multi-party evaluation more closely with Ascon's parallelized bitwise design. We will discuss secret-sharing semantics applied to the required inputs and outputs. Finally, we will provide an overview of the ongoing implementation efforts for the NIST multi-party threshold call.

Joint work: Peter Schwarz, Aysajan Abidin

Suggested readings:

• Preview Writeup (PDF): Threshcon: Multi-Party Threshold Ascon
• Evaluating Ascon in Secure Multi-Party Computation using Reverse Multiplication-Friendly Embeddings (ia.cr/2025/1538)