TCPT3: Threshold Call Preview Talks #3

Abstract. This brief talk opens the NIST TCPT event: Threshold Call Preview Talks #3 (3rd phase). This short segment welcomes the participants, recalls the context of the NIST Threshold Call, explains the logistics of the virtual event, and transitions to the first technical session.

Suggested readings:

• NIST IR 8214C: NIST Threshold Call
• List of Preview Writeups

"Preview Talk" (by team Kryptallage) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk we present an overview of our threshold integrated Fully Homomorphic Encryption (FHE) system, Kryptallage, targeting NIST Threshold Categories S4 and S5. Kryptallage unifies several homomorphic encryption schemes and the procedures for switching between them into a single encrypted-computation framework. Rather than working with specific named FHE schemes, we consider ciphertexts through their functionality, message space, encoding, and mathematical representation. This offers a more generic framework to describe scheme switching, via ciphertext characteristics. We will present an overview of the different ciphertext types and how they interact. Our scheme switching approach is used to make leveled evaluation of look-up tables (LUTs), comparisons, and other operations practical at scale. We will motivate and overview the batched circuit bootstrapping process which is used to enable our approach. The FHE specification that we use features distributed key generation and decryption. This is enabled by a module threshold layer that realises these distributed operations using Shamir secret sharing over Galois rings. The threshold protocols are proven UC-secure against a static malicious adversary corrupting $t<n/2$t<n/2 parties, providing active security with abort for key generation and guaranteed output delivery for decryption.

Joint work: Ghada Almashaqbeh, Sonia Belaïd, Nicolas Bon, Ilaria Chillotti, Mariana Gama, Antonio Guimarães, Erin Hales, Hyojun Kim, Elena Kirshanova, Damien Ligier, Ryan Orendorff, Emmanuela Orsini, Matthieu Rivain, Luisa Siniscalchi, Ravital Solomon, Rick Weber.

Suggested readings:

• Preview Writeup (PDF): Kryptallage: Thresholdized FHE scheme switching

"Preview Talk" (by team MOZI) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, I will introduce MOZI and discuss how to make threshold fully homomorphic encryption (ThFHE) scalable for hundreds or thousands of participants. ThFHE enables computation on encrypted data while distributing decryption authority among multiple key holders. Scaling this capability requires careful control of computation, communication, and storage complexity. I will explain MOZI’s modular design, which uses approximate secret sharing (ApproxSS) to separate threshold decryption from the underlying encryption scheme. This design supports two complementary systems: MOZI-Fang uses lattice-based symmetric encryption and targets post-quantum security, while MOZI-Yuan combines lattice techniques with elliptic-curve operations to explore lower recovery costs under quantum-vulnerable assumptions. These goals include guaranteed output delivery with an available semi-honest combiner and sufficient honest participation, and security with abort against a malicious combiner. Finally, I will outline our evaluation plan, covering network costs, optional preprocessing, and authenticated Beaver-triple generation for secure multi-party computation. The talk will highlight the design choices and practical tradeoffs involved in scaling threshold encryption for collaborative applications.

Joint work: Man Ho Au, Yijia Chang, Rongmao Chen, Xinyi Huang, Xianhui Lu, Moti Yung.

Suggested readings

• Preview Writeup (PDF): MOZI: Threshold FHE at Scale: Efficient and Resilient, for Large-Scale MPC
• Arbitrary-Threshold Fully Homomorphic Encryption with Lower Complexity (ia.cr/2025/084)
• Resolving the Efficiency-Utility Dilemma of Threshold Linearly Homomorphic Encryption via Message-Space Adapter (ia.cr/2025/948)

"Preview Talk" (by team Holocron) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we introduce a framework for thresholdizing K-PKE, the public-key encryption (PKE) underlying ML-KEM, using fully homomorphic encryption (FHE). Our construction achieves full ciphertext interchangeability: threshold encryption outputs a K-PKE ciphertext that can be decrypted by standard K-PKE decryption, while threshold decryption decrypts ordinary K-PKE ciphertexts with equivalent functionality. For encryption, parties combine independently sampled random bits while encrypted in a discrete Cheon-Kim-Kim-Song (CKKS) ciphertext. By lifting the plaintext space utilizing CKKS short-integer bootstrapping, we exploit noise flooding, plaintext masking, and linearity to form the final ciphertext without revealing the message or randomness. For decryption, we embed the K-PKE phase computation into a Brakerski-Gentry-Vaikuntanathan (BGV) scheme, homomorphically evaluate the nonlinear compression/decompression step, and use modulus expansion and noise flooding to protect partial decryptions. We discuss correctness and active-static security with abort based on the commit-and-reveal technique and Buckler non-interactive zero-knowledge proofs (NIZKs).

Joint work: Jihoon Cho, Siwoo Eum, Kyoohyung Han, Intak Hwang, Jaejun Ko, Jihoon Kwon, Byeonghak Lee, Sangyub Lee, Seonhong Min, Hwajeong Seo, Yongsoo Song, Hyojin Yoon.

Suggested readings

• Preview Writeup (PDF): Holocron: Threshold K-PKE Encryption and Decryption from FHE

"Preview Talk" (by team ark-pq) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we introduce ark-pq, a library for transparent, post-quantum zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs). ark-pq can prove sensitive claims about threshold cryptographic primitives without exposing sensitive data (e.g., knowledge of a secret key, or the validity of a signature), as well as an extensive range of complex well-formedness conditions. ark-pq is built from two very well-understood primitives: interactive oracle proofs (IOPs) and Merkle tree vector commitments (VCs). ark-pq is designed to be modular and configurable, allowing for the construction of a wide range of zkSNARKs with different trade-offs between proof size, prover time, and verifier time.

Joint work: Alessandro Chiesa, Giacomo Fenzi, Christian Knabenhans, Andrew Zitek-Estrada.

Suggested readings

• Preview Writeup (PDF): ark-pq: post-quantum zero-knowledge arguments of knowledge
• arkworks: zkSNARK ecosystem (repo).
• Interactive Oracle Proofs (ia.cr/2016/116).

Abstract: In this talk, we will introduce ATMACA, an efficient post-quantum threshold signature protocol for the FFT (fast Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA/FALCON). The main difficulty of threshold signing for FALCON in multi-party computation (MPC) is that FALCON's sampler draws its Gaussian samples sequentially. Therefore, the number of rounds grows linearly with the ring degree. ATMACA evaluates the hybrid sampler used by Mitaka, a FALCON variant, with annular NTRU trapdoor generation (ANTRAG) keys. In this setting, only two steps are sequential, and the samples within each step are drawn in parallel. The signatures still pass the unchanged FALCON verifier. ATMACA tolerates a dishonest majority with security with abort, uses a trusted dealer, and aims for Category N1 at NIST security categories 1 and 5. We estimate fewer than 180 online rounds per attempt in expectation, and at most 350 under a reasonable iteration cap, against thousands reported for earlier threshold FALCON work. In this presentation, we go over the main design choices and differences from the past work.

Joint work: Erdem Alkım, Metin Bektaş, Erem Ersoy, Muhammed Said Gündoğan.

Suggested readings

• Preview Writeup (PDF): ATMACA (A Threshold Multiparty Algorithm for Compact Authentication): Lattice-Based Threshold Signing for FALCON
• Mitaka: a simpler, parallelizable, maskable variant of Falcon (ia.cr/2021/1486)
• Antrag: Annular NTRU Trapdoor Generation (ia.cr/2023/1335)
• Thresholdizing Standardized FALCON Signatures (ia.cr/2026/1300)

"Preview Talk" (by team Kettle) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we present Kettle, a thresholdized version of the signature scheme HAWK. While HAWK has been attacked recently, its security remains exponential, and its parameters are still competitive compared to existing threshold schemes. We demonstrate that HAWK can be evaluated with as few as 2 online rounds, provide short signatures and low online communication cost. Through a tailored way of daBits, we manage to move the Gaussian sampling and a secret multiplication to the offline phase, lowering the number of online rounds and communication cost. We prove the security of our scheme in the ABB framework, which make our building blocks (eg. Gaussian sampling) reusable in other schemes.

Joint work: Calvin Abou Haidar, Daniel Escudero, Thomas Espitau, Clément Hoffmann, Haruhisa Kosuge, Kaoru Takemure, Mehdi Tibouchi, Hernán Darío Vanegas Madrigal.

Suggested readings

• Preview Writeup (PDF): Kettle: Short Post-Quantum Threshold Signatures from the HAWK Signature Scheme
• HAWK: version 1.1 (February 5, 2025) (PDF)

"Preview Talk" (by team MASTER) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we preview DUOV, a planned submission to the NIST Multi-Party Threshold Cryptography (MPTC) process. DUOV is a post-quantum threshold version of the Unbalanced Oil and Vinegar (UOV) multivariate signature scheme, enhanced with pre-signing. We will present the main ideas underlying the scheme and an evaluation of a Common Lisp prototype deployed on up to 16 cloud instances located in distinct Amazon Web Services (AWS) regions and communicating over the public internet.

Joint work: Elouan Gros, Dayane Horkos, River Moreira Ferreira, Ludovic Perret.

Suggested readings

• Preview Writeup (PDF): DUOV: A Dressing in Advance for Threshold UOV with Pre-signing
• Efficient Implementations of Rainbow and UOV using AVX2 (DOI: 10.46586/tches.v2022.i1.245-269)
• Sharing the LUOV: Threshold Post-quantum Signatures (ia.cr/2019/1060)
• Optimizing and Implementing Threshold MAYO (ia.cr/2026/710)

"Preview Talk" (by team TALH) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, I will preview TALH and ASPEN, two hash-based threshold signature schemes planned for submission to the NIST Multi-Party Threshold Cryptography (MPTC) Call. Both schemes rest on the security of a hash function alone, rather than on a structured algebraic problem. TALH (Threshold Authentication via Leaf-sharing in Hash-based Signatures) is stateless. It distributes among the trustees the secret leaves of a forest of random subsets (FORS) and signs in three rounds, two of which fix a randomizer by commit-then-reveal. I will present two ways of sharing these secrets: a compact version based on replicated seeds, whose storage grows combinatorially with the number of trustees, and a scalable version based on Shamir sharing, which avoids that growth and therefore also fits the medium and large party-count profiles of the Call. ASPEN is stateful. It removes the randomizer, so that signing takes a single round and no interaction among trustees is needed, turning the stateful standards XMSS (eXtended Merkle Signature Scheme) and LMS (Leighton-Micali Signatures) into threshold schemes with a non-interactive signing phase. Both schemes assume a trusted dealer, and the aggregator holds only public data, so any trustee can play its role. I will also discuss how the schemes fit categories S1 and N1.5 of the Call.

Joint work: Muhammed Said Gündoğan.

Suggested readings:

• Preview Writeup (PDF): TALH: Threshold Authentication via Leaf-sharing in Hash-based Signatures
• Turning hash-based signatures into distributed signatures and threshold signatures (ia.cr/2022/241)
• Haystack: Threshold and Distributed Stateful Hash-Based Signatures (Preview writeup)
• FIPS 205: Stateless Hash-Based Digital Signature Standard.

"Preview Talk" (by team Octopus) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we will present two lattice-based two-round threshold signature schemes supporting general t-out-of-n access structures for the NIST Multi-Party Threshold Cryptography Call. The first scheme, TalonG, targets large-scale threshold settings and focuses on reducing per-party communication overhead. It follows the Raccoon signature framework and its threshold variants, and uses Shamir secret sharing in a trusted-dealer setup. The second scheme, P-DualTS, targets small-party deployments and focuses on compact public keys, short signatures, and efficient communication. It follows the ML-DSA signature framework and recent threshold constructions, and uses replicated secret sharing in a trusted-dealer setup. Both schemes provide post-quantum security under standard lattice assumptions and target Category S1: [Special] Signing of the NIST Threshold Cryptography Call. We will describe the system and security models, the main construction approaches, implementation status, and preliminary performance results, as well as our plans for the final submissions.

Joint work: Man Ho Au, Robert H. Deng, Liming Gao, Bowen Jiang, Xianhui Lu, Tian Qiu, Guofeng Tang, Ruida Wang, Haiyang Xue, Guomin Yang, Chengru Zhang.

Suggested readings

• Preview Writeup (PDF): TalonG and P-DualTS: Lattice-based Threshold Signatures
• TalonG: Bandwidth-Efficient Two-Round Threshold Signatures from Lattices (ia.cr/2026/303) 

"Preview Talk" (by team LaTSEC) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we present our plan to submit two related cryptosystems to the NIST Threshold Call. Lattice-based threshold signatures with identifiable abort, where misbehaving signers are pinpointed rather than merely detected, need a secret sharing scheme whose shares and reconstruction coefficients are all short; existing schemes of this kind give each participant many short sub-shares, and with them many public verification keys. We first introduce SEC, a secret sharing scheme over integer modules built from a lossless bipartite expander graph, which gives each participant exactly one short share, and we explain why its privacy is computational, reducing to the Module Learning With Errors (MLWE) problem. We then present LaTSEC, a three-round threshold signature over an authenticated broadcast channel that uses SEC as its sharing layer: each participant holds one short signing share and one public abort key, so every partial response is checked independently and non-interactively, without zero-knowledge proofs. We outline its security under the MLWE and Module Short Integer Solution (MSIS) assumptions and show concrete parameters: for 60 participants at 128-bit security, each participant stores a 15.19-KiB share, many times smaller than in the closest comparable scheme. We also discuss the trade-offs, namely a gap between the corruption and signing thresholds, larger signatures, and a trusted dealer, and our plans for the submission package.

Joint work: Muhammad Arzaki, Muhammed F. Esgin, Markku-Juhani O. Saarinen, Amin Sakzad, Ron Steinfeld.

Suggested readings

• Preview Writeup (PDF): LaTSEC: Lattice-Based Threshold Signature from Expander Codes: Identifiable Aborts from Everywhere-Short Secret Sharing over Integer Modules
• Blackbox secret sharing revisited: A coding-theoretic approach with application to expansionless near-threshold schemes (ia.cr/2019/1134)
• Threshold Raccoon: Practical threshold signatures from standard lattice assumptions (ia.cr/2024/184)
• Hermine: An efficient lattice-based FROST-like threshold signature (ia.cr/2026/419)

"Preview Talk" (by team Thimza) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we will talk about Thimza, a threshold signature over module lattices. In a (t,n) threshold signature scheme, a signing key is distributed among n parties such that any subset of at least t members of participants can jointly produce a valid signature which can be verified by an ordinary verifier. The signatures in Thimza are based on Raccoon system (CRYPTO’ 24). Threshold Raccoon is a lattice-based signature scheme which is a Fiat-Shamir construction and has had a significant influence on threshold lattice-based signatures that avoid expensive operations. This scheme and its variants hide partial signatures behind one-time additive masks. However, there are three main issues with this mechanism. First, a signer needs to remember every session identifier it has ever used to avoid repeating masks, which could leak the key share. Moreover, in the two-round case, a signer set is fixed. The next issue is that the channels need to be authenticated by some message authentication code. Previous attempts to address this issue have resulted in signature inflation from 11 to 30-50 kilobytes. The third issue is that the amount of communication per signer is in the range of 27 to 613 kilobytes, which is inefficient. In our signature scheme, we address all these issues. We first show that interactive Fiat-Shamir threshold signatures cannot be stateless; however, one ephemeral self-erasing token per session is enough. Then, we discuss that masks derived from signer’s view imply a view-partition lemma stating that honest responses decompose based on the views of honest parties. This removes authenticated channels and preprocessing awareness of the signer set. We discuss the security analysis of our scheme and show that it is more efficient than previous schemes. For threshold t=1024, the communication per signer is 16.3 KiB which is 1.6 times less than best prior schemes, while it is at least 1.6 times faster.

Joint work: Navid Abapour, Hamidreza Amini Khorasgani.

Suggested readings

• Preview Writeup (PDF): Thimza: Stateless Threshold Signatures at Optimal Bandwidth
• Raccoon: A Masking-Friendly Signature Proven in the Probing Model (ia.cr/2024/1291)
• Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions (ia.cr/2024/184)
• Lattice Signatures without Trapdoors (ia.cr/2011/537)

"Preview Talk" (by team TSitH) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we will introduce a family of threshold signature schemes based on the MPC-in-the-Head paradigm with threshold-friendly Merkle-tree commitments. It builds on the recent Threshold-Signatures-in-the-Head (TSitH) framework which enables the construction of threshold signatures from any one-way function. The submission will include three concrete instantiations of the framework, based respectively on the block cipher AES, the multivariate quadratic problem (MQ), and the syndrome decoding problem (SD). These variants are intended to provide plausibly post-quantum security: no efficient quantum or classical attacks are known against the underlying symmetric primitives used in the MPC-in-the-Head construction, nor against the hard problems on which the three instantiations rely. The TSitH framework was introduced as a preprint in mid-2026. The present submission aims to develop that framework into concrete threshold signature schemes suitable for consideration in the NIST MPTC process. These schemes combine techniques from hash-based proof systems (MPC-in-the-Head with Merkle tree commitments) and generic secure multiparty computation in order to obtain practical threshold signatures schemes based on various security assumptions.

Joint work: Thibauld Feneuil, Matthieu Rivain, Damien Vergnaud, Auguste Warmé-Janville.

Suggested readings

• Preview Writeup (PDF): TSitH: Threshold Signatures in the Head: A framework for threshold MPC-in-the-Head signatures
• “Threshold Signatures in the Head” (ia.cr/2026/1125)
• Threshold computation in the head: Improved framework for post-quantum signatures and zero-knowledge arguments (ia.cr/2023/1573)

"Preview Talk" (by team CL) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, I will present the Castagnos-Laguillaumie (CL) encryption scheme, a Linearly Homomorphic Public-Key Encryption (LHE) scheme based on Class Groups of imaginary quadratic fields, as well as its threshold variant, Threshold-CL. Both schemes are submitted to the NIST Threshold Call as Gadgets (category S7). LHE and Threshold-LHE have become key tools for building secure MPC protocols. CL offers a LHE that, compared to Paillier, is more efficient for security levels of 128 bits and above, and gives shorter ciphertexts. CL does not require a trusted setup, thanks to the unique context of class groups, another useful property for secure MPC. The threshold variant, Threshold-CL, is statically secure in the honest majority setting, and provides efficient distributed decryption that scales well with large sets of parties. I will provide a performance overview of CL and Threshold-CL from their implementation in the BICYCL library, and give examples of threshold schemes that make use of CL or Threshold-CL.

Joint work: Cyril Bouvier, Lennart Braun, Guilhem Castagnos, Quentin Combal, Fabien Laguillaumie, Kelsey Melissaris, Ida Tucker.

Suggested readings

• Preview Writeup (PDF): CL and Threshold-CL: (Threshold) Linearly Homomorphic PKE from Class Group
• Practical Fully Secure Unrestricted Inner Product Functional Encryption modulo p (ia.cr/2018/791)
• An Improved Threshold Homomorphic Cryptosystem Based on Class Groups (ia.cr/2024/717)

"Preview Talk" (by team Trout) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we will present Axolotl, a multi-party pseudo-random function. Axolotl can be executed by arbitrary thresholds over an asynchronous network where participants solely have peer-to-peer channels with each other. Despite this flexibility, Axolotl is concretely efficient, requiring just a few kibibytes be multicast by each participant at the 128-bit security level.

We then premise a threshold Schnorr signing protocol upon Axolotl. The result is a two-round protocol which does not require a consistent set to participate in each round, nor a consistent view over who participated in the first round, avoiding the overhead (and assumptions) required for agreement. We manage to achieve this result without the use of Fully Homomorphic Encryption or similarly heavy cryptography, instead premising our instantiation on a group of unknown order.

Joint work: Hila Dahari-Garbian, Ariel Nof, Luke Parker.

Suggested readings

• Preview Writeup (PDF): Axolotl: Robust Asynchronous Two-Round Threshold Schnorr over Point-to-Point Channels
• Linearly Homomorphic Encryption from DDH (ia.cr/2015/047)
• Two-Round Threshold ECDSA (Trout) trout-plus-plus (GitHub)

"Preview Talk" (by team The Stoats) @ TCPT3, in reply to the NIST Threshold Call

Abstract: This presentation covers our plan to submit Stoats, a family of two-round two-party threshold signature crypto-systems built from pseudorandom correlation functions (PCFs). The principal crypto-systems computes ECDSA (Elliptic Curve Digital Signature Algorithm) or Schnorr signatures in two rounds with about a hundred bytes of communication and a runtime in the range of one millisecond. The crypto-systems from the Stoats family satisfy malicious security in the universal composability framework and include variants with stateless and deterministic signing, i.e., nonces are derived pseudorandomly without keeping state across signing sessions. Signing is enabled by a one-time interactive setup that distributes keys for a PCF generating vector oblivious linear evaluation (VOLE) correlations; the PCF is based on the well-studied sparse learning-parity-with-noise (LPN) assumption in the random oracle model. The underlying VOLE-PCF and its maliciously secure distributed key generation are also specified as a standalone gadget and submitted as a crypto-system.

Joint work: Lennart Braun, Geoffroy Couteau, Kelsey Melissaris, Mahshid Riahinia, Peter Rindal, Elahe Sadeghi.

Suggested readings

• Preview Writeup (PDF): Stoats: Short Two-round vOle-bAsed Threshold Signatures: Two-Party Signing from Pseudorandom Correlated Functions for Vector OLE
• Succinct Two-Round Two-Party Signing from PCFs (ia.cr/2026/1978)
• Fast Pseudorandom Correlation Functions from Sparse LPN (ia.cr/2025/1644)

"Preview Talk" (by team ABCDKLs: Associated Builders of and Contributors to the DKLs protocols) @ TCPT3, in reply to the NIST Threshold Call

Abstract: TBA

Joint work: Jack Doerner, Yashvanth Kondi, Eysa Lee, Peter Rindal, Lawrence Roy, abhi shelat.

Suggested readings

• Preview Writeup (PDF): DKLs: Threshold ECDSA from VOLE and Commitments

"Preview Talk" (by team Octopus) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we present three threshold ECDSA schemes — a two-party protocol and two t-out-of-n threshold signature protocols — submitted as the Octopus team's preview proposals to the NIST Multi-Party Threshold Cryptography (MPTC) call. All three schemes run in three rounds. (1) Our two-party scheme, Menshen, requires only a single multiplicative-to-additive (MtA) conversion, also known as oblivious linear evaluation (OLE); importantly, this MtA is key-independent. (2) Our first t-out-of-n scheme, Octopus-CL, relies on standard Castagnos–Laguillaumie (CL) encryption. It provides cheater identification for any threshold t, and additionally guarantees robustness in the honest-majority setting. (3) Our second t-out-of-n scheme, Octopus-TCL, builds on a threshold version of CL encryption.

Joint work: Man Ho Au, Robert H. Deng, Liming Gao, Bowen Jiang, Xianhui Lu, Tian Qiu, Guofeng Tang, Ruida Wang, Haiyang Xue, Guomin Yang, Chengru Zhang.

Suggested readings

• Preview Writeup (PDF): Menshen and Octopus-(T)CL: Two-party and Threshold ECDSA Schemes
• Efficient online-friendly two-party ECDSA signature (ia.cr/2022/318)
• Robust Threshold ECDSA with Online-Friendly Design in Three Rounds (ia.cr/2025/910)
• Three-Round (Robust) Threshold ECDSA from Threshold CL Encryption (ia.cr/2026/190)

"Preview Talk" (by team Octopus) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we will introduce a two-round threshold BBS scheme, which currently achieves the minimum number of rounds. It is the best of both worlds: it satisfies security under a dishonest majority assumption and robustness under an honest majority, meaning that the signing protocol is guaranteed to output a valid signature as long as there are enough honest signers. Additionally, we will discuss how this protocol achieves high efficiency while minimizing communication rounds and maintaining robustness. At the same time, we will also introduce a two-party BBS scheme in two passes, which outperforms previous two-party constructions in terms of both communication and computation. This makes our solutions highly practical for decentralized credential systems and real-world privacy-preserving applications.

Joint work: Man Ho Au, Robert H. Deng, Liming Gao, Bowen Jiang, Xianhui Lu, Tian Qiu, Guofeng Tang, Ruida Wang, Haiyang Xue, Guomin Yang, Chengru Zhang.

Suggested readings

• Preview Writeup (PDF): TapTop and Robot: Two-party BBS and Robust Threshold BBS Schemes
• Robot: Robust threshold BBS+ in two rounds (ia.cr/2026/651)
• Two-party BBS+ signature in two passes (ia.cr/2026/573)

"Preview Talk" (by team Tulva) @ TCPT3, in reply to the NIST Threshold Call

Abstract:  While fully homomorphic encryption (FHE) enables computation on encrypted data, whoever holds the secret key can decrypt every input and output, creating a single point of failure.  Threshold FHE alleviates this problem by distributing the decryption key among K shareholders in such a way that any threshold t of them can jointly decrypt a ciphertext.  In this talk, I will present Tulva, a compiler that turns a lattice-based FHE scheme into a threshold FHE scheme with asynchronous decryption: each participating party produces its own partial decryption share, and the message is recovered only when sufficiently many shares are combined.  Parties may produce these shares asynchronously, without even agreeing in advance on who will participate.  Tulva adopts a two-layer design: a base FHE layer that inherits the format and efficiency of the FHE scheme, and a threshold layer that handles threshold decryption. It is almost agnostic to the FHE scheme, supporting the common BGV/BFV, FHEW/TFHE and discrete CKKS families, with implementations differing only in a public ciphertext preprocessing step.  Tulva targets a security model where an adversary can selectively corrupt |C| parties and request for partial decryptions of honestly generated ciphertexts, including the challenge ciphertext.  The message encrypted in the challenge ciphertext remains hidden so long as the adversary sees fewer than t - |C| of its partial decryptions.  Practically, Tulva-compiled threshold FHE schemes feature very small decryption shares, flexible threshold configurations with large numbers of parties, fast non-interactive decryption, and black-box integration with state-of-the-art FHE schemes.

Joint work: Valerio Cini, Antonio Guimarães, Aaron Kaiser, Russell W. F. Lai, Michał Osadnik, Ivy K. Y. Woo.

Suggested readings

• Preview Writeup (PDF): Tulva: Asynchronous Threshold FHE Transform with Small Decryption Shares
• Pilvi: Lattice Threshold PKE with Small Decryption Shares and Improved Security (ia.cr/2025/1691)
• Leaky LWE: Learning with Errors with Semi-Adaptive Secret- and Error-Leakage (cic.iacr.org/p/2/3/21)

"Preview Talk" (by team Adamas) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we present Adamas, a family of one-round lattice-based (t,N)-threshold key encapsulation mechanism (TKEM) and public key encryption (TPKE) schemes.  It comprises two TKEM schemes and one TPKE scheme, all supporting one-round decryption, and achieving chosen-ciphertext (CCA) security under adaptive corruptions, based on standard structured-lattice assumptions with polynomial modulus.  For active security, our TKEM schemes TKEM₁ and TKEM₂ achieve security-with-abort while our TPKE scheme achieves stronger robustness.  Technically, all our schemes are threshold variants of Regev-style encryption schemes augmented with non-interactive zero-knowledge (NIZK) proofs.  Our TKEM₁ uses Shamir secret sharing and supports synchronous decryption for large-scale parties.  Our TKEM₂ and TPKE use replicated secret sharing, and support asynchronous decryption for small-scale parties.  We use the polynomial flooding technique and the masking technique to control leakage about the secret key revealed by partial-decryption queries while keeping the modulus polynomial.  More precisely, TKEM₁ combines the masking technique and adaptive Hint-MLWE assumption, whereas TKEM₂ and TPKE rely on a new adaptive leftover hash lemma under noisy linear leakage.  We use the Fujisaki-Okamoto transform to achieve security-with-abort in the threshold setting for our TKEM schemes, and use NIZK proofs to achieve stronger robustness for our TPKE scheme.  Finally, we provide a concrete efficiency estimate and comparison with prior works.  To our best knowledge, Adamas is the first lattice-based TKEM/TPKE family enjoying security under adaptive corruptions and polynomial modulus, simultaneously.

Joint work: Shuai Han, Shengli Liu, Yuxin Zhang, Yunxiao Zhou.

Suggested readings

• Preview Writeup (PDF): Adamas: One-Round Lattice-Based Threshold KEM and PKE under Adaptive Corruptions
• Adaptively CCA-Secure Threshold Decryption from Lattices with Polynomial Modulus (ia.cr/2026/1627)

"Preview Talk" (by team THQC) @ TCPT3, in reply to the NIST Threshold Call

Abstract:  This talk introduces THQC (Threshold Hamming Quasi-Cyclic), a threshold decryption version of FIPS (Federal Information Processing Standards) 207 HQC-KEM (Hamming Quasi-Cyclic Key-Encapsulation Mechanism). The decryption key is split using Shamir Secret Sharing.  Standard HQC parameters do not allow us to thresholdize decryption straightforwardly.  We will cover existing primitives making thresholdization possible.

Joint work: Jean-Christophe Deneuville, Nathan Maillet, Vincent Migliore, Cyrius Nugier.

Suggested readings

• Preview Writeup (PDF): THQC: Threshold HQC-KEM Decryption
• HQC Specification: https://pqc-hqc.org/resources.html
• Constant-Round Secure Distributed Decoding and HQC Threshold Decryption (ia.cr/2026/946)

"Preview Talk" (by team Kelvin Zero) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we describe two members of the Two-Round Trustless Distributed Key Generation (TORTL DKG) family: TORTL Elliptic Curve (TORTL-EC) and TORTL Module Lattice (TORTL-ML) DKG.  TORTL DKG leverages functional verification to minimize the size of data exchanged over the network at the end of each round. We build on top of standard secret sharing schemes and Chaum-Pedersen-type Zero Knowledge Proofs (ZKP) to construct a two-round DKG with exact interpolation and verifiable correctness and soundness. TORTL DKG's functional verifications validate whether the resulting secret sharing implements the threshold access structure for the expected threshold T and number of parties N. While this technique does not permit identifiable aborts, the protocol can only succeed if each party contributed to the secret sharing, removing the need for trust in the other parties. TORTL-EC results in a Shamir secret sharing of a joint-random elliptic curve key for P256, which is compatible with thresholdized Diffie-Hellman-based schemes. TORTL-ML results in a replicated secret sharing of a joint-random small-norm module lattice key, efficient for small T and N (single-digit parameters). The resulting secret sharing is compatible with thresholdized ML-based schemes.

Joint work: Maxime Godon, Florian Le Mouël, Nadège Pulgar-Vidal, Thierry St-Jacques-Gagnon.

Suggested readings

• Preview Writeup (PDF): TORTL DKG: Two-Round Trustless Distributed Key Generation
• Trustless Distributed Symmetric-key Encryption (arxiv:2408.16137)
• Practical post-quantum few-time verifiable random function with applications to Algorand (ia.cr/2020/1222)

"Preview Talk" (by team Octopus) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this talk, we present our plan to submit a t-out-of-n threshold EdDSA scheme, which we call Teddy.  To the best of our knowledge, all prior threshold EdDSA constructions are limited to the n-out-of-n setting.  The obstacle is that each party derives its deterministic local "randomness" solely from the secret key and the message, which lets an adversary recover the secret key by dynamically varying the active signing set.  Teddy—Threshold EdDSA with Dynamic signing set and message—addresses this.  Our technical contributions are twofold: a general t-out-of-n access structure for threshold EdDSA, and optimised zero-knowledge proofs for exponent-VRF computation across several PRF candidates, including Poseidon, AES, and SHA-3.

Joint work: Man Ho Au, Robert H. Deng, Liming Gao, Bowen Jiang, Xianhui Lu, Tian Qiu, Guofeng Tang, Ruida Wang, Haiyang Xue, Guomin Yang, Chengru Zhang.

Suggested readings

• Preview Writeup (PDF): Teddy: Threshold EdDSA Schemes
• Exponent-VRFs and Their Applications (ia.cr/2024/397)
• Sigmabus: Binding Sigmas in Circuits for Fast Curve Operations (ia.cr/2023/1406)

"Preview Talk" (by team Pilaf) @ TCPT3, in reply to the NIST Threshold Call

Abstract: In this presentation, we will introduce Pilaf, a two-round threshold signature scheme with complete message-independent preprocessing, and outline our planned submission to the NIST Threshold Call.  Pilaf allows a set of signing parties to prepare its entire first-round output, state, and randomness before the message is known, leaving the second round to process the subsequently chosen message.  Its security relies on the decisional Diffie-Hellman assumption in the classical random-oracle model, without bilinear pairings or the algebraic group model.  We highlight that our construction achieves level-two threshold-signature unforgeability (TS-UF-2) type security under adaptive corruptions that reveal the corrupted participants' secret shares and complete historical randomness without secure erasure, including the conditions under which preprocessing and partial signing interactions on the eventual forgery target are allowed.  We will also describe the tight security reduction, whose multiplicative loss is independent of the number of users, signing threshold, instances, and oracle queries.  Finally, we will discuss communication costs and implementation considerations, including centralized key generation, signer sets fixed before preprocessing, and single-use preprocessing states.

Joint work: Hao Cheng, Zengpeng Li, Chen Qian, Puwen Wei, Quan Yuan, Xingyu Zhao.

Suggested readings

• Preview Writeup (PDF): Pilaf: Fully Tight Two-Round Threshold Signatures: Adaptive, Pairing-Free Threshold Signing from MDDH
• FROST: Flexible Round-Optimized Schnorr Threshold Signatures (ia.cr/2020/852)
• Twinkle: Threshold Signatures from DDH with Full Adaptive Security (ia.cr/2023/1482)
• Dazzle: Improved Adaptive Threshold Signatures from DDH (ia.cr/2025/264)