LibraryPrivacy2020Design paperCorpus record
FROST: Flexible Round-Optimized Schnorr Threshold Signatures
FROST. Chelsea Komlo and Ian Goldberg.
A threshold Schnorr signature: any t of n signers can produce one ordinary-looking signature, and fewer than t cannot. The signing protocol is two rounds, or one if nonces were prepared earlier. The paper is the scheme, not a custody vendor.
FROST is a t-of-n Schnorr threshold signature. Any t signers produce one signature under one group key. Fewer than t learn nothing they can use to forge. Signing is two rounds, or one round if nonces were preprocessed. The chain cannot see the threshold. That is both the feature and the audit gap.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 3
Code
Source, repository, and what is actually hosted
- ePrint 2020/852https://eprint.iacr.org/2020/852
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
Threshold, not n-of-n
The policy is any t of n. MuSig2 is the different tool, where every signer must participate. Swapping the names swaps the recovery story.
Claim 02 · Paper model
One signature on-chain
Verification is ordinary Schnorr under the aggregated key. Observers do not learn which subset signed, and do not learn t or n.
Claim 03 · Paper model
Two rounds, with a warning
The round structure exists because naive threshold Schnorr leaks or forges when nonces are handled casually. Preprocessing nonces is allowed and is also a way to get the implementation wrong.
Claim 04 · Paper model
Key generation matters
Distributed key generation is in the argument. A dealer who hands out shares and keeps a copy has reduced the threshold to one, off-chain, where the signature scheme cannot see it.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 Threshold, not n-of-n
Observation
What the study says
The policy is any t of n. MuSig2 is the different tool, where every signer must participate. Swapping the names swaps the recovery story.
Model
What has to hold
The verification key in the output script is the group key from this ceremony, not a key from a different one.
Falsifier
What would retire it
Was key generation distributed, or did a dealer see every share?
02 One signature on-chain
Observation
What the study says
Verification is ordinary Schnorr under the aggregated key. Observers do not learn which subset signed, and do not learn t or n.
Model
What has to hold
At least t signers are honest and available when a signature is required. The complement may be anything.
Falsifier
What would retire it
Does the application need to know which subset signed? The chain will not say.
03 Two rounds, with a warning
Observation
What the study says
The round structure exists because naive threshold Schnorr leaks or forges when nonces are handled casually. Preprocessing nonces is allowed and is also a way to get the implementation wrong.
Model
What has to hold
At least t signers are honest and available when a signature is required. The complement may be anything.
Falsifier
What would retire it
Are nonces preprocessed, and are commitments verified?
04 Key generation matters
Observation
What the study says
Distributed key generation is in the argument. A dealer who hands out shares and keeps a copy has reduced the threshold to one, off-chain, where the signature scheme cannot see it.
Model
What has to hold
Key generation matches the scheme. Shares are not recombined somewhere else.
Falsifier
What would retire it
Was key generation distributed, or did a dealer see every share?
03 Sequence
One action, as an operating tape
- 01Signers run key generation and publish one group key.
- 02When a message is to be signed, t signers exchange nonce commitments.
- 03They exchange signature shares and combine them.
- 04Anyone verifies the result under the group key.
- 05An absent signer beyond the threshold is not required. A missing share below the threshold means there is no signature.
04 Load-bearing
The argument, and where a pitch drops it
Privacy against auditors
The cut
The chain record cannot answer 'which officers signed'. A custody design that needs that answer needs a different mechanism, or an off-chain log the signature will not provide.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The chain cannot see the threshold. That privacy is also why an observer cannot audit who signed.
The paper is not a control framework
The cut
FROST does not say who may propose a message, how a lost share is rotated, or what a court can seize. Those are outside the cryptographic game.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Key generation is part of the security argument. A dealer who knows every share is a single party, whatever the whitepaper says.
05 Register
What has to be true
Cryptography · Not re-measured
Key generation matches the scheme. Shares are not recombined somewhere else.
Cryptography · Not re-measured
Nonce commitments are checked. A shortcut here is a known way to lose the key.
Cryptography · Not re-measured
At least t signers are honest and available when a signature is required. The complement may be anything.
Cryptography · Not re-measured
The verification key in the output script is the group key from this ceremony, not a key from a different one.
06 Divergence
What happened after the paper
FROST became a widely implemented threshold Schnorr scheme, later specified in an RFC that should be cited separately when the implementation claims conformance. The 2020 paper is the scheme. It is not a vendor assessment.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
A multisignature that puts n keys on-chain is visible and rigid. A threshold signature should look like one key, work when only a subset is online, and not take five rounds to produce.
What the design proposes
- A distributed key generation gives each signer a share. The group has one public key.
- Signing is two rounds in the general case. A signer who has pre-shared a nonce can finish in one.
- The output verifies under the group key with ordinary Schnorr verification.
How the mechanism is specified
- The security claim is that forging is as hard as Schnorr, under the paper's model, including the handling of rogue keys.
- t-of-n is the policy. The chain sees neither t nor n.
- A signer who reuses nonce material badly can still destroy the key. The paper's rounds exist to stop a known class of that failure. They do not stop an implementation from ignoring them.
What this page does not treat as proven
- The chain cannot see the threshold. That privacy is also why an observer cannot audit who signed.
- Key generation is part of the security argument. A dealer who knows every share is a single party, whatever the whitepaper says.
- This is not a policy for recovery, legal ownership, or a qualified custodian. It is a signature scheme.
Why the desk still reads it
Ask who ran the key generation, what t and n are, and whether nonce commitments are actually checked. A product that cannot answer those is not offering FROST. It is offering a key somewhere.
09 Lexicon
Terms, opened into the record
- Threshold signature
- A signature that can be produced by any t of n parties and that verifies under a single public key.
- Nonce commitment
- The first-round message that binds a signer to nonce material before signature shares are revealed.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
Concepts
Papers
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.