Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody

Abstract: Digital-asset custody has been built on threshold multi-party approval: no operation proceeds unless $t$ of $n$ parties approve, and fewer than t compromised parties can neither authorize nor learn the authorization secret. Threshold signature schemes (TSS) have been the standard mechanism, but the post-quantum transition disrupts this model: standardized hash-based signatures resist efficient threshold signing, and lattice-based threshold protocols remain an emerging research track. We present a dual-gate architecture that separates member authentication from threshold authorization. Each member signs its approval with an ordinary signature under any EUF-CMA scheme; the quorum jointly produces a threshold seal from Shamir-shared secrets bound to the operation. The seal is the base instance of a programmable authorization computation: simple quorum is the minimal policy, while richer policies can evaluate secret-shared state without making the member-signature scheme part of that computation. The signature scheme is a deployment parameter: migrating from ECDSA to SLH-DSA or ML-DSA is a key rotation, not a protocol redesign, and members holding keys in commodity HSMs participate through the standard sign API. The architecture can be deployed wherever the asset-control path supports programmable verification, such as smart contracts, vault modules, or HSMs guarding a master key, and produces an enforcement-layer authorization rather than a native chain signature. Below-threshold secrecy is information-theoretic; an adversary holding $\geq t$ signing keys but no coefficient shares still cannot produce the seal.

• The paper introduces a dual-gate architecture that decouples member authentication from threshold authorization, enabling signature agility and key rotation without protocol redesign.
• It employs information-theoretic secrecy via Shamir-shared coefficients, ensuring that below-threshold groups reveal no sensitive operational data.
• The dual-gate scheme enhances digital asset custody security while allowing seamless migration to post-quantum cryptography amid evolving regulatory demands.

Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody

Problem Motivation

The paper addresses digital asset custody amid the migration to post-quantum cryptography. Threshold signature schemes (TSS) based on classical primitives like ECDSA have been the standard for multi-party approval, delivering both member authentication and threshold authorization in a single object. However, post-quantum standardized hash-based signatures (e.g., SLH-DSA, LMS/HSS) resist efficient threshold signing, and threshold protocols for lattice-based schemes (e.g., ML-DSA, Falcon) remain non-mature. Custodians cannot force blockchains to accept new signature schemes but must ensure the control plane (policy enforcement, authentication, backups, integrations) is post-quantum and cryptographically agile. Regulatory drivers (cf. Executive Order 14412) and protocol evolution intensify this requirement.

Dual-Gate Architecture

The paper introduces a decoupled, dual-gate architecture. Member authentication and threshold authorization are separated:

• Authentication: Each member signs their approval under an EUF-CMA signature scheme (e.g., ECDSA, SLH-DSA, ML-DSA).
• Authorization: The quorum reconstructs a threshold seal, information-theoretically secret below threshold, using Shamir-shared coefficients bound to the operation.

The threshold seal is the base instance of a programmable MPC-like authorization model: quorum is the minimal policy, and richer policies can evaluate secret-shared state without entangling the signature scheme. This separation eliminates the protocol redesign when migrating signature schemes; migration becomes pure key rotation.

Operational Protocol

Setup: Involves JRSS/VSS distribution of single-use coefficient slots, maintaining per-slot share commitments under a setup root. Each member registers their authentication public key.

Approval: Each approving member computes one affine evaluation and one ordinary signature, signs their envelope containing the evaluation and opening randomness.

Acceptance: Requires validation of signatures (C1), opening verification against setup commitments (C2), Lagrange interpolation of the seal (C3), and slot consumption under ordered finality (C4).

Authorization Output: The enforcement-layer receives a custody receipt containing the threshold seal, not a native signature. The enforcement layer verifies both gates, holding no secrets.

Security Guarantees and Attack Matrix

The dual-gate composition provides:

• Threshold Authorization: No set of fewer than $t$ effective parties can authorize.
• Threshold Secrecy: Below-threshold coalitions have zero leakage about unused coefficient slots.
• Operation Binding and Attribution: Authorization is bound to operations and specific slots; signatures ensure member attribution and non-frameability.

Attack scenarios are analyzed:

• Stealing a single signing key does not enable authorization without slot openings.
• Compromising fewer than $t$ full custody parties cannot reconstruct the seal.
• Compromising $\geq t$ signing keys but not coefficient shares cannot produce the seal (per-slot guarantee).
• Compromising $\geq t$ custody parties yields full compromise, matching the intended threshold assumption.

The scheme leverages salted-hash and Pedersen commitment profiles, achieving quantum security bounds with proper parameterization.

Deployment Considerations

The architecture is signature-scheme agnostic. Migration from classical to post-quantum signatures is a key rotation, not a protocol update. Hybrid quorums comprising mixed schemes are supported, inheriting the weakest link per operation. Members can hold keys in commodity HSMs and use standard signing APIs. The enforcement layer, which can be a smart contract, consensus module, vault, account-abstraction layer (cf. ERC-4337, Safe), or an HSM controlling a master key, needs only signature verification, field arithmetic, hashing, share-correctness checking, and ordered finality.

Assets whose control path is restricted to legacy native signature verifiers are only supported when the enforcement layer is an HSM unlocking the master key.

Comparison with Baselines

• Threshold ECDSA: Migrating the signature scheme requires rebuilding the threshold protocol, DKG, presignature logic, and integration pipeline.
• On-Chain Multisig: While deployable and programmatically simple, has no below-threshold secrecy or share refresh; compromising $t$ keys gives total access.
• Off-Chain Dual Control: Practiced in HSM-based stacks, but relies on trusted code and lacks independent threshold secrets; again, $t$ stolen keys suffice for compromise.

The dual-gate architecture adds information-theoretic below-threshold secrecy, share refresh, and programmable policy evaluation beyond mere quorum counting, retaining cryptographic agility.

Operational Requirements and Limitations

While the output is not a native signature, it is a verifiable seal. Enforcement-layer deployments require programmable acceptance logic and per-operation state (slot consumption tracking). Attribution information is explicit; unlike threshold signatures, the approving quorum is not hidden from the verifier. Operational limitations include setup requirements for AVSS/JRSS exporting per-share commitments, economic quorum capture, and not covering assets without programmable verification.

Numerical Results and Implementation

Strong theoretical security bounds are provided: the end-to-end security is $\min$(hash security, member signature EUF-CMA). For salted-hash profiles, even large slot batches retain quantum security margins. The paper provides a Rust reference implementation covering hash-committed, Pedersen, and external-AVSS transcript profiles, with tests for all operational and adversarial scenarios.

Implications and Speculation

Practically, the architecture enables post-quantum readiness and signature agility for custodians ahead of chain protocol migration. It supports staged migration, maintaining operational integrity and auditability. Theoretically, it reframes distributed authorization as cryptographic enforcement rather than joint signature computation, decoupling operational properties from specific signature thresholding.

Future directions likely include adaptive corruption-resistant protocol extensions, advanced policy programmability leveraging secret-shared state, automatic slot management for asynchronous deployments, and native consensus-layer integration as programmable validity conditions.

Conclusion

The dual-gate, signature-agnostic MPC custody scheme provides threshold authorization, information-theoretic secrecy, cryptographic agility, and programmability for digital asset custody. It enables graceful migration to post-quantum primitives, eliminating the performance and operational costs of thresholdizing signatures themselves. The practical and theoretical separation of member authentication from threshold authorization presents a robust custodial solution suitable for deployment across diverse operational contexts, wherever programmable verification logic is available.