Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody

Source: arXiv:2607.08226 · Published 2026-07-09 · By Dariia Porechna

TL;DR

This paper addresses the challenge of threshold authorization in digital asset custody under the upcoming post-quantum transition, which complicates the use of traditional threshold signature schemes (TSS). Standardized post-quantum signature schemes, particularly hash-based signatures, resist efficient threshold signing, creating a deployment bottleneck. The author proposes a novel dual-gate architecture separating member authentication from threshold authorization, enabling MPC-like custody semantics without threshold signing. Each member individually signs approvals with any existing EUF-CMA signature scheme (classical or post-quantum), while the threshold authorization comes from jointly reconstructing a secret-shared "seal" via Shamir sharing. This seal enforces threshold policies information-theoretically, and the signature scheme remains a flexible deployment parameter, simplifying post-quantum migration.

Key findings

The dual-gate construction separates member authentication (ordinary EUF-CMA signatures) from threshold authorization (Shamir-shared seal), avoiding thresholding the signature scheme itself.
Below-threshold secrecy of the shared authorization coefficients is information-theoretic, so an adversary with ≥t signing keys but no coefficient shares cannot produce a valid authorization.
Approvals are non-interactive and require only one affine field evaluation plus one ordinary signature per member, with no multi-round threshold signing MPC involved.
Migration between signature schemes (e.g., ECDSA to post-quantum SLH-DSA or ML-DSA) is a key rotation without protocol redesign or new threshold MPC, enabling cryptographic agility.
The enforcement layer holds no secret and verifies both gates: member signatures and a reconstructed threshold seal via Lagrange interpolation and share correctness checks.
The scheme supports programmable authorization policies beyond simple t-of-n quorum, including weighted, hierarchical, risk-based, or confidential policy evaluation over secret-shared state.
The construction composes naturally with commodity HSMs using standard sign APIs, unlike threshold signing which requires scheme-specific partial-signature computation.
The dual gate yields operations cheaper than threshold ECDSA per approval and does not require publishing a long-lived joint signing key, improving key exposure resistance.

Threat model

The adversary is static and can corrupt members in two categories: key-only compromise (stealing signing keys but no coefficient shares) and full corruption (stealing signing keys and all secret shares of coefficient slots). The adversary may control an untrusted relay that observes, injects, delays, reorders envelopes arbitrarily. The enforcement layer is assumed trusted for integrity but holds no secrets; compromise of enforcement cannot forge authorizations. The threshold assumption is fewer than t members are fully corrupted. An adversary holding fewer than t full corruptions cannot produce valid seals; an adversary holding ≥t signing keys but no shares cannot forge valid seals due to information-theoretic share secrecy. The setup phase is assumed trusted, with at least one honest contributor correctly distributing Shamir shares with binding randomness.

Methodology — deep read

The paper formulates a custody authorization system with n members and threshold t. Each member possesses a long-term signing key for ordinary signatures and per-slot coefficient shares from a dealer-free Joint Random Secret Sharing (JRSS) protocol, providing degree-(t-1) Shamir secret sharings of affine share coefficients (k1, k2) over a prime field Fp ~ 2^256. Setup distributes coefficient shares and commitments binding each member's share with securely sampled randomness, recording a setup transcript root. For every operation M, a deterministic scalar x is derived by hashing a canonical operation message together with a unique single-use coefficient slot ID. Each member evaluates their secret shares to compute a value σ_i = k1_i * x + k2_i, produces an envelope Ai containing this evaluation plus openings (shares and randomness) and signs Ai with their EUF-CMA member key. An untrusted relay collects t such envelopes from distinct members. The enforcement layer then performs (C1) signature verification to check valid member signatures, (C2) share correctness verification for openings against commitments, (C3) reconstruction of the seal σ via Lagrange interpolation of the shares, and (C4) single-use consumption of the coefficient slot to bind freshness. Only if all gates hold is authorization accepted. The approach decouples member authentication from threshold authorization, avoiding MPC over signing algorithms. It supports programmable policies by generalizing the affine map to MPC over secret-shared states for richer authorization logic. The threat model assumes static adversaries corrupting fewer than t members fully (signing keys+shares) or some with key-only compromise. An adversary holding ≥t signing keys but no shares cannot fabricate the seal due to information-theoretic secrecy of shares and cryptographic binding of openings. Precision is ensured by rigorous share correctness commitments and operating over fresh coefficient slots consumed under finality to prevent replay. The enforcement layer is stateless with respect to secrets but implements verification logic and single-use slot consumption. Experimental evaluation is conceptual; the paper focuses on protocol design, formal definitions, and security reduction proofs. The author discusses deployment examples, including integration with commodity HSMs and programmable smart-contract enforcement layers. Migration between signature schemes is a key rotation operation. The author provides detailed operational lifecycle mapping each custody action (Setup, Approve, Authorize, Verify, Maintain) to protocol steps. Protocol components rely on standard cryptographic primitives (EUF-CMA signatures, collision-resistant hashes, polynomial commitments) and do not embed complex zero-knowledge or lattice operations in approval steps. Theoretical security is supported by formal proofs in appendices with realistic assumptions on honest setup contributions and share correctness. The end-to-end example involves members independently producing signed envelopes for an operation M using reserved coefficient slots, a relay collecting envelopes, and enforcement verifying and interpolating to produce the authorization receipt.

Technical innovations

Decoupling member authentication from threshold authorization by using ordinary signatures plus a Shamir-shared threshold seal, avoiding threshold signature MPC.
Use of a Shamir-shared Wegman–Carter one-time authenticator as a seal, providing information-theoretic secrecy and programmable authorization policies.
Cryptographic agility through making the member-signature scheme a deployment parameter, enabling seamless key rotation for post-quantum migration.
Enforcement-layer verification of authorization without holding secrets, supporting composable integration with smart contracts, vault modules, or HSMs as enforcement points.

Baselines vs proposed

Threshold ECDSA: requires multi-round threshold signing MPC with fixed signature scheme vs Dual gate: non-interactive per-member ordinary signature plus affine evaluation with no threshold signing MPC.
On-chain multisig (post-quantum keys): threshold authorization without below-threshold secrecy vs Dual gate: adds information-theoretic below-threshold secrecy and programmable authorization policies.
Off-chain dual control (ordinary multisig plus master key): no below-threshold secrecy or share refresh vs Dual gate: adds cryptographic threshold authorization and proactive share refresh.

Limitations

The paper does not provide empirical performance benchmarks or gas-cost estimates for on-chain deployment, leaving practical overhead unclear.
Security relies on a trusted setup meeting specific randomness binding and verifiable secret sharing assumptions, which must be carefully implemented.
Complex programmable policies beyond affine evaluation require per-policy correctness proofs, not supplied here.
The scheme produces an enforcement-layer authorization receipt, not a native threshold signature, limiting direct plug-in to legacy signature-verification-only chain protocols.
Handling revoked or compromised keys requires careful operational processes and do not magically prevent all insider threats.
Below-threshold compromise secrecy applies per unused coefficient slot only; once a slot is consumed or shares opened, stolen keys may enable replay on that slot.

Open questions / follow-ons

How to efficiently implement and verify richer programmable authorization policies beyond affine maps including confidentiality and complex state?
What are the precise on-chain deployment costs (gas, latency) and scalability limits of the seal verification compared to threshold signatures and multisigs?
How would the protocol interact with future chain-native post-quantum threshold signature standards once available?
What are optimal operational strategies and tooling for key rotation, share refresh, and compromised key recovery in real-world HSM deployments?

Why it matters for bot defense

This work is highly relevant to bot-defense and CAPTCHA practitioners involved in securing high-value asset custody systems where threshold authorization and upgrade to post-quantum security are needed. The key insight is separating member authentication from threshold authorization enables cryptographic agility and operational resilience absent in traditional threshold signature approaches. The dual-gate model preserves below-threshold secrecy and share refresh—critical for preventing partial compromise attacks—without relying on complex threshold signing MPC. Systems that currently implement off-chain multisig or HSM-based dual control can adopt this architecture to upgrade security with minimal disruption and gain programmable policies. It also fits deployments where the asset-control path supports programmable verification such as smart contracts or HSM modules. However, because it does not produce native chain-understandable threshold signatures, custody designers must integrate enforcement-layer authorization receipts thoughtfully, potentially combined with master key-controlled signer HSMs. Overall, this careful cryptographic layering and comprehensive lifecycle modeling provide a practical path to post-quantum ready custody designs, a priority as adversaries and compliance landscapes evolve.

Cite

bibtex

@article{arxiv2607_08226,
  title={ Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody },
  author={ Dariia Porechna },
  journal={arXiv preprint arXiv:2607.08226},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.08226}
}

Threshold Authorization Without Threshold Signatures: Signature-Agnostic MPC Custody ​

TL;DR ​

Key findings ​

Threat model ​

Methodology — deep read ​

Technical innovations ​

Baselines vs proposed ​

Limitations ​

Open questions / follow-ons ​

Why it matters for bot defense ​

Cite ​

Read the full paper ​