// learn · season 02 · episode 08 · finale
MPC — signing together
Episode 7 removed the single point of failure by requiring several signatures. This one explores signing without reconstructing a complete key. Avoiding a complete key during setup also requires a suitable distributed key generation (DKG) protocol; splitting an existing key is different. Start with real secret-sharing arithmetic, then a conceptual signing animation.
01 · splitting a secret
Two points make a line
Before any of the clever protocols, one beautifully simple idea: you can cut a secret into pieces so that some of the pieces rebuild it and fewer than that reveal literally nothing. Hold shares, set them aside, and watch.
the secret — a 120-bit number (stand-in for a private key)
…
select at least one share above
With a threshold of 2, the polynomial is just a straight line: the secret is where it crosses x=0, and each share is a point on it. Two points fix the line; one doesn't. Raise the threshold to 3 and it becomes a curve needing three points — same idea, more dimensions. This is real Shamir's Secret Sharing, the mathematics behind “any 3 of our 5 executives”, backup share schemes, and how custody platforms shard key material across data centres.
02 · the catch
Splitting isn't signing
Here's the part that gets skipped in most explanations. Shares are wonderful at rest — but to actually sign something using only a Shamir backup and a conventional single-key signer, you reconstruct it first. Threshold signing needs an additional protocol. Watch what that costs.
share 1
held apart, safely
share 2
held apart, safely
share 3
held apart, safely
complete key existed on one machine
a few seconds — every single time you sign
and how often is that?
For a business paying suppliers, dozens of times a week. Each one is a fresh chance for the jackpot to be sitting somewhere an attacker can reach.
So secret sharing solves storage and leaves usage wide open. That gap — not the splitting — is the problem MPC was built to close.
03 · the resolution
Signing without assembling
Multi-party computation asks an odd question: could several parties jointly compute a signature without any of them learning the others' secrets — and without the key ever being formed? The answer, worked out over decades of cryptography, is yes.
illustrative choreography
Real threshold signing (GG20, FROST and friends) is multi-round cryptography with its own security proofs, and this page does not implement it. Below is a conceptual animation of local computation, message exchange and signature aggregation. Exact rounds, messages and guarantees depend on the protocol. No shares or threshold signatures are computed here.
Party A
your phone
holds: share 1
Party B
your laptop
holds: share 2
Party C
the custodian's HSM
holds: share 3
04 · choosing
Multisig or MPC?
Not a fight with a winner. They make opposite trades, and the right answer depends on what you need to prove to whom — including the places where MPC is genuinely the weaker choice.
| multisig | MPC / threshold signing | |
|---|---|---|
| where the rule lives | In the chain — a Bitcoin script or a smart contract enforces it. | In mathematics, off-chain. The chain sees no policy at all. |
| on-chain footprint | Several signatures, and usually a visible “this is a vault” marker. | One ordinary signature. Indistinguishable from a single-key wallet. |
| chain support | Depends on the chain — scripts on Bitcoin, contracts on EVM, varies elsewhere. | Requires a protocol compatible with the chain's signature scheme and transaction format; sharing a curve alone is insufficient. |
| changing who signs | Bitcoin: move the funds to a new address. EVM: send a transaction to the contract. | Some protocols can refresh or redistribute shares while preserving the public key; support and compromise assumptions vary. |
| auditability | Public. Anyone can verify the policy and see who signed — a genuine strength. | Depends on the operator's logs. The chain can't show you what happened internally. |
| who runs it | You and your co-signers, with ordinary wallets. | Usually a vendor's infrastructure — which makes vendor risk a real part of your risk. |
what custody actually is
Neither of these is “custody”. They're both just the signing layer. Real custody is what surrounds it: hardware security modules, policy engines that encode who may approve what, approval workflows, monitoring, audits, insurance, and the people who follow the procedure at 2am when it's inconvenient. Both the cryptographic implementation and the operating procedures need review and testing. A signing demonstration does not establish the safety of a custody service.
season 02 complete
From key material to custody questions
Season 1 built the machine: hashes, blocks, consensus, keys. Season 2 asked the only question that matters once you own something on it — how do you keep it, and hand it on? You've generated a BIP39 phrase, simulated an offline signing workflow in one browser, tested a threshold policy with real message signatures, and tried secret sharing. The MPC segment illustrates a protocol without implementing it. These are learning models, not an institutional custody system.
One thread ran through all eight episodes: this technology is excellent at making things permanent and terrible at forgiving mistakes — and it has no opinion at all about what happens when the person holding the keys is no longer around to hold them. That's not a cryptography problem. It's a planning one.
Digital assets that outlive their owners need a succession plan — designed before it's needed, tested like any other system.
That's the problem I work on →← back to all episodes