Threshold Signatures Post Quantum

Short answer: A threshold signature splits a signing key into shares so that any group of at least a chosen number of parties can sign together, and no single party holds the whole key. Threshold schemes are well studied for classical cryptography but sparse for quantum-resilient assumptions. Recent research includes the first efficient lattice-based threshold signatures, and surveys that map the field and its open gaps. This is active research, and the papers do not describe a finished standard.

What a threshold signature does

A 2025 ACM survey explains the motivation. Both classical and post-quantum digital signatures usually rely on centralised trust, where one party manages the secrets and operations, which creates a single point of failure. Threshold cryptography reduces that risk by distributing secrets, for example through Shamir secret sharing, and distributing the computation using multi-party computation, so a subset of parties must collaborate to perform the operation. The survey covers threshold and distributed signatures in conventional and post-quantum settings, generic constructions based on multi-party computation and custom thresholding techniques, as well as applications and future directions. It notes that NIST has launched an initiative to standardise multi-party threshold schemes, which evaluates submissions based on approved primitives and on alternative algorithms.

A lattice-based construction

The Threshold Raccoon paper, a major revision of a EUROCRYPT 2024 publication, observes that threshold signatures split the signing key into N shares so that any subset of at least T parties can produce a signature. It says that while they are extensively studied before the quantum setting, they remain sparse from quantum-resilient assumptions. The authors present what they call the first efficient lattice-based threshold signatures, with signature size 13 KiB and communication cost 40 KiB per user, supporting a threshold as large as 1024 signers, with an accompanying high-performance implementation. Security rests on the same assumptions as Dilithium, which the authors say cannot easily be made threshold efficiently. Signing uses symmetric primitives and simple lattice operations, with no threshold fully homomorphic encryption or homomorphic trapdoor commitments as in prior constructions. The key technical idea is one-time additive masks to limit leakage of partial signing keys through partial signatures.

Gaps that a 2026 survey points to

A 2026 survey on the IACR ePrint archive notes that ML-DSA, FN-DSA (Falcon) and SLH-DSA have much larger keys and signatures than classical schemes, which makes compact multiparty signing an important problem. It reviews more than 30 schemes published between 2021 and 2026 and finds most work targets blockchain and validator-consensus settings. A less studied setting is institutional multiparty document signing, where tens to hundreds of signers may use different post-quantum schemes during a gradual migration, with non-interactive signing and exact per-signer accountability. The authors propose an eight-dimensional taxonomy, three testable hypotheses and a benchmark methodology, and say they found no published study that quantitatively evaluates that institutional workload across the aggregation approaches they cover.

What this does not tell you

These are research papers and surveys, not standards or products. The size figures belong to one construction under its own parameters. Nothing here shows that any organisation signs documents this way today.

FAQ

What is a threshold signature?

A signature produced jointly by at least T of N key-share holders, so no single party holds the full key.

Why is it hard after quantum?

The 2024 Threshold Raccoon paper says such schemes are sparse from quantum-resilient assumptions, and that Dilithium cannot easily be made threshold.

How big are the Threshold Raccoon signatures?

The paper reports 13 KiB signatures and 40 KiB communication per user, supporting thresholds up to 1024 signers.

What gap does the 2026 survey find?

Little work on institutional document signing with mixed schemes and exact per-signer accountability.

Is there a standard?

The ACM survey notes a standardisation initiative for threshold schemes. The papers do not describe a finished standard.