The key that never exists: a threshold signing ceremony in your browser · 808bitsThe key that never exists: a threshold signing ceremony in your browser<br>2026-08-15 · 8 min<br>A cryptographic key is a single point of failure: whoever holds it, holds everything. Every custody disaster you have read about reduces to that sentence. Threshold cryptography attacks the premise itself: what if the key never exists in one place, not even for a millisecond, not even at birth?<br>On this page, three keyholders - alice , bob and carol - create one key together: any two of them can sign, no one at any point ever holds the whole key, and no trusted dealer makes it and splits it. The key is born already in pieces.<br>Everything below is real cryptography, compiled from Zig to WebAssembly and running locally in your tab; the library, zig-mpc , is on GitHub. Pick a curve, press Begin the ceremony, and the page walks you through the rest.<br>Choose a key<br>These panels need JavaScript. Everything runs locally in your browser; nothing you do here is sent anywhere.<br>SchemeEd25519 Solana · Cardano · TON<br>secp256k1 Bitcoin · Ethereum<br>BIP-340 Bitcoin Taproot
Begin the ceremonyThe cast is fixed: alice is party 1, bob is party 2,<br>carol is party 3, and the threshold is 2 - any two can sign, any one<br>alone can do nothing. In production each party is a separate machine;<br>this page plays all three and shows you exactly which bytes would cross<br>the network.
Session id<br>Alice mints 32 random bytes that name this run. Every<br>message will carry this id, and it is mixed into every hash - two<br>ceremonies can never contaminate each other. It identifies the run; it<br>is not a secret. With the CLI this is the value zmpc init<br>prints for the other parties.
Two pieces of jargon before the rounds start. This is MPC - secure multi-party computation, protocols where several parties jointly compute a result while each party’s input stays secret. It is the machinery inside every “MPC wallet”, normally sealed behind a vendor’s API; here it runs in the open. And a key ceremony is custody’s name for the formal procedure in which key material is born or used: classically a scripted afternoon in a vault, with witnesses, dual controls and tamper-evident bags. The ceremony on this page is the real protocol, minus the vault.<br>The details behind the pickers: the ceremony is identical for all three schemes - only the curve and the final signature format differ. Ed25519 and BIP-340 sign with FROST (Flexible Round-Optimized Schnorr Threshold signatures, RFC 9591); the same distributed key generation (DKG) also feeds threshold ECDSA (CGGMP24) for chains that require it. The curve and hash primitives are the Zig standard library’s; the protocol layer on top is zig-mpc, and it reproduces the RFC 9591 test vectors byte for byte.<br>Every byte you will see is a genuine protocol message, in the same wire format the zmpc CLI exchanges between real machines. Nothing you type or click leaves this page: there is no server, no analytics call, no network request carrying your input anywhere. The page fetches one wasm file and then goes quiet.<br>Grow a key that never exists whole<br>Distributed key generation, three rounds plus a finalize. With the CLI this is zmpc dkg round1..round3, finalize, one command per machine per round. Each round reads the frames that arrived, produces new ones, and the page delivers them the way you would between machines: a broadcast frame (…-t0) is copied to both other parties, a p2p frame (…-tN) goes to party N only.<br>The shape of the trick is worth stating before you click. Each party invents its own secret polynomial and hands the others single points on it. Add three polynomials together and you get a group secret nobody chose and nobody knows; each party’s share is just its own stack of points. Commitments in round 1 stop anyone from picking their polynomial after seeing the others; verification in round 3 catches anyone who dealt inconsistent points. Cheating does not corrupt the key. It aborts the ceremony and names the cheater.<br>If you know Shamir’s secret sharing, the algebra is familiar - polynomials, points, interpolation - but the trust model is not. Shamir needs a dealer who holds the whole secret before splitting it, and using the secret means putting it back together: the key exists whole at birth and again at every use, which is exactly the exposure we set out to delete. Here each party deals only its own contribution, and reconstruction never happens - not at birth, and, as the signing section shows, not at signing either.<br>Round 1 · Commit<br>Round 2 · Deal shares<br>Round 3 · Verify<br>Finalize<br>The rounds unlock once you begin the ceremony above.
Group public key -<br>All three parties computed this same key<br>independently, from each other's commitments. The matching private key<br>has never existed anywhere: alice, bob and carol each hold<br>keyshare.zmpc - one point on a secret polynomial nobody<br>knows - and that file never leaves...