The ECDSA tax: a field guide to threshold signing · 808bitsThe ECDSA tax: a field guide to threshold signing<br>2026-08-19 · 16 min<br>Two vendors sell you an “MPC wallet”. Both keep the key in shares that never meet, both produce ordinary signatures, both have a whitepaper with a lock icon on it. One of them signs in two rounds of 282 bytes. The other one runs nine rounds of Paillier ciphertexts and zero-knowledge proofs, and its protocol family has spent the last five years getting patched against key-extraction attacks. The difference between them is not engineering quality. It is one line of algebra, and it was decided in 1992, long before anyone tried to split a key.<br>I recently implemented three of these protocols from scratch - FROST, CGGMP, and DKLs23, in one codebase, zig-mpc - and benchmarked them against the reference implementations they were ported from. This article is the map I wish I’d had at the start: what the families are, why they exist, what each one costs, and where the bodies are buried.<br>The tax, in one equation<br>A Schnorr signature - which includes Ed25519 and Bitcoin’s Taproot flavor - is<br>s = k + e·x<br>where x is the private key, k is a fresh nonce, and e is a hash everyone can compute. Look at the shape of it: the secrets appear added together, each multiplied only by public values . If three parties hold shares of x that sum to the key, and shares of k that sum to the nonce, then each party computes its own little s_i = k_i + e·x_i, the shares are added up, and the sum is a valid signature. Nobody ever holds x. Nobody has to do anything clever. The entire threshold problem reduces to “agree on the nonce commitment first so nobody can bias it”, which is what FROST spends its two rounds on.<br>An ECDSA signature is<br>s = k⁻¹ · (m + r·x)<br>Same ingredients, catastrophically different shape. That k⁻¹ is the inverse of a secret that must never exist in one place , and it multiplies x, another secret that must never exist in one place. Shares of k do not give you shares of k⁻¹. Shares of k and shares of x do not give you shares of k·x. To sign, the parties must jointly compute products and an inversion of numbers none of them knows, and prove to each other they did it honestly - because a party that cheats in this step doesn’t just break the signature, it can walk away with the key.<br>Everything else in this field - the Paillier encryption, the oblivious transfer, the range proofs, the nine-round protocols, most of the CVEs - is the bill for that inversion. That is the ECDSA tax. You don’t pay it because your vendor is bad. You pay it because Bitcoin, Ethereum and every EVM chain settled on ECDSA before threshold signing was a requirement anyone had.<br>EdDSA and Schnorr sit on the other side of the line, and the price difference is not subtle. Later in this article there’s a table where the same library, on the same machine, signs with FROST in 3 milliseconds and with threshold ECDSA in 5 seconds .<br>The family tree<br>Every practical threshold-ECDSA protocol answers one question: how do two parties multiply secrets they don’t have? There are two mainstream answers, and they define the two lineages. A third lineage - Schnorr - never has to answer it.<br>he(LConPiM+mcanGGPproridGGremyle12/efpll80srrtilCiepie1(Ggshor7t+Gnhin)-iaMi,c(odbPn2feo2g+--nr1,UonttChf)i)+o-fppw2irr)aoodbaoolcfetsyi)ovuemDDDuKKKlotLLLtbrsssila112pin893qlsuyif((ooe2t+rtur--duwsooymoffns--a)s2nmh))iacredsecrEedtF2s(RR5T?yhSOF5aoacSC1puvhT9ren9,odo5ootr9stnor1e')ctp,<br>Threshold signing protocols, by how they multiply secrets.The Paillier lineage encrypts one secret under Paillier - an encryption scheme where you can multiply a ciphertext by a known number and the plaintext gets multiplied too. Party A sends an encryption of k_A, party B multiplies it by x_B inside the ciphertext, adds a mask, and sends it back. Neither learned the other’s secret; together they now hold additive shares of the product. The catch: Paillier needs an RSA-sized modulus per party, generating one needs safe primes, and a maliciously crafted modulus is a weapon - so the protocols wrap everything in zero-knowledge range proofs, and the setup ceremony proves your modulus is well-formed before anyone will talk to you. Lindell’s 2017 protocol did this for two parties and made MPC wallets practical; GG18 extended it to t-of-n; GG20 added identifiable aborts (when signing fails, you learn who broke it); CMP and CGGMP21 rebuilt it with UC security proofs, presigning, and proactive share refresh. CGGMP21 has been revised repeatedly since publication - the 2024 revision is what I implemented.<br>The OT lineage replaces the encryption with oblivious transfer: a primitive where a receiver picks one of two values a sender offers, the sender doesn’t learn which, and the receiver doesn’t learn the other. Chain a few hundred of these and you can build multiplication out of what is essentially binary long...