152 sats \ 0 replies \ @maths 20 Jul 2023 freebie \ on: Frostsnap - Easy, personalized, secure bitcoin multisig for everyone bitcoin
n: The total number of parties or participants. k: The interpolation threshold, i.e., the minimum number of parties required to evaluate the polynomial. x: The index or participant number. P(x): The polynomial function that each secret share belongs to. S(x): The secret share of a party at index x. P_j(x): The joint polynomial used by the parties after removing a signer. K: The public key derived from the polynomial. E(x): The evaluation of the joint polynomial P_j(x) at a new participant index x. S'(x): The secret share of the new party at index x after adding them to the system.
  1. Each secret share of a FROST key belongs to a polynomial with the interpolation threshold k:
S(x) = P(x) for all x = 1 to n
  1. A threshold number of parties can each evaluate their share of this joint polynomial at a new participant index x:
E(x) = P_j(x) for at least 'k' parties
  1. The new party's secret share S'(x) is obtained by summing up the evaluations communicated by the other parties:
S'(x) = Σ E(x) for at least 'k' parties
  1. The joint polynomial P_j(x) has the same joint-secret (x=0) as the original polynomial:
P_j(0) = P(0)
  1. The public key K is derived from the joint polynomial:
K = P_j(0)
  1. When a signer is removed, parties recreate their secret shares and a new polynomial, but the joint-secret remains the same:
P_j(x) = P(x) for all x = 1 to n, except the removed signer
  1. The removed signer's secret share remains the same, but they become incompatible with honest signers on the new polynomial:
S(x) = S'(x) for the removed signer
write
preview