Securing the “weakest link” of a chain through Sharding

Question

In this question I discussed how sharding a private key with Shamir's Secret Sharing Scheme maybe a good alternative to MultiSig as a means of reducing excessive fees associated with MultiSig transactions. @Pieter Wuille provided an excellent analysis of the pros and cons of using Sharding vs. MultiSig and revealed some of the work in progress aiming to address the main concern with sharding (the "A Chain Only as Strong as Its Weakest Link" problem).

As mentioned, the main problem with employing SSS as an alternative to MultiSig is that it is necessary to reconstruct the actual secret key on a single machine before signing a transaction - once again making it vulnerable to a single point of failure (attack). As the saying goes "a chain is only as strong as its weakest link".

While Taproot and Schnorr signatures were proposed as potential alternatives to SSS, these two solutions are for the time being just "proposals" and they will need to be accepted by the entire Bitcoin community (which could take forever) before they become viable alternatives.

Are there any alternatives to SSS, which can be used right now, where a transaction can be signed by two (or more) parties without needing the secret key to convene on one machine? Are there any alternatives to "Shamir's Secret Sharing" that might allow this functionality?

In case it makes a difference, all I need is n-of-n (i.e, 3-out-of-3) rather than k-of-n (i.e, 3-out-of-4 or 2-out-of-3).

Thanks

Answer 1

Right now, the top two alternatives to Taproot & Schnorr Signatures rely on multiparty ECDSA (elliptic curve digital signature algorithm) also known as threashold ECDSA.

Threshold ECDSA has two main functions: The first function is to spread out key generation across multiple machines. This makes it so that no single party is ever made aware of the full key. The second function is to sign a transaction with the key shares (generated in step 1) without needing to combine them in a single place. This allows a set of distinct parties (that do not trust each other and do not wish to reveal their PK to each other), to jointly compute a function over their inputs while keeping those inputs private.

ZenGo, is a Multi-party ECDSA written in Rust. It comes with two key features:

• Key Generation for creating secret shares.
• Signing for using the secret shares to generate a signature.

Binance Chain, is a Multi-party threshold signature scheme that supports the first two features but also allows for Dynamic Regrouping of shares:

• Key Generation for creating secret shares with no trusted dealer ("keygen").
• Signing for using the secret shares to generate a signature ("signing").
• Dynamic Groups to change the group of participants while keeping the secret ("resharing").

Both libraries have been audited by Kudelski Security. Be warned, however, that both of these technologies are relatively "new" and may suffer from unknown bugs/security flaws. Use them at your own peril.