Distributed Key Generation — No Trusted Dealer Required
Elliptic Curve Distributed Key Generation (EC-DKG) is a cryptographic protocol where N parties jointly create a shared private key without any single "trusted dealer." Each party generates a polynomial, commits to it publicly, and distributes secret shares to all other parties. The result: a threshold public key that all parties verify, with no party ever seeing the complete private key.
Key property: No single point of failure. The key is distributed from the start, and all parties can verify the process is honest using the public commitments.
| Method | Dealer | Verification | Speed |
|---|---|---|---|
| Feldman VSS | Trusted | Homomorphic commitments | Fast |
| Pedersen VSS | Trusted | Unconditional security | Very Fast |
| EC-DKG | None (distributed) | Public commitments + dispute | Moderate |
Feldman VSS check: For each j, all parties can verify that party i's share is correct by checking:
The commitments are public and binding — party i can't change their polynomial later.
Each party i:
If Party i finds that a share from Party j is incorrect (fails verification against C_j), they broadcast a complaint:
Party j must then publicly reveal the correct share y_ji. If the revealed share matches the complaint, Party j is disqualified. If it doesn't match, Party i is disqualified for lying.
Each party i holds their local share: x_i = sum(y_ji for j in Q)
No single point of failure: The key is never reconstructed or visible to any single party.
Verifiable shares: Every party can check that their share is correctly formed using public commitments.
Forward security: If old shares are compromised, they're useless unless combined with other parties' current shares.
DKG relies on Shamir Secret Sharing. A secret S is encoded as the constant term of a polynomial:
Commitments (Feldman's method): To hide the polynomial, broadcast C = [a_0*G, a_1*G, ..., a_t*G]
t+1 = 2 parties needed to sign
Tolerates 1 faulty party
No party ever saw the full private key. Each party has a random share (x_i). Together, any threshold number of parties can sign, but no single party can sign alone. The public key Q is the same on all devices and verifiable on-chain.
| Aspect | Single Device (Traditional) | EC-DKG (Distributed) |
|---|---|---|
| Key Generation | One device generates the key locally | All N parties jointly generate; no device has the full key |
| Exposure Risk | If device is hacked before signing, full key is exposed | Attacker must compromise threshold parties simultaneously |
| Recovery | If device lost, key is lost | Can recover via backup quorum (by access structure) |
| Verification | Must trust device's randomness | All parties verify the protocol; public commitments prove fairness |
| Complexity | Simple (one device) | Moderate (network communication, dispute handling) |