Key Recovery Scheme

The aim of this scheme is to enable 3 players to generate a single public key which can be recovered using any of players. It is trustless and anonymous. The scheme can be used for multisig payments which appear on chain as normal payments.

The basic concept relies on the additivity of functions , and additive homomorphism of EC points. That way we avoid heavy MPC multiplications and keep the scheme lightweight.

The values are fixed strings known by all players.

Let denote a hiding pedersen commitment to .

Constructing the Curve

Each player constructs their own curves, with the resulting curve being the sum of them all. Given any t points, we can recover the original curve and hence the secret.

Player creates curve

Player creates a random curve , and broadcasts commits .

Then player lifts points sending each to player .


Upon receiving player receiving , they check that

Compute Shared Public Key

Let , then the secret key (unknown to any player) is: The corresponding public key is:

Key Recovery

Let be the subset of players recovering the secret key. Reordering as needed, all players in send their points for curves to player 1.

For each curve , player 1 now has points. Using either lagrange interpolation or row reduction, they can recover curves and compute .

Then player 1 computes the shared secret .