Mithril

Threshold signatures enable multiple participants to collaboratively produce a digital signature, ensuring both fault tolerance and decentralization. These schemes have seen a growing adoption in classical cryptography, notably thanks to their compatibility with existing signature standards such RSA, Shnorr, ECDSA. This compatibility facilitates seamless integration into existing systems, and enhances trust in the deployed solutions as the cryptographic community has long vetted these standards. It appears crucial to also achieve such compatibility in the post-quantum setting, and obtain distributed variants of the recent NIST post-quantum standards.

This work introduces the first practical ML-DSA-compatible threshold signature scheme, which supports up to 6 users and requires only 3 rounds of communication per signing attempt. The protocol is computationally efficient, with transcripts computed in milliseconds and communication costs ranging from 10.5 kB to 525 kB. This allows for a full signing execution in a few hundred milliseconds, even in a WAN setting. Our construction leverages recent results from the Finally! signature scheme, performs per-party rejection-based signing, and uses critical optimizations to adhere to ML-DSA parameters while maintaining high efficiency. A full implementation with benchmarks is provided to demonstrate its real-world practicality.