https://en.bitcoin.it/w/index.php?action=history&feed=atom&title=FROSTFROST - Revision history2026-09-11T19:33:04ZRevision history for this page on the wikiMediaWiki 1.43.9https://en.bitcoin.it/w/index.php?title=FROST&diff=71236&oldid=prevNotATether: FROST stub — threshold Schnorr / RFC 95912026-09-09T13:27:41Z<p>FROST stub — threshold Schnorr / RFC 9591</p>
<p><b>New page</b></p><div>'''FROST''' (Flexible Round-Optimized Schnorr Threshold signatures) is a two-round threshold signature protocol. Any subset of ''k'' honest participants out of ''n'' can produce a single BIP340 Schnorr-compatible signature for a shared public key, and fewer than ''k'' cannot. With a Bitcoin-compatible ciphersuite the result verifies like an ordinary Schnorr signature. FROST is specified in [https://www.rfc-editor.org/rfc/rfc9591 RFC 9591]. It is not a Bitcoin consensus change and is not a BIP. It is an off-chain signing protocol whose output is a normal signature.<br />
<br />
Script-based k-of-n multisignature publishes keys and multiple signatures on chain. [[MuSig]] (MuSig2) aggregates keys into one on-chain key but requires every listed participant to sign (n-of-n). Threshold Schnorr schemes share the secret so only ''k'' shares are needed to sign.<br />
<br />
FROST, described by Chelsea Komlo and Ian Goldberg, binds each signer to a nonce commitment before the challenge is known, which addresses earlier forgery attacks on naive threshold Schnorr designs. Signing uses two rounds of commitments and signature shares. A coordinator may assemble shares into one signature. Nonce reuse across sessions can leak key material.<br />
<br />
A Taproot-oriented ciphersuite is required for x-only keys and BIP340 hashing conventions. A FROST group key used as a [[Taproot]] internal key still needs the BIP341 tweak applied correctly at keygen or signing time. On-chain, a successful Taproot key-path spend does not reveal that FROST was used.<br />
<br />
== See also ==<br />
* [[MuSig]]<br />
* [[Taproot]]<br />
* [[Multi-signature]]<br />
<br />
== External links ==<br />
* [https://www.rfc-editor.org/rfc/rfc9591 RFC 9591: Two-Round Threshold Schnorr Signatures with FROST]<br />
* [https://eprint.iacr.org/2020/852.pdf FROST paper (IACR ePrint 2020/852)]<br />
* [https://frost.zfnd.org/ ZF FROST documentation]<br />
* [https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki BIP340: Schnorr signatures for secp256k1]<br />
<br />
[[Category:Technical]]</div>NotATether