FROST
FROST (Flexible Round-Optimized Schnorr Threshold signatures) is a two-round threshold signature protocol. Any subset of k honest participants out of n can produce a single BIP340 Schnorr-compatible signature for a shared public key, and fewer than k cannot. With a Bitcoin-compatible ciphersuite the result verifies like an ordinary Schnorr signature. FROST is specified in RFC 9591. It is not a Bitcoin consensus change and is not a BIP. It is an off-chain signing protocol whose output is a normal signature.
Script-based k-of-n multisignature publishes keys and multiple signatures on chain. MuSig (MuSig2) aggregates keys into one on-chain key but requires every listed participant to sign (n-of-n). Threshold Schnorr schemes share the secret so only k shares are needed to sign.
FROST, described by Chelsea Komlo and Ian Goldberg, binds each signer to a nonce commitment before the challenge is known, which addresses earlier forgery attacks on naive threshold Schnorr designs. Signing uses two rounds of commitments and signature shares. A coordinator may assemble shares into one signature. Nonce reuse across sessions can leak key material.
A Taproot-oriented ciphersuite is required for x-only keys and BIP340 hashing conventions. A FROST group key used as a Taproot internal key still needs the BIP341 tweak applied correctly at keygen or signing time. On-chain, a successful Taproot key-path spend does not reveal that FROST was used.