DKG Gate
Pedersen DKG · Gennaro et al. 1999
Runs a real dealerless key-generation ceremony — n parties Feldman-deal to each other, complaints throw out cheaters, and the sharings sum into one t-of-n key — then lets you cheat as a dealer and bias the key the way GJKR showed.
What is distributed key generation?
A group of n parties wants one shared public key, with the matching secret split so that any t of them can act for the group — and no one, ever, holds the whole secret. The trick: everyone is a dealer. Each party secret-shares a random value of its own to all the others, everyone cross-checks what they received against public commitments, provable cheaters are voted out, and the surviving sharings are added up. The sum is a perfectly good secret sharing of a value nobody chose and nobody knows.
Jargon that follows: a share is one point on a dealer's secret polynomial; a commitment is a public curve point that locks the polynomial down without revealing it; and t-of-n means any t parties suffice, any t−1 learn nothing.
Exhibit 1 · The ceremony
Step the protocol round by round. Arm the cheat to watch a bad share get caught by the public complaint mechanism — then see what changes if the cheater backs down instead of doubling down.
The math on one screen
Dealer d picks a random polynomial f_d(x) = a₀ + a₁x + … + a_{t−1}x^{t−1} over the ristretto255
scalar field, broadcasts A_j = a_j·G, and sends party i the share s = f_d(i).
Anyone checks a share with s·G = Σ_j iʲ·A_j — the polynomial evaluated "in the exponent."
Because the sum of degree-(t−1) polynomials is a degree-(t−1) polynomial, the per-party sums
x_i = Σ_d f_d(i) form a t-of-n sharing of x = Σ_d a₀, with public key
PK = Σ_d A₀ = x·G.
Exhibit 2 · Prove the threshold
The ceremony claims any t shares regenerate the key and t−1 reveal nothing. Don't take its word for it — reconstruct and compare both sides, byte for byte.
Exhibit 3 · Bias the key — the GJKR attack & fix
Pedersen's original DKG has a subtle flaw: a rushing adversary who controls k dealers sees every contribution before deciding which of its own dealers to sacrifice — and that choice picks among 2ᵏ final keys. Run the real attack, then flip on the fix.
Scope: this exhibit is a faithful model of the GJKR bias and its commit-then-reveal fix — real hiding Pedersen commitments and real subset-sum key math — not a second full ceremony with a separate extraction phase. Exhibit 1 above is the runnable Pedersen / Joint-Feldman DKG. The insight is the teaching target, and it is exact.
What this isn't
- Not production crypto. A teaching demo: real ristretto255 group math and a real protocol transcript, but one browser tab plays all n parties, so the "private channels" are visible on purpose.
- Not threshold signing or decryption. DKG produces shares; it never uses them. Consuming them is frost-threshold, threshold-decrypt and gg20-wallet.
- Not proactive refresh. Re-dealing shares to heal compromise is reshare-circle.
- Not standalone VSS. One dealer, verifiably sharing, is vss-gate — this demo composes n of those.
- Synchronous, honest-majority only. Asynchronous DKG, network adversaries, and robust-under-crash variants are out of scope; what you see assumes reliable broadcast and t ≤ n honest enough to finish.