DKG Gate
Pedersen DKG · Gennaro et al. 1999
Runs a real dealerless key-generation ceremony — n parties Feldman-deal to each other, complaints throw out cheaters, and the sharings sum into one t-of-n key — then lets you cheat as a dealer and bias the key the way GJKR showed.
What is distributed key generation?
A group of n parties wants one shared public key, with the matching secret split so that any t of them can act for the group — and no one, ever, holds the whole secret. The trick: everyone is a dealer. Each party secret-shares a random value of its own to all the others, everyone cross-checks what they received against public commitments, provable cheaters are voted out, and the surviving sharings are added up. The sum is a perfectly good secret sharing of a value nobody chose and nobody knows.
Jargon that follows: a share is one point on a dealer's secret polynomial; a commitment is a public curve point that locks the polynomial down without revealing it; and t-of-n means any t parties suffice, any t−1 learn nothing.
Exhibit 1 · The ceremony
Step the protocol round by round. Arm the cheat to watch a bad share get caught by the public complaint mechanism — then see what changes if the cheater backs down instead of doubling down.
The math on one screen
Dealer d picks a random polynomial f_d(x) = a₀ + a₁x + … + a_{t−1}x^{t−1} over the ristretto255
scalar field, broadcasts A_j = a_j·G, and sends party i the share s = f_d(i).
Anyone checks a share with s·G = Σ_j iʲ·A_j — the polynomial evaluated "in the exponent."
Because the sum of degree-(t−1) polynomials is a degree-(t−1) polynomial, the per-party sums
x_i = Σ_d f_d(i) form a t-of-n sharing of x = Σ_d a₀, with public key
PK = Σ_d A₀ = x·G.
Exhibit 2 · Prove the threshold
The ceremony claims any t shares regenerate the key and t−1 reveal nothing. Don't take its word for it — reconstruct and compare both sides, byte for byte.
Exhibit 3 · Bias the key — the GJKR attack & fix
Pedersen's original DKG has a subtle flaw: a rushing adversary who controls k dealers sees every contribution before deciding which of its own dealers to sacrifice — and that choice picks among 2ᵏ final keys. Run the real attack, then flip on the fix.
Scope: this exhibit is a faithful model of the GJKR bias and its commit-then-reveal fix — real hiding Pedersen commitments and real subset-sum key math — not a second full ceremony with a separate extraction phase. Exhibit 1 above is the runnable Pedersen / Joint-Feldman DKG. The insight is the teaching target, and it is exact.
What this isn't
- Not production crypto. A teaching demo: real ristretto255 group math and a real protocol transcript, but one browser tab plays all n parties, so the "private channels" are visible on purpose.
- Not threshold signing or decryption. DKG produces shares; it never uses them. Consuming them is frost-threshold, threshold-decrypt and gg20-wallet.
- Not proactive refresh. Re-dealing shares to heal compromise is reshare-circle.
- Not standalone VSS. One dealer, verifiably sharing, is vss-gate — this demo composes n of those.
- Synchronous, honest-majority only. Asynchronous DKG, network adversaries, and robust-under-crash variants are out of scope; the next panel states, property by property, what is assumed and against whom.
Secure against whom, for what?
Two different numbers govern the claims below. t is the reconstruction threshold: t final shares rebuild the secret, t−1 do not. f is how many parties an adversary corrupts. They are not the same quantity, and each property has its own bound on f.
- Correctness & agreement — everyone who finishes agrees on QUAL and PK. Holds for any number of cheating dealers, because every complaint is decided by a public equation — but only under the synchronous rounds and reliable broadcast this tab simulates. Implemented and tested: complaints, disqualification, and the fail-closed abort.
- Secrecy of the group secret — a coalition of f ≤ t−1 share holders cannot reconstruct (Shamir's bound), and secrecy is computational (discrete log), because each dealer's Feldman commitment publishes A₀ = a₀·G. Implemented; Exhibit 2's reconstruction X-ray deliberately violates it on screen, and says so.
- Output uniformity — fails against a rushing adversary with even one corrupted dealer in the naive flow; that is Exhibit 3's attack. GJKR's commit-then-reveal restores it, which Exhibit 3 models rather than runs as a second full ceremony.
- Availability — the ceremony finishing, and a later t-of-n operation working, need at least t qualified dealers and later t responsive share holders, so they tolerate f ≤ n−t withholding or crashed parties. Demonstrated by Exhibit 2's t versus t−1 comparison; message loss is otherwise unmodeled here.
- Channels — the protocol assumes authenticated private dealer-to-holder channels and reliable synchronous broadcast. One tab playing all parties makes equivocation — telling different parties different things — impossible by construction here, not defended against.
- Corruption model — static, fixed before the run. Rushing behaviour appears only in Exhibit 3; adaptive corruption and denial of service are unmodeled.