Skip to content

DKG Gate

Pedersen DKG · Gennaro et al. 1999

Runs a real dealerless key-generation ceremony — n parties Feldman-deal to each other, complaints throw out cheaters, and the sharings sum into one t-of-n key — then lets you cheat as a dealer and bias the key the way GJKR showed.

What is distributed key generation?

A group of n parties wants one shared public key, with the matching secret split so that any t of them can act for the group — and no one, ever, holds the whole secret. The trick: everyone is a dealer. Each party secret-shares a random value of its own to all the others, everyone cross-checks what they received against public commitments, provable cheaters are voted out, and the surviving sharings are added up. The sum is a perfectly good secret sharing of a value nobody chose and nobody knows.

Jargon that follows: a share is one point on a dealer's secret polynomial; a commitment is a public curve point that locks the polynomial down without revealing it; and t-of-n means any t parties suffice, any t−1 learn nothing.

Exhibit 1 · The ceremony

Step the protocol round by round. Arm the cheat to watch a bad share get caught by the public complaint mechanism — then see what changes if the cheater backs down instead of doubling down.

The math on one screen

Dealer d picks a random polynomial f_d(x) = a₀ + a₁x + … + a_{t−1}x^{t−1} over the ristretto255 scalar field, broadcasts A_j = a_j·G, and sends party i the share s = f_d(i). Anyone checks a share with s·G = Σ_j iʲ·A_j — the polynomial evaluated "in the exponent." Because the sum of degree-(t−1) polynomials is a degree-(t−1) polynomial, the per-party sums x_i = Σ_d f_d(i) form a t-of-n sharing of x = Σ_d a₀, with public key PK = Σ_d A₀ = x·G.

Exhibit 2 · Prove the threshold

The ceremony claims any t shares regenerate the key and t−1 reveal nothing. Don't take its word for it — reconstruct and compare both sides, byte for byte.

Exhibit 3 · Bias the key — the GJKR attack & fix

Pedersen's original DKG has a subtle flaw: a rushing adversary who controls k dealers sees every contribution before deciding which of its own dealers to sacrifice — and that choice picks among 2ᵏ final keys. Run the real attack, then flip on the fix.

Scope: this exhibit is a faithful model of the GJKR bias and its commit-then-reveal fix — real hiding Pedersen commitments and real subset-sum key math — not a second full ceremony with a separate extraction phase. Exhibit 1 above is the runnable Pedersen / Joint-Feldman DKG. The insight is the teaching target, and it is exact.

What this isn't