Introduction

Every lock needs a key — and every encrypted channel, signed certificate, or blockchain wallet relies on a cryptographic key that was generated somewhere. The naive approach is to have one trusted party generate it. But what if that party is untrustworthy, unavailable, or simply too important a target?

Distributed Key Generation (DKG) is a cryptographic protocol that lets a group of nn participants collectively produce a shared keypair — a public key that anyone can use, and a private key that is never assembled in any single place. Each participant holds only a fragment of the private key; using it requires cooperation from at least tt of the nn participants (a threshold).

The protocol relies on two elegant ideas. The first is secret sharing: a secret ss can be split into nn shares so that any tt shares reconstruct it but any t−1t-1 reveal nothing. The second is the hardness of the discrete logarithm — the same foundation underlying RSA and elliptic-curve cryptography. Together they let every participant broadcast commitments to their fragments while keeping the fragments private, and the group assembles a valid public key without the private key ever existing in one location.

Combine Partial Keys

Below are five participants. Each one secretly holds a random value — their partial private key share — and broadcasts only a public commitment to it. Click Run DKG round to simulate one round: each participant contributes, the commitments are aggregated, and the final group public key is derived from the sum of contributions — without any participant ever learning the private key of another.

<!-- Distributed key generation demo layout -->
<p class="hint">Each participant secretly picks a random value and publishes only <b>g<sup>s</sup> mod p</b> — a commitment. The group public key is the product of all commitments: no one ever sees the full private key.</p>
<div id="participants" class="participants"></div>
<div class="status-row">
  <div class="status" id="status">Press Run DKG round to start.</div>
</div>
<div id="pubkey-box" class="pubkey-box hidden">
  <span class="pubkey-label">Group public key:</span>
  <span class="pubkey-value" id="pubkey-value"></span>
</div>
<div class="btns">
  <button id="btn-run" type="button">Run DKG round</button>
  <button id="btn-reset" type="button" class="ghost">New round</button>
</div>

/* Styles for the DKG demo */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; padding: 14px; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .7rem; line-height: 1.5; }
.participants { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: .6rem; }
.participant {
  flex: 1 1 80px; min-width: 80px; max-width: 120px;
  border: 1.5px solid #cdd9e3; border-radius: 10px;
  padding: .5rem .4rem; text-align: center;
  background: #f0f4f8; transition: background .25s, border-color .25s;
}
.participant.active { background: #dbeafe; border-color: #3b82f6; }
.participant.done { background: #dcfce7; border-color: #16a34a; }
.p-name { font-weight: 700; font-size: .8rem; color: #1d3557; margin-bottom: .3rem; }
.p-secret { font-size: .72rem; color: #888; margin-bottom: .2rem; font-style: italic; }
.p-commit { font-size: .78rem; color: #1d3557; font-family: ui-monospace, monospace; word-break: break-all; min-height: 1.2em; }
.p-commit.revealed { color: #15803d; font-weight: 600; }
.status-row { margin: .4rem 0; min-height: 1.5em; }
.status { font-size: .95rem; font-weight: 600; }
.status.ok { color: #15803d; }
.status.running { color: #1d4ed8; }
.pubkey-box {
  display: flex; align-items: center; gap: .5rem;
  background: #1d3557; color: #fff; border-radius: 10px;
  padding: .55rem .8rem; margin: .5rem 0; font-size: .82rem; flex-wrap: wrap;
}
.pubkey-box.hidden { display: none; }
.pubkey-label { font-weight: 700; white-space: nowrap; }
.pubkey-value { font-family: ui-monospace, monospace; word-break: break-all; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; margin-top: .3rem; }
button { font: 600 14px system-ui, sans-serif; padding: .45rem .9rem;
         border: 1px solid #1d3557; background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .45; cursor: not-allowed; }

const fmt = (s, v) => s.replace(/%(\w+)%/g, (_, k) => String(v[k] ?? ''));
// Distributed Key Generation demo (simplified over integers mod prime).
// Each participant holds a secret s_i in Z_p; commits to g^s_i mod p.

// Small prime for demo (real DKG uses 2048-bit+ primes or elliptic curves)
const P = 9973;
// Generator g
const G = 7;
// Number of participants
const N = 5;
// Participant names
const NAMES = ['Alice', 'Bob', 'Carol', 'Dave', 'Eve'];

// Modular exponentiation using BigInt for exactness
function modpow(base, exp, mod) {
  let result = 1n;
  base = base % mod;
  while (exp > 0n) {
    if (exp % 2n === 1n) result = result * base % mod;
    exp = exp / 2n;
    base = base * base % mod;
  }
  return result;
}

// Pick a random secret in [1, p-1]
function randSecret() {
  return BigInt(Math.floor(Math.random() * (P - 2)) + 1);
}

let participants = [];
let running = false;

function initParticipants() {
  participants = NAMES.map((name, i) => ({
    name,
    secret: randSecret(),
    commit: null,
    el: null
  }));
}

function renderParticipants() {
  const container = document.getElementById('participants');
  container.innerHTML = '';
  participants.forEach((p, i) => {
    const div = document.createElement('div');
    div.className = 'participant';
    div.id = 'p-' + i;
    div.innerHTML =
      fmt('<div class="p-name">%name%</div><div class="p-secret">Secret: ?</div><div class="p-commit" id="commit-%i%">waiting...</div>', { name: p.name, i: i });
    container.appendChild(div);
    p.el = div;
  });
}

function setStatus(msg, cls) {
  const s = document.getElementById('status');
  s.textContent = msg;
  s.className = 'status ' + (cls || '');
}

function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }

// Animate one DKG round: each participant commits, then aggregate
async function runDKG() {
  if (running) return;
  running = true;
  document.getElementById('btn-run').disabled = true;
  document.getElementById('pubkey-box').classList.add('hidden');

  setStatus('Starting DKG protocol...', 'running');
  await sleep(300);

  // Phase 1: each participant computes and broadcasts their commitment
  for (let i = 0; i < N; i++) {
    const p = participants[i];
    p.el.classList.add('active');
    setStatus(fmt('Computing commitment for %name%...', { name: p.name }), 'running');
    await sleep(400);

    // Commitment = g^secret mod p
    p.commit = modpow(BigInt(G), p.secret, BigInt(P));

    const secretEl = p.el.querySelector('.p-secret');
    secretEl.textContent = fmt('Secret: %secret%', { secret: p.secret.toString() });

    const commitEl = document.getElementById('commit-' + i);
    commitEl.textContent = 'g^s = ' + p.commit.toString();
    commitEl.classList.add('revealed');

    p.el.classList.remove('active');
    p.el.classList.add('done');
    await sleep(200);
  }

  // Phase 2: aggregate commitments into the group public key
  setStatus('Aggregating public commitments...', 'running');
  await sleep(400);

  // Group public key Y = product of all g^s_i mod p = g^(sum s_i) mod p
  let Y = 1n;
  for (const p of participants) {
    Y = Y * p.commit % BigInt(P);
  }

  // Reveal the group public key
  const box = document.getElementById('pubkey-box');
  box.classList.remove('hidden');
  document.getElementById('pubkey-value').textContent = Y.toString();

  setStatus('✓ Group public key established — no dealer needed!', 'ok');
  console.log('Group public key:', Y.toString());
  console.log('Individual secrets (never combined in a real DKG):', participants.map(p => p.secret.toString()).join(' + ') + ' mod ' + P + ' = ' + participants.reduce((a, p) => (a + p.secret) % BigInt(P), 0n).toString());

  running = false;
  document.getElementById('btn-run').disabled = false;
}

function reset() {
  running = false;
  initParticipants();
  renderParticipants();
  setStatus('Press Run DKG round to start.', '');
  document.getElementById('pubkey-box').classList.add('hidden');
  document.getElementById('btn-run').disabled = false;
}

document.getElementById('btn-run').addEventListener('click', runDKG);
document.getElementById('btn-reset').addEventListener('click', reset);

initParticipants();
renderParticipants();
Result
Console

Notice the asymmetry: each participant can verify that everyone else committed honestly (commitments are public), but no one can reconstruct the full private key from fewer than tt shares. The public key appears from collective math, not from a secret held by a single dealer.

The Real Complexity

Building a key with no dealer sounds simple but hides real depth.

  • Secret sharing: Shamir's scheme encodes a secret ss as a polynomial f(x)=s+a1x+⋯+at−1xt−1f(x) = s + a_1 x + \dots + a_{t-1} x^{t-1} over a finite field. Participant ii receives f(i)f(i). Any tt shares reconstruct ff (and thus ss) via Lagrange interpolation; any t−1t-1 shares are information-theoretically useless.
  • The dealer problem: if one party generates the polynomial, they know ss. DKG removes the dealer by having each of the nn participants run their own sharing scheme: participant ii picks a random polynomial fif_i, broadcasts commitments (public values gfi(j)g^{f_i(j)} for each jj), and sends each share fi(j)f_i(j) privately to participant jj.
  • Aggregation: the group's secret is s=∑ifi(0)(modq)s = \sum_i f_i(0) \pmod{q}. No participant ever computes this sum; instead, each holds their piece sj=∑ifi(j)s_j = \sum_i f_i(j). The group public key is Y=gsY = g^s, which can be computed by everyone as Y=∏igfi(0)Y = \prod_i g^{f_i(0)} using only public commitments.
  • Complaint rounds: a malicious participant might send inconsistent shares. The protocol requires a complaint round: if participant jj cannot verify the share they received from ii against ii's public commitment, they broadcast a complaint and ii is disqualified (or must reveal the share publicly). This adds at least two communication rounds.
  • Communication cost: each of the nn participants sends O(n)O(n) private messages and O(n)O(n) public broadcasts per round, giving O(n2)O(n^2) total messages. Pedersen's 1991 protocol achieves this with two rounds in the honest-but-curious model; later refinements (Gennaro et al., 1999) handle active adversaries with additional rounds.
  • Security assumption: the scheme's security rests on the discrete logarithm being hard in the chosen group — the same hardness assumption as Diffie–Hellman. An adversary who can compute discrete logs breaks both the commitment scheme and the secret sharing at once.

Where It Matters

"No single point of failure" is one of the most valuable properties a security system can have, and DKG is the tool that delivers it at the key-generation step:

  • Threshold signatures: Ethereum's validator committees, Bitcoin multisig wallets, and enterprise signing services use DKG so that signing a transaction requires tt-of-nn keyholders to cooperate — no single compromise breaks the system.
  • Certificate authorities: a root CA key generated and held by one HSM is a catastrophic target. DKG lets the key ceremony be distributed across geographically separate parties, none of whom can act alone.
  • Secure multiparty computation: DKG is the key-setup phase for many MPC protocols, including threshold decryption, threshold ECDSA, and privacy-preserving machine learning.
  • Blockchains and randomness beacons: decentralized networks like Dfinity (ICP) and drand use DKG to generate shared secrets that become unpredictable public randomness, needed for leader election and lotteries.

The same mathematics that lets a group share a key also underlies secret sharing and connects to the broader landscape of problems around the discrete logarithm.

Conclusion

Distributed key generation answers a deceptively simple question: can a group agree on a secret without any single member knowing it? The answer is yes — and it rests on a beautiful combination of polynomial arithmetic, public commitments, and the hardness of the discrete logarithm.

The protocol is more than a theoretical curiosity. Every time a blockchain validator set signs a block, every time a certificate authority ceremony distributes trust across continents, and every time a privacy-preserving computation begins, some version of DKG is running beneath the surface. The math turns nn self-interested parties into a single, incorruptible key-holder that no adversary can compromise by corrupting fewer than tt of them.

Trust, it turns out, does not have to live in a single place — it can be embedded in arithmetic itself.

Share this article

Pick a channel — or use your device's native share sheet.

Comments

Loading comments...

https://www.kipuhub.com/en/article/distributed-key-generation/Content licensed under CC BY-NC 4.0.