FROST

FROST, short for Flexible Round-Optimized Schnorr Threshold signatures, is a threshold signing protocol in which any t out of n participants can cooperate to produce a single Schnorr signature that is indistinguishable from one made by a lone signer. Standardized in the cryptographic literature as RFC 9591, FROST is a leading approach for distributing trust over a Bitcoin key without the full private key ever existing in one place — not at setup, not at signing, not ever.

How a threshold signature works

During key generation, signing power is split into shares distributed across the participants — either by a trusted dealer or, preferably, by a distributed key generation ceremony in which no party ever holds the whole key. To sign, any threshold-sized subset of participants uses their individual shares to collaboratively produce signature shares, which combine into one signature that is mathematically equivalent to what the full key would have created. Fewer than t shares reveal nothing useful. The result is one compact Schnorr signature, which on-chain looks identical to an ordinary single-signer spend — preserving privacy and saving block space compared with multisig scripts, whose participant counts and policies are visible to the whole world.

Round-optimized and flexible

FROST is "round-optimized" because signing takes just two communication rounds: a commitment round in which each signer commits to fresh nonces, followed by a signature-share round. The commitment phase can be precomputed in advance, so the online portion of signing collapses to a single round — a meaningful property when signers are air-gapped devices or people in different time zones. It is "flexible" because the construction depends only on a prime-order group and a hash function, so it can target Bitcoin's BIP-340 Schnorr signatures as well as EdDSA-style variants. The nonce commitments are not decoration: they defend against the forgery attacks that broke earlier, simpler multi-party Schnorr schemes, which is why the protocol treats them as load-bearing.

Why it matters for self-custody

For sovereign Bitcoiners, FROST points toward more resilient self-custody. A 2-of-3 arrangement across a home device, a hardware wallet, and a geographically separate backup means no single theft, fire, or seizure compromises the funds — and unlike script-based multisig, the on-chain footprint is a single Taproot key path spend that discloses nothing about the policy behind it. The trade-offs are operational rather than cryptographic: share backup and recovery ceremonies demand real discipline, signing requires coordination between shareholders, and tooling for everyday users is still maturing. As with any custody scheme, the protocol is only as strong as the habits around it.

Not the same as splitting a seed

FROST is often confused with Shamir-style secret sharing, but the difference is fundamental. Shamir shares reconstruct the secret: to sign, the shares are brought together and the full key exists — briefly, on one device — creating exactly the single point of failure the scheme was meant to remove. FROST shares never reconstruct anything; each participant computes a partial signature locally, and only the signature shares are combined. The key that could be stolen simply never exists as a whole. That distinction matters most at the worst moment: signing under pressure, on a possibly compromised machine. It is the difference between a vault whose combination must be spoken aloud to open it and one whose door opens only when enough keyholders each turn their own key from wherever they stand.

FROST builds directly on the Schnorr signature machinery that Taproot brought to Bitcoin; compare it with traditional multisig to see what threshold signing hides from the chain, and with a single private key to see what it protects you from.