FROST

FROST, short for Flexible Round-Optimized Schnorr Threshold, is a threshold signing protocol in which any t out of n participants can cooperate to produce a single Schnorr signature that is indistinguishable from one made by a lone signer. Standardized as RFC 9591, FROST is a leading approach for distributing trust over a Bitcoin key without ever reconstructing it in one place.

How a threshold signature works

During setup, a single private key is split into shares distributed across the participants, with no party ever holding the whole key. To sign, a threshold number of participants use their individual shares to collaboratively produce a signature that is mathematically equivalent to what the original key would have created, yet that original key is never reassembled. The result is one compact signature, which on-chain looks identical to an ordinary single-signer Schnorr signature, preserving privacy and saving block space compared with multisig scripts.

Round-optimized and flexible

FROST is "round-optimized" because signing takes just two communication rounds: a commitment round followed by a signature-share round, with the commitment phase able to be precomputed. It is "flexible" because it depends only on a prime-order group and a hash function, so it can target Bitcoin's BIP-340 Schnorr signatures as well as EdDSA variants. Like other protocols in this family, it relies on a commitment scheme for the nonces to defend against forgery attacks.

For sovereign Bitcoiners, FROST points toward more resilient self-custody: distributed signing across devices or geographies, redundancy against the loss of any single share, and a smaller, more private on-chain footprint than legacy multisig.