✕

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Projects Multi-Party Threshold Cryptography

Multi-Party Threshold Cryptography MPTC

Reference Material Submitted to the NIST Threshold Call

This page organizes documentation related to the NIST First Call for Multi-Party Threshold Schemes [NIST IR 8214C] (2026).

The technical scope is organized across two classes — Class N (NIST-specified primitives) and Class S (Special primitives not specified by NIST) — each with various categories of crypto-systems, as follows:

  Sign PKE Symm KeyGen FHE ZKPoK Gadgets
Class N N1 N2 N3 N4      
Class S S1 S2 S3 S4 S5 S6 S7

The NIST Threshold Call considers a Previews phase (including three opportunities/rounds) and a Packages phase. Participation in the Previews phase is a requirement for a subsequent participation in the Packages phase.

Template for Preview Writeups (v0.2.2, 2026-07-11): .zip (with latex code) and .pdf (example). Submitted Preview Writeups may be subject to revision recommendations and their full consideration also depends on a corresponding Preview Talk.

Template for Package Writeups: To appear (expected October 2026, after TCPT3), with the structure outlined in the NIST Threshold Call. Will be usable for Technical Specification, Report on Experimental Evaluation, and Notes on Patent Claims.

The first phase of previews gathered 26 Preview Writeups (PW) from 23 distinct teams, as listed in the table below. The union of the teams includes 185 authors. The corresponding Preview Talks (PT) were hosted at MPTS 2026 (NIST Workshop on Multi-Party Threshold Schemes). The Preview Writeups can be updated across time (see date in column "Preview Writeup").

Legend: [PW] = [Preview Writeup (link to file)]; [PT] = [Preview Talk (link to webpage)]. |⁠Team⁠| = Number of team members. # is just an index for reference (alphabetical ordering by team name).

Previews Phase 1
# Team |⁠Team⁠|   Categories Crypto-systems (hint)

Preview
Writeup

Preview
Talk @ MPTS 2026

 Patents *
1 Amber 4 S2 Amber (Threshold Lattice-based KEM) [PW] [3b5] Yes
2 BBDL 4 S1 tBLS (Threshold BLS Sign) [PW] [1b1]  
3 BDLR 4 N1 Gargos (Threshold Schnorr Sign) [PW] [1a4]  
4 BICYCCLIST 7 N1

TECLA (2-party Threshold ECDSA)

 [PW] [2a3]  
5     N1 [PW]
6 Fireblocks-3MI 7 N1, N4 Classic Schnorr (Threshold Schnorr Sign) [PW] [1a3]  
7     N1, N4 [PW] [2a2]  
8     N1, N4, S2, S7 [PW]
9 FROST 12 N1 FROST (Threshold Schnorr Sign) [PW] [1a1]  
10 Haystack 3 N1 Haystack (Threshold HBS) [PW] [3a6]  
11 Hermine 8 S1, S4 Hermine (Threshold Sign) [Lattice-based] [PW] [3b3]  
12 LEAST 9 S1, S4 LEAST (Threshold Sign) [from code-based group-actions] [PW] [4a3]  
13 Mithril 6 N1, N4 Mithril (Threshold ML-DSA) [PW] [3b7] Yes
14 MPC MINIons 14 N3, S3, S7 MiniMPC (Threshold AES+SHA+MAC) and gadgets (inc. OT and garbling) [PW] [3a2] [3a3]  
15 PANTHERIA 26 S5 PANTHERIA (RLWE-based FHE and Threshold FHE) [PW] [2b5] Yes
16 PiVer 10 S7 PiVer (Verifiable Secret Sharing) [PW] [4b2]  
17 PQarrots 31 S1, S2, S4 Macaw (Threshold Signature), Kea (Threhold PKE), Kakapo (SKG) (from Isogeny-based Group Actions) [PW] (Jan-30) [4a1]  
18 Quorus 5 N1, N4 Quorus (Threshold ML-DSA) [PW] [3b6]  
19 RedETA 6 N1, N4 RedETA signatures (Threshold ECDLP-based Signatures) [PW] [2a4] Yes
20 Schmivitz 8 S6, S7 VOLEith-based ZKPoK [PW] [4c1]  
21 SmallWood 2 S6 SmallWood (hash-based ZKPoK) [PW] [4c2]  
22 SplitForge 10 N1, S2, N4 SplitKey (Server-assisted threshold signatures and PKE) [PW] [2a5]  
23 Symphony 4 N3, S7 Maestro (T-AES), SHArp (T-SHA), MACnifico (T-MAC) and gadgets (inc one-hot vectors) [PW] [3a5]  
24 Tanuki 12 S1 Tanuki (Threshold Lattice-based Signature) [PW] [3b2] Yes
25 Vinaigrette 9 S1, S4 Vinaigrette (Multivariate-based Threshold UOV+MAYO Sign) [PW] [4a4]  
26 Zama 13 S4, S5, S6 TFHE (Torus), ZHEnith (ZKP), Nexus (Threshold FHE) [PW] [2b3] Yes

* The column "Patents" shows "Yes" for the "Preview Writeups" that indicated there are patents or pending patents whose claims may apply to the proposed crypto-systems. The upcoming package submission requires a "Notes on Patent Claims" document with more detail.

The second phase of previews gathered 10 Preview Writeups (PW) from 10 distinct teams, as listed in the table below. The union of the teams includes 35 authors. The corresponding Preview Talks (PT) were hosted at TCPT2 (Threshold Call Preview Talks #2 on July 07–08, 2026). The Preview Writeups may be updated across time (see date in column "Preview Writeup").

Legend: [PW] = [Preview Writeup (link to file)]; [PT] = [Preview Talk (link to webpage)]. |⁠Team⁠| = Number of team members. # is just an index for reference (alphabetical ordering by team name).

Previews Phase 2
# Team |⁠Team⁠| Categories Crypto-systems (hint) Preview Writeup Preview Talk @ TCPT2 Patents *
27 Dfns-Coord 3 S7 Coordinated Messaging [PW] [1b1]  
28 Dfns-KU 4 N1 KU (Threshold ECDSA) [PW] (Jul-27) [1a3] Yes
29 FaFROST 6 N1 FaFROST (Threshold Schnorr) [PW] (Jul-24) [1b2]  
30 LaZer 4 S6 LaZer (Lattice-based ZKP) [PW] [2b1]  
31 Lemur 5 S1 Lemur (Lattice-based Signature) [PW] [2a2]  
32 LoTRS 6 S1 LoTRS (Lattice-based Signature) [PW] [2a3]  
33 TALUS 2 N1, N4 TALUS (Threshold ML-DSA) [PW] (Aug-11) [2a1] Yes
34 Threshcon 2 N3 Threshcon (Threshold Ascon) [PW] [2b2]  
35 Trout 3 N1 Trout++ (Threshold ECDSA) [PW] [1a1]  
36 Twig 7 N1 Twig (Threshold ECDSA) [PW] (Jul-22) [1a2] Yes

* The column "Patents" shows "Yes" for the "Preview writeups" that indicated there are patents or pending patents whose claims may apply to the proposed crypto-systems. The upcoming package submission requires a "Notes on Patent Claims" document with more detail.

The preview talks of phase 3 were hosted at TCPT3 (Threshold Call Preview Talks #3) on Sep 30 and Oct {6,7,13}, 2026.  The corresponding 24 preview writeups (from 21 teams) were submitted earlier, but often revised later.  Further revisions are welcome (the "PW" link will be updated accordingly).

Legend: [PW] = [Preview Writeup (link)]; |⁠Team⁠| = Number of team members; [digit-letter-digit] = Talk index at TCPT3.

Previews Phase 3
# Team |⁠Team⁠| Categories Crypto-systems (hint) Preview Writeup Preview Talk @ TCPT3 Patents *
37 ABCDKLs 6 N1,N4,S7 DKLs (DKG, T-ECDSA / VOLE+OT) [PW] (Aug-07) [3b1]  
38 Adamas 4 S2 Adamas (Threshold Lattice-based PKE/decryption) [PW] (Oct-08) [4a2]  
39 ark-pq 4 S6 ark-pq (ZKP) [PW] (Sep-28) [1a4]  
40 ATMACA 4 N1 ATMACA (Threshold FALCON Signature) [PW] (Sep-30) [2a1]  
41 CL 7 S7 CL and Threshold-CL (Linearly HE based on class groups) [PW] (Jul-31) [3a1]  
42 DUOV 4 S1, S4 DUOV (T-UOV Signature) [PW] (Aug-07) [2a3]  
43 Holocron 12 N2 Holocron (PKE via FHE) [PW] (Sep-28) [1a3] Yes
44 THQC 4 N2, S2 THQC (Threshold HQC-KEM Decryption) [PW] (Oct-12) [4a3]  
45 Kettle 8 S1 Kettle (Threshold HAWK Signature) [PW] (Sep-19) [2a2]  
46 Kryptallage 16 S5 Kryptallage (Threshold FHE) [PW] (Sep-25) [1a1]  
47 LaTSEC 5 S1, S7 LaTSEC (Threshold Lattice-based Signature / Secret sharing) [PW] (Oct-05) [2b2]  
48 MOZI 6 S5 MOZI (Threshold FHE) [PW] (Sep-29) [1a2]  
49

Octopus

 11 N1 Menshen and Octopus-(T)CL (Threshold ECDSA) [PW] (Sep-20) [3b2]  
50 S1 TalonG and P-DualTS (Threshold Lattice-based Signature) [PW] (Oct-12) [2b1] Yes
51 S1 TapTop and Robot (Threshold BBS Signature) [PW] (Sep-20) [3b3]  
52 N1 Teddy (Threshold Deterministic EdDSA) [PW] (Oct-06) [4b2]  
53 Pilaf 6 S1 Pilaf (Two-Round Threshold Signatures) [PW] (Aug-07) [4b3] Yes
54 Stoats 6 N1, N4, S7 Stoats (2p ECDSA/Schnorr & VOLE) [PW] (Aug-07) [3a4]  
55 TALH 1 N1, S1 TALH (Hash-based signature) [PW] (Aug-08) [2a4]  
56 Thimza 2 S1 Thimza (Threshold Lattice-based Signature) [PW] (Oct-11) [2b3]  
57 TORTL 3 N4 TORTL DKG (Distributed Key Generation for EC and ML) [PW] (Sep-21) [4b1] Yes
58 Trout 3 N1, S7 Axolotl (Threshold Schnorr) [PW] (Sep-24) [3a2]  
59 TSitH 4 S1 TSiTH (Threshold Signature in the Head) [PW] (Jul-30) [2b4]  
60 Tulva 6 S5 Tulva (Threshold FHE) [PW] (Oct-05) [4a1]  

* The column "Patents" shows "Yes" for the "Preview writeups" that indicated there are patents or pending patents whose claims may apply to the proposed crypto-systems. The upcoming package submission requires a "Notes on Patent Claims" document with more detail.

Each package will include Technical Specification, Open-Source Reference Implementation, Report on Experimental Evaluation, Notes on Patent Claims.

Deadlines for the submission of packages will be confirmed only after TCPT3 (the third phase of preview talks):

  • The packages submission deadline is expected to be set to 2027-Mar-01 (it will not be before).
  • Optionally, throughout December (Dec 01–31, 2026) teams can submit a preliminary package for preliminary editorial feedback by MPTC.

The latex template for Technical Specification, Report on Experimental Evaluation, and Notes in Patent Claims will be made available after the Preview Phase 3, following the structure outlined in the NIST Threshold Call.

 

Contacts

Multi-Party Threshold Cryptography (MPTC) Project
[email protected]

Luís T. A. N. Brandão - NIST/Strativia
[email protected]

Michael Davidson - NIST

René Peralta - NIST

Dustin Moody - NIST

Created July 26, 2018, Updated October 13, 2026