confium-tc-frost-p256 — threshold ECDSA on P-256

Real P-256 Shamir secret sharing and threshold ECDSA signing. The crate provides key generation (or import), secret splitting into N shares with threshold T, share distribution, signing with any T shares, and signature recovery.

When to use this crate

Use confium-tc-frost-p256 when:

  • You need P-256 ECDSA signatures (the curve used by TLS, code signing, X.509) where no single party holds the full key.
  • You want a software-only threshold scheme (no HSM coordination required).
  • You are building a Mode 2 PKI drop-in that must produce signatures indistinguishable from single-key ECDSA-P256.

For production threshold ECDSA signing where the secret is never reconstructed, prefer confium-tc-cmp20 (which implements the MtA sub-protocol this crate defers).

Public API

use confium_tc_frost_p256::{generate_keypair, recover_secret,
    sign_message, split_secret};

// Generate a keypair.
let kp = generate_keypair();
// kp.secret_scalar — p256::Scalar (zeroized on drop)
// kp.public_key    — p256::AffinePoint

// Split into 5 shares, threshold 3.
let shares = split_secret(&kp.secret_scalar, 3, 5);

// Recover the secret from any 3 shares.
let subset: Vec<&_> = vec![&shares[0], &shares[2], &shares[4]];
let recovered = recover_secret(&subset).expect("recover");
assert_eq!(recovered, kp.secret_scalar);

// Sign with the original key.
let signed = sign_message(&kp, b"threshold test").expect("sign");
// signed.der_bytes   — DER-encoded ECDSA signature (RFC 3279)
// signed.fixed_bytes — fixed-length (r || s) encoding

Shamir secret sharing

The secret is split into N shares using a polynomial of degree T − 1 over the scalar field of P-256. Any T shares uniquely determine the polynomial and thus the secret. Fewer than T shares reveal zero information about the secret.

Recovery

Recovery uses Lagrange interpolation at x = 0. The crate accepts any subset of T or more shares; if more than T are provided, the result is overdetermined and the crate verifies consistency.

Security notes

  • No share reuse: each signing session must use fresh random nonces. Reusing a nonce across two sessions leaks the private key. The crate uses OsRng for nonce generation by default.
  • Constant-time scalar arithmetic: via the p256 crate’s CtOption API. Never convert CtOption to Option and then branch on it for secret data.
  • Share format: shares are (x, y) pairs over the P-256 scalar field. The crate serializes them as fixed-length byte arrays.
  • No network code: the crate is pure crypto. Multi-party session orchestration is provided by confium-coordinator.