{"id":51578777,"url":"https://github.com/systemslibrarian/crypto-lab-threshold-mldsa","last_synced_at":"2026-07-11T03:32:25.599Z","repository":{"id":367025411,"uuid":"1215387511","full_name":"systemslibrarian/crypto-lab-threshold-mldsa","owner":"systemslibrarian","description":"Browser-based threshold ML-DSA demo — distributed post-quantum signing where k-of-n parties collaborate without any single party holding the full key. In development.","archived":false,"fork":false,"pushed_at":"2026-06-24T07:52:03.000Z","size":97,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-24T10:30:41.005Z","etag":null,"topics":["crypto-lab","cryptography","digital-signatures","dilithium","distributed-signing","fips-204","frost","hsm-alternative","key-custody","lattice-signatures","ml-dsa","mpc","multi-party-computation","post-quantum-cryptography","shamir-secret-sharing","threshold-cryptography","threshold-signatures"],"latest_commit_sha":null,"homepage":"https://systemslibrarian.github.io/crypto-lab-threshold-mldsa/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/systemslibrarian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-19T21:04:46.000Z","updated_at":"2026-06-24T07:52:07.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/systemslibrarian/crypto-lab-threshold-mldsa","commit_stats":null,"previous_names":["systemslibrarian/crypto-lab-threshold-mldsa"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/systemslibrarian/crypto-lab-threshold-mldsa","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-threshold-mldsa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-threshold-mldsa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-threshold-mldsa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-threshold-mldsa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/systemslibrarian","download_url":"https://codeload.github.com/systemslibrarian/crypto-lab-threshold-mldsa/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-threshold-mldsa/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35350133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crypto-lab","cryptography","digital-signatures","dilithium","distributed-signing","fips-204","frost","hsm-alternative","key-custody","lattice-signatures","ml-dsa","mpc","multi-party-computation","post-quantum-cryptography","shamir-secret-sharing","threshold-cryptography","threshold-signatures"],"created_at":"2026-07-11T03:32:25.475Z","updated_at":"2026-07-11T03:32:25.590Z","avatar_url":"https://github.com/systemslibrarian.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crypto-lab-threshold-mldsa\n\n## What It Is\n\nThis repository demonstrates the central threshold-signing question for post-quantum cryptography:\n\n- Can multiple parties cooperate to produce a single valid ML-DSA signature?\n- Can the verifier remain unchanged and still accept that signature under standard FIPS 204 verification?\n- Why is this harder than threshold Schnorr or threshold BLS?\n\nThe demo answers those questions with an educational two-party simulation based on the current research direction:\n\n- **Trilithium** — Dufka, Kravtsenko, Laud, Snetkov, ePrint 2025/675\n- **Quorus** — Borin et al., ePrint 2025/1163\n- **TOPCOAT** — 2024 two-party HighBits compression approach\n- **Dufka–Kravtsenko identifiable aborts** — ePrint 2025/871\n- **del Pino–Prest unmasking TRaccoon** — ePrint 2025/849\n- **THED** — ePrint 2026/638\n- **Threshold Raccoon** — Saarinen, EUROCRYPT 2024\n\nThe live UI includes five exhibits:\n\n1. Why threshold ML-DSA is harder than classical threshold signatures\n2. A Trilithium-style step-by-step protocol walkthrough\n3. Interactive two-party signing with restart-on-rejection behavior\n4. A comparison table of the 2024–2026 threshold ML-DSA research landscape\n5. Real-world applications for post-quantum multi-party signing\n\n\u003e This repo is **educational, not production-safe**. No threshold ML-DSA scheme is NIST-standardized as of 2026.\n\n## When to Use It\n\nUse this demo when you want to:\n\n- understand why threshold lattice signatures are more complicated than threshold Schnorr or BLS\n- study the structure of a two-party ML-DSA protocol in a browser-only environment\n- see additive secret sharing applied to ML-DSA-flavored key components\n- compare communication rounds, byte cost, and restart behavior against standalone signing\n- explain threshold post-quantum signing to engineers, students, auditors, or security teams\n- explore future design ideas for root CAs, validator networks, recovery flows, and enterprise approvals\n- Do NOT use this repository for production signing systems, HSM deployments, or compliance-sensitive infrastructure — it is a teaching demo.\n\n## Live Demo\n\n**[systemslibrarian.github.io/crypto-lab-threshold-mldsa](https://systemslibrarian.github.io/crypto-lab-threshold-mldsa/)**\n\nThe live UI walks through five exhibits: why threshold ML-DSA is harder than classical threshold signatures, a Trilithium-style step-by-step protocol walkthrough, interactive two-party signing with restart-on-rejection behavior, a comparison table of the 2024–2026 threshold ML-DSA research landscape, and real-world applications for post-quantum multi-party signing. The math is genuine ML-DSA-65 from `@noble/post-quantum`, so every emitted signature verifies under the unmodified standard FIPS 204 verifier.\n\n## What Can Go Wrong\n\nThreshold ML-DSA remains an active research area, and several practical issues remain:\n\n- **No NIST threshold standard yet.** Verifier compatibility exists in research papers, but the threshold protocols themselves are not standardized.\n- **Rejection sampling compounds coordination cost.** If a signing attempt is rejected, all parties must regenerate fresh randomness.\n- **Communication overhead matters.** Even efficient two-party designs exchange far more than standalone signing.\n- **Malicious security is difficult.** Semi-honest approximations are not enough for real-world adversaries.\n- **Non-linear gadgets are tricky.** HighBits, LowBits, MakeHint, and norm checks need careful MPC treatment.\n- **Implementation pitfalls remain.** Timing leaks, replay handling, message binding, transcript consistency, and abort accountability all matter.\n- **This demo simplifies MPC internals.** It is meant to teach the protocol shape and compatibility goal, not to serve as a hardened implementation.\n\n## Real-World Usage\n\nIf threshold ML-DSA matures and standardizes, likely deployment targets include:\n\n- **post-quantum root CA protection** across multiple HSMs or organizations\n- **blockchain validator signing** without single-node compromise risk\n- **government and enterprise approval workflows** with t-of-n control\n- **social recovery and emergency access** for long-lived user credentials\n- **distributed randomness beacons** and other collective authorization systems\n\nFor now, production systems generally use classical threshold schemes such as FROST or threshold ECDSA while tracking post-quantum migration plans.\n\nA reasonable forward-looking timeline is:\n\n- **2026–2027:** research consolidation and cryptanalysis\n- **2027–2028:** possible draft threshold standards or profiles\n- **2028–2030:** early production rollouts if the field stabilizes\n\n## How to Run Locally\n\n```bash\ngit clone https://github.com/systemslibrarian/crypto-lab-threshold-mldsa\ncd crypto-lab-threshold-mldsa\nnpm install\nnpm run dev\n```\n\n## Related Demos\n- [crypto-lab-dilithium-seal](https://systemslibrarian.github.io/crypto-lab-dilithium-seal/) — single-party ML-DSA (FIPS 204) signing, the primitive this threshold demo distributes.\n- [crypto-lab-frost-threshold](https://systemslibrarian.github.io/crypto-lab-frost-threshold/) — the classical threshold signature (FROST over Ed25519) that lattice schemes are compared against.\n- [crypto-lab-threshold-decrypt](https://systemslibrarian.github.io/crypto-lab-threshold-decrypt/) — `t-of-n` threshold cryptography applied to decryption instead of signing.\n- [crypto-lab-vss-gate](https://systemslibrarian.github.io/crypto-lab-vss-gate/) — the verifiable secret sharing that underpins distributed key generation.\n- [crypto-lab-hybrid-sign](https://systemslibrarian.github.io/crypto-lab-hybrid-sign/) — composite Ed25519 + ML-DSA-65 signatures for the PQC migration path.\n\n## What's Real and What's Simulated\n\nA cryptography demo earns trust by being precise about its own limits. This one draws a hard line:\n\n**Real (standard FIPS 204):**\n\n- Key generation, signing, and verification use `@noble/post-quantum`'s ML-DSA-65.\n- The public key and every emitted signature are genuine and verify under the **unmodified** standard verifier.\n- All randomness comes from the Web Crypto CSPRNG — there is no `Math.random` anywhere in `src/`.\n- Additive secret sharing is real: each share on its own is uniform and reveals nothing about the secret.\n\n**Simulated (for teaching):**\n\n- The round-by-round nonce / `w₁` / challenge / `z` exchanges are *choreography*. They show the protocol's shape but do not produce the signature.\n- The \"secure norm check\" reveals the combined value in the clear instead of running real MPC.\n- Rejections are injected so you can watch restart-on-reject behavior.\n- **To actually sign, the demo reconstructs the full secret key in one place** and calls the standard signer. It therefore does **not** achieve real key-non-reconstruction — the central property a production threshold scheme must provide.\n\nBottom line: the ML-DSA math is real and the output is a valid FIPS 204 signature; the *distributed-trust* property is illustrated, not enforced. Closing that gap is the open research problem this lab exists to explain.\n\n## Stack\n\nBrowser-based educational demo of threshold signature protocols for ML-DSA (NIST FIPS 204, the standardized post-quantum digital signature algorithm). The app simulates a simplified two-party signing flow inspired by Trilithium, where Server and Phone cooperatively produce a signature that still verifies with the standard ML-DSA verifier.\n\nStack: Vite + TypeScript strict + vanilla CSS + `@noble/post-quantum/ml-dsa`. No backends.\n\n## Verification\n\n```bash\nnpm run build    # typecheck (tsc) + production build\nnpm run verify   # run the verification suite (exits non-zero on failure)\n```\n\n`npm run verify` is the project's test gate: it checks additive sharing, distributed key\ngeneration, two-party signing, standard-verifier compatibility, tamper rejection, the\nsingle-party block, the no-`Math.random` rule, and the honesty disclosures. Both `build`\nand `verify` run on every push and pull request via GitHub Actions (`.github/workflows/ci.yml`).\n\n## Repo Description\n\n\u003e Browser-based educational demo of threshold ML-DSA (FIPS 204) — two-party distributed signing where neither party holds the complete secret key. Produces signatures that verify with standard ML-DSA. Inspired by Trilithium (2025). Shows why threshold lattice signatures are harder than classical. Research status: no NIST standard yet, expected 2027+.\n\n## Suggested GitHub Topics\n\n```text\ncryptography\npost-quantum\nml-dsa\nthreshold-signatures\ndistributed-signing\nmulti-party-computation\ntrilithium\nlattice-cryptography\nfips-204\nmpc\nbrowser-demo\neducational\ntypescript\nvite\n```\n\n---\n\n*One of 120+ browser demos in the [Crypto Lab](https://crypto-lab.systemslibrarian.dev/) suite.*\n\n*\"So whether you eat or drink or whatever you do, do it all for the glory of God.\" — 1 Corinthians 10:31*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-threshold-mldsa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-threshold-mldsa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-threshold-mldsa/lists"}