# Does Ed25519 support cryptographic threshold signatures?

This is a loaded question so I'll list the concerns, not all of which need to be satisfied.

Does there exist a threshold-signature scheme for Ed25519 that...

1. Does not require a trusted dealer to set up the key shares (required)
2. Does not require interaction to set up the key shares (optional: ideally users can independently generate key pairs, but if all n users need to interact to compute the key shares, that's acceptable)
3. Supports arbitrary m-of-n composition, as opposed to having restrictions on m (required)
4. Does not require interaction to reconstruct the threshold signature from signature shares (optional: same as 2, non-interative schemes are preferred)

Some sources claim that this is possible (e.g. https://ripple.com/curves-with-a-twist/) but I haven't seen an implementation yet.

• There is always the generic solution: A public key is the concatenation of n individual public keys and the threshold m, a signature is the concatenation of m individual signatures. – CodesInChaos Dec 2 '14 at 13:04

• Ed25519 includes $R$ in the message hash. Does that cause problems for the threshold scheme? – CodesInChaos May 18 '15 at 13:21
• @CodesInChaos A new fresh $R$ can be calculated by the subset of key-share-holders willing to issue a signature. Care to state a problem? – Vadym Fedyukovych May 21 '15 at 16:54