// learn · season 02 · episode 08 · finale
MPC — the key that never exists
Episode 7 removed the single point of failure by requiring several signatures. This one removes something stranger: the key itself. Not hidden, not encrypted — never assembled anywhere, at any moment. We'll get there honestly, starting with mathematics you can watch working.
01 · splitting a secret
Two points make a line
Before any of the clever protocols, one beautifully simple idea: you can cut a secret into pieces so that some of the pieces rebuild it and fewer than that reveal literally nothing. Hold shares, set them aside, and watch.
the secret — a 120-bit number (stand-in for a private key)
…
select at least one share above
With a threshold of 2, the polynomial is just a straight line: the secret is where it crosses x=0, and each share is a point on it. Two points fix the line; one doesn't. Raise the threshold to 3 and it becomes a curve needing three points — same idea, more dimensions. This is real Shamir's Secret Sharing, the mathematics behind “any 3 of our 5 executives”, backup share schemes, and how custody platforms shard key material across data centres.
02 · the catch
Splitting isn't signing
Here's the part that gets skipped in most explanations. Shares are wonderful at rest — but to actually sign something with a Shamir-split key, you have to put it back together first. Watch what that costs.
share 1
held apart, safely
share 2
held apart, safely
share 3
held apart, safely
complete key existed on one machine
a few seconds — every single time you sign
and how often is that?
For a business paying suppliers, dozens of times a week. Each one is a fresh chance for the jackpot to be sitting somewhere an attacker can reach.
So secret sharing solves storage and leaves usage wide open. That gap — not the splitting — is the problem MPC was built to close.
03 · the resolution
Signing without assembling
Multi-party computation asks an odd question: could several parties jointly compute a signature without any of them learning the others' secrets — and without the key ever being formed? The answer, worked out over decades of cryptography, is yes.
illustrative choreography
Real threshold signing (GG20, FROST and friends) is multi-round cryptography with its own security proofs, and this page does not implement it. What's accurate below is the shape of the protocol: who computes what, what actually travels between parties, and what each one ends up knowing. Everything else on this site runs real algorithms — this segment is the honest exception.
Party A
your phone
holds: share 1
Party B
your laptop
holds: share 2
Party C
the custodian's HSM
holds: share 3
04 · choosing
Multisig or MPC?
Not a fight with a winner. They make opposite trades, and the right answer depends on what you need to prove to whom — including the places where MPC is genuinely the weaker choice.
| multisig | MPC / threshold signing | |
|---|---|---|
| where the rule lives | In the chain — a Bitcoin script or a smart contract enforces it. | In mathematics, off-chain. The chain sees no policy at all. |
| on-chain footprint | Several signatures, and usually a visible “this is a vault” marker. | One ordinary signature. Indistinguishable from a single-key wallet. |
| chain support | Depends on the chain — scripts on Bitcoin, contracts on EVM, varies elsewhere. | Works anywhere the signature curve is used, because the output is just a signature. |
| changing who signs | Bitcoin: move the funds to a new address. EVM: send a transaction to the contract. | Re-share the key material between parties. The address never changes. |
| auditability | Public. Anyone can verify the policy and see who signed — a genuine strength. | Depends on the operator's logs. The chain can't show you what happened internally. |
| who runs it | You and your co-signers, with ordinary wallets. | Usually a vendor's infrastructure — which makes vendor risk a real part of your risk. |
what custody actually is
Neither of these is “custody”. They're both just the signing layer. Real custody is what surrounds it: hardware security modules, policy engines that encode who may approve what, approval workflows, monitoring, audits, insurance, and the people who follow the procedure at 2am when it's inconvenient. The cryptography is the easy part — it's been solved for years. The hard part is everything organisational built on top, which is precisely why custody is a service and not a download.
season 02 complete
From one number to institutional custody
Season 1 built the machine: hashes, blocks, consensus, keys. Season 2 asked the only question that matters once you own something on it — how do you keep it, and hand it on? You've now written a real seed phrase, kept a key off the internet while still using it, built a vault that survives losing a key, and split a secret that can be used without ever being whole. That's the entire custody stack, hands-on.
One thread ran through all eight episodes: this technology is excellent at making things permanent and terrible at forgiving mistakes — and it has no opinion at all about what happens when the person holding the keys is no longer around to hold them. That's not a cryptography problem. It's a planning one.
Digital assets that outlive their owners need a succession plan — designed before it's needed, tested like any other system.
That's the problem I work on →← back to all episodes