How can a group create a private key that no one ever sees?

Distributed key generation, or DKG, is a cryptographic process in which multiple parties contribute to the calculation of a shared public and private key set. Unlike most public key encryption models, it does not rely on a trusted third party. Instead, the participation of a threshold of honest parties determines whether a key pair can be computed. Crucially, it prevents any single party from having access to the private key.

Why bother? The alternative is a trusted dealer, who creates the key and hands out the shares. That dealer is trusted to generate good randomness, to delete secret values after distributing the shares, and to keep them confidential. Ordinary secret sharing simply assumes the dealer is honest. DKG is the other way to set up a group that signs together: a threshold signing group can be configured with a single trusted dealer, or by running a distributed key generation protocol.

How does it work? The protocols build on verifiable secret sharing, where extra information lets players check that their shares are consistent, so that even a malicious dealer cannot leave the group without a well-defined secret. In the protocol of Gennaro, Jarecki, Krawczyk and Rabin, all parties share random polynomial functions this way. Every party then verifies the shares it received. If a share fails the check, the recipient broadcasts a complaint, and the accused party then broadcasts their shares. Accused parties can be disqualified, and the group computes its private key from every qualified party's contribution.

The first protocol was specified by Torben Pedersen in 1991. In 1999, Gennaro and colleagues showed that it was vulnerable to malicious contributions that would leak information about the shared private key, and proposed an updated scheme. Today DKG is commonly used to decrypt shared ciphertexts or create group digital signatures.