// the take
A Go implementation of threshold signature schemes (GG18, CGGMP for ECDSA, FROST for EdDSA) with an added twist: Birkhoff interpolation lets shares carry different ranks, so a signature can require a specific party (e.g. a manager) rather than just any N-of-M. Built by AMIS for their own custodial wallet product, aimed at teams building MPC-based key management rather than app developers who just need to sign something.
Actually audited by a named third party (Kudelski Security, two full reports linked) rather than just claiming it. The security notes section is unusually honest for a crypto repo — it names the tsshock paper's three attacks and CVE-2023-33241 individually and explains the concrete fix for each (Paillier key factor check, Fiat-Shamir hashing moved outside the loop, etc.) instead of a vague 'we take security seriously.' The hierarchical/ranked-share feature is a real, uncommon capability — most TSS libraries only do flat N-of-M. Primitives (Paillier, CL encryption, Pedersen/Feldman commitments, OT extension, Birkhoff interpolation) are split into independent packages usable outside the TSS flow.
The GG18 path is explicitly marked DEPRECATED in the README, pushing you toward CGGMP, which has had less real-world battle-testing. The warning to 'never restart in the middle of flow' after an error implies the protocol state machine isn't crash-safe — a real problem for anything running in production where processes get killed or redeployed. It punts transport security entirely ('end-to-end encryption... is necessary') onto the integrator, so a naive deployment is exposed even with a correct library. This is the kind of codebase where the history of retroactively patched protocol-level flaws (not just bugs) means adopting it means signing up for ongoing cryptographic review, not a one-time integration — and with AMIS being the main driver behind their own wallet product, there's no visible evidence of a broader maintainer base if they deprioritize it.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →