Dfns decentralized key management network supports threshold Diffie-Hellman protocol based on GLOW20 paper. You can use the DH protocol to derive output from a domain separation tag and a seed value. The derivation process is deterministic, i.e. the same Diffie-Hellman key and seed will lead to the same derived output. To ensure reproducibility, we use hash to curve RFC9380 and standard ciphersuite secp256k1_XMD:SHA-256_SSWU_RO_.
The seed doesn’t need to be secret. Without access to the DH key, it is not possible to do the derivation, even if the seed is known. Moreover, if both seed and derived output are known, it’s also not possible to do the derivation for another seed without having access to the DH key.
This endpoint only supports Diffie-Hellman keys. Regular threshold signature keys, like ECDSA or EdDSA, will not work. You can create a Diffie-Hellman key with the Create Key endpoint using scheme=DH and curve=secp256k1.
CustomerEmployee)EndUser)Keys:Derive: Always required.Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows
User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows
1Success