Threshold VM (T-Chain)

The Threshold VM (T-Chain) provides Multi-Party Computation (MPC) as a service for all Lux chains. It manages threshold key generation, distributed signing, and key lifecycle operations using the LSS (Lux Secret Sharing) protocol. Any authorized chain can request cryptographic operations from the T-Chain via Warp messaging.

Architecture

• Threshold Signing: t-of-n threshold signatures where t+1 parties are needed to sign
• Key Generation (DKG): Distributed key generation across MPC parties
• Key Resharing: Rotate parties without changing the public key
• Key Refresh: Refresh key shares without changing parties or public key
• Multi-Protocol: Supports multiple threshold protocols via a protocol registry
• Quota Management: Per-chain daily signing limits

Configuration

{
  "threshold": 2,
  "totalParties": 5,
  "sessionTimeout": "30s",
  "maxActiveSessions": 100,
  "maxSessionsPerChain": 10,
  "keyRotationPeriod": "720h",
  "maxKeyAge": "8760h",
  "dailySigningQuota": {},
  "authorizedChains": {}
}

Chain Permissions

Each authorized chain has configurable permissions:

{
  "chainId": "...",
  "chainName": "B-Chain",
  "canSign": true,
  "canKeygen": true,
  "canReshare": false,
  "allowedKeyTypes": ["secp256k1", "ed25519"],
  "maxSigningSize": 32,
  "requirePreHash": true,
  "dailySigningLimit": 10000
}

Key Types

RPC API

The T-Chain uses JSON-RPC with the threshold namespace. Endpoint:

https://api.lux.network/{network}/ext/bc/{blockchain-id}/rpc

Key Generation

• threshold_keygen -- Initiate distributed key generation
• threshold_getKeygenStatus -- Check status of a keygen session

Signing

• threshold_sign -- Request a threshold signature
• threshold_getSignature -- Retrieve a completed signature
• threshold_batchSign -- Sign multiple messages in one session

Key Management

• threshold_reshare -- Reshare key to new set of parties
• threshold_refresh -- Refresh key shares (same parties)
• threshold_listKeys -- List all managed keys
• threshold_getKey -- Get key metadata by ID
• threshold_getPublicKey -- Get the public key for a managed key
• threshold_getAddress -- Get the Ethereum address for a secp256k1 key

Protocol Information

• threshold_getProtocols -- List supported threshold protocols
• threshold_getProtocolInfo -- Get details about a specific protocol

Session Management

• threshold_getSessions -- List active signing sessions
• threshold_cancelSession -- Cancel a signing session

Network Information

• threshold_getInfo -- Get T-Chain node info (party ID, threshold, readiness)
• threshold_getStats -- Get signing statistics
• threshold_getParties -- List all MPC parties
• threshold_getQuota -- Get remaining signing quota for a chain

Authorization

• threshold_getAuthorizedChains -- List chains authorized to use MPC services
• threshold_getChainPermissions -- Get permissions for a specific chain

Health

• threshold_health -- Health check

FHE Precompiles

The T-Chain also provides FHE (Fully Homomorphic Encryption) precompiles for confidential computing on EVM-compatible chains:

FHE operations use github.com/luxfi/lattice for lattice-based cryptography. GPU acceleration is available via CGO; CPU fallbacks are used when CGO is disabled.

Related LPs

See lps.lux.network for the relevant Lux Proposals governing this chain.