Threshold VM (M-Chain MPC + F-Chain FHE per LP-134)

The Threshold VM substrate powers M-Chain (MPC ceremonies for bridge custody of external wallets — CGGMP21, FROST, Pulsar-general) and F-Chain (FHE compute + TFHE bootstrap-key generation) per LP-134. It manages threshold key generation, distributed signing, and key lifecycle operations using the LSS (Lux Secret Sharing) protocol. Any authorized chain can request cryptographic operations from M-Chain via Warp messaging. The legacy name "T-Chain" is retained ONLY for teleportvm (LP-6332). New work targets M-Chain (MPC) or F-Chain (FHE).

Architecture

• Threshold Signing: t-of-n threshold signatures where t+1 parties are needed to sign
• Key Generation (DKG): Distributed key generation across MPC parties
• Key Resharing: Rotate parties without changing the public key
• Key Refresh: Refresh key shares without changing parties or public key
• Multi-Protocol: Supports multiple threshold protocols via a protocol registry
• Quota Management: Per-chain daily signing limits

Configuration

{
  "threshold": 2,
  "totalParties": 5,
  "sessionTimeout": "30s",
  "maxActiveSessions": 100,
  "maxSessionsPerChain": 10,
  "keyRotationPeriod": "720h",
  "maxKeyAge": "8760h",
  "dailySigningQuota": {},
  "authorizedChains": {}
}

Chain Permissions

Each authorized chain has configurable permissions:

{
  "chainId": "...",
  "chainName": "B-Chain",
  "canSign": true,
  "canKeygen": true,
  "canReshare": false,
  "allowedKeyTypes": ["secp256k1", "ed25519"],
  "maxSigningSize": 32,
  "requirePreHash": true,
  "dailySigningLimit": 10000
}

Key Types

RPC API

The T-Chain uses JSON-RPC with the threshold namespace. Endpoint:

https://api.lux.network/{network}/ext/bc/{blockchain-id}/rpc

Key Generation

• threshold_keygen -- Initiate distributed key generation
• threshold_getKeygenStatus -- Check status of a keygen session

Signing

• threshold_sign -- Request a threshold signature
• threshold_getSignature -- Retrieve a completed signature
• threshold_batchSign -- Sign multiple messages in one session

Key Management

• threshold_reshare -- Reshare key to new set of parties
• threshold_refresh -- Refresh key shares (same parties)
• threshold_listKeys -- List all managed keys
• threshold_getKey -- Get key metadata by ID
• threshold_getPublicKey -- Get the public key for a managed key
• threshold_getAddress -- Get the Ethereum address for a secp256k1 key

Protocol Information

• threshold_getProtocols -- List supported threshold protocols
• threshold_getProtocolInfo -- Get details about a specific protocol

Session Management

• threshold_getSessions -- List active signing sessions
• threshold_cancelSession -- Cancel a signing session

Network Information

• threshold_getInfo -- Get T-Chain node info (party ID, threshold, readiness)
• threshold_getStats -- Get signing statistics
• threshold_getParties -- List all MPC parties
• threshold_getQuota -- Get remaining signing quota for a chain

Authorization

• threshold_getAuthorizedChains -- List chains authorized to use MPC services
• threshold_getChainPermissions -- Get permissions for a specific chain

Health

• threshold_health -- Health check

FHE Precompiles

The T-Chain also provides FHE (Fully Homomorphic Encryption) precompiles for confidential computing on EVM-compatible chains:

FHE operations use github.com/luxfi/lattice for lattice-based cryptography. GPU acceleration is available via CGO; CPU fallbacks are used when CGO is disabled.

Related LPs

See lps.lux.network for the relevant Lux Proposals governing this chain.