k-of-n Threshold

A k-of-n threshold scheme splits authority over a secret, or the right to sign something, across n participants, such that any k of them acting together can exercise it, but any k-1 acting together learn or can do nothing. Pick 3-of-5: any three of five guardians suffice; two colluding or compromised guardians get nowhere.

The idea generalizes a simple, older intuition (a bank vault that needs two keys turned at once, or a joint account requiring two signatures) into mathematics that works for any k and n, not just two-of-two. The threat model it names explicitly is collusion: the question a k-of-n design answers is not "can this be broken?" but "how many parties have to conspire before it breaks?" Set k high relative to n and you resist collusion but risk unavailability if too many participants go missing; set k low and the reverse. Every real deployment is that tradeoff, made concrete.

Where it comes from

Two people solved this the same year with different mathematics. Adi Shamir's 1979 paper "How to Share a Secret" encodes the secret as the constant term of a random polynomial of degree k-1, hands each participant one point on that polynomial, and relies on the fact that k points determine a degree k-1 polynomial uniquely, but k-1 points determine nothing at all. G.R. Blakley published an independent construction the same year using intersecting hyperplanes in a geometric space: the secret is a point, each share is a hyperplane through it, and any k hyperplanes intersect at exactly that point while k-1 leave a whole line (or higher-dimensional space) of possibilities. Both are decades-old, peer-reviewed secret-sharing cryptography that predates Solidus by 46 years. Solidus designed neither.

Solidus status

Guardian-recovery, Solidus's k-of-n mechanism, is testnet and unaudited. It shipped as a working chain-primitive-to-SDK-to-relay-to-UI stack and was verified end-to-end against the live node with real guardian accounts, but it has not been audited and has not recovered a real account holding anything of value. It is worth being precise about what it actually is: not Shamir or Blakley secret sharing reconstructing an off-chain secret, but a threshold co-signing policy that the chain's own executor enforces as a consensus rule, k of n guardians the user chose must co-sign a rotation transaction before the executor accepts it. No company, backend, or support desk holds the authority to override that threshold; the chain does the checking.

Recovery is instant by design, and the corresponding risk is the mirror image of the guarantee: a colluding guardian threshold is the actual threat model, so choosing guardians well is what the security rests on, not any property of the code alone. A completed recovery also mints a new root key, which severs every pairwise per-verifier identity derived from the old one, a recovered account looks new to every relying party again. That's a deliberate design choice, not a bug: a compromised key should sever old handles rather than carry them forward.

There is no standalone, npm-installable proof a stranger can run today, the mechanism only exists inside the full wallet-relay-chain flow.

See also

Guardian Recovery is the specific Solidus mechanism this term underlies. BLS Signature is a threshold-adjacent primitive Solidus uses elsewhere in consensus. Committee Election is the other place a chosen threshold, there, of validators, not guardians, gates a chain-level decision.