Vaults, signers, and thresholds

io.sign protects a signing identity by distributing key shares across multiple signers. A vault's weighted threshold defines which combinations of those signers can create a signature.

Core concepts

Vault

A vault is a signing identity controlled by a defined group of signers. It records the public key, signer membership, each signer's weight, and the threshold required to sign.

A vault does not store a complete private key. Its signers hold shares and use MPC to create signatures together.

Signer

A signer is a device or service that holds a share and can participate in an MPC operation:

• A Mobile Signer lets a person review and approve requests in the io.sign mobile app.
• A Virtual Signer runs as a service and evaluates requests with OPA or a custom policy server.

A vault can use either type or combine both types.

Weight

A signer's weight is its contribution toward the vault threshold. Weight represents signing power, not the number of devices or approvals.

Threshold

The threshold is the minimum combined signer weight required to perform a signing operation.

valid signing set: sum(participating signer weights) >= vault threshold

The number of participating signers alone does not determine whether a set can sign.

Worked example

A threshold-4 vault contains three signers with weights 2, 2, and 4:

This arrangement provides two paths: two lower-weight signers can collaborate, or the weight-4 signer can act independently.

A threshold does not guarantee multiple participants. If one signer has weight equal to or greater than the threshold, that signer can satisfy the threshold alone. To require collaboration, keep every individual signer below the threshold.

Approval and signing

An approval records a signer's decision to participate in a requested operation. A Mobile Signer can obtain a decision from a person; a Virtual Signer obtains a policy decision from OPA or a custom policy server.

Signing begins after an eligible set of approved signers is available. Those signers run the MPC protocol and jointly produce the signature without reconstructing the complete private key.

For how threshold signatures (TSS) use MPC to produce a standard digital signature, see Digital signature algorithms.

Rejecting or abstaining means that signer does not contribute its weight to that operation. The operation can still proceed if another set of participating signers reaches the threshold.

Key generation and resharing

• Key generation creates a new vault and distributes new shares to its initial signers.
• Resharing changes signer membership or weights while retaining the vault's public key.

Treat changes to membership, weight, and threshold as security-policy changes. Review which signer combinations can meet the threshold before creating or resharing a vault.

Next steps

• Deploying io.sign helps you choose where io.sign runs.
• Signer types compares human and automated signers.
• Digital signature algorithms explains TSS, MPC, and the supported signature algorithms.