papers/lux-validator-mpc/sections/06-key-resharing-and-recovery.tex

\section{Key Resharing and Recovery}

\label{sec:resharing}

\subsection{Problem: Validator Set Changes}

Validator sets are not static. Validators join (new stake) and leave (unbonding).
Without resharing, the threshold parameters $(t, n)$ are fixed at DKG time. If
validators leave, the effective threshold shrinks. If too many leave, signing
becomes impossible.

\subsection{Resharing Protocol}

Resharing transitions from $(t, n)$ to $(t', n')$ without reconstructing the
master key:

\begin{algorithm}[ht]
\caption{Proactive Key Resharing.}
\label{alg:resharing}
\begin{algorithmic}[1]
\Require Old committee $\mathcal{C} = \{P_1, \ldots, P_n\}$ with $(t, n)$ shares
\Require New committee $\mathcal{C}' = \{P'_1, \ldots, P'_{n'}\}$ with threshold $t'$
\Ensure New shares $sk'_j$ for $\mathcal{C}'$; master key $sk$ unchanged
\ForAll{$P_i \in \mathcal{C}$, $i \in S$ where $|S| = t$}
  \State Compute Lagrange coefficient $\lambda_i$
  \State Sample random polynomial $g_i(x)$ of degree $t' - 1$ with $g_i(0) = \lambda_i \cdot sk_i$
  \State Send $g_i(j)$ to each $P'_j \in \mathcal{C}'$ via encrypted channel
  \State Broadcast Feldman commitments for $g_i$
\EndFor
\ForAll{$P'_j \in \mathcal{C}'$}
  \State Verify each received share against commitments
  \State $sk'_j \leftarrow \sum_{i \in S} g_i(j)$
\EndFor
\end{algorithmic}
\end{algorithm}

\begin{theorem}[Resharing correctness]
After resharing, the new shares $sk'_j$ are valid $(t', n')$-Shamir shares of the
same master key $sk$.
\end{theorem}

\begin{proof}
Let $F(x) = \sum_{i \in S} g_i(x)$. Then $F(0) = \sum_{i \in S} \lambda_i \cdot sk_i = sk$
by the Lagrange reconstruction property. Each $g_i$ has degree $t' - 1$, so $F$ has
degree $t' - 1$. Therefore $sk'_j = F(j)$ are valid $(t', n')$-Shamir shares of $sk$.
\end{proof}

\subsection{Recovery Without Key Reconstruction}

If a party $P_i$ loses their share (disk failure, corruption), the remaining parties
can help $P_i$ recover without ever materializing the master key:

\begin{enumerate}[leftmargin=2em]
  \item Select a qualifying set $S$ of $t$ parties (not including $P_i$).
  \item Each $P_j \in S$ computes $r_{j \to i} = \lambda_j \cdot sk_j$ evaluated at
        point $i$ using a fresh random polynomial.
  \item $P_i$ reconstructs their share from the $t$ recovery shares.
\end{enumerate}

The master key is never reconstructed in this process. Each party contributes a
partial recovery share that individually reveals nothing.

%% ========================================================================
%%  7. SLASHING COMPATIBILITY
%% ========================================================================