BIP Draft: ChillDKG: Distributed Key Generation for FROST #2227

This PR adds a BIP for the ChillDKG distributed key generation protocol intended to be used with BIP 445 (FROST Signing). The development repository is at https://github.com/BlockstreamResearch/bip-frost-dkg.

Remaining items to do:

• Test vector coverage is already quite good, but we'd like to add a few additional test vectors (https://github.com/BlockstreamResearch/bip-frost-dkg/issues/138) and also make them a bit more convenient to use (https://github.com/BlockstreamResearch/bip-frost-dkg/issues/121). (Note to implementors: After all, this is still a draft. There's no guarantee that already existing vectors won't change.)
• We'd like to add a warning and a reference to BIP 445 once the adaptive security issue has been dealt with there. (https://github.com/BlockstreamResearch/bip-frost-dkg/issues/126)
• While we tried to be consistent and compatible with BIP 445, some smaller changes may be warranted depending on some final changes in BIP 445. For example, we want to make sure that the DKGOutput data structure of the reference code here matches what BIP 445 expects as input (https://github.com/BlockstreamResearch/bip-frost-dkg/issues/157).

Feedback is very much appreciated! Please comment on this pull request or open an issue at https://github.com/BlockstreamResearch/bip-frost-dkg for any feedback. Thank you!

Disclosure: AI has been used in the later stages of drafting for proof reading as well as refactoring and reviewing certain sections of the reference code.

Note to editors: Despite there being a handful of things we still plan to improve, we're opening this PR intentionally not as a draft PR to indicate that the BIP draft is in a shape ready for review by the community. Should you disagree with this decision, simply convert the PR to draft.

How did you solve the ice problem...?

How did you solve the ice problem...?

Thanks for the question — I assume you mean identifiable cheating entities, as in ICE-FROST?

ChillDKG does identify faulty parties. Whenever a session aborts, an honest party will blame at least one participant or the coordinator. If a participant receives incorrect secret shares and cannot immediately tell who is responsible, it can request an auxiliary investigation message from the coordinator, which lets it single out the faulty participant.

The guarantees are deliberately limited. Blame is conditional on reliable communication links, and a participant blaming another participant additionally relies on an honest coordinator.

Most importantly, ChillDKG is not robust by design: the session aborts instead of continuing without the faulty party (see the "Robustness is Not a Goal" section). Excluding a participant would degrade the setup from t-of-n to (t-1)-of-(n-1) from the outset, and would hand a faulty coordinator the power to exclude participants at will.

@leviwinks please stop spamming here with long, unrelated comments. Thank you.

Repost #! 🤙🙂‍↔️🎯

Sent from Outlook for iOShttps://aka.ms/o0ukef

From: Mark Flatt @.> Sent: Saturday, August 1, 2026 09:53 To: bitcoin/bips @.>; bitcoin/bips @.> Cc: Mention @.> Subject: Re: [bitcoin/bips] BIP Draft: ChillDKG: Distributed Key Generation for FROST (PR #2227)

The Gerbil King has returned

Sent from Outlook for iOShttps://aka.ms/o0ukef

From: Mark Flatt @.> Sent: Saturday, 01 August 2026 09:25:12 To: bitcoin/bips @.>; bitcoin/bips @.> Cc: Mention @.> Subject: Re: [bitcoin/bips] BIP Draft: ChillDKG: Distributed Key Generation for FROST (PR #2227)

Sorry Mr Slave

Sent from Outlook for iOShttps://aka.ms/o0ukef

From: Jon Atack @.> Sent: Saturday, 01 August 2026 09:24:21 To: bitcoin/bips @.> Cc: MuSig2 @.>; Mention @.> Subject: Re: [bitcoin/bips] BIP Draft: ChillDKG: Distributed Key Generation for FROST (PR #2227)

[https://avatars.githubusercontent.com/u/2415484?s=20&v=4]jonatack left a comment (bitcoin/bips#2227)https://github.com/bitcoin/bips/pull/2227#issuecomment-5148837699 @leviwinkshttps://github.com/leviwinks please stop spamming here with long, unrelated comments. I've removed two of them. Thank you.

— Reply to this email directly, view it on GitHubhttps://github.com/bitcoin/bips/pull/2227?email_source=notifications&email_token=ALI6O4NN2MRPXZ4PKJRICJ35HVBELA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUHA4DGNZWHE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5148837699, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ALI6O4OYY25KWLP3GN5S4AL5HVBELAVCNFSNUABEKJSXA33TNF2G64TZHMYTINJTGE3TGNZ3JFZXG5LFHM2TAMRTGMZTSMJVG6QXMAQ. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOShttps://github.com/notifications/mobile/ios/ALI6O4O5YKMCOJJ7XT3IOGL5HVBELA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUHA4DGNZWHE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y and Androidhttps://github.com/notifications/mobile/android/ALI6O4OKQ64GTMXZKSW2GM35HVBELA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJUHA4DGNZWHE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI. Download it today! You are receiving this because you were mentioned.