What Is a k-of-n Threshold? (Multisig and Social Recovery, Explained)

A bank vault built for two keyholders doesn't care which two show up. Any two of the three people with a key can open it; one alone cannot. That's a k-of-n threshold with k = 2 and n = 3, and the idea behind it is older than any wallet, any blockchain, and any company using it today.

The plain definition

A k-of-n threshold splits authority, over a secret, or over the right to sign something, across n participants, such that any k of them acting together can exercise it, while any k-1 acting together cannot do anything at all. Pick 3-of-5: any three of five people suffice, and two colluding or compromised participants get nowhere. Pick 2-of-2 and you've described the two-key vault, or a bank's dual-signature requirement on a large wire transfer.

The number that matters isn't k or n in isolation: it's the gap between them, because that gap is what an attacker has to clear. A k-of-n scheme doesn't answer "can this be broken?" the way a single lock does. It answers "how many parties have to conspire before it breaks?" Set k high relative to n and collusion gets harder, but so does ordinary use if participants become unreachable. Set k low and the reverse is true. Every real deployment of this idea is that tradeoff, made concrete.

Where it comes from

Two people solved this problem the same year with two different kinds of math, neither aware of the other's work. Adi Shamir's 1979 paper, "How to Share a Secret" (Communications of the ACM, Vol. 22, No. 11), encodes a secret as the constant term of a random polynomial of degree k-1 and hands each participant one point on that curve. Any k points determine the polynomial, and the secret, uniquely; any k-1 points determine nothing, mathematically, not just practically. G. R. Blakley published an independent construction the same year using intersecting hyperplanes in geometric space: the secret is a point, each share is a hyperplane through it, and any k hyperplanes intersect at exactly that point while k-1 leave an entire line of possibilities open.

Multisignature wallets are the same idea applied to signing rather than secret-splitting: Bitcoin's P2SH format made "require k of n signatures to spend" a native scripting primitive years before most software wallets existed. This is decades-old, peer-reviewed, publicly documented cryptography and engineering practice. No single company designed it, and no single company gets to claim it invented the pattern, including Solidus, which applies it below to one specific, narrower problem.

What k-of-n guarantees, and what it doesn't

The guarantee is precise, which is why the scheme is trusted: fewer than k participants, acting together, cannot exercise the authority, not "it's hard," but structurally cannot, regardless of which k-1 they are. k or more participants can, regardless of which k they happen to be; the scheme doesn't care about identity, only count.

What it doesn't guarantee is anything about the participants themselves. A k-of-n threshold says nothing about whether the k who show up are trustworthy, coerced, or colluding on purpose. The security of the whole construction rests entirely on choosing k and n, and the actual people or devices behind them, well. Set the threshold too low and a small, plausible conspiracy clears it. Set it too high, and the everyday risk of participants going offline or becoming unreachable is enough to lock the legitimate owner out of their own authority. There is no k-of-n configuration that is simply "safe", only ones matched, or mismatched, to a specific threat model.

Solidus's guardian recovery, one worked example, not the definition

Solidus's wallet applies this pattern to a specific problem: recovering a lost or compromised key without a seed phrase and without a company holding override authority. A user names a set of guardians and a threshold, k of n, and any k of those guardians co-signing is enough to rotate the wallet's identity to a new key. The chain's own executor checks the threshold was actually met before accepting the rotation; no support desk or backend operator can approve it on their own say-so.

That's one worked example of the general pattern, alongside multisig wallets generally and other social-recovery implementations such as Argent's, not the origin of the idea and not the only way to apply it. The full mechanism, including what a completed recovery costs, is covered on Social Recovery vs. Seed Phrases, this page won't re-explain it.

Why this matters if you're evaluating any wallet

The next time a wallet's guardian-setup screen asks for a threshold number, or a service calls itself "multisig," the question worth asking isn't whether the underlying math works: Shamir's and Blakley's constructions have held for 46 years. It's whether the k and n chosen fit the actual people involved, and whether losing access to n-k+1 of them is a risk you're comfortable with. The scheme only ever protects against the threat model it was configured for.