Internet Computer Lifts Chain Key Signing Capacity Tenfold

The Internet Computer is expanding the capacity of its threshold signing service, with throughput for chain key signatures rising by a factor of ten on subnets configured for heavy load. The changes, announced by DFINITY, apply to tECDSA, tSchnorr and vetKeys, and are now live on mainnet following a governance vote.

Threshold signing on the Internet Computer allows canisters to generate public keys, sign arbitrary messages and derive encrypted keys without exposing a master private key. Instead, that key is secret shared across all nodes within a subnet. Two master key sets are currently deployed in this way, one on a test signing subnet and another on the fiduciary signing subnet known as pzp6e, which runs with 34 nodes.

Until recently, the fiduciary subnet operated with relatively modest throughput limits. tECDSA was capped at around 0.5 signatures per second, tSchnorr at roughly 1.1 signatures per second and vetKeys at about 5 signatures per second. For routine activity these ceilings were adequate. For decentralised finance applications and other high intensity workloads, they presented constraints, particularly where transactions arrive in bursts or require multiple signatures in quick succession.

According to DFINITY, the latest upgrades address those bottlenecks across several layers of the replica codebase. Optimisations include multi threading for cryptographic operations, changes to inter process communication and adjustments to how IDKG dealings are handled. A key shift involves storing pre signature artefacts in the subnet’s replicated state rather than embedding them in consensus blocks, where space is limited. This enables thousands of pre signatures to be prepared in advance.

Pre signature generation has long been the main performance constraint in the protocol. By producing them during quieter periods, subnets are better positioned to absorb sudden spikes in demand. When pre signatures are available, a subnet can now process more than 100 signatures per second for schemes that rely on them, until the prepared pool is exhausted. Sustained throughput, measured when no pre signatures remain, has increased by at least ten times on subnets tuned for heavy signing activity.

On mainnet, proposal 140289 raised the pre signature target for the fiduciary signing subnet from five to 100. With that adjustment, expected maximum rates on pzp6e are now about 3.5 signatures per second for tECDSA, 6.5 signatures per second for tSchnorr and 18 signatures per second for vetKeys. VetKeys does not rely on pre signatures in the same way, but still benefits from the broader optimisations.

The updated limits apply per subnet, which means capacity can be scaled horizontally by adding further signing subnets. That architectural choice reflects the Internet Computer’s broader design, where different workloads are distributed across independent subnet blockchains.

While the improvements expand headroom for developers, real world impact will depend on adoption patterns. DeFi protocols, cross chain bridges and applications that coordinate multi signature approvals are among the likely beneficiaries. A single Bitcoin transaction, for example, may involve signing multiple inputs, and higher signature capacity reduces the risk of queuing delays during periods of intense activity.

DFINITY says it will continue monitoring usage and may propose further parameter changes if demand warrants it. The foundation has also invited developers expecting higher signature requirements to share details of their use cases, with a view to informing future configuration updates.

For the Internet Computer ecosystem, the message is clear. Chain key cryptography remains central to its cross chain ambitions, and performance constraints are being addressed in incremental, code level steps rather than headline grabbing redesigns. Whether the new capacity will be quickly absorbed by existing projects or unlock new categories of applications is likely to become clearer over the coming months.