Key Generation Ceremony

A key generation ceremony is the structured event of creating a high-stakes cryptographic key under conditions designed to ensure no single party knows or could have influenced the result.

Typical components:

• Multiple participants. Sensitive steps need several trusted people at once, so no one can act alone.
• Air-gapped or hardened hardware. In the ceremonies IANA holds for the internet's DNS root signing key, the key lives in hardware security modules (HSMs), and no part of the system that uses them is connected to a network. Between ceremonies the HSMs sit in tamper-evident bags in locked safes, and old ones are destroyed when retired.
• Witnesses, often with video recording or independent observers. The ceremony is reviewable after the fact. IANA invites outside members of the internet community to take part, streams its ceremonies live, and publishes the scripts and audit camera footage.
• Verification of the resulting public key, with the private key (or shares of it) sealed before anyone leaves the room.

Where they come up in Bitcoin:

• Threshold cold wallets meant to hold large amounts of bitcoin. ChillDKG, a draft Bitcoin spec for setting up FROST threshold keys, uses this as its example of a key generation ceremony.
• Systems run by a federation of signers. The same draft notes that such systems typically set up their keys in a one-time ceremony at launch, sometimes repeated every few months.
• DKG (distributed key generation) for FROST-based threshold setups. Each participant contributes its own random secret and ends up holding only its own share of the key. That avoids a trusted dealer who would create every share, a single point of failure that could forge signatures if compromised.

The ceremony adds no new cryptography. Its job is to make sure nobody has to take one person's word that the key was made and stored safely.