Threshold Cryptography IV: Multiplicative-to-Additive (MtA) Protocol and Paillier Encryption Scheme

## Executive summary This post explains the Paillier additively homomorphic encryption scheme and its use in the MtA (Multiplicative-to-Additive) protocol for converting multiplicative shares into additive shares within threshold ECDSA (as used in Binance tss-lib and GG18). It covers Paillier key generation, encryption/decryption correctness, additive homomorphism properties, and a detailed description of the three-round interactive MtA(MtAwc) protocol including range- and Bob-proofs, under the assumption of mutually verified public parameters.