"We consider distributed (threshold) cryptosystems over a composite modulus N in which the factors of N are shared among the participants as the secret key. This is a new idea for threshold cryptosystems based on a composite (i.e., different from the typical treatment of the much-studied RSA-based threshold systems where a "decryption exponent" is shared among the participants). The paradigm enables solutions to open problems in threshold cryptography and it also yields substantial efficiency improvements when generation of N is done in a distributed manner (i.e., without a trusted dealer)."

Threshold Cryptosystems Based on Factoring