LWE-Based Threshold Key Management with Dynamic Enrollment and Share Refresh

We present a trusted-dealer Learning with Errors (LWE)-based threshold key-management framework that separates the public-key layer from threshold-share maintenance. The coordinator generates one LWE public key PK=(A,b),b=As+e(modq) and distributes the same secret vector through coordinate-wise Shamir (t,n) sharing. Dynamic membership is restricted to enrollment: a new participant obtains an evaluation of the existing sharing polynomial, so enrollment does not rotate the secret or change the LWE key pair. Share refresh uses participant-generated degree-(t−1) vector polynomials with zero constant term. Their evaluations are exchanged over authenticated private channels and added locally, preserving the same secret without interpolation or accumulation of LWE error. This paper formalizes exact threshold recovery, single-epoch share privacy, and cross-epoch share-snapshot privacy under a restricted post-refresh observation model with hidden refresh state and effective erasure. It also introduces an explicit epoch-consistency rule so that recovery never mixes shares from different refresh epochs and derives communication and computation costs separately for setup, enrollment, refresh, and recovery. Hash-based commitments and authenticated private channels are treated as integrity and delivery mechanisms rather than as substitutes for maliciously secure verifiable secret sharing (VSS). The post-quantum claim is conditional on concrete validation of the selected LWE parameter tuple. Dealerless distributed key generation (DKG), coordinator-compromise proactive security, participant departure, threshold changes, and a complete quantum random oracle model (QROM) reduction remain outside the present security claims.