Multi-party computation node configuration
A system may include a client device that generates a user interface that is configured to receive a user input related to a multi-party computation (MPC) operation. The system may include a plurality of MPC nodes configured to jointly execute the MPC operation. Each MPC node is executed in an instance of a secure enclave. Each MPC node is established in the respective instance of the secure enclave based on a configuration file. The configuration file of a particular MPC node is combined from a plurality of parts, and the plurality of parts of the configuration file of the particular MPC node comprise: (1) an encryptor key file that is uniquely associated with the particular MPC node, (2) a node-specific configuration part, and (3) a common configuration part.
1 . A system comprising:
a client device comprising one or more processors and memory, the memory storing executable instructions, the instructions, when executed by the one or more processors, cause the one or more processors to generate a user interface that is configured to receive a user input related to a multi-party computation (MPC) operation; and
a plurality of MPC nodes configured to jointly execute the MPC operation, wherein each MPC node is executed in an instance of a secure enclave, each MPC node is established in the respective instance of the secure enclave based on a configuration file, the configuration file of a particular MPC node is combined from a plurality of parts, and the plurality of parts of the configuration file of the particular MPC node comprise:
(1) an encryptor key file that is uniquely associated with the particular MPC node,
(2) a node-specific configuration part that includes one or more parameters unique to the particular MPC node, and
(3) a common configuration part that is shared among the plurality of MPC nodes and includes one or more unencrypted parameters defining shared MPC operation parameters.
2 . The system of claim 1 , wherein the encryptor key file is capable of decrypting an MPC key shard corresponding to the particular MPC node, and each MPC node is associated with a different MPC key shard.
3 . The system of claim 1 , wherein the encryptor key file is encrypted and is protected by an attestation process of the instance of the secure enclave executing the particular MPC node.
4 . The system of claim 1 , wherein each MPC node is in communication with a respective attestation node that is configured to store the encryptor key file and a data key that is used to encrypt the encryptor key file.
5 . The system of claim 1 , wherein the encryptor key file is a symmetric key that is used to encrypt and decrypt a key shard of a private cryptographic key.
6 . The system of claim 1 , wherein the encryptor key file is backed up using a Shamir split.
7 . The system of claim 1 , wherein the node-specific configuration part of each configuration file of each MPC node is different from that of another MPC node.
8 . The system of claim 1 , wherein the node-specific configuration part comprises an MPC node private key that is used in secure communications among the plurality of MPC nodes.
9 . The system of claim 1 , wherein at least a parameter in the common configuration part is stored unencrypted.
10 . The system of claim 1 , wherein each MPC node of the plurality of MPC nodes is administered by a different administrator of an enterprise.
11 . The system of claim 1 , wherein the respective instance of the secure enclave is associated with a non-persistent memory, and the plurality of parts of the configuration file of the particular MPC node are injected into the secure enclave to establish an execution environment of the particular MPC node.
12 . The system of claim 1 , wherein the interface is a blockchain wallet interface, and the MPC operation is a signature creation process of a blockchain operation.
13 . A computer-implemented method, comprising:
receiving, via a user interface, a user input related to a multi-party computation (MPC) operation;
encrypting an encryptor key file that is uniquely associated with a particular MPC node of a plurality of MPC nodes that collectively carry out the MPC operation;
separating a configuration file of the particular MPC node to a node-specific configuration part and a common configuration part, wherein the node-specific configuration part includes one or more parameters unique to the particular MPC node, and the common configuration part is shared among the plurality of MPC nodes and includes one or more unencrypted parameters defining shared MPC operation parameters; and
deploying the particular MPC node in an MPC system that include a plurality of MPC nodes configured to jointly execute the MPC operation, wherein each MPC node is executed in an instance of a secure enclave, the MPC node is established in the respective instance of the secure enclave based on the configuration file that include the encryptor key file, the node-specific configuration part, and the common configuration part.
14 . The computer-implemented method of claim 13 , wherein the encryptor key file is capable of decrypting an MPC key shard corresponding to the particular MPC node, and each MPC node is associated with a different MPC key shard.
15 . The computer-implemented method of claim 13 , wherein the encryptor key file is encrypted and is protected by an attestation process of the instance of the secure enclave executing the particular MPC node.
16 . The computer-implemented method of claim 13 , wherein each MPC node is in communication with a respective attestation node that is configured to store the encryptor key file and a data key that is used to encrypt the encryptor key file.
17 . The computer-implemented method of claim 13 , wherein the encryptor key file is a symmetric key that is used to encrypt and decrypt a key shard of a private cryptographic key.
18 . The computer-implemented method of claim 13 , wherein the encryptor key file is backed up using a Shamir split.
19 . The computer-implemented method of claim 13 , wherein the node-specific configuration part of each configuration file of each MPC node is different from that of another MPC node.
20 . The computer-implemented method of claim 13 , wherein the node-specific configuration part comprises an MPC node private key that is used in secure communications among the plurality of MPC nodes.