Key ceremony in multi-party computation

1 . A system for performing a multi-party computation (MPC) operation, the system comprising:

an MPC node comprising memory and one or more processors, the MPC node executed in a secure enclave, the MPC node comprising executable instructions injected into the secure enclave to create an execution environment, wherein the executable instructions, when executed by the one or more processors of the secure enclave, cause the one or more processors to:

perform an attestation check on the execution environment that relies on a private cryptographic key shard to carry out an MPC operation, the attestation check comprises checking state information of the execution environment to attest that the secure enclave has not been tampered;

generate a result of the attestation check; and

cause the secure enclave to create a cryptographic signature on the result of the attestation check; and

an attestation node in communication with the secure enclave, the attestation node configured to:

verify the cryptographic signature on the result of the attestation check to determine that the secure enclave has not been tampered;

responsive to verifying that the secure enclave has not been tampered, cause a decryption of an encrypted private cryptographic key shard to generate a decrypted private cryptographic key shard, wherein the decrypted cryptographic key shard is used by the MPC node to perform the MPC operation.

2 . The system of claim 1 , wherein the executable instructions are part of a bootstrapping package to inject an operating system image into the secure enclave to create the execution environment.

3 . The system of claim 2 , wherein the bootstrapping package further cause the one or more processors of the secure enclave to fetch one or more configuration parameters for the MPC node to create the execution environment.

4 . The system of claim 1 , wherein the memory of the secure enclave is a non-persistent storage that erases the decrypted cryptographic key shard in the memory after the MPC node is terminated.

5 . The system of claim 1 , wherein the attestation check comprises:

generating a quote comprising the state information of the execution environment of the secure enclave; and

verifying that one or more register counter values in the quote match one or more expected values.

6 . The system of claim 1 , wherein the secure enclave is associated with a secure enclave private key, and the cryptographic signature is generated by the secure enclave signing the state information of the execution environment using the secure enclave private key.

7 . The system of claim 1 , wherein the attestation node is in communication with the secure enclave through a secure channel that is proof against man-in-the-middle attacks.

8 . The system of claim 1 , wherein the decryption of the encrypted private cryptographic key shard comprises:

decrypt, responsive to the cryptographic signature being verified, an encryptor key file;

use the encryptor key file to decrypt one or more configuration data for the MPC node; and

use the encryptor key file to decrypt the encrypted private cryptographic key shard.

9 . The system of claim 1 , wherein the encrypted private cryptographic key shard is stored in a persistent storage outside of the secure enclave, and the decryption of the encrypted private cryptographic key shard comprises:

fetching, by the attestation node, the encrypted private cryptographic key shard from the persistent storage;

decrypting the encrypted private cryptographic key shard;

encrypting a key shard using an enclave public key; and

transmitting the encrypted key shard to the secure enclave that decrypts the key shard using an enclave private key.

10 . The system of claim 1 , wherein the MPC node is a first MPC node, the secure enclave is a first secure enclave, and the decrypted cryptographic key shard is a first decrypted cryptographic key shard, wherein the system further comprises a second MPC node executed in a second secure enclave and the second MPC node is associated with a second decrypted cryptographic key shard different from the first decrypted cryptographic key shard, and wherein the first MPC node and the second node jointly perform the multi-party computation operation using respective decrypted cryptographic key shards.

11 . The system of claim 1 , wherein the cryptographic signature is time bound to a valid period and the attestation check is performed periodically.

12 . The system of claim 1 , wherein the decrypted private cryptographic key shard is a shard of a private cryptographic key that has a public cryptographic key, and the multi-party computation operation comprises a blockchain operation associated with a blockchain address corresponding to the public cryptographic key.

13 . A computer-implemented method, comprising:

injecting executable instructions associated with a multi-party computation (MPC) node into a secure enclave to create an execution environment of the MPC node in the secure enclave;

performing an attestation check on the execution environment that relies on a private cryptographic key shard to carry out an MPC operation, the attestation check comprises checking state information of the execution environment to attest that the secure enclave has not been tampered;

generating a result of the attestation check;

causing the secure enclave to create a cryptographic signature on the result of the attestation check;

verifying the cryptographic signature on the result of the attestation check to determine that the secure enclave has not been tampered; and

responsive to verifying that the secure enclave has not been tampered, causing a decryption of an encrypted private cryptographic key shard to generate a decrypted private cryptographic key shard, wherein the decrypted cryptographic key shard is used by the MPC node to perform an MPC operation.

14 . The computer-implemented method of claim 13 , wherein the executable instructions are part of a bootstrapping package to inject an operating system image into the secure enclave to create the execution environment.

15 . The computer-implemented method of claim 14 , wherein the bootstrapping package further causes the secure enclave to fetch one or more configuration parameters for the MPC node to create the execution environment.

16 . The computer-implemented method of claim 13 , wherein memory of the secure enclave is a non-persistent storage that erases the decrypted cryptographic key shard in the memory after the MPC node is terminated.

17 . The computer-implemented method of claim 13 , wherein the attestation check comprises:

generating a quote comprising the state information of the execution environment of the secure enclave; and

verifying that one or more register counter values in the quote match one or more expected values.

18 . The computer-implemented method of claim 13 , wherein the secure enclave is associated with a secure enclave private key, and the cryptographic signature is generated by the secure enclave signing the state information of the execution environment using the secure enclave private key.

19 . The computer-implemented method of claim 13 , wherein the attestation node is in communication with the secure enclave through a secure channel that is proof against man-in-the-middle attacks.

20 . The computer-implemented method of claim 13 , wherein the decryption of the encrypted private cryptographic key shard comprises:

decrypting, responsive to the cryptographic signature being verified, an encryptor key file;

using the encryptor key file to decrypt one or more configuration data for the MPC node; and

using the encryptor key file to decrypt the encrypted private cryptographic key shard.