Dynamic key management

1 . A method for data management, comprising:

receiving, from a user, at least one input comprising a selection of a set of security properties for a key associated with respective key shares, wherein the set of security properties includes at least a threshold quantity of key shares and an operational property different from the threshold quantity of key shares;

receiving, from a client, a request to sign a message using the respective key shares generated by a plurality of multi-party computation (MPC) nodes, wherein key shares are generated in accordance with an access structure and the access structure is configured based at least in part on a respective set of parameters for a respective MPC node of the plurality of MPC nodes, wherein the respective set of parameters corresponds to the set of security properties, and wherein a first set of parameters for a first MPC node of the plurality of MPC nodes includes the threshold quantity of key shares and a second set of parameters for a second MPC node of the plurality of MPC nodes includes the operational property;

transmitting, after receiving the request and to at least the first MPC node and the second MPC node of the plurality of MPC nodes, a request to execute a MPC signature function using the respective key shares, wherein the MPC signature function is defined by the access structure and is based at least in part on the first set of parameters and the second set of parameters;

maintaining data associated with execution of the MPC signature function by at least the first MPC node and the second MPC node of the plurality of MPC nodes using the respective key shares, wherein the data comprises a messaging queue corresponding to operations performed by the plurality of MPC nodes, a state machine associated with the MPC signature function, or both; and

transmitting, to the client and based at least in part on the data being indicative of satisfaction of the access structure, a result of execution of the MPC signature function by at least the first MPC node and the second MPC node of the plurality of MPC nodes.

2 . The method of claim 1 , further comprising:

generating, based at least in part on the set of security properties, the access structure; and

identifying, based at least in part on the set of security properties, at least the first MPC node and the second MPC node of the plurality of MPC nodes for generation of the respective key shares in accordance with the access structure.

3 . The method of claim 1 , further comprising:

transmitting, to a MPC node of the plurality of MPC nodes, a request to execute a MPC key generation function to generate one of the respective key shares of a private key, wherein the MPC key generation function is defined by the access structure and is based on the respective set of parameters associated with the MPC node.

4 . The method of claim 1 , wherein the operational property is indicative of a geographic location of the second MPC node, whether the second MPC node is fully automated, whether the second MPC node is operated via artificial intelligence (AI), whether the second MPC node is human-operated, whether the second MPC node is stored in a public cloud, whether the second MPC node is stored in a private datacenter, a datacenter type of the second MPC node, or any combination thereof.

5 . The method of claim 1 , further comprising:

receiving at least one second input that configures the access structure based at least in part on the respective set of parameters for the respective MPC node of the plurality of MPC nodes.

6 . The method of claim 1 , wherein:

the access structure includes an expression with a combination of a set of operators and a set of key shares, and

the expression defines the combination used to execute an MPC operation.

7 . The method of claim 6 , wherein the set of operators includes an AND operator, an OR operator, or a threshold operator defining the threshold quantity of key shares of a total quantity of key shares, or a combination thereof.

8 . The method of claim 1 , wherein transmitting the request to execute the MPC signature function comprises:

transmitting, to a first set of MPC nodes of the plurality of MPC nodes comprising the first MPC node, a request to perform an asynchronous approval in accordance with the access structure having a threshold operator that defines the threshold quantity of key shares of a total quantity of key shares generated by the first set of MPC nodes; and

transmitting, to at least one second MPC node of the plurality of MPC nodes and after the threshold quantity is satisfied by approvals by MPC nodes of the first set of MPC nodes, a request to execute the MPC signature function.

9 . The method of claim 1 , wherein the message is configured for broadcast via a blockchain network.

10 . An apparatus for data management, comprising:

at least one processor;

memory coupled with the at least one processor; and

instructions stored in the memory and executable by the at least one processor to cause the apparatus to:

receive, from a user, at least one input comprising a selection of a set of security properties for a key associated with respective key shares, wherein the set of security properties includes at least a threshold quantity of key shares and an operational property different from the threshold quantity of key shares;

receive, from a client, a request to sign a message using the respective key shares generated by a plurality of multi-party computation (MPC) nodes, wherein key shares are generated in accordance with an access structure and the access structure is configured based at least in part on a respective set of parameters for a respective MPC node of the plurality of MPC nodes, wherein the respective set of parameters corresponds to the set of security properties, and wherein a first set of parameters for a first MPC node of the plurality of MPC nodes includes the threshold quantity of key shares and a second set of parameters for a second MPC node of the plurality of MPC nodes includes the operational property;

transmit, after receiving the request and to at least the first MPC node and the second MPC node of the plurality of MPC nodes, a request to execute a MPC signature function using the respective key shares, wherein the MPC signature function is defined by the access structure and is based at least in part on the first set of parameters and the second set of parameters;

maintain data associated with execution of the MPC signature function by at least a subset of the plurality of MPC nodes using the respective key shares, wherein the data comprises a messaging queue corresponding to operations performed by the plurality of MPC nodes, a state machine associated with the MPC signature function, or both; and

transmit, to the client and based at least in part on the data being indicative of satisfaction of the access structure, a result of execution of the MPC signature function by at least the first MPC node and the second MPC node of the plurality of MPC nodes.

11 . The apparatus of claim 10 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

transmit, to a MPC node of the plurality of MPC nodes, a request to execute a MPC key generation function to generate the respective key shares of a private key, wherein the MPC key generation function is defined by the access structure and is based on the respective set of parameters associated with the MPC node.

12 . The apparatus of claim 10 , wherein the operational property is indicative of a geographic location of the second MPC node, whether the second MPC node is fully automated, whether the second MPC node is operated via artificial intelligence (AI), whether the second MPC node is human-operated, whether the second MPC node is stored in a public cloud, whether the second MPC node is stored in a private datacenter, a datacenter type of the second MPC node, or any combination thereof.

13 . The apparatus of claim 10 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

receive at least one second input that configures the access structure based at least in part on the respective set of parameters for the respective MPC node of the plurality of MPC nodes.

14 . The apparatus of claim 10 , wherein:

the access structure includes an expression with a combination of a set of operators and a set of key shares, and

the expression defines the combination used to execute an MPC operation.

15 . The apparatus of claim 14 , wherein the set of operators includes an AND operator, an OR operator, or a threshold operator defining the threshold quantity of key shares of a total quantity of key shares, or a combination thereof.

16 . The apparatus of claim 10 , wherein the instructions to transmit the request to execute a MPC signature function are executable by the at least one processor to cause the apparatus to:

transmit, to a first set of MPC nodes of the plurality of MPC nodes, a request to perform an asynchronous approval in accordance with the access structure having a threshold operator that defines the threshold quantity of key shares of a total quantity of key shares generated by the first set of MPC nodes; and

transmit, to at least one second MPC node of the plurality of MPC nodes and after the threshold quantity is satisfied by approvals by MPC nodes of the first set of MPC nodes, a request to execute the MPC signature function.

17 . The apparatus of claim 10 , wherein the message is configured for broadcast via a blockchain network.

18 . A non-transitory computer-readable medium storing code for data management, the code comprising instructions executable by at least one processor to:

receive, from a user, at least one input comprising a selection of a set of security properties for a key associated with respective key shares, wherein the set of security properties includes at least a threshold quantity of key shares and an operational property different from the threshold quantity of key shares;

receive, from a client, a request to sign a message using the respective key shares generated by a plurality of multi-party computation (MPC) nodes, wherein key shares are generated in accordance with an access structure and the access structure is configured based at least in part on a respective set of parameters for a respective MPC node of the plurality of MPC nodes, wherein the respective set of parameters corresponds to the set of security properties, and wherein a first set of parameters for a first MPC node of the plurality of MPC nodes includes the threshold quantity of key shares and a second set of parameters for a second MPC node of the plurality of MPC nodes includes the operational property;

transmit, after receiving the request and to at least the first MPC node and the second MPC node of the plurality of MPC nodes, a request to execute a MPC signature function using the respective key shares, wherein the MPC signature function is defined by the access structure and is based at least in part on the first set of parameters and the second set of parameters;

maintain data associated with execution of the MPC signature function by at least a subset of the plurality of MPC nodes using the respective key shares, wherein the data comprises a messaging queue corresponding to operations performed by the plurality of MPC nodes, a state machine associated with the MPC signature function, or both; and

transmit, to the client and based at least in part on the data being indicative of satisfaction of the access structure, a result of execution of the MPC signature function by at least the first MPC node and the second MPC node of the plurality of MPC nodes.