Protecting Application Private Keys Using MPC Techniques
In response to a key generation request from a client application, a security controller generates a cryptographic key pair and splits the private key portion into a first fragment and a second fragment. The first fragment, but not the second fragment, is encrypted using a symmetric wrapping key that is accessible to the security controller but not the client application. A key package with the encrypted first fragment is returned to the client application. When the client application needs to digitally sign a data value with the split private key, the client application generates a first partial Multiparty Computation (MPC) signature using the second fragment. The security controller generates a second partial MPC signature with the first fragment, which has been decrypted using the symmetric wrapping key. The first and second partial MPC signatures are combinable to digitally sign the data value.
1 . A method, comprising:
in response to a key generation request from a client application, generating, by a security controller executing on at least a first node of a computer system, a split private key for the client application that includes a first fragment and a second fragment, the first fragment, but not the second fragment, being encrypted with a symmetric wrapping key that is accessible to the security controller but is not accessible to the client application; and
distributing, by the security controller, the split private key to the client application; and
wherein the security controller and the client application are executable to perform a first Multiparty Computation (MPC) cryptographic operation that permits the client application to use the split private key to digitally sign a data value without having access to the symmetric wrapping key.
2 . The method of claim 1 , wherein the security controller is executing on the first node and a second node of the computer system that communicates with the client application over a computer network, and wherein the symmetric wrapping key is accessible by the first node, and wherein the first MPC cryptographic operation is performed jointly by the first node and the client application.
3 . The method of claim 2 , wherein distributing the split private key to the client application includes generating a key package that includes the first fragment, the key package being signed with a digital signature by the security controller, the digital signature being produced using a signing private key and the digital signature being verifiable using a corresponding signing public key.
4 . The method of claim 3 , wherein the first and second nodes have corresponding fragments of a signing private key, and wherein in response to the key generation request, the first and second nodes are executable to perform a second MPC cryptographic operation to produce the digital signature for the key package.
5 . The method of claim 3 , wherein the key package includes a certificate for the client application and is signed by the security controller using a certificate authority private key, the certificate including a public key generated by the security controller responsive to the key generation request.
6 . The method of claim 2 , wherein the security controller is a first of a plurality of security controller instances, wherein each security controller instance executes on a pair of nodes of the computer system, and wherein the method further comprises:
performing, by the first security controller instance, a key agreement protocol with a second of the plurality of security controller instances to generate a symmetric sharing key for encrypting the symmetric wrapping key for transmission from the first security controller instance to the second security controller instance to permit the second security controller instance to handle a subsequent key signature request from the client application.
7 . The method of claim 6 , wherein generating the symmetric sharing key includes the first security controller instance:
generating a key agreement key pair;
splitting a private key of the key agreement key pair between the first and second nodes;
sending a public key of the key agreement key pair to the second security controller instance; and
using the split private key of the key agreement key pair and a public key of the second security controller instance to perform a third MPC cryptographic operation using the first and second nodes to generate the symmetric sharing key.
8 . The method of claim 6 , further comprising generating the symmetric sharing key in response to provisioning a new security controller instance.
9 . The method of claim 2 , further comprising:
receiving, by the client application, a challenge to digitally sign a data value with the split private key;
in response to the challenge:
sending, by the client application to the security controller, a key signature request, the key signature request including the first fragment and the data value;
generating, by the client application, a first partial MPC signature using the second fragment;
in response to the key signature request:
decrypting, by the security controller, the first fragment using the symmetric wrapping key; and
generating, by the security controller, a second partial MPC signature using the decrypted first fragment; and
wherein the first and second partial MPC signatures are combinable to generate a final MPC signature for the data value.
10 . A non-transitory, computer-readable storage medium storing program instructions that are capable of being executed on a computer system to implement a security controller that performs operations including:
in response to a key generation request from a client application:
generating a key pair for the client application that includes a public key and a private key;
splitting the private key into a first fragment and a second fragment;
encrypting the first fragment, but not the second fragment, using a symmetric wrapping key that is not accessible to the client application;
distributing the encrypted first fragment and the second fragment to the client application in response to the key generation request;
receiving a key signature request from the client application to use the private key to digitally sign a data value, the key signature request including the encrypted first fragment and the data value;
in response to the key signature request:
decrypting the first fragment using the symmetric wrapping key; and
using the decrypted first fragment to generate a partial Multiparty Computation (MPC) signature of the data value that is combinable with another partial MPC signature of the data value generated by the client application using the second fragment to generate a final MPC signature with which to digitally sign the data value.
11 . The computer-readable storage medium of claim 10 , wherein the program instructions of the security controller are capable of being executed on a first node and a second node of the computer system, and wherein the operations performed in response to the key generation request further include:
generating a key package that includes the first fragment; and
digitally signing the key package by performing an MPC cryptographic operations using a signing private key that is split into fragments stored at the first and second nodes.
12 . The computer-readable storage medium of claim 11 , wherein the key package further includes a certificate for the client application that is signed by the security controller, the certificate including a public key generated by the security controller responsive to the key generation request.
13 . The computer-readable storage medium of claim 10 , wherein the security controller is a first of a plurality of security controller instances, and wherein the operations further include the first security controller instance:
performing a key agreement protocol with a second of the security controller instances to generate a symmetric sharing key for encrypting the symmetric wrapping key for transmission from the first security controller instance to the second security controller instance to permit the second security controller instance to handle a subsequent key signature request from the client application.
14 . The computer-readable storage medium of claim 13 , wherein the program instructions of the security controller are capable of being executed on a first node and a second node, and wherein the operations further include the first security controller instance generating the symmetric sharing key by:
generating a key agreement key pair;
splitting a private key of the key agreement key pair between the first and second nodes;
sending a public key of the key agreement key pair to the second security controller instance; and
using the split private key of the key agreement key pair and a public key of the second security controller instance to perform a MPC cryptographic operation with the first and second nodes to generate the symmetric sharing key.
15 . A system, comprising:
a computer system that includes a plurality of nodes;
memory storing program instructions executable on the computer system to implement:
a client application executable to issue a request to generate a cryptographic key pair for the client application; and
a security controller on at least a first of the plurality of nodes, wherein the security controller is executable to:
generate, in response to the request, a split private key for the client application that includes 1) a first fragment that is encrypted with a symmetric wrapping key accessible to the security controller but not to the client application, and 2) a second fragment that is not encrypted by the symmetric wrapping key; and
distribute the split private key to the client application; and
wherein the client application and the security controller are executable to sign a digital data value with the split private key by performing a first Multiparty Computation (MPC) cryptographic operation.
16 . The system of claim 15 , wherein the security controller is implemented on the first node and a second node that are separate from a node on which the client application is implemented, and wherein the first and second nodes have corresponding fragments of a signing private key, and wherein, in response to the request, the security controller is executable to:
send the encrypted first fragment to the client application within a key package that is digitally signed by a second MPC cryptographic operation performed by the first and second nodes to produce a digital signature for the key package, the digital signature being verifiable using a corresponding signing public key.
17 . The system of claim 15 , wherein the security controller includes a plurality of security controller instances, each executable on a pair of nodes of the computer system, wherein a first of the plurality of security controller instances is executable to perform a key agreement protocol with a second of the plurality of security controller instances to generate a symmetric sharing key for passing the symmetric wrapping key from the first security controller instance to the second security controller instance to permit the second security controller instance to handle a key signature request from the client application.
18 . The system of claim 17 , wherein, to generate the symmetric sharing key, the first security controller instance is executable to:
generate a key agreement key pair;
split a private key of the key agreement key pair between the first and second nodes;
send a public key of the key agreement key pair to the second security controller instance; and
use the split private key of the key agreement key pair and a public key of the second security controller instance to perform a third MPC cryptographic operation to generate the symmetric sharing key.
19 . The system of claim 15 , wherein, to perform the first MPC cryptographic operation, the client application is executable to generate a first partial MPC signature using the second fragment, and the second node of the security controller is executable to generate a second partial MPC signature using the first fragment; and
wherein the first and second partial MPC signatures are combinable to generate a final MPC signature for the digital data value.
20 . The system of claim 19 , wherein the security controller is executable to generate the second partial MPC signature in response to a key signature request from the client application that includes the first fragment.