Multi-party computation (MPC) overview

This guide provides a conceptual overview of Multi-Party Computation (MPC) integration with Ripple Custody. MPC is a distributed key management approach that eliminates single points of failure by distributing key shares across multiple nodes.

Multi-Party Computation (MPC) is a cryptographic protocol that enables multiple parties to jointly compute a function over their inputs while keeping those inputs private. In Ripple Custody, MPC is used for distributed key management where:

• No Single Point of Failure: Private keys are never reconstructed in a single location
• Distributed Key Shares: Each party holds only a share of the private key
• Threshold signatures: A minimum number of parties must collaborate to sign transactions.
• Enhanced security: An attacker must compromise multiple nodes to steal the key shares, and would still need access to Ripple's proprietary algorithm to reconstruct private keys.

Ripple Custody implements a 3-of-4 threshold signing scheme for transaction signing, with 4-of-4 consensus required for account creation:

MPC deployment follows a shared responsibility model:

• Ripple deploys and manages Nodes 0 and 1, plus the Relay Server and vault
• Customers deploy and manage Nodes 2 and 3 in their own infrastructure

The following diagram shows the MPC network topology.

Abbreviations:

• DKG – Distributed Key Generation: The process where all 4 nodes collaborate to generate key shares
• TSS – Threshold Signature Scheme: The protocol enabling 3-of-4 nodes to produce valid signatures

Each MPC node requires a Key Encryption Key (KEK) to encrypt its key share at rest. The KEK is an AES symmetric key stored securely that never leaves the node's secure environment.

When deploying customer nodes to AWS using the MPC Deployer tool:

• KEK is automatically generated during key generation (--keygen mode)
• KEK is stored in AWS Secrets Manager
• KEK is a 32-character hexadecimal string (256-bit AES key)
• Key shares are encrypted with the KEK before storage

Each MPC node uses a Communication Key for secure node-to-node communication:

• Type: Asymmetric key (ECDSA)
• Purpose: Each node signs its payload with its private key
• Verification: Other nodes verify payloads using known public keys (Peer IDs)

The Peer ID (public key) for each customer node is generated during the --keygen phase and must be shared with Ripple to configure the cluster.

MPC deployments include encrypted backup capabilities using verifiable encryption:

• Each node can generate encrypted backups of its key shares
• Backups are encrypted using a separate Backup Encryption Key
• Backups include zero-knowledge proofs for verification

1. Backup creation: Initiated through the Ripple Custody API via the v0_CreateBackup intent
2. Backup storage: Encrypted backup files are stored securely
3. Verification: The backup can be verified using zero-knowledge proofs without decryption
4. Restoration: Requires the backup encryption key and coordination with Ripple

For detailed backup procedures, including key generation scripts, backup verification, and exit strategy information, see MPC backups.

Customer MPC nodes (Node 2 and Node 3) are deployed using the MPC Deployer tool:

The MPC Deployer is a Docker-based tool that automates the deployment of customer MPC nodes (Node 2 and Node 3) to a specific cloud provider.

Customer node deployment is a two-step process:

1. Key material generation: Generate cryptographic keys for your nodes.
2. Node deployment: Deploy the infrastructure and MPC node software.

Before deploying customer nodes, ensure you have:

See the AWS deployment guide for detailed instructions.

1. Review Prerequisites for deployment
2. Contact Ripple to initiate MPC cluster setup.
3. Follow the AWS deployment guide
4. Review Production best practices for namespace segmentation, HA, and monitoring