MPC configuration

Use this page to understand the Multi-Party Computation (MPC) fields used by Vault configuration in Ripple Custody. The example shows one possible configuration shape; node endpoints, threshold policy, resource values, and network routing depend on your deployment.

For MPC deployment procedures, see MPC overview and MPC on AWS.

What this config controls

MPC provides distributed key management. In the documented MPC model:

Four MPC nodes hold key shares.
No single node has the complete key.
A 3-of-4 threshold is used for signing operations.
Nodes 0 and 1 are hosted by Ripple.
Nodes 2 and 3 are deployed by the customer.

The Vault connects to the MPC network through the Node 0 HTTP API.

Vault fields

Location: harmonize.vaults.<vault-id>

Parameter	Type	Required	Description
`platform`	string	Yes	Set to `kms_mpc`.
`notary_public_key`	string	Yes	Notary public key used for Vault/Notary communication.
`kms_mpc.url`	string	Yes	URL of MPC Node 0.
`kms_mpc.threshold`	integer	Yes	Minimum number of MPC nodes required to participate in signing.

KMS MPC URL

The kms_mpc.url field points the Vault at MPC Node 0.

Attribute	Value
Format	`http://<node-0-host>:<port>` or `https://<node-0-host>:<port>`
Common port	`8888`
Target node	Node 0

Configure the Vault to connect to MPC Node 0. Do not point Vault at Nodes 1, 2, or 3.

KMS MPC threshold

The threshold value sets how many MPC nodes must participate in a signing operation.

Threshold	Fault tolerance	Availability trade-off
`2` of 4	Two nodes can fail.	Lower participation requirement.
`3` of 4	One node can fail.	Documented threshold for the standard 4-node model.
`4` of 4	No nodes can fail.	Requires every node for signing.

Vault service fields

Location: vault

Field	Description
`env.VAULT_LOGLEVEL`	Vault logging level. Possible values shown in the draft reference: `debug`, `info`, `warn`, `error`.
`env.VAULT_ID`	Vault instance UUID. This matches the key in `harmonize.vaults`.
`resources.requests`	CPU and memory requests for Vault.
`resources.limits`	CPU and memory limits for Vault.

Platform and internal sidecar addresses are managed by the release package unless explicitly exposed.

Network relationship

The Vault must be able to reach MPC Node 0.

Direction	Source	Destination	Common port	Protocol
Outbound	Vault pod	MPC Node 0	`8888`	HTTP or HTTPS

If Node 0 is in another network, the required routing, firewall, VPN, peering, and TLS decisions are deployment-specific.

Example

This example shows a Vault configured to use MPC:

harmonize:
  vaults:
    "00000000-0000-0000-0000-000000000000":
      enabled: true
      platform: kms_mpc
      notary_public_key: "ed25519:<notary-public-key>"
      kms_mpc:
        url: "https://mpc-node-0.example.com:8888"
        threshold: 3

vault:
  env:
    VAULT_LOGLEVEL: "info"
    VAULT_ID: "00000000-0000-0000-0000-000000000000"
  resources:
    requests:
      cpu: 500m
      memory: 256Mi
    limits:
      cpu: 2000m
      memory: 512Mi