Introducing Enclave MPC API

Portal’s core multi-party computation (MPC) cryptography provides secure key material management by distributing one share to user and one to a server. This enables our customers to build secure embedded wallets into their applications.

‍

MPC cryptography requires that both parties perform a series of computations and message exchanges to securely generate signatures. This code is run on the user’s device (via one of our React Native, iOS, Android, or Web SDKs) and our backend. This requires that our customers’ applications incorporate our SDK.

Now, with the Enclave MPC API, we can run the same MPC code that runs on a user’s device on a secure enclave, leveraging confidential compute to provide API access to the same MPC power without sacrificing security.

How does this work?

The Enclave MPC API runs in an AWS Nitro Enclave. Visit the AWS docs to learn more about how Nitro Enclaves work, but at a high level, they provide a trusted execution environment by leaning on private key burned into the CPU by the chip manufacturer. This key is used to encrypt memory and verify execution.

‍

Encrypted memory means that all of the data being processed on the enclave can’t be accessed by anything other than the running application. Portal employees can’t even read the data on there! Verified execution means that a user can cryptographically verify that their request was handled in a secure enclave. When a user sends an API request to the enclave, Portal returns a set of signed “measurements” that can be verified by the enclave’s public key to ensure that the request was processed on an AWS Nitro Enclave.

These enable the Enclave MPC API to act as an extension of the client trust. Key material created by running generate, backup, and recover is still stored on the user’s device. The key material is transmitted to the stateless Enclave MPC API for signing where no details about the key material are stored, logged, or leave the trusted execution environment.

What are the benefits?

You get the security of MPC with the simplicity of an API and the speed of server-side compute:

• Security: Two key shares managed by two parties.
• Simplicity: One endpoint to generate your wallet. One endpoint to sign a transaction.
• Speed: Beefy server-side compute that can complete signatures in less than a second.

‍

By moving the MPC compute to a server, you don’t need to rely on user devices, which can range in operating system, CPU, and age that lead to variable results. The Enclave MPC API provides consistent, quick computation.

Who does this help?

Everybody! Non-custodial or custodial. Backend treasury operations or client-side wallet applications. Read the Slingshot Finance case study on how they're using the Enclave MPC API for high-performance, cross-chain trading.

‍

Reach out today to learn how to incorporate the MPC API into your application!