MPC and the shape of key material

Graduate · enrolled learners

This lesson opens with TSSHOCK threshold-signature disclosures, 2024.

What happened

Multi-party computation custody splits a private key into shares held by different parties and has them compute a signature jointly, so the whole key is never assembled anywhere, not at generation, not at signing. It is the custody model of most large institutional custodians because it removes the single place a full key could sit. But the joint signing is a cryptographic protocol, and its security depends on that protocol being implemented correctly. In 2024 researchers at Verichains disclosed a set of vulnerabilities they called TSSHOCK in widely used threshold-signature libraries, implementations of the protocols that MPC wallets and custodians relied on, in which a malicious participant could exploit implementation flaws to recover the full private key from the honest parties' shares. No headline theft is attached; the disclosure is the lesson. MPC had removed the single stored key and replaced it with a promise that the joint-signing math was implemented soundly, and that promise, in several popular libraries, was not kept.

The decision point

MPC changes the shape of key material, and understanding custody means understanding where that change moves the risk rather than treating MPC as simply safer. In a single-key or multisig scheme, a full key or several full keys exist and can be stolen; MPC's advance is that no full key is ever assembled, so there is no single secret to steal at rest. That is a real gain. But it is not risk removed, it is risk relocated: the security now rests on the correctness of the cryptographic protocol that lets the shares sign without combining, and TSSHOCK showed that when that protocol is implemented wrongly, a malicious participant can reconstruct the very key MPC promised never existed. So the honest comparison is by where each model puts its trust. Multisig trusts several independent key holders and their key management. MPC trusts the soundness of a subtle cryptographic implementation. Neither is safe in the abstract; each is safe only where the thing it trusts actually holds, and an institution chooses knowing which trust it is taking on.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.