The Single Point of Failure Problem
Every key management scheme discussed so far has one thing in common: somewhere, at some point, a complete cryptographic key exists as a single object. In BYOK, it exists in your HSM and in the cloud HSM. In HYOK, it exists in your HSM. Even in a well-secured system, this creates a single point of compromise: steal the key, own the data. Lose the key, lose the data forever.
This is not a theoretical risk. In 2022, the Ronin Network (a blockchain bridge) lost $625 million because an attacker obtained enough private key material to authorize fraudulent transactions. The key existed as a single recoverable object.
What MPC Changes
Multi-Party Computation (MPC) is a branch of cryptography that allows multiple parties to jointly compute a function over their private inputs without any party revealing their input to the others. Applied to key management, it means: the private key is never constructed as a complete object, anywhere, at any time.
Instead of generating one key K, the MPC protocol generates N key shares (also called shards). Each share is a random-looking number that is mathematically useless on its own. Only when M of the N shares participate in a computation (an M-of-N threshold scheme) can a valid cryptographic operation be performed — and even then, the shares are never combined into a single key. The computation happens in a distributed fashion across the parties holding the shares.
A Concrete Example: 2-of-3 MPC Wallet
Consider a cryptocurrency custody platform. A client's Bitcoin private key is split into three shares:
- Share 1: Stored on the client's mobile device.
- Share 2: Stored on the custody platform's signing server.
- Share 3: Stored in an offline cold storage vault.
To sign a transaction ("Send 1 BTC to address X"):
- The client initiates the request from their phone (Share 1 participates).
- The signing server validates the request against fraud rules, then participates (Share 2 participates).
- The two parties execute an MPC signing protocol (specifically, a threshold ECDSA or Schnorr scheme). They exchange several rounds of encrypted messages.
- The result is a valid Bitcoin transaction signature — produced without either party ever holding the complete private key.
What an attacker must do to steal funds: Compromise the client's phone AND the signing server simultaneously, within the same signing session. Compromising only one yields a useless share.
What happens if the client loses their phone: The platform can recover the wallet by combining Share 2 (signing server) and Share 3 (cold storage vault) — the 2-of-3 threshold is still met.
MPC vs. Multi-Signature (Multisig)
These are often confused. Multisig is a blockchain-level feature: a transaction requires M of N separate private keys to sign it, and the blockchain enforces this rule. Each key is a complete, independent object. MPC is a cryptographic protocol: a single key is split into shares, and the signing happens off-chain. From the blockchain's perspective, an MPC-signed transaction looks identical to a single-key transaction. MPC is more flexible (works with any cryptographic scheme, not just blockchains that support multisig) and more private (the threshold structure is not visible on-chain).
A common interview question: "How does MPC differ from Shamir's Secret Sharing (SSS)?" Both split a secret into shares, but the critical difference is reconstruction. In SSS, the shares must be combined to reconstruct the full secret before use — meaning the complete key exists in memory at the moment of use, creating a window of vulnerability. In MPC, the computation is performed without reconstruction — the full key never exists anywhere. For custody and high-security applications, this distinction is the entire point.