Secure multi-party computation vs Multisignature
Recently, we have declared Multi-party computation (MPC) as the technology, which fits our principles to build a keyless, convenient and flexible security solutions, and briefly explored how it works.
In short: the private key is replaced with a set of secrets distributed between user’s gadgets or devices stored on behalf of chosen institutions or people. Each party independently generates, stores and processes its secret separated from other parties.
It is a similar concept with multisig, but these are two different technologies. Let’s take a close look at the differences between them.
Compatibility
Multisig works with the limited number of blockchains, while MPC is a blockchain agnostic technology — it works with any ledger from the box as the support comes on the cryptography level.
As crypto industry moves towards mass adoption, users need to have blockchain addresses of their coins compatible with future services. But multisig already fails to support dApps and DeFi services — it doesn’t work with them, since it is implemented as a smart-contract (if we talk about Ethereum). By contrast, MPC provides users with a simple address that can be used in any decentralized service or application and works with them perfectly.
There is a misconception, that MPC has a lack of hardware security module (HSM) support. Сontrariwise — MPC is a technology that can be deployed on mobile, desktop or server device with authorization policies being changed with ease, as it is completely software solution. HSM operators will have only blockchain addresses and infrastructure changes won’t affect them. On the other side, multisig can cause problems to HSMs because it doesn’t support blockchains — only cryptographic curves like secp256k1 (Bitcoin) or edwards25519 (Monero). It means that changes in the code of a blockchain in case of a hard fork or some other reason can lead to issues which can take months to resolve or need an employment of a new hardware.
Another misconception: MPC is a proprietary technology that is not well tested and relies on peer review. There are MPC solutions that are open source because such an approach can help technology to evolve, expand and provide benefits to every party on the market.
Speed
Multisig transactions are signed on-chain and there is a need in confirmations that can take a long time. The MPC transactions are signed off-chain with confirmation comes afterward. As confirmations are performed simultaneously sometimes the speed can be low, but in general off-chain approach of MPC can give the market speed that it requires.
Moreover, when parties are participating in a quorum, multisig scripts entail more data to accommodate metadata about each signer. At that, the time to process a new block and the final cost for the end-user increase.
With MPC, as parties are processing their secrets independently, their devices can stay online 24/7, and not think about the possibility of being compromised. Secrets participate in the transaction signing anonymously, and lack of data helps to keep transaction time short and costs less.
Privacy
If the multisig participant shares his address on the internet or to someone, all transactions with that address can be traced and related to him (if they take place on the public blockchain). MPC secrets, used in the transaction signing, can be seen by participants, but the secret owner can’t be identified. The process works as follows:
- Party receives a notification about a transaction;
- Goes through the multi-factor authentication;
- Takes a close look on the transaction;
- Confirms or declines it.
It can be noted, that with MPC secrets, it is impossible to distinguish which one of them was used to sign the transaction: at the end of the computation they all look the same. From that perspective this tech can have a hard way getting to a corporate segment, where it is important to know which party signed a transaction. But overall, anonymity is one of the technology’s benefits.
Especially when it comes to the fact that MPC secrets leave no trace on the ledger. This tech can be used externally on any blockchains — even built without multisig capabilities initially. MPC could be taken as an additional privacy measure for anonymity-oriented blockchains like Monero.
Flexibility
Any changes in the multisig addresses involve changes in the code. For businesses, this can mean dependence on third-party IT service for daily operations and sufficient time and money expenditures.
Limited flexibility in supporting advanced quorum authorization policies (more than 2-of-3) is also a problem for multisig. This can be an easy target for a hacker (or a group of hackers). Institutions like banks cherish the security of their customers and require more complex quorums. Also, they do that to meet compliance requirements.
It is hard to change approval rules in the multisig, as it can involve a lot of man-hours to develop such a solution and even more to deploy it. Also, factors based on transaction amount, geolocation, etc. are not available. Customized application-based code can help the vendor to mitigate these problems — but such a solution is exposed to various attacks as it is much less secure than cryptographic mechanisms.
In the MPC the number of parties for a quorum is unlimited and can implement any rules to sign a transaction: the amount of money, type of payment, geolocation, time of day, etc.
K.O.
MPC has clear advantages over the multisig and can replace the latter shortly due to resulting benefits for all participants on the market.
In the next article, we will continue to cover our principles of building future-ready security systems and will talk about the second of them — biometry.
Stay tuned.
#spatium_vision
Spatium develops solutions to store and manage digital assets powered by SMPC and biometry. In our technology, the private key is replaced with the encrypted set of secrets, stored on behalf of funds owner’s devices, individuals and institutions, chosen by him. Even if some of the parties are compromised — funds will stay safe. Such an approach dramatically decreases the risk of theft and provides a previously unavailable level of flexibility and unique benefits for everyone on the market: no single point of failure, easy recovery, no need in backups, blockchain agnostic, access levels differentiation, instant crypto/crypto and crypto/fiat exchange, fully compliant solution, support of dApps and DeFi services, etc.
