Trusted Execution Environments Amplify MPC Security but Introduce New Risks
Researchers warn that while running Multi-Party Computation (MPC) within Trusted Execution Environments (TEEs) can enhance security, it also introduces novel risks like nonce reuse and private key disclosure if not implemented carefully.
The integration of Multi-Party Computation (MPC) protocols within Trusted Execution Environments (TEEs) presents a compelling strategy for bolstering the security of sensitive computations. MPC distributes trust across multiple independent parties, while TEEs leverage hardware-based security to protect code and data. This synergistic approach aims to create a more robust security posture than either technology could achieve alone. However, this powerful combination is not without its complexities and potential pitfalls, particularly when the underlying host system is untrusted.
One significant risk arises from the interaction between the TEE and the host. A malicious host could exploit vulnerabilities, such as a filesystem rollback mechanism, to revert the state of a TEE after a threshold signer has deleted a used pre-signature. This rollback could lead to a reuse of the signer's nonce share, ultimately resulting in the disclosure of their private key share. This scenario highlights a critical dependency: the security of the MPC protocol running within the TEE can be undermined by the very environment it is designed to protect if that environment is compromised.
To navigate these challenges, researchers emphasize that TEEs should be viewed as an additional layer of defense-in-depth, rather than a complete substitute for sound MPC protocol design. The inherent security guarantees of MPC, which rely on assumptions about participant behavior (ranging from semi-honest to malicious), must still be upheld. TEE attestation, while powerful, can elevate semi-honest protocols to provide malicious security guarantees, but only if the attestation process is robust and correctly implemented.
TEEs offer three core security guarantees: confidentiality, integrity, and attestation. Confidentiality ensures that data and code within the TEE are encrypted and inaccessible to the host system. Integrity protects against tampering, with the TEE designed to detect external modifications. Attestation allows remote parties to cryptographically verify the code running within the TEE, providing assurance about the computation's legitimacy without trusting the host.
The attestation mechanism is central to TEE security. It involves the TEE generating a signed 'quote' containing cryptographic measurements of its software, configuration, and hardware state. This quote is signed by the TEE's private key, which is provisioned during manufacturing and chained to a trusted root certificate. Verifying this quote requires checking the signature, the certificate chain, and crucially, comparing the measurements against known-good values, often stored in binary transparency logs.
However, the verification process is not standardized and can be vendor-specific, placing a significant burden on developers to understand and implement the necessary checks. Furthermore, the measurements themselves are merely hashes; they do not inherently indicate the correctness or maliciousness of the code. This necessitates reproducible builds to ensure consistent binaries and binary transparency logs to verify that the TEE is running legitimate, audited software, a step frequently overlooked in deployments.
The trust model clash occurs when the assumptions of MPC protocols meet the realities of TEE implementations. While TEEs aim to provide hardware-rooted trust, their security is ultimately dependent on the integrity of the attestation process and the underlying hardware. If the attestation process is flawed, or if the host system can interfere with the TEE's operations (e.g., through filesystem manipulation), the security guarantees can be compromised.
Best practices for deploying MPC within TEEs include treating the TEE as a defense-in-depth measure, implementing rigorous attestation processes, and binding these attestations to the specific identities of the MPC parties. This ensures that the TEE's assurances are tied to the correct participants and that the overall system relies on a layered security approach, mitigating risks associated with individual component failures or compromises.