Multi-Party Computation

Multi-party computation, also called secure multi-party computation (MPC or SMPC), is a field of cryptography concerned with protocols that let a group of parties compute a function over their combined data while keeping each party's own input secret. Each participant learns the agreed output, such as a total, a comparison or a digital signature, and nothing more about the others' data than the output itself reveals.

The idea dates back to academic work in the early 1980s and moved into commercial use in the 2010s. In crypto, its best-known application is the MPC wallet, in which no single device ever holds a complete private key. MPC is also used in banking, advertising and healthcare to analyse sensitive data jointly without sharing it. It is one of several privacy-enhancing technologies.

Imagine three colleagues who want to know their average salary without anyone revealing their own pay. The first adds a large random number to her salary and passes the total to the second, who adds his salary and passes it on. The third adds hers and hands the result back to the first, who subtracts her secret random number. They now know the sum, and therefore the average, but nobody has seen anyone else's salary.

Real MPC protocols are far more sophisticated, but the principle is the same: split secrets into meaningless pieces, do the calculation on the pieces, and only put together the final answer. Even if one participant is dishonest or hacked, the others' secrets stay safe, up to a limit set by the protocol.

The computer scientist Andrew Yao introduced the field in 1982 with the "millionaires' problem", which asks how two people can find out who is richer without revealing their wealth. Later in the 1980s, researchers showed that any function could, in principle, be computed securely by several parties, even if some of them cheat. For decades these protocols were too slow for practical use. Improvements in algorithms and computing power changed that, and one of the first large real-world deployments came in 2008, when Danish sugar-beet farmers and their buyer used MPC to run a sealed-bid auction for production contracts without revealing individual bids.

MPC protocols combine several building blocks:

• Secret sharing. A secret is split into shares so that any single share, or any group smaller than a threshold, reveals nothing, while enough shares together can reconstruct it. Shamir's secret sharing, published in 1979, is a classic scheme.
• Garbled circuits. One party encrypts a computation as a scrambled circuit that another party can evaluate without learning the intermediate values.
• Homomorphic encryption. Some encryption schemes allow calculations on encrypted data, a technique taken furthest in fully homomorphic encryption.
• Oblivious transfer and commitments. Lower-level tools that let parties exchange information or commit to values without revealing more than intended.

Protocols differ in how many dishonest parties they can tolerate and in whether they assume participants follow the rules but are curious, or may actively cheat. Stronger guarantees usually cost more computation and communication.

• Key management and custody. Threshold signature schemes based on MPC let several devices or organisations jointly sign blockchain transactions without ever assembling the full private key. Exchanges and digital asset custodians use this to remove single points of failure, and it is offered commercially as MPC as a service.
• Comparison with multisig. A multi-sig wallet achieves shared control through the blockchain's own rules and shows several signatures on-chain, whereas MPC produces one ordinary signature off-chain, which works on any chain and keeps the arrangement private.
• Financial crime and analytics. Banks can, in principle, check whether customers appear on each other's lists or spot shared fraud patterns without exchanging raw customer data, supporting fraud detection while respecting privacy law.
• Private auctions and trading. Sealed bids and dark-pool style matching can be run without revealing orders to the operator.

MPC is complex to design and implement. Protocols require several rounds of communication between parties, which adds delay, and the mathematics leaves room for subtle errors. Researchers have disclosed serious flaws in widely used threshold-signature libraries, some of which could have allowed attackers to extract keys. MPC also does not protect against everything: if enough parties collude, or if the agreed output itself reveals sensitive information, privacy can be lost. Systems still need secure devices, such as a hardware security module, careful governance and independent audits. Compared with alternatives such as zero-knowledge proofs, which prove a statement without revealing data, or trusted hardware, MPC spreads trust across parties rather than relying on a single machine or mathematical proof.