Skip to main content

Overview

This cookbook deploys Silent Shard Trio on AWS Nitro Enclaves: two cloud nodes whose keyshares never leave a hardware-isolated enclave, plus an Auth Service that gates every MPC request. You then create a (2,3) wallet from the React Native sample app and sign with it.

If you are new to Trio, read Key Concepts first. It covers MPC, the party setups, and what distributed key generation and signing mean. This cookbook assumes that and only covers what is specific to running Trio inside a TEE.

What you will build

  • Two EC2 instances, each running a Nitro enclave with a Trio cloud node inside. Node 1 also runs the Auth Service; node 2 is a backup that participates in key generation and recovery only.
  • A KMS key whose policy grants decryption only to an enclave that presents a valid attestation document, so keyshares can be stored encrypted in S3 and read back only by the enclave.
  • A (2,3) wallet: one keyshare on the phone, one in each cloud node.

Prerequisites

  • An AWS account with billing enabled, and permission to create EC2, KMS, S3, IAM and Secrets Manager resources
  • An Android phone or emulator, to install the sample app
  • Comfort with a terminal and a text editor

For the purpose of this cookbook the enclave runs in debug mode, which allows serial console access. In debug mode the attestation document reports all-zero values for some measurements, so it is not a production configuration.

If you want to understand the AWS side more deeply:

Upcoming improvements

The AWS deployment is under active development, and its architecture will continue to evolve. Work already planned includes:

  • Service isolation. Running the MPC node and the Auth Service in separate enclaves, so each is measured and attested independently.
  • Horizontal scaling. Running several instances behind a load balancer, rather than one instance per cloud node.
  • Mutual node attestation. Each cloud node verifying its peer's attestation document before taking part in a protocol round.