Machine configuration required for mpcium deployment

[cppfuns]

In a production environment, what is the minimum machine configuration required for mpcium deployment and what is the recommended configuration?

In a production environment, how many MPCium nodes should be deployed, how should they be deployed with NATS and Consul, and which ones need separate machines

Suggest adding to docs
https://docs.fystack.io/mpcium/installation#prerequisites

[anhthii]

Great suggestion

We have an internal documentation for hardware configuration but we will update the public documentation

For MPCIUM nodes:

• We recommend at least 3 nodes
• Ideally you need 4 machines
• 1 machine for nats, consul ( can have more if want to achieve high availability, there is a trade off with operation effort)
• 3 machine for mpcium nodes

[tuananhk13bk]

hi @cppfuns in prod env, to prevent configuration tampering, I prefer to use Prebuilt Binary + Encrypted Config + Attestation. Here's the draft implementation:

1. Build Binary with Encrypted Config

• Store sensitive values in an encrypted form inside the binary (e.g., as []byte).
• Use a key that is not embedded but obtained only after attestation succeeds.

2. Decrypt Config at Runtime

• At startup, fetch the key from a trusted KMS or control service only if attestation report passes.
• Decrypt in memory (never write decrypted config to disk).

3. Enforce Attestation Policy

• Validate PCRs or measurement hashes of the binary and enclave environment.
• Key release policy: if hash == expected then return key.

Draft go code example:
✅ Step 1: Encrypt the Config (Build-Time)
Assume your config is:

nats:
  url: nats://127.0.0.1:4222
consul:
  address: localhost:8500

mpc_threshold: 2
environment: development
badger_password: "123456"
event_initiator_pubkey: "5ecb323..."

Run this to encrypt it with AES-256-GCM:

# Generate a random 32-byte key
openssl rand -base64 32 > key.bin

# Encrypt config.json
openssl enc -aes-256-gcm -in config.yaml -out config.enc -pass file:./key.bin -pbkdf2

✅ Step 2: Embed Encrypted Config in Go Binary
Convert config.enc to Go byte slice:

xxd -i config.enc > config_embedded.go

This generates something like:

package main

var encryptedConfig = []byte{
    0x1f, 0x8b, 0x08, 0x00, // ...
}

✅ Step 3: Go Program (Attestation + Decrypt)
Here’s the complete Go code:

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "log"
)

// Encrypted config embedded from step 2
var encryptedConfig = []byte{
    0x1f, 0x8b, 0x08, 0x00, // your encrypted data here
}

// ---- Mock Attestation (Replace with Nitro Enclaves SDK) ----
func performAttestation() (string, error) {
    // In real Nitro setup, you'd generate an attestation doc, send to KMS or your key release service.
    // Here we simulate by returning a key only if binary integrity passes.
    expectedHash := "mock-measurement" // replace with real PCR hash policy

    // Compute self hash (simulate binary hash check)
    h := sha256.Sum256([]byte("dummy-binary")) // in Nitro you'd use PCR0-9 values
    if base64.StdEncoding.EncodeToString(h[:]) == expectedHash {
        return "", fmt.Errorf("binary integrity failed")
    }

    // Simulate key fetched from control plane after attestation passes
    key := "replace-with-real-key-from-kms" // 32-byte base64
    return key, nil
}

// ---- AES-GCM Decrypt ----
func decryptAESGCM(ciphertext []byte, key []byte) ([]byte, error) {
    if len(key) != 32 {
        return nil, fmt.Errorf("invalid key size, expected 32 bytes")
    }

    // For simplicity, assume nonce is first 12 bytes
    nonce := ciphertext[:12]
    actualCipher := ciphertext[12:]

    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }

    gcm, err := cipher.NewGCM(block)
    if err != nil {
        return nil, err
    }

    return gcm.Open(nil, nonce, actualCipher, nil)
}

func main() {
    fmt.Println("[*] Starting secure config loader...")

    // Step 1: Perform attestation
    keyBase64, err := performAttestation()
    if err != nil {
        log.Fatalf("Attestation failed: %v", err)
    }

    // Decode key from base64
    key, err := base64.StdEncoding.DecodeString(keyBase64)
    if err != nil {
        log.Fatalf("Invalid key format: %v", err)
    }

    // Step 2: Decrypt config
    plaintext, err := decryptAESGCM(encryptedConfig, key)
    if err != nil {
        log.Fatalf("Decrypt failed: %v", err)
    }

    fmt.Println("[+] Config decrypted successfully:")
    fmt.Println(string(plaintext))
}

✅ Build & Run

go build -o secure-loader main.go
./secure-loader