
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mpc-framework
Advanced tools
A framework that makes MPC easy in TypeScript.
Choose from multiple existing circuit generators and MPC engines, or create your own.
MPC stands for Multi-Party Computation. In regular computation, all inputs, outputs, and intermediate calculations are necessarily visible on the device performing the computation. MPC, by contrast, allows multiple devices to collaborate on a computation while keeping intermediate calculations and others' inputs private.
Here's some ways that can be useful:
For a bit more of an introduction to MPC, I recommend Barry Whitehat's talk 2PC is for Lovers. The lovers' app described in the talk has been implemented using mpc-framework here.
For a more technical introduction, see Computerphile's video on Garbled Circuits. For a deeper dive: Pragmatic MPC.
In addition to mpc-framework, you will need:
npm install mpc-framework
npm install summon-ts # circuit generator
npm install emp-wasm-engine # engine
The computation to be done inside MPC must be specified in the form of a circuit. This is a special simplified program in the form of a fixed tree specifying how to combine values together. Regular programs allow the CPU to branch into different code paths, and circuits can't do that. It's possible to write these circuits by hand (or using third party tools), but you might find it easier to use summon:
// This isn't exactly TypeScript, but it uses the same syntax and has enough in
// common that you can use the .ts extension and get useful intellisense
export default (io: Summon.IO) => {
// Alice provides a number called 'a'
const a = io.input('alice', 'a', summon.number());
// Bob provides a number called 'b'
const b = io.input('bob', 'b', summon.number());
let result;
// This seems like a branch that I just said is not allowed, but this is just
// an abstraction, and summon will compile it down to a fixed circuit. Loops
// are possible too. See the summon docs for more detail.
if (isLarger(a, b)) {
result = a;
} else {
result = b;
}
// Everyone gets an output called 'result'
io.outputPublic('result', result);
}
// We could inline this, but we're just demonstrating that summon supports
// modularity (multi-file works too and many other TS features).
function isLarger(a: number, b: number) {
return a > b;
}
import * as summon from 'summon-ts';
// ...
await summon.init();
const { circuit } = summon.compile({
// Specify the entry point, similar to the `main` field of package.json
path: 'circuit/main.ts',
// This is the bit width of numbers in your summon program. You can use any
// width you like, but all numbers in the program will be the same. You can
// achieve smaller bit widths within the program using masking (the unused
// gates will be optimized away). It's also possible to define classes for
// matrices/floats/etc.
boolifyWidth: 8,
// File tree to compile
files: {
'circuit/main.ts': `
// Include code from step 1
// This can be inlined or you can use build tools to just include a
// directory from your source tree
// (eg https://github.com/privacy-scaling-explorations/mpc-hello/tree/main/client-client)
`,
// Other files can be specified here
},
});
import { Protocol } from 'mpc-framework';
import { EmpWasmEngine } from 'emp-wasm-engine';
// ...
const protocol = new Protocol(circuit, new EmpWasmEngine());
function send(to: string, msg: Uint8Array) {
// implement sending a message to the specified party
}
const session = protocol.join('alice', { a: 3 }, send);
// This is just a hypothetical API for getting external messages
onMessageReceived((from: string, msg: Uint8Array) => {
// The important part is that you provide the messages to the session like
// this
session.handleMessage(from, msg);
});
// have another device (or tab) join as bob and provide { b: 5 }
console.log(await session.output()); // { main: 5 }
For clarity, a complete version of the example above is provided as mpc-hello.
| Name | Similar to | Related Repos |
|---|---|---|
summon-ts | TypeScript | summon, boolify, ValueScript |
circom-2-arithc-ts | Circom | circom-2-arithc, circom |
| Name | Description | Related Repos |
|---|---|---|
emp-wasm-engine | Secure MPC using authenticated garbling | emp-wasm, emp-ag2pc, emp-agmpc |
mpz-ts | Semi-honest 2PC | mpz |
FAQs
MPC framework supporting a variety of circuit generators and backends
We found that mpc-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.