MPC Integration

Use this page to understand how private client inputs move through Stoffel: input collection, secret sharing, VM execution, openings, and client-output delivery. If you are deciding which backend to use, start with MPC Backends. If you already chose a backend and need config or runtime details, use How Backend Selection Works.

Networked MPC runtime diagram separating the application boundary, coordinator control plane, and symbolic MPC party mesh, with party-local preprocessing and client-side output reconstruction.

Protocol architecture

StoffelLang program
    │
    ▼
Compiled bytecode manifest
    │
    ├── backend: HoneyBadgerMPC | AVSS
    ├── curve/field metadata
    ├── client input/output schema
    └── preprocessing demand
        │
        ▼
VM + selected MPC backend

Current backend support

Backend	Purpose	Developer selector
HoneyBadgerMPC	Default asynchronous/robust backend for field-compatible secret application values.	`honeybadger` / `MpcBackend::HoneyBadger`
AVSS	AVSS backend for verifiable scalar shares, public commitments, and curve-compatible outputs.	`avss`, `avss:<curve>` / `MpcBackend::Avss { curve }`

Both backends use the same high-level Stoffel application model, but they are not interchangeable at the cryptographic layer. HoneyBadgerMPC is field-arithmetic oriented. AVSS is group/scalar oriented and is the backend to use when the output boundary needs public commitments, curve-encoded values, or scalar responses that match an external verifier.

Integration points

Stoffel VM

Secret register operations map to backend share operations.
Clear-to-secret transitions create backend share data.
Reveal/open operations reconstruct values through the selected backend.
Share.random, Share.open, Share.get_commitment, and Mpc.* builtins route through backend capabilities.

CLI and bytecode

Stoffel.toml stores [mpc] backend, optional curve, parties, and threshold.
CLI flags such as --backend, --field, --parties, and --threshold override project settings.
.stflb bytecode records backend and curve/field metadata so execution can validate the runtime configuration.

Rust SDK

MpcConfig::builder() configures parties, threshold, instance ID, and backend.
Program builders accept .backend(...) and .curve(...).
NetworkDeployment and off-chain client configs carry backend selection into generated network/client TOML.

Security model

Each backend has its own threat model and assumptions. Do not treat “MPC backend” as a single security claim.

Backend	Security posture	Deployment topology
HoneyBadgerMPC	Static active-adversary model, with online guarantees conditional on valid, fresh preprocessing. Asynchronous safety does not guarantee completion against every allowed fault.	Full deployments require `n >= 4t+1`; the stronger requirement comes from preprocessing.
AVSS	Feldman checks reject shares inconsistent with a public commitment. End-to-end multiplication inherits the static passive preprocessing limitation unless triples receive an independent product-relation check.	`n >= 3t+1` in preprocessing and online execution.

Here, n counts computing parties and t is the maximum corrupted-party count. Input and output clients are not included in n. With t=1, use five parties for HoneyBadgerMPC or four for AVSS:

HoneyBadgerMPC: parties >= 4 * threshold + 1
AVSS:           parties >= 3 * threshold + 1

See Security and fault model for phase-specific node counts, preprocessing assumptions, corruption timing, and conditional liveness.

Data protection flow

Inputs become secret shares through ClientStore or direct secret-value paths.
Computation proceeds over backend share data.
Intermediate secret values remain secret unless the program opens/reveals them.
Outputs are returned, opened, or sent to client slots only where the program explicitly does so.

Performance considerations

Operation shape	Notes
Local share arithmetic	Addition, subtraction, and scalar operations are usually cheap.
Secret multiplication	Requires backend protocol work and preprocessing.
Opening/reveal	Requires reconstruction from enough parties.
Comparisons and bit-heavy logic	More expensive than field arithmetic because they lower into additional share operations.
Curve/commitment workflows	Use AVSS when the output boundary needs public commitments, curve-encoded values, or opened scalar responses.

Introduction

Getting Started

Tutorials

The Stoffel CLI

MPC Backends

Deployment

StoffelLang

Stoffel VM

Architecture

Protocol architecture

Current backend support

Integration points

Stoffel VM

CLI and bytecode

Rust SDK

Security model

Data protection flow

Performance considerations

See also

​Protocol architecture

​Current backend support

​Integration points

​Stoffel VM

​CLI and bytecode

​Rust SDK

​Security model

​Data protection flow

​Performance considerations

​See also

Protocol architecture

Current backend support

Integration points

Stoffel VM

CLI and bytecode

Rust SDK

Security model

Data protection flow

Performance considerations

See also