MPC Backends

Stoffel separates application code from the MPC protocol used to run it. The selected backend determines how secret values are shared, computed over, and reconstructed across MPC parties. Stoffel currently supports two MPC backend families:

Backend	Selector	Use when	Main design lens
HoneyBadgerMPC	`honeybadger`	Your program is mostly private field arithmetic over application values.	Circuit shape: multiplication count, multiplication depth, type choices, reveals, and preprocessing capacity.
AVSS	`avss` or `avss:<curve>`	Your program needs committed scalar shares, public commitments, curve-compatible outputs, or threshold-cryptography building blocks.	Protocol transcript: curve selection, commitments, transcript-to-field boundaries, openings, and verifier-facing artifacts.

The backend choice determines which share representation, curve/field, preprocessing, and client I/O path Stoffel records in the bytecode manifest. Security and completion guarantees differ between preprocessing and online execution. See Security and fault model before treating the configured threshold as an end-to-end Byzantine-security guarantee.

mpc-protocols has received an external audit from Zellic. Audit scope matters: validate the specific protocol version, integration code, deployment configuration, and threat model you rely on. Other Stoffel components have also had AI-assisted security review, including tools such as veria.dev. Treat audit and review coverage as component-scoped when evaluating a deployment.

Choose by workload shape

Start from the shape of the secret work, not the name of the application.

Backend-selection diagram comparing HoneyBadgerMPC and AVSS by representation, preprocessing, application boundary, and deployment topology.

This comparison is about the application boundary as well as protocol internals. HoneyBadgerMPC accepts general field-compatible values. AVSS exposes a scalar-and-curve-oriented boundary in which commitments and group encodings may be public protocol artifacts.

Security and cost reference

Topology depends on the backend: HoneyBadgerMPC requires n >= 4t+1, while AVSS requires n >= 3t+1. These constraints do not by themselves guarantee preprocessing availability, fairness, or output delivery under arbitrary delays. Use the backend-specific parameter table and security matrix, protocol costs, and paper map to evaluate your deployment. Select AVSS with a specific curve:

[mpc]
backend = "avss:secp256k1"
parties = 5
threshold = 1

You can also keep backend = "avss" and set the curve separately:

[mpc]
backend = "avss"
curve = "p-256"
parties = 5
threshold = 1

Accepted curve names include bls12_381, bn254, curve25519, ed25519, secp256k1, and p-256.

Select a backend from the CLI

# Default field-MPC backend
stoffel build --backend honeybadger --parties 5 --threshold 1

# AVSS default curve
stoffel build --backend avss --parties 5 --threshold 1

# AVSS over an elliptic-curve scalar field
stoffel build --backend avss --field secp256k1 --parties 5 --threshold 1

# Equivalent selector form
stoffel build --backend avss:secp256k1 --parties 5 --threshold 1

stoffel check, stoffel compile, stoffel build, stoffel run, and stoffel dev accept the same backend/field overrides when they compile source or project settings.

Select a backend from Rust

use stoffel::prelude::*;

# fn example() -> stoffel::Result<()> {
let honeybadger = MpcConfig::builder()
    .parties(5)
    .threshold(1)
    .honeybadger()
    .build()?;

let avss = MpcConfig::builder()
    .parties(5)
    .threshold(1)
    .avss(Curve::Secp256k1)
    .build()?;
# Ok(())
# }

On program builders, use .backend(...) or .curve(...):

# use stoffel::prelude::*;
# async fn example() -> stoffel::Result<()> {
let result = Stoffel::load_file("target/debug/threshold-demo.stflb")?
    .parties(5)
    .threshold(1)
    .backend(MpcBackend::Avss { curve: Curve::Secp256k1 })
    .execute_local()
    .await?;
# Ok(())
# }

Generated manifests can carry the bytecode backend and curve into SDK builders, so app code does not need to duplicate backend literals by hand.

Topology constraints

Backend	Minimum topology	Reconstruction shape
HoneyBadgerMPC	`parties >= 4 * threshold + 1`; minimum five parties	Robust field openings normally start from `2 * threshold + 1` matching shares; error-correction and degree-`2t` preprocessing can require more.
AVSS	`parties >= 3 * threshold + 1`; minimum four parties	Feldman-verified scalar reconstruction requires `threshold + 1` consistent shares, while Byzantine protocol progress relies on the full topology.

With threshold one, this means five HoneyBadgerMPC parties or four AVSS parties. HoneyBadgerMPC needs the extra party because its preprocessing reconstructs degree-2t values while correcting up to t errors. AVSS verifies degree-t shares against public commitments and uses 3t+1 Byzantine quorum intersection. Its lower party count comes with public commitments and group-operation costs; it is not a drop-in replacement for private application arithmetic.

Introduction

Getting Started

Tutorials

The Stoffel CLI

Deployment

StoffelLang

Stoffel VM

Architecture

MPC Backends

Choose by workload shape

Security and cost reference

Select a backend from the CLI

Select a backend from Rust

Topology constraints

Further reading

​Choose by workload shape

​Security and cost reference

​Select a backend from the CLI

​Select a backend from Rust

​Topology constraints

​Further reading

Choose by workload shape

Security and cost reference

Select a backend from the CLI

Select a backend from Rust

Topology constraints

Further reading