feat(kms): add multi-instance MPC key provider

dstack/Cargo.toml

@@ -123,6 +123,7 @@ wavekv = "1.0.0"
 
 # Core dependencies
 anyhow = { version = "1.0.97", default-features = false }
+async-trait = "0.1.89"
 binrw = { version = "0.15.1", default-features = false, features = ["std"] }
 arc-swap = "1"
 errify = { version = "0.3.0", features = ["anyhow"] }
@@ -185,6 +186,8 @@ object = "0.36.4"
 fatfs = "0.3.6"
 fscommon = "0.1.1"
 ciborium = "0.2"
+cggmp21 = { version = "0.6.3", features = ["curve-secp256k1", "curve-secp256r1", "state-machine"] }
+round-based = { version = "0.4.1", features = ["state-machine"] }
 
 # Networking/HTTP
 bollard = "0.18.1"

dstack/dstack-util/src/system_setup.rs

@@ -2090,7 +2090,11 @@ impl<'a> Stage0<'a> {
             gateway_app_id: response.gateway_app_id,
             key_provider: KeyProvider::Kms {
                 url: kms_url,
-                pubkey: root_pubkey,
+                pubkey: if response.key_provider_id.is_empty() {
+                    root_pubkey
+                } else {
+                    response.key_provider_id
+                },
                 tmp_ca_key: tmp_ca.temp_ca_key,
                 tmp_ca_cert: tmp_ca.temp_ca_cert,
             },

dstack/kms/Cargo.toml

@@ -11,9 +11,11 @@ license.workspace = true
 
 [dependencies]
 anyhow.workspace = true
+async-trait.workspace = true
 chrono.workspace = true
 clap.workspace = true
 fs-err.workspace = true
+futures.workspace = true
 dstack-build-info.workspace = true
 hex.workspace = true
 hex_fmt.workspace = true
@@ -33,6 +35,7 @@ reqwest = { workspace = true, features = ["json"] }
 sha2.workspace = true
 sha3.workspace = true
 k256.workspace = true
+p256 = { workspace = true, features = ["hash2curve"] }
 rand.workspace = true
 dstack-guest-agent-rpc.workspace = true
 http-client = { workspace = true, features = ["prpc"] }
@@ -41,6 +44,7 @@ x509-parser = { workspace = true, features = ["verify"] }
 ring.workspace = true
 safe-write.workspace = true
 serde_json.workspace = true
+serde_jcs.workspace = true
 dstack-types.workspace = true
 tokio = { workspace = true, features = ["process"] }
 tempfile.workspace = true
@@ -49,9 +53,14 @@ dstack-verifier = { workspace = true, default-features = false }
 dstack-mr.workspace = true
 dstack-attest.workspace = true
 dstack-api-auth.workspace = true
+cggmp21.workspace = true
+round-based.workspace = true
 
 [dev-dependencies]
 cc-eventlog.workspace = true
+cggmp21 = { workspace = true, features = ["spof"] }
+round-based = { workspace = true, features = ["sim"] }
+key-share = { version = "0.6.1", features = ["spof"] }
 
 [features]
 default = []

dstack/kms/README.md

@@ -232,3 +232,8 @@ The `SignCert` RPC is used by the dstack app to sign a TLS certificate. In this
 - Verify the CSR signature
 - Query the smart contract to check if the app is authorized
 - If authorized, sign the CSR with the CA root key and return the certificate chain to the app
+
+## Multi-instance MPC mode
+
+See [docs/mpc.md](docs/mpc.md) for the identity chain, genesis, membership
+lifecycle, crash recovery, deployment procedure, and migration constraints.

dstack/kms/docs/mpc.md

@@ -0,0 +1,183 @@
+# Multi-instance MPC KMS
+
+## Security identity
+
+MPC mode never loads or reconstructs a complete root private key. Its stable
+`key_provider_id` is the SHA-256 domain-separated commitment to:
+
+- the threshold P-256 root CA public key;
+- the threshold K-256 signing public key;
+- the threshold P-256 derivation public key; and
+- the MPC protocol version and cluster ID.
+
+Membership is deliberately excluded from this identity. A membership epoch is
+a canonical manifest signed by the threshold K-256 key. Each member entry binds
+the node ID, endpoint, quote-bound RA-TLS SubjectPublicKeyInfo, and a commitment
+to that node's three public shares.
+
+The verification chain is:
+
+1. an application pins `key_provider_id` in its measured compose configuration;
+2. `GetMeta` publishes the cluster identity, signed active manifest, and local
+   node evidence;
+3. the manifest signature verifies under the pinned K-256 group key;
+4. the manifest binds the serving node's RA-TLS key and public-share
+   commitment; and
+5. the TEE quote binds the live TLS key to the measured KMS instance.
+
+The threshold P-256 key signs the root certificate and all member RPC
+certificates. A member certificate is issued only after every signer verifies
+that its embedded attestation is valid and bound to the authorized TLS key.
+
+## Genesis
+
+Genesis is an all-member maintenance ceremony. Before starting it, provision
+only transport material (`rpc.crt`, `rpc.key`, the temporary CA files), an
+operator-reviewed genesis plan, and a CA used by the provisional transport.
+Do not provision a root private key.
+
+Example MPC configuration:
+
+```toml
+[core.mpc]
+enabled = true
+protocol_version = 1
+cluster_id = "production-kms"
+node_id = "kms-1"
+identity_file = "/var/lib/dstack-kms/mpc-identity.json"
+genesis_plan_file = "/var/lib/dstack-kms/genesis-plan.json"
+genesis_tls_ca_cert = "/var/lib/dstack-kms/genesis-transport-ca.crt"
+join_authorization_file = "/var/lib/dstack-kms/join-authorization.json"
+client_cert_file = "/var/lib/dstack-kms/mpc-client.crt"
+client_key_file = "/var/lib/dstack-kms/mpc-client.key"
+manifest_file = "/var/lib/dstack-kms/epoch-manifest.json"
+checkpoint_file = "/var/lib/dstack-kms/epoch-checkpoint.json"
+p256_share_file = "/var/lib/dstack-kms/p256.share"
+k256_share_file = "/var/lib/dstack-kms/k256.share"
+derivation_share_file = "/var/lib/dstack-kms/derivation.share"
+max_sessions = 128
+session_ttl = "5m"
+```
+
+The canonical JSON genesis plan contains sorted members:
+
+```json
+{
+  "protocol_version": 1,
+  "cluster_id": "production-kms",
+  "threshold": 3,
+  "coordinator": "kms-1",
+  "members": [
+    {
+      "node_id": "kms-1",
+      "endpoint": "https://kms-1.example/prpc",
+      "attestation_pubkey": "<hex DER SubjectPublicKeyInfo>"
+    }
+  ]
+}
+```
+
+All members must receive the identical plan. The coordinator waits for every
+attested peer and then runs distributed auxiliary generation and DKG for all
+three keys. It threshold-signs the root CA, reissues each attested RPC
+certificate under that root, signs epoch 1, and distributes the final bundle.
+A durable genesis journal makes every node finish a crash-interrupted commit.
+Processes shut down after commit and must be restarted by their supervisor.
+
+`mpc-client.crt` must be accepted by `[rpc.tls.mutual].ca_certs`, contain a
+valid RA-TLS attestation, and use the same key as `rpc.crt`. The server
+certificate is reissued by the threshold root; the client certificate remains
+under the mutual-TLS CA so Rocket can authenticate peer connections before the
+RPC quote and manifest checks run.
+
+Record and independently compare `key_provider_id` from multiple members before
+placing it in application compose files.
+
+## Normal operation
+
+Signing uses an exact live threshold selected in canonical manifest order.
+Two offline nodes are tolerated by a 3-of-5 cluster. Every protocol envelope is
+bound to the epoch, protocol, session, request hash, sender, recipient, sequence
+number, and expiry. Raw arbitrary-digest signing is not exposed.
+
+Derivation is a verifiable threshold PRF. Each response carries a DLEQ proof
+against the member's public derivation share; the coordinator combines only
+verified partials. Disk, environment, application K-256, and application CA
+keys use separate semantic domains.
+
+## Revocation and subset resharing
+
+For a target consisting only of current members:
+
+1. call `Admin.PrepareReshare` with a canonical next-epoch `ResharePlan`;
+2. construct an `EpochManifest` using the returned commitment for every target
+   member;
+3. call `Admin.SignEpochManifest`;
+4. send the signed result to `Admin.ActivateEpoch` on every target and removed
+   member; and
+5. let the supervisor restart each process.
+
+Exactly an old threshold acts as dealers. Their Lagrange-weighted random
+polynomials preserve every group public key. Private evaluations are sent
+point-to-point over RA-TLS and are verified against coefficient commitments.
+
+Activation validates the signed chain, local pending share topology, stable
+group keys, and local share commitment. It writes an activation journal before
+changing active files. Startup completes an interrupted transaction before it
+loads a manifest or share. Removed nodes install the signed epoch and then fail
+closed because they are no longer members.
+
+## Adding members
+
+Adding a member is an explicitly authorized maintenance operation:
+
+1. Create a sorted `ResharePlan` containing the target membership and exactly
+   the old threshold in `dealers`. Existing node endpoints and attestation keys
+   must remain unchanged. New members use freshly attested TLS keys.
+2. Call `Admin.AuthorizeReshare`. The result is signed by the active threshold
+   K-256 key and binds the predecessor, target epoch, threshold, dealers,
+   endpoints, and quote-bound keys.
+3. Provision the signed authorization, active signed manifest, cluster
+   identity, root certificate, and provisional attested transport key on every
+   target node. Place the authorization at `join_authorization_file`.
+4. Restart every target. They enter maintenance join mode. The first authorized
+   dealer coordinates fresh all-target auxiliary generation, point-to-point
+   verifiable resharing, target manifest signing, and threshold issuance of
+   each target RPC certificate.
+5. Each target atomically activates the signed epoch, removes the authorization,
+   and shuts down for a normal-mode restart.
+
+The coordinator never receives all private recipient evaluations. A joining
+node receives only the old public topology and its own evaluation from each
+old dealer. The old root private key is never reconstructed.
+
+## Migration and compatibility
+
+The public KMS RPCs and guest key-delivery formats remain unchanged. MPC mode
+adds metadata fields and admin methods without removing legacy fields.
+
+Moving an existing single-root deployment to a newly generated MPC cluster is
+a provider rotation: the `key_provider_id` and deterministically derived
+application keys change. Existing encrypted disks therefore require an
+application-level migration ceremony. Do not silently switch an existing
+compose pin. Run old and new providers in parallel, migrate protected data,
+then update and re-measure the compose pin.
+
+MPC members reject legacy root-key export and handover. There is intentionally
+no API that reconstructs threshold roots.
+
+## Operational requirements
+
+- Keep share, checkpoint, journal, identity, authorization, and manifest files
+  on durable storage; secret shares and journals must be mode `0600`.
+- Use authenticated admin listeners. Never enable `insecure_no_auth` in a
+  network-reachable deployment.
+- Require at least threshold 2; production deployments should use 3-of-5 or
+  stronger.
+- Monitor quorum availability and restart completion. Do not activate a target
+  manifest until every retained member reports its expected commitment.
+- Back up shares independently. A backup set smaller than the threshold cannot
+  recover the root; losing threshold shares permanently loses the provider.
+- Treat a same-epoch fork, skipped epoch, checkpoint permission failure, quote
+  mismatch, share commitment mismatch, or group-key change as a security
+  incident. The implementation fails closed for all of them.

dstack/kms/kms.toml

@@ -97,6 +97,32 @@ insecure_no_auth = false
 # or another access-control layer.
 enabled = true
 
+# MPC cluster identity preview. When enabled, applications pin a stable hash of
+# the group public keys rather than one KMS node. The local keys must match the
+# configured signing group keys until the threshold key backend is enabled.
+[core.mpc]
+enabled = false
+protocol_version = 1
+cluster_id = ""
+identity_file = ""
+genesis_plan_file = ""
+genesis_tls_ca_cert = ""
+join_authorization_file = ""
+client_cert_file = ""
+client_key_file = ""
+p256_group_pubkey = ""
+k256_group_pubkey = ""
+derivation_group_pubkey = ""
+node_id = ""
+manifest_file = ""
+checkpoint_file = ""
+allow_unsigned_manifest = false
+max_sessions = 128
+session_ttl = "5m"
+p256_share_file = ""
+k256_share_file = ""
+derivation_share_file = ""
+
 [core.auth_api]
 type = "webhook"