CONSUMER PROTECTION TUESDAY: HOW COINBASE SAFEGUARDS PII USING MPC ENCRYPTION

Summary from the TLDR InfoSec newsletter

Coinbase's CoreKMS Encryption Service uses Multi-Party Computation (MPC) to protect PII by deriving ephemeral encryption keys on demand through Distributed Key Generation, ensuring no single party ever holds the complete master key. The system employs AES-GCM-SIV for deterministic, authenticated, field-level encryption of sensitive data such as SSNs, enabling secure querying and indexing of encrypted records in Snowflake without decrypting the underlying data. The approach demonstrates a practical architecture for organizations that need to balance regulatory compliance requirements, such as state data-match reporting, with strong cryptographic guarantees against key compromise.