id: d-ta-overview title: Decentralized Trust Authority Overview sidebar_label: D-TA Node Overview


Apache Milagro Distributed Trust Authority is a server application that enables you to generate and secure secret keys using the Milagro Cryptographic libraries. Securing of secret keys (Safeguarding) is enabled in RC1 - and is the focus of this documentation. In future releases we aim to enable a wide range of keys to be generated including Type-3 Pairing Keys that can be used to authorise MPIN authentication servers and as client secrets.

Safeguarding Secrets

In order to safeguard a secret, a pair of Milagro DTA servers is required: a client (refered to as the Principal) and a server (refered to as a Fiduciary). In addition a third party can be nominated as the ultimate recipient of the secret (refered to as the Beneficiary). This system can be imagined like a “network HSM”. Here is a VERY simplified version of the process:

Figure 1

Milagro DTA is Not Secure (on its own)

The key seed is the focus of the system - Milagro DTA aims to provide a method for communicating with organisations who provide services for securing seeds (Custodians), it does not prescribe how the securing should be done. We hope that many custodial services will adopt Milagro as a communication protocol and that they will bring a proffusion of security paradigms: working together we can make the Internet a safer place. The most basic implementation of Milagro should secure seeds in an HSM using a PKCS#11 interface. (We aim to release a PKCS11 driver in a subsequent release)

The Milagro Communication Protocol

Milagro DTA provides a secure, distributed method of communication between beneficiaries, principals and fiduciaries. It aims to solve the following problems:

  1. How can actors in the system be identified and trusted?

    Answer: Identity Documents

  2. How can records of interactions between actors in the system be trusted and verified?

    Answer: Encrypted Envelopes via IPFS

  3. How can conditions for revealing or using secrets be specified?

    Answer: Redemption Policies

  4. How can different custodial services provide their own “special security sauce”?

    Answer: Plugins

A more complete view of the Milagro DTA ecosystem is shown below

Figure 1

:::tip WE NEED HELP DOCUMENTING! Interested in becoming a contributor? Milagro is looking for you. CONTRIBUTOR'S GUIDE. :::