MPC Hardware Wallet Backup Using Distributed Key Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic solutions fail to address vulnerabilities in electronic devices, including single-key vulnerabilities and lack robust backup and recovery mechanisms for cryptographic keys.
Innovation Solution
Implement a secure electronic device with a secure element that integrates a secure element with a high-capacity processing device, storage memory, and working memory in a single monolithic chip structure, incorporating a secure bus structure to protect against hacking and provide comprehensive backup and recovery of lost or compromised security data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic algorithms use highly complex computational schemes, then security against breaking the algorithm is improved, but the vulnerability to memory hacking and physical analysis increases
Solution Approach 1:
The private key is divided into multiple key shares that are distributed across different hardware wallets and servers. No single entity holds the complete private key, so compromising one or more individual storage locations does not reveal the full key. This segmentation approach directly addresses the memory hacking vulnerability by ensuring that even if multiple memory locations are compromised, the complete cryptographic key remains secure.
Solution Approach 2:
A threshold signature scheme acts as an intermediary mechanism that requires multiple key shares to be combined to produce a valid digital signature. The system uses a (k,n) threshold scheme where k signatures are needed from n total shares. This intermediary layer prevents direct access to the complete private key while still enabling legitimate transactions when sufficient shares are available.
2Device complexity
If a single device stores all cryptographic key data, then device complexity is reduced, but reliability and backup capability deteriorate
Solution Approach 1:
The system segments the cryptographic key into multiple distributed shares stored across different devices (hardware wallets, servers, cloud storage). This maintains relative simplicity in individual device storage while achieving high reliability through distribution. Each device stores only a portion of the key, simplifying individual device architecture while the collective system provides robust backup and recovery.
Solution Approach 2:
The system performs preliminary actions by pre-distributing key shares to multiple locations before any loss or compromise occurs. Recovery procedures are pre-configured through the threshold signature scheme, allowing automatic reconstruction of the full private key from sufficient shares without requiring complex manual recovery processes.
3Ease of operation
If cryptographic keys are stored in conventional memory, then ease of access is improved, but security against inference attacks deteriorates
Solution Approach 1:
The threshold signature scheme serves as an intermediary that prevents direct storage of the complete private key in conventional memory. Instead, the system stores distributed key shares that can only be combined through the threshold mechanism to produce valid signatures. This intermediary layer blocks inference attacks while maintaining ease of operation for authorized transactions.
Solution Approach 2:
Different locations in the system have different quality characteristics for key storage. Individual hardware wallets and servers store only partial key information locally, providing limited exposure to inference attacks. The complete key never resides in a single location, with each location having reduced vulnerability characteristics while collectively providing full functionality.
Data Source
AI summary
Backup and recovery of multi-party computation (MPC) security data utilized to secure digital assets and transactions thereof can enhance user confidence and user experience in digital asset transactions. Example MPC security data can include cryptographic keys and key shares utilized with a N×M MPC signature and validation framework. A computing device participating in generation of MPC secure data can retain a segment of the MPC secure data and can encrypt and store an encrypted segment at a second device. A recovery service or recovery application at the second device can facilitate recovery of the MPC secure data segment at the computing device, or at an additional device not involved in generation of the MPC secure data. The recovery service or application can facilitate recovery of the MPC secure data segment even in the event the computing device is lost.