MPC keyshare storage

Regulated custodians and institutions that sign with MPC systems distribute keyshares across parties, and typically rely on an independent backup or recovery provider so that losing one party’s share does not mean losing funds. Turnkey Secrets can serve as that independent recovery store. An MPC party’s keyshare bundle is imported as an opaque secret, held inside a secure enclave, and released only through a policy-gated export encrypted to a designated recovery participant. You can use it instead of, or in addition to, another recovery store. This solution builds on Secret storage.

What Turnkey contributes

Need	How Turnkey solves it
Keyshare bundle never sits plaintext in your infrastructure	Enclave-protected opaque storage: the bundle is end-to-end encrypted into the enclave at import and only ever leaves re-encrypted to a designated recipient
Recovery must not be unilateral	Policy-gated export with independently controllable approvals: require consensus from risk officers or recovery operators that you manage separately from the MPC system
Only the recovery participant may read the released share	The export payload is encrypted to a single ephemeral public key generated by the designated recovery participant; approvers cannot read it
Recovery events must be auditable	Every import, export, and approval is a signed, attributable activity, logged and queryable

Classifying and gating keyshares

Bind static properties at import time so policies target classes of keyshares instead of individual IDs:

const secretId = await turnkey.apiClient().importSecret({
  plaintext: keyshareBundle,
  name: "treasury-signer-party-2-keyshare",
  staticProperties: {
    kind: "mpcKeyshare",
    curve: "secp256k1",
    environment: "production",
    recoveryRole: "backupParty",
  },
});

Gate export on those properties. For example, require two recovery operators to approve before any production keyshare is released:

{
  "policyName": "Production MPC keyshares require two recovery operators",
  "effect": "EFFECT_ALLOW",
  "consensus": "approvers.filter(u, u.tags.contains('recovery-operator')).count() >= 2",
  "condition": "secret.static_properties['kind'] == 'mpcKeyshare' && secret.static_properties['environment'] == 'production' && activity.type == 'ACTIVITY_TYPE_EXPORT_SECRETS'"
}

At recovery time, the designated recovery participant generates an ephemeral keypair and retrieves the bundle with exportSecret, or with the proposal helpers described in Programmable credential access when the export requires additional approvals. Only that participant can decrypt the released bundle, which then re-enters your MPC provider’s own recovery procedure.

Overview

Embedded Wallets

Company Wallets

Key Management

Cookbooks

MPC keyshare storage

What Turnkey contributes

Classifying and gating keyshares

Next steps

​What Turnkey contributes

​Classifying and gating keyshares

​Next steps

What Turnkey contributes

Classifying and gating keyshares

Next steps