MPC keyshare and recovery key storage

Enclave-protected, policy-gated backup and recovery for MPC keyshare bundles and recovery keys, stored as opaque secrets.

Regulated custodians and institutions that sign with MPC systems distribute keyshares across parties, and typically rely on an independent backup or recovery provider so that losing one party’s share does not mean losing funds. Turnkey Secrets can be that independent store, for both keyshare backups and the recovery keys that protect them. A recovery key is the private key, often paired with a passphrase, that decrypts your provider’s keyshare backup. Vendors also call it a recovery kit, a recovery private key, or an escrow key. Losing it is as bad as losing the shares themselves.

You import either one as an opaque secret. Turnkey holds it inside a secure enclave and releases it only through a policy-gated export encrypted to a designated recovery participant. You can use Turnkey instead of, or in addition to, another recovery store. This solution builds on Secret storage.

What Turnkey contributes

Need	How Turnkey solves it
Keyshares and recovery keys never sit plaintext in your infrastructure	Enclave-protected opaque storage: the secret is end-to-end encrypted into the enclave at import and only ever leaves re-encrypted to a designated recipient
Recovery must not be unilateral	Policy-gated export with independently controllable approvals: require consensus from risk officers or recovery operators that you manage separately from the MPC system
Only the recovery participant may read the released secret	The export payload is encrypted to a single ephemeral public key generated by the designated recovery participant; approvers cannot read it
Recovery events must be auditable	Every import, export, and approval is a signed, attributable activity, logged and queryable

Classifying and gating keyshares

Bind static properties at import time so policies target classes of keyshares instead of individual IDs:

const secretId = await turnkey.apiClient().importSecret({
  plaintext: keyshareBundle,
  name: "treasury-signer-party-2-keyshare",
  staticProperties: {
    kind: "mpcKeyshare",
    curve: "secp256k1",
    environment: "production",
    recoveryRole: "backupParty",
  },
});

Gate export on those properties. For example, require two recovery operators to approve before any production keyshare is released:

{
  "policyName": "Production MPC keyshares require two recovery operators",
  "effect": "EFFECT_ALLOW",
  "consensus": "approvers.filter(u, u.tags.contains('recovery-operator')).count() >= 2",
  "condition": "secret.static_properties['kind'] == 'mpcKeyshare' && secret.static_properties['environment'] == 'production' && activity.type == 'ACTIVITY_TYPE_EXPORT_SECRETS'"
}

At recovery time, the designated recovery participant generates an ephemeral keypair and retrieves the bundle with exportSecret, or with the proposal helpers described in Programmable credential access when the export requires additional approvals. Only that participant can decrypt the released bundle, which then re-enters your MPC provider’s own recovery procedure.

Next steps