Keyshard backup and recovery

Salt automatically backs up every MPC keyshard generated during account creation. The process is transparent to users and removes the need to manually manage backups of Salt keyshards. Each encrypted keyshard is securely associated with the user's Externally Owned Account (EOA), so it can be recovered automatically at any time.

You are responsible for protecting your EOAs. Salt manages the backup and recovery of MPC keyshards; the EOA is the root of that recovery.

Automatic backup

During account creation, each participant runs the Salt SDK on their own device. As part of the distributed key generation (DKG) protocol, the SDK performs multiple rounds of cryptographic communication before producing that participant's keyshard, then automatically prepares it for backup.

Users never need to:

export keyshards
store backup files
remember additional passwords or recovery phrases

What is stored, and where

Before backup, each keyshard is encrypted, then the encrypted keyshard is written to a public blockchain. Because the stored data is encrypted, the blockchain acts only as durable storage and never exposes usable key material.

The encryption key is derived from a deterministic piece of entropy, generated from multiple sources — including a signature produced by the user's EOA combined with randomness from Salt's Verifiable OPRF (VOPRF) service. This derivation is handled entirely by the Salt SDK and is included in the Salt platform audit scope.

Although the entropy appears random, it is deterministic with respect to the user's identity and cryptographic inputs, so the same encryption key can be regenerated whenever the user signs in, including on a new device.

Automatic recovery

When a user signs in to Salt, the platform automatically:

retrieves the encrypted backup
decrypts it locally
stores the keyshard in the device's secure browser cache

When the user signs out or closes the Salt app, the keyshard is deleted from the device.

Recovery without Salt

Recovery does not depend on Salt remaining operational. During the initial backup, the derived entropy is:

encrypted using ECIES with the public key of the user's EOA
stored alongside the encrypted keyshard in the smart contract

Because only the corresponding EOA can decrypt this stored entropy, the user always retains the information required to re-derive the symmetric encryption key and decrypt the keyshard directly from on-chain data with no dependency on Salt's infrastructure.

Salt will provide an open-source recovery process that reads the encrypted backup from the smart contract, recovers the entropy, regenerates the symmetric key, and decrypts the keyshard using public on-chain data, without Salt's backend.

Security properties

Keyshards are backed up automatically — users never manage Salt keyshard backups
Backups are encrypted before being written to the blockchain
Encryption keys are derived from deterministic cryptographic entropy
Recovery works across multiple devices
Recovery remains possible even if Salt is unavailable

Flow

Distributed Key Generation
            │
            ▼
     User keyshard created
            │
            ▼
Generate deterministic entropy
   (EOA signature + Salt VOPRF)
            │
            ▼
 Derive symmetric encryption key
            │
            ▼
       Encrypt keyshard
            │
            ▼
 Store encrypted keyshard on-chain
            │
            ▼
 Encrypt entropy with user EOA (ECIES)
            │
            ▼
 Store encrypted entropy in smart contract
────────────────────────────────────────────
            │
       User signs in
            │
            ▼
   Retrieve encrypted backup
            │
            ▼
       Recover entropy
            │
            ▼
     Derive symmetric key
            │
            ▼
      Decrypt keyshard
            │
            ▼
     Continue using Salt

Automatic backup​

What is stored, and where​

Automatic recovery​

Recovery without Salt​

Security properties​

Flow​

See also​