Skip to main content

Key Lifecycle

Once we have already generated our key shares, we can refresh and also export them. We show how to do this below.

Key Refresh​

Key Refresh (sometimes referred to as "Key Rotation") is a protocol that allows the devices to compute entirely new secret shares of the same public key. Refreshing the key material frequently is considered a best practice for enhanced security, as it adds an element of time to the security setting. Since even if one secret share was compromised, then after Key Refresh the compromised secret share will no longer be useful. Below is an example of how to use Key Refresh:

using SodotSDK;
using SodotSDK.Ecdsa;

// Assume we have N parties with T threshold
ushort N = 3;
var myApiKey = "MY_API_KEY";
var hostUrl = "demo.sodot.dev"; // Your Relay URL

// Create the Ecdsa instance with your relay server hostURL
var ecdsa = new Ecdsa(hostUrl);

// Create a room for refreshing the key
var refreshRoomUuid = await ecdsa.CreateRoom(N, myApiKey);

// Each participating party uses their secret share from key generation
var (_, secretShare) = await ecdsa.Keygen(/*...*/);

// All parties now join the refresh room using their current secret share
var (refreshedPubkey, refreshedSecretShare) = await ecdsa.Refresh(refreshRoomUuid, secretShare);

// Note: The public key remains the same
// Store refreshedSecretShare securely for future use
// It can now be used for signing under the same threshold, as well as be refreshed again

Key Reshare​

Key Resharing is a protocol that allows changing the threshold parameters of the distributed key. This can be useful when adding or removing participants, or when changing the threshold value.

There are two roles in the resharing process:

  • Remaining Parties: Participants who already have a secret share
  • New Parties: Participants who will receive a new secret share
using SodotSDK;
using SodotSDK.Ecdsa;

// Change from T=2 of N=3 to T'=3 of N'=5
ushort oldThreshold = 2;
ushort newThreshold = 3;
ushort newN = 5;
var myApiKey = "MY_API_KEY";
var hostUrl = "demo.sodot.dev"; // Your Relay URL

// Create the Ecdsa instance with your relay server hostURL
var ecdsa = new Ecdsa(hostUrl);

// Create a room for resharing the key
var reshareRoomUuid = await ecdsa.CreateRoom(newN, myApiKey);

// The keygenIds of all the parties that will have a secret share after resharing
var keygenIds = new KeygenId[] { new KeygenId("keygenId1"), new KeygenId("keygenId2"), new KeygenId("keygenId3"), new KeygenId("keygenId4"), new KeygenId("keygenId5") };

// For remaining parties (those who already have a secret share):
var (_, secretShare) = await ecdsa.Keygen(/*...*/);

var (pubkey, newSecretShare) = await ecdsa.ReshareRemainingParty(reshareRoomUuid, newThreshold, secretShare, keygenIds);

// For new parties:
var (keygenId, keygenSecret) = ecdsa.InitKeygen();

var (pubkey, secretShare) = await ecdsa.ReshareNewParty(reshareRoomUuid, newThreshold, keygenSecret, keygenIds);

// Both remaining and new parties should store their new secret shares
// These can now be used with the new threshold parameters

Key Export​

In certain scenarios, you might need to export the full private key from the distributed key shares. This should be used with caution as it negates some of the security benefits of MPC.

using SodotSDK;
using SodotSDK.Ecdsa;

ushort T = 2;
var myApiKey = "MY_API_KEY";
var hostUrl = "demo.sodot.dev"; // Your Relay URL
// Create the Ecdsa instance with your relay server hostURL
var ecdsa = new Ecdsa(hostUrl);
var (_, secretShare) = await ecdsa.Keygen(/*...*/);

// Only 1 party will receive the full private key
// Get the export ID from the secret share of the party that will receive the full private key
var exportID = await ecdsa.GetExportId(secretShare);

// Create a room for the export process
var exportRoomUuid = await ecdsa.CreateRoom(T, myApiKey);

// Export the full private key (requires threshold number of participants)
// All parties must specify the same export ID
var fullPrivateKey = await ecdsa.ExportFullPrivateKey(exportRoomUuid, secretShare, exportID);

// Handle the full private key with extreme care
// This key should be securely stored or used immediately and then discarded

// Alternatively, if you already have collected all secret shares offline:
var secretShares = new[] { secretShare1, secretShare2 }; // At least threshold number of shares
var offlinePrivateKey = await ecdsa.OfflineExportFullPrivateKey(secretShares);

Key Import​

You can also import an existing private key into the MPC system to create distributed shares. This is useful for migrating existing keys to the MPC framework.

using SodotSDK;
using SodotSDK.Ecdsa;

ushort N = 3;
ushort T = 2;
var myApiKey = "MY_API_KEY";
var hostUrl = "demo.sodot.dev"; // Your Relay URL
// Create the Ecdsa instance with your relay server hostURL
var ecdsa = new Ecdsa(hostUrl);

string privateKey = "aabbccddeeff..."; // The private key to import as a hex string

// Create a room for the import process
var importRoomUuid = await ecdsa.CreateRoom(N, myApiKey);

// All parties initialize key generation
var (keygenId, keygenSecret) = ecdsa.InitKeygen();

// All parties exchange their keygenIds
var keygenIds = new KeygenId[] { new KeygenId("keygenId1"), new KeygenId("keygenId2"), new KeygenId("keygenId3") };

// For the party importing the key (the importer):
var (pubkey, secretShare) = await ecdsa.ImportPrivateKeyImporter(importRoomUuid, T, privateKey, keygenSecret, keygenIds);

// For all other parties (the recipients):
var (pubkey, secretShare) = await ecdsa.ImportPrivateKeyRecipient(importRoomUuid, T, keygenSecret, keygenIds);

// All parties now have a secret share of the imported key
// Store the secret share for future use