@@ -11,9 +11,11 @@ Web3Auth's [`@web3auth/mpc-core-kit`](https://github.com/Web3Auth/mpc-core-kit)
1111easy-to-use SDK, that helps you implement Web3Auth's MPC Threshold Signature Scheme (TSS) features
1212in which the private key is never reconstructed.
1313
14- Compared to other Web3Auth SDKs, such as Plug and Play(PnP), and Single Factor Auth(SFA) SDKs where
15- the private key is securely reconstructed on user's device, and is used to sign transactions. In the
16- MPC TSS architecture, the private key is never reconstructed.
14+ Compared to other Web3Auth SDKs, such as Plug and Play (PnP) and Single Factor Auth (SFA) SDKs,
15+ where the private key is securely reconstructed on the user's device and used to sign transactions,
16+ the MPC TSS architecture ensures that the private key is never reconstructed for signing. However,
17+ the SDK provides options to export the private key if the user wants to use their account in other
18+ wallets. This approach eliminates vendor lock-in, unlike other MPC solutions.
1719
1820Instead, the partial key shares are stored at different locations which are used to generate the
1921partial signatures. The final signature is generated combining the partial signatures using the TSS.
@@ -33,8 +35,8 @@ in a single location, the key is divided into multiple parts and distributed acr
3335devices and our Auth Network. This means that the key is always available and never in danger of
3436being compromised.
3537
36- The traditional Web3Auth SDK uses threshold signatures to dynamically reconstruct the key in the
37- frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
38+ The traditional Web3Auth SDK uses Shamir Secret Sharing (SSS) to dynamically reconstruct the key in
39+ the frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
3840longer necessary. Instead, partial keys are stored in different locations, and the user's device is
3941used to make partial signatures for messages and transactions.
4042
@@ -64,16 +66,6 @@ transactions on the blockchain. Let's understand each of these stages in detail.
6466
6567## Types of Factors
6668
67- ### Hashed Cloud Factor
68-
69- The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
70- factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
71- factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
72- above architecture to understand more about factors.
73-
74- This is done to make sure the user can access their account from any device without having to
75- generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
76-
7769### Social Login Factor
7870
7971This is the primary way for a user to access their account. This step involves authentication of
@@ -85,6 +77,16 @@ When a user logs in, the Auth Network generates signatures corresponding to the
8577nodes and returns them to the user's end. These signatures are then used alongside other shares to
8678generate the final TSS Account signatures.
8779
80+ ### Hashed Cloud Factor
81+
82+ The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
83+ factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
84+ factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
85+ above architecture to understand more about factors.
86+
87+ This is done to make sure the user can access their account from any device without having to
88+ generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
89+
8890### Device Factor (Factor Index: 2)
8991
9092This is the second factor used to access the user's account. This step involves the generation of a
@@ -106,12 +108,23 @@ backup factor of your choice like social recovery, Email OTP, SMS OTP, Authentic
106108## Threshold
107109
108110The threshold is the minimum number of shares required to generate a final signature for the TSS
109- Account. This threshold, by default, is set to 3/5 on the Auth Network and 2/3 for the user's device
110- front. This ensures high availability and ease of access on both ends alongside optimum security.
111- Both these thresholds can be customized according to the requirements.
111+ Account. By default, the Auth Network requires 3 out of 5 shares (3/5) to generate a signature. This
112+ means that out of the 5 shares distributed across different nodes, any 3 shares can be combined to
113+ create the final signature. This setup ensures high availability and security, as it allows for some
114+ shares to be unavailable or compromised without affecting the overall system.
115+
116+ On the user's device front, the default threshold is set to 2 out of 3 shares (2/3). This means that
117+ out of the 3 shares available on the user's device, any 2 shares can be used to generate the final
118+ signature. This setup provides a balance between security and ease of access, ensuring that the user
119+ can still access their account even if one share is unavailable.
120+
121+ Only the user level threshold can can be customized according to the requirements. The Auth Network
122+ threshold is fixed at 3/5.
112123
113- Please note that when user logs in for the first time, the threshold is set to 2/2. The threshold is
114- set to 2/3 after the user enables the MFA flow.
124+ Please note that when a user logs in for the first time, the threshold is set to 2 out of 2 shares
125+ (2/2). This means that both shares are required to generate the final signature. After the user
126+ enables the MFA flow, the threshold is set to 2 out of 3 shares (2/3), providing an additional layer
127+ of security.
115128
116129## Components of a Factor
117130
@@ -122,9 +135,10 @@ the user. These shares are generated using distributed key generation(DKG) and a
122135Auth Network and the user's device. Since these shares are generated using MPC, they are ** never
123136reconstructed** and always stay decentralized and secure.
124137
125- However, we have exposed a function to reconstruct the TSS Key from the shares in the SDK. This
126- function has been marked unsafe since there is no direct use case for it other than key exports in
127- the case the user wants to own it completely.
138+ We've included a function in the SDK that lets you reconstruct the TSS Key from the shares. Just a
139+ heads-up, this function is marked as unsafe, so it's best to use it with extra layers of security.
140+ For example, only make this function available when MFA is enabled and ask the user to input their
141+ MFA share while exporting.
128142
129143### Metadata Key & Shares
130144
0 commit comments