Skip to content

Commit aa88c02

Browse files
committed
Update according to comments
1 parent d723932 commit aa88c02

File tree

10 files changed

+146
-66
lines changed

10 files changed

+146
-66
lines changed

docs/sdk/mpc-core-kit/mpc-core-kit-js/authentication/login-jwt.mdx

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,15 @@ By default, the ed25519 key is formatted in base58 and is 64 bytes long. This co
151151
32 bytes as the seed (also known as the private key) and the last 32 bytes as the public key. Ensure
152152
that the first 32 bytes are provided in hexadecimal format when using the ed25519 seed.
153153

154+
:::info ED25519 Seed
155+
156+
The ed25519 seed is a 64-byte value, where the first 32 bytes represent the private key and the last
157+
32 bytes represent the public key. When using the ed25519 seed, ensure that the first 32 bytes
158+
(private key) are provided in hexadecimal format. For example, a sample ed25519 seed in hexadecimal
159+
format could be `0x1a2b3c4d5e6f7890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f6789`.
160+
161+
:::
162+
154163
```tsx
155164
import { JWTLoginParams } from "@web3auth/mpc-core-kit";
156165

docs/sdk/mpc-core-kit/mpc-core-kit-js/authentication/login-oauth.mdx

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,15 @@ By default, the ed25519 key is formatted in base58 and is 64 bytes long. This co
202202
32 bytes as the seed (also known as the private key) and the last 32 bytes as the public key. Ensure
203203
that the first 32 bytes are provided in hexadecimal format when using the ed25519 seed.
204204

205+
:::info ED25519 Seed
206+
207+
The ed25519 seed is a 64-byte value, where the first 32 bytes represent the private key and the last
208+
32 bytes represent the public key. When using the ed25519 seed, ensure that the first 32 bytes
209+
(private key) are provided in hexadecimal format. For example, a sample ed25519 seed in hexadecimal
210+
format could be `0x1a2b3c4d5e6f7890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f6789`.
211+
212+
:::
213+
205214
```tsx
206215
import { SubVerifierDetailsParams } from "@web3auth/mpc-core-kit";
207216

docs/sdk/mpc-core-kit/mpc-core-kit-js/initialize.mdx

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,13 @@ After installation, the next step to use Web3Auth MPC Core Kit is to configure &
1919
Please note that these are the most critical steps where you need to pass on different parameters
2020
according to the preference of your project.
2121

22+
:::info
23+
24+
Ensure that you configure your authentication method and verifier prior to initializing the SDK in
25+
your codebase. This will streamline the implementation process.
26+
27+
:::
28+
2229
### Parameters
2330

2431
The Web3AuthMPCCoreKit constructor takes an object with `Web3AuthOptions` as input which helps you

docs/sdk/mpc-core-kit/mpc-core-kit-js/install.mdx

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@ flexibility to customize the UI and UX of the authentication process.
1818
npm install @web3auth/mpc-core-kit
1919
```
2020

21+
:::note
22+
23+
If you were using the MPC Core Kit JS SDK in your react native application, you need to follow this
24+
[migration guide](/migration-guides/mpc-core-kit-react-native-migration) to migrate to the new MPC
25+
Core Kit React Native SDK.
26+
27+
:::
28+
2129
## Common Types and Interfaces
2230

2331
This package gives access to common types and interfaces for Web3Auth. This comes in handy by

docs/sdk/mpc-core-kit/mpc-core-kit-js/mpc-core-kit-js.mdx

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,11 @@ Web3Auth's [`@web3auth/mpc-core-kit`](https://github.com/Web3Auth/mpc-core-kit)
1111
easy-to-use SDK, that helps you implement Web3Auth's MPC Threshold Signature Scheme (TSS) features
1212
in which the private key is never reconstructed.
1313

14-
Compared to other Web3Auth SDKs, such as Plug and Play(PnP), and Single Factor Auth(SFA) SDKs where
15-
the private key is securely reconstructed on user's device, and is used to sign transactions. In the
16-
MPC TSS architecture, the private key is never reconstructed.
14+
Compared to other Web3Auth SDKs, such as Plug and Play (PnP) and Single Factor Auth (SFA) SDKs,
15+
where the private key is securely reconstructed on the user's device and used to sign transactions,
16+
the MPC TSS architecture ensures that the private key is never reconstructed for signing. However,
17+
the SDK provides options to export the private key if the user wants to use their account in other
18+
wallets. This approach eliminates vendor lock-in, unlike other MPC solutions.
1719

1820
Instead, the partial key shares are stored at different locations which are used to generate the
1921
partial signatures. The final signature is generated combining the partial signatures using the TSS.
@@ -33,8 +35,8 @@ in a single location, the key is divided into multiple parts and distributed acr
3335
devices and our Auth Network. This means that the key is always available and never in danger of
3436
being compromised.
3537

36-
The traditional Web3Auth SDK uses threshold signatures to dynamically reconstruct the key in the
37-
frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
38+
The traditional Web3Auth SDK uses Shamir Secret Sharing (SSS) to dynamically reconstruct the key in
39+
the frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
3840
longer necessary. Instead, partial keys are stored in different locations, and the user's device is
3941
used to make partial signatures for messages and transactions.
4042

@@ -64,16 +66,6 @@ transactions on the blockchain. Let's understand each of these stages in detail.
6466

6567
## Types of Factors
6668

67-
### Hashed Cloud Factor
68-
69-
The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
70-
factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
71-
factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
72-
above architecture to understand more about factors.
73-
74-
This is done to make sure the user can access their account from any device without having to
75-
generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
76-
7769
### Social Login Factor
7870

7971
This is the primary way for a user to access their account. This step involves authentication of
@@ -85,6 +77,16 @@ When a user logs in, the Auth Network generates signatures corresponding to the
8577
nodes and returns them to the user's end. These signatures are then used alongside other shares to
8678
generate the final TSS Account signatures.
8779

80+
### Hashed Cloud Factor
81+
82+
The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
83+
factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
84+
factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
85+
above architecture to understand more about factors.
86+
87+
This is done to make sure the user can access their account from any device without having to
88+
generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
89+
8890
### Device Factor (Factor Index: 2)
8991

9092
This is the second factor used to access the user's account. This step involves the generation of a
@@ -106,12 +108,23 @@ backup factor of your choice like social recovery, Email OTP, SMS OTP, Authentic
106108
## Threshold
107109

108110
The threshold is the minimum number of shares required to generate a final signature for the TSS
109-
Account. This threshold, by default, is set to 3/5 on the Auth Network and 2/3 for the user's device
110-
front. This ensures high availability and ease of access on both ends alongside optimum security.
111-
Both these thresholds can be customized according to the requirements.
111+
Account. By default, the Auth Network requires 3 out of 5 shares (3/5) to generate a signature. This
112+
means that out of the 5 shares distributed across different nodes, any 3 shares can be combined to
113+
create the final signature. This setup ensures high availability and security, as it allows for some
114+
shares to be unavailable or compromised without affecting the overall system.
115+
116+
On the user's device front, the default threshold is set to 2 out of 3 shares (2/3). This means that
117+
out of the 3 shares available on the user's device, any 2 shares can be used to generate the final
118+
signature. This setup provides a balance between security and ease of access, ensuring that the user
119+
can still access their account even if one share is unavailable.
120+
121+
Only the user level threshold can can be customized according to the requirements. The Auth Network
122+
threshold is fixed at 3/5.
112123

113-
Please note that when user logs in for the first time, the threshold is set to 2/2. The threshold is
114-
set to 2/3 after the user enables the MFA flow.
124+
Please note that when a user logs in for the first time, the threshold is set to 2 out of 2 shares
125+
(2/2). This means that both shares are required to generate the final signature. After the user
126+
enables the MFA flow, the threshold is set to 2 out of 3 shares (2/3), providing an additional layer
127+
of security.
115128

116129
## Components of a Factor
117130

@@ -122,9 +135,10 @@ the user. These shares are generated using distributed key generation(DKG) and a
122135
Auth Network and the user's device. Since these shares are generated using MPC, they are **never
123136
reconstructed** and always stay decentralized and secure.
124137

125-
However, we have exposed a function to reconstruct the TSS Key from the shares in the SDK. This
126-
function has been marked unsafe since there is no direct use case for it other than key exports in
127-
the case the user wants to own it completely.
138+
We've included a function in the SDK that lets you reconstruct the TSS Key from the shares. Just a
139+
heads-up, this function is marked as unsafe, so it's best to use it with extra layers of security.
140+
For example, only make this function available when MFA is enabled and ask the user to input their
141+
MFA share while exporting.
128142

129143
### Metadata Key & Shares
130144

docs/sdk/mpc-core-kit/mpc-core-kit-react-native/authentication.mdx

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,15 @@ By default, the ed25519 key is formatted in base58 and is 64 bytes long. This co
169169
32 bytes as the seed (also known as the private key) and the last 32 bytes as the public key. Ensure
170170
that the first 32 bytes are provided in hexadecimal format when using the ed25519 seed.
171171

172+
:::info ED25519 Seed
173+
174+
The ed25519 seed is a 64-byte value, where the first 32 bytes represent the private key and the last
175+
32 bytes represent the public key. When using the ed25519 seed, ensure that the first 32 bytes
176+
(private key) are provided in hexadecimal format. For example, a sample ed25519 seed in hexadecimal
177+
format could be `0x1a2b3c4d5e6f7890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f6789`.
178+
179+
:::
180+
172181
```tsx
173182
const jwtLoginParams = {
174183
verifier: "YOUR_VERIFIER_NAME",

docs/sdk/mpc-core-kit/mpc-core-kit-react-native/initialize.mdx

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@ After installation, the next step to use Web3Auth MPC Core Kit is to configure &
1515
2. [Configure Web3AuthMPCCoreKit instance](#configure-instance)
1616
3. [Initialize Web3AuthMPCCoreKit](#initialize-web3authmpccorekit)
1717

18+
:::note
19+
20+
Ensure that you configure your authentication method and verifier prior to initializing the SDK in
21+
your codebase. This will streamline the implementation process.
22+
23+
:::
24+
1825
## Configure React Native Environment
1926

2027
In order to make this SDK compatible with the React Native development environment, you need to
@@ -459,22 +466,16 @@ To initialize the instance, you need to call the `init` method. The method also
459466

460467
<TabItem value="table">
461468

462-
| Parameter | Description |
463-
| ---------------------- | ------------------------------------------------------------------------- |
464-
| `handleRedirectResult` | Handles the redirect result during initialization. Default value is true. |
465-
| `rehydrate` | Rehydrates the session during initialization. Default value is true. |
469+
| Parameter | Description |
470+
| ----------- | -------------------------------------------------------------------- |
471+
| `rehydrate` | Rehydrates the session during initialization. Default value is true. |
466472

467473
</TabItem>
468474

469475
<TabItem value="interface">
470476

471477
```typescript
472478
export interface InitParams {
473-
/**
474-
* @defaultValue `true`
475-
* handle the redirect result during init()
476-
*/
477-
handleRedirectResult: boolean;
478479
/**
479480
* @defaultValue `true`
480481
* rehydrate the session during init()

docs/sdk/mpc-core-kit/mpc-core-kit-react-native/install.mdx

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ flexibility to customize the UI and UX of the authentication process.
2121
npm install @web3auth/react-native-mpc-core-kit
2222
```
2323

24+
:::note
25+
26+
If you were using the MPC Core Kit JS SDK in your react native application, you need to follow this
27+
[migration guide](/migration-guides/mpc-core-kit-react-native-migration) to migrate to the new MPC
28+
Core Kit React Native SDK.
29+
30+
:::
31+
2432
## Common Types and Interfaces
2533

2634
This package gives access to common types and interfaces for Web3Auth. This comes in handy by

docs/sdk/mpc-core-kit/mpc-core-kit-react-native/mpc-core-kit-react-native.mdx

Lines changed: 37 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ Web3Auth's
1212
is simple and easy-to-use SDK for react native environment, that helps you implement Web3Auth's MPC
1313
Threshold Signature Scheme (TSS) features in which the private key is never reconstructed.
1414

15-
Compared to other Web3Auth SDKs, such as Plug and Play(PnP), and Single Factor Auth(SFA) SDKs where
16-
the private key is securely reconstructed on user's device, and is used to sign transactions. In the
17-
MPC TSS architecture, the private key is never reconstructed.
15+
Compared to other Web3Auth SDKs, such as Plug and Play (PnP) and Single Factor Auth (SFA) SDKs,
16+
where the private key is securely reconstructed on the user's device and used to sign transactions,
17+
the MPC TSS architecture ensures that the private key is never reconstructed for signing. However,
18+
the SDK provides options to export the private key if the user wants to use their account in other
19+
wallets. This approach eliminates vendor lock-in, unlike other MPC solutions.
1820

1921
Instead, the partial key shares are stored at different locations which are used to generate the
2022
partial signatures. The final signature is generated combining the partial signatures using the TSS.
@@ -34,8 +36,8 @@ in a single location, the key is divided into multiple parts and distributed acr
3436
devices and our Auth Network. This means that the key is always available and never in danger of
3537
being compromised.
3638

37-
The traditional Web3Auth SDK uses threshold signatures to dynamically reconstruct the key in the
38-
frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
39+
The traditional Web3Auth SDK uses Shamir Secret Sharing (SSS) to dynamically reconstruct the key in
40+
the frontend. However, with the new Web3Auth MPC (Multi Party Computation) architecture, this is no
3941
longer necessary. Instead, partial keys are stored in different locations, and the user's device is
4042
used to make partial signatures for messages and transactions.
4143

@@ -65,16 +67,6 @@ transactions on the blockchain. Let's understand each of these stages in detail.
6567

6668
## Types of Factors
6769

68-
### Hashed Cloud Factor
69-
70-
The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
71-
factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
72-
factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
73-
above architecture to understand more about factors.
74-
75-
This is done to make sure the user can access their account from any device without having to
76-
generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
77-
7870
### Social Login Factor
7971

8072
This is the primary way for a user to access their account. This step involves authentication of
@@ -86,6 +78,16 @@ When a user logs in, the Auth Network generates signatures corresponding to the
8678
nodes and returns them to the user's end. These signatures are then used alongside other shares to
8779
generate the final TSS Account signatures.
8880

81+
### Hashed Cloud Factor
82+
83+
The MPC Core Kit SDK starts in a 2/2 flow by default. This means when user's logs in, a social login
84+
factor is generated and at the same time SDK will generate a hashed cloud factor. This hashed cloud
85+
factor is derived on the front end and stored in the encrypted metadata server. Please refer to the
86+
above architecture to understand more about factors.
87+
88+
This is done to make sure the user can access their account from any device without having to
89+
generate a new factor. The hashed cloud factor is deleted when the user enables the MFA.
90+
8991
### Device Factor (Factor Index: 2)
9092

9193
This is the second factor used to access the user's account. This step involves the generation of a
@@ -107,12 +109,23 @@ backup factor of your choice like social recovery, Email OTP, SMS OTP, Authentic
107109
## Threshold
108110

109111
The threshold is the minimum number of shares required to generate a final signature for the TSS
110-
Account. This threshold, by default, is set to 3/5 on the Auth Network and 2/3 for the user's device
111-
front. This ensures high availability and ease of access on both ends alongside optimum security.
112-
Both these thresholds can be customized according to the requirements.
112+
Account. By default, the Auth Network requires 3 out of 5 shares (3/5) to generate a signature. This
113+
means that out of the 5 shares distributed across different nodes, any 3 shares can be combined to
114+
create the final signature. This setup ensures high availability and security, as it allows for some
115+
shares to be unavailable or compromised without affecting the overall system.
116+
117+
On the user's device front, the default threshold is set to 2 out of 3 shares (2/3). This means that
118+
out of the 3 shares available on the user's device, any 2 shares can be used to generate the final
119+
signature. This setup provides a balance between security and ease of access, ensuring that the user
120+
can still access their account even if one share is unavailable.
121+
122+
Only the user level threshold can can be customized according to the requirements. The Auth Network
123+
threshold is fixed at 3/5.
113124

114-
Please note that when user logs in for the first time, the threshold is set to 2/2. The threshold is
115-
set to 2/3 after the user enables the MFA flow.
125+
Please note that when a user logs in for the first time, the threshold is set to 2 out of 2 shares
126+
(2/2). This means that both shares are required to generate the final signature. After the user
127+
enables the MFA flow, the threshold is set to 2 out of 3 shares (2/3), providing an additional layer
128+
of security.
116129

117130
## Components of a Factor
118131

@@ -123,9 +136,10 @@ the user. These shares are generated using distributed key generation(DKG) and a
123136
Auth Network and the user's device. Since these shares are generated using MPC, they are **never
124137
reconstructed** and always stay decentralized and secure.
125138

126-
However, we have exposed a function to reconstruct the TSS Key from the shares in the SDK. This
127-
function has been marked unsafe since there is no direct use case for it other than key exports in
128-
the case the user wants to own it completely.
139+
We've included a function in the SDK that lets you reconstruct the TSS Key from the shares. Just a
140+
heads-up, this function is marked as unsafe, so it's best to use it with extra layers of security.
141+
For example, only make this function available when MFA is enabled and ask the user to input their
142+
MFA share while exporting.
129143

130144
### Metadata Key & Shares
131145

0 commit comments

Comments
 (0)