MPC or SSS for Passkey Encryption of the Private Key for Multiple Keys

[eminogrande]

The idea is to encrypt the Bitcoin private key via multiple passkey PRFs so the user can add multiple passkeys each able to decrypt the Bitcoin private key.

The encryped bitcoin private key will be stored in the icloud keychain but can also be exported by the user and stored somewhere safely.

Maybe it would be fun to generate a bip39 seed out of the encrypted key, this would also trick hackers and work as plausible deniabliity (like a better salt).

@claude create a plan for this (draft, wip)

[claude]

Claude finished @eminogrande's task —— View job

---

MPC/SSS Passkey Encryption Implementation Plan for Bitcoin Private Keys

I've completed the analysis and created a comprehensive plan for implementing multi-passkey encryption of Bitcoin private keys using Shamir's Secret Sharing.

Progress Checklist

• Read repository structure and understand current codebase
• Analyze existing Bitcoin private key management implementation
• Research current passkey implementation in the codebase
• Compare MPC vs SSS approaches for multi-passkey encryption
• Design architecture for multi-passkey Bitcoin private key encryption
• Plan iCloud keychain integration and export functionality
• Design BIP39 seed generation for plausible deniability
• Create comprehensive implementation plan

Executive Summary

Recommendation: Implement Shamir's Secret Sharing (SSS) with Passkey PRF encryption

This approach provides threshold-based access to Bitcoin private keys through multiple passkeys while maintaining security, usability, and compatibility with the existing Nuri architecture.

Detailed Implementation Plan

Phase 1: Core SSS Infrastructure (Weeks 1-2)

1.1 Shamir Secret Sharing Service (ShamirSecretService)

// New service in Nuri/Sources/Services/ShamirSecretService.swift
class ShamirSecretService {
    func createShares(secret: Data, threshold: Int, total: Int) -> [Data]
    func reconstructSecret(shares: [Data]) -> Data?
    func validateShare(share: Data) -> Bool
}

1.2 Multi-Passkey Management (MultiPasskeyManager)

// New service in Nuri/Sources/Services/MultiPasskeyManager.swift
class MultiPasskeyManager {
    func setupMultiPasskeyWallet(threshold: Int, passkeys: [PasskeyInfo]) async throws
    func addPasskey(to wallet: String, passkey: PasskeyInfo) async throws
    func removePasskey(from wallet: String, passkey: PasskeyInfo) async throws
    func reconstructWallet(with passkeys: [PasskeyInfo]) async throws -> String
}

Phase 2: Passkey PRF Integration (Week 3)

2.1 Enhanced Passkey Service

• Extend PasskeyAuthenticationService to support PRF operations
• Implement deterministic key derivation from passkey credentials
• Add support for share encryption/decryption using PRF output

2.2 Share Encryption Layer

extension PasskeyAuthenticationService {
    func derivePRFKey(credential: PasskeyCredential, salt: Data) async throws -> Data
    func encryptShare(_ share: Data, with credential: PasskeyCredential) async throws -> Data
    func decryptShare(_ encryptedShare: Data, with credential: PasskeyCredential) async throws -> Data
}

Phase 3: Storage & Backup Integration (Week 4)

3.1 Enhanced iCloud Keychain Storage

• Modify ICloudBackupService to support multiple encrypted shares
• Implement share synchronization across devices
• Maintain backward compatibility with existing single-key backups

3.2 Server-Side Share Backup

• Extend passkey server API with share storage endpoints
• Implement authenticated share upload/download
• Add redundancy and availability guarantees

Phase 4: BIP39 Plausible Deniability (Week 5)

4.1 Steganographic BIP39 Export

class PlausibleDeniabilityService {
    func createDecoyExport(shares: [Data]) -> String  // Returns valid BIP39 with hidden payload
    func extractHiddenPayload(from bip39: String) -> [Data]?  // Recovers shares
    func generateValidDecoy() -> String  // Creates empty wallet seed
}

4.2 Export/Import Workflows

• QR code generation for easy backup
• File export with plausible deniability
• Share import and validation

Phase 5: Bitcoin Wallet Integration (Week 6)

5.1 Enhanced BitcoinWalletService

• Integrate multi-passkey reconstruction into existing wallet flows
• Maintain compatibility with existing single-key wallets
• Implement migration path from single-key to multi-passkey setup

5.2 UI/UX Components

• Passkey management interface
• Threshold configuration screens
• Share backup/restore workflows
• Migration assistance

Phase 6: Security & Testing (Week 7-8)

6.1 Security Hardening

• Implement secure memory handling for shares
• Add timing attack protections
• Audit cryptographic implementations
• Penetration testing

6.2 Comprehensive Testing

• Unit tests for all SSS operations
• Integration tests with existing services
• UI/UX testing across devices
• Recovery scenario testing

Technical Specifications

Security Model

• Threshold: 2-of-3 passkeys (configurable)
• Encryption: AES-256-GCM with passkey-derived keys
• Shares: Shamir's Secret Sharing over GF(2^256)
• Authentication: WebAuthn with PRF extension

Compatibility

• Backward Compatible: Existing single-key wallets continue working
• Forward Compatible: Easy migration to multi-passkey setup
• Cross-Platform: Passkey shares work across iOS devices
• Hardware Keys: Full support for YubiKey and other FIDO2 devices

Storage Strategy

• Primary: iCloud Keychain (encrypted shares)
• Secondary: Passkey server backup
• Emergency: Steganographic BIP39 export
• Local: iOS Keychain for active shares

Risk Analysis & Mitigations

Risks

1. Complexity: Multi-passkey system increases implementation complexity
2. User Error: Users may lose threshold number of passkeys
3. Recovery: More complex recovery scenarios
4. Performance: Additional cryptographic operations

Mitigations

1. Phased Implementation: Gradual rollout with extensive testing
2. User Education: Clear documentation and guided setup
3. Multiple Backup Methods: iCloud + server + export options
4. Optimization: Efficient crypto libraries and caching

Success Criteria

Functional Requirements

• Support 2-of-3 passkey threshold (minimum)
• Seamless integration with existing wallet
• Cross-device synchronization via iCloud
• Server-side backup redundancy
• BIP39 steganographic export
• Hardware key support (YubiKey, etc.)

Security Requirements

• No single point of failure
• Secure share distribution
• Forward secrecy for shares
• Protection against timing attacks
• Secure memory handling

User Experience Requirements

• Simple passkey setup flow
• Clear threshold explanation
• Easy backup/restore process
• Migration from single-key wallets
• Emergency recovery options

This plan provides a robust foundation for implementing multi-passkey Bitcoin wallet encryption while maintaining the security and usability standards expected from Nuri.

---