Platform

Verifiable Backup

Verifiable Backup lets users generate an encrypted backup of their MPC wallet that can be verified as correct without decryption. This means you can confirm a backup is valid before storing it, without ever exposing the private key.

Backup is not exposed directly in the client SDK. Instead, you make a POST request to the cloud node's backup endpoint to generate an encrypted backup of the server's share, then use the SDK's verify method to confirm the backup is correct.

It's your responsibility to expose this endpoint securely. For example:

• When a user requests a backup, your backend authenticates them (2FA, etc.).
• Your backend calls the cloud node's backup endpoint and returns the encrypted backup to the client.
• The client verifies the backup using the SDK's verify method.

Never expose the backup endpoint directly to users.

ECDSA

App.tsx

import { type EcdsaSession, ecdsaVerifyBackup } from '@silencelaboratories/silent-shard-sdk/ecdsa';
import { Platform } from 'react-native';

const CLOUD_NODE_URI = Platform.select({ android: '10.0.2.2', ios: 'localhost' }) + ':8080';

export const keyBackup = async (
  session: EcdsaSession,
  // RSA public key in PEM format
  rsaPublicKeyPEM: string = '<RSA_PUBLIC_KEY_PEM>'
) => {
  // Creating a new keyshare for demo purpose. In real application, you can use an existing keyshare.
  const keyshare = await session.keygen();

  // Backup
  const label = 'example-backup';
  const backupRes = await fetch(`http://${CLOUD_NODE_URI}/v3/ecdsa/backup`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      key_id: keyshare.keyIdHex, // Use Hex version of keyId for server request
      rsa_pubkey_pem: rsaPublicKeyPEM,
      label,
    }),
  });
  const backupJson = await backupRes.json();

  const backupConfig = {
    keyshare: keyshare,
    rsa_public_pem: rsaPublicKeyPEM,
    backup: backupJson.verifiable_backup,
    label,
  };

  const isVerified = await ecdsaVerifyBackup(backupConfig);
  console.log('Is backup verified:', isVerified);
};

EdDSA

App.tsx

import { type EddsaSession, eddsaVerifyBackup } from '@silencelaboratories/silent-shard-sdk/eddsa';
import { Platform } from 'react-native';

const CLOUD_NODE_URI = Platform.select({ android: '10.0.2.2', ios: 'localhost' }) + ':8080';

export const keyBackup = async (
  session: EddsaSession,
  // RSA public key in PEM format
  rsaPublicKeyPEM: string = '<RSA_PUBLIC_KEY_PEM>'
) => {
  // Creating a new keyshare for demo purpose. In real application, you can use an existing keyshare.
  const keyshare = await session.keygen();

  // Backup
  const label = 'example-backup';
  const backupRes = await fetch(`http://${CLOUD_NODE_URI}/v3/eddsa/backup`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      key_id: keyshare.keyIdHex, // Use Hex version of keyId for server request
      rsa_pubkey_pem: rsaPublicKeyPEM,
      label,
    }),
  });
  const backupJson = await backupRes.json();

  const backupConfig = {
    keyshare: keyshare,
    rsa_public_pem: rsaPublicKeyPEM,
    backup: backupJson.verifiable_backup,
    label,
  };

  const isVerified = await eddsaVerifyBackup(backupConfig);
  console.log('Is backup verified:', isVerified);
};

Please refer to the Session creation guide to learn how to create a session.

Step 1: Fetch the server's encrypted backup. Make a POST request to the backup endpoint (/v3/ecdsa/backup or /v3/eddsa/backup) with:

• key_id: the keyshare's key ID (hex string, from the Keyshare's keyIdHex)
• rsa_pubkey_pem: an RSA public key in PEM format
• label: a label used as associated data for the RSA encryption

Step 2: Verify the backup. Call ecdsaVerifyBackup(), which takes a EcdsaVerifyBackupConfig with:

• keyshare: your client share (a Keyshare)
• rsaPublicKeyPEM: the RSA public key in PEM format
• backup: the encrypted backup from the server response
• label: the same label used when requesting the backup

Returns a boolean indicating whether the backup is valid.