Running DKG
Operator’s runbook. For the cryptographic protocol — the five rounds, the verifiable secret sharing, the security guarantees — see Security → MPC Protocol → Key Generation (DKG).
Distributed Key Generation creates a master key without any dealer: each participating signer generates its own key share locally, and the full private key is never assembled anywhere. This page walks the operator through the ceremony in the dashboard.
When DKG Is Needed
- First-time setup — after deploying The Vault and enrolling signers
- Additional master keys — for separate operational contexts (e.g., treasury vs. trading)
You do not need DKG for new wallets or addresses — those are derived from the existing master key.
Prerequisites
- All server signers deployed and healthy
- All mobile signers enrolled and approved (see Device Management)
- Mobile signer holders available with devices charged and connected
Threshold Schemes
The dashboard offers a fixed set of k-of-n schemes; you pick one and then select exactly n signers from the available active devices and servers:
| Scheme | Recommendation |
|---|---|
| 3-of-4 | Recommended for production |
| 3-of-5 | Higher availability |
| 3-of-3 | All signers required |
| 5-of-5 | All signers required (larger set) |
| 2-of-3 | Small teams |
A mobile signer is always required. For any wallet with enrolled mobile devices, the platform reserves at least one slot in every signing set for a mobile signer — servers can fill at most threshold − 1 slots. So even in a 2-of-3 wallet the two server signers cannot sign alone; one mobile signer is always part of the quorum. This holds regardless of how the shares are distributed.
The only exception is a server-only wallet — a wallet created with no mobile devices, which is auto-signed by the servers. This is a deliberate, opt-in choice for automation workloads; do not create a server-only wallet unless unattended signing is exactly what you intend.
Creating a Master Key
Start Master Key Creation
On the Wallets page, click Create master key (requires the
create_master_key permission), then confirm the Master key creation prompt
to Proceed. In the dashboard this flow is labelled “master key creation”; DKG
is the underlying cryptographic ceremony it runs.
Choose the Scheme and Signers
In the Signing devices and servers dialog, select an MPC scheme (k of n)
from the fixed list, then select exactly n signers from the Mobile Devices
and Servers shown — only active signers appear. Click Create.
Signers Participate
All signers participate automatically — there is no approval tap on mobile. Each selected mobile device must be online with The Vault app open so it can join the ceremony; the holder sees a confirmation on the device once key generation completes.
Completion
Each pair of signers performs a Noise XX handshake for end-to-end encryption, then the DKG protocol runs. On success each party holds one key share and the new key appears in the list.
The DKG ceremony has a 5-minute timeout. Coordinate a specific time window with all signer holders before initiating.
If DKG Fails
| Failure | Resolution |
|---|---|
| Timeout — mobile signer didn’t respond | Ensure holder has the app open and connected, then retry |
| Server signer disconnected | Verify server signer health, then retry |
| Verification failure | Ceremony aborts safely — no key material created. Retry |
A failed DKG has no side effects — no shares are persisted until the ceremony completes successfully.