Refresh & Recovery
Two operations maintain the health and availability of key shares over time: refresh rotates all shares proactively, and recovery restores a lost share to a new device.
Key Refresh
Refresh cryptographically rotates all key shares without changing the master key or any wallet addresses. After a refresh, each signer holds a new share that is mathematically unrelated to the old one.
Why Refresh
Protects against piecemeal attacks — if an attacker compromises one share, it becomes useless after a refresh.
| Trigger | Description |
|---|---|
| Scheduled rotation | Quarterly recommended |
| Security incident | Any suspected share compromise |
| Employee offboarding | Mobile signer holder leaves |
| Post-recovery | After restoring a lost share |
What Changes
| Component | After Refresh |
|---|---|
| Key shares | New — unrelated to previous shares |
| Master key | Unchanged |
| All wallet addresses | Unchanged |
| Signing threshold | Unchanged |
Running a Refresh
Initiate
From Wallets → Keys, open the key’s actions and choose Refresh shares.
Approval
An admin quorum must approve the refresh request.
Ceremony
All n signers participate simultaneously. Each pair establishes an encrypted channel via Noise Protocol, then the protocol produces new shares with an incremented version number. Old shares are securely zeroised.
Confirm
The dashboard shows the master key with an updated share version. All signers display Share Held with the new version.
A failed refresh has no effect — old shares remain valid. Retry when all signers are available.
Key Recovery
Recovery restores a lost key share to a replacement device without ever reconstructing the full private key. The remaining signers cooperate to re-issue a share using Publicly Verifiable Encryption (PVE).
This is a cryptographic re-sharing operation, not a backup restore. It works even without traditional backups, as long as a quorum of signers is available.
When Recovery Is Needed
| Scenario | Impact |
|---|---|
| Mobile device lost or stolen | The key share stored on that device is lost |
| Device replacement | Key shares don’t transfer between devices |
| App reinstalled | App storage wiped, share erased |
| Server signer decommissioned | Share must be re-issued to replacement |
Recovery Flow
Block the Lost Device
In Settings → Devices, select the lost device and click Block. This logs the device out immediately and excludes it from signing.
Enroll the Replacement Device
Follow the Device Management enrollment procedure. The replacement device must reach Active status.
Initiate Recovery
From Wallets → Keys, open the key’s actions and choose Recover share. Select the lost party and the replacement device.
Helper Participation
The remaining signers (helpers) each produce a partial decryption share using their PVE RSA key. A threshold number of helpers (k) must participate.
Completion
The replacement device combines partial decryptions to reconstruct the share, verifies it against public key commitments, and stores it in secure hardware. The dashboard shows the replacement device as an active signer.
Always perform a Key Refresh after a successful recovery. The recovered party lacks a PVE RSA key until refresh regenerates backup bundles for all parties.
Recovery vs. Refresh
| Recovery | Refresh | |
|---|---|---|
| Purpose | Restore one lost share | Rotate all shares |
| When | Device lost or replaced | Scheduled or post-incident |
| Participants | k helpers + replacement device | All n signers |
| What changes | One party gets a new share | All shares replaced |
| Follow-up | Refresh recommended | None |
For backup-based procedures, see Key Backup & Recovery.