Storage Options, Multi-Device Coordination, and Redundancy Logic
iOS provides multiple mechanisms for securely storing cryptographic material. Each offers different trade-offs between security, accessibility, and recoverability.
What: Hardware-isolated cryptographic processor on A-series chips.
Security: Private keys never leave the enclave. Operations performed in isolation.
Use: Master keys, signing operations, MPC party shares.
Trade-off: Limited key count (~32 keys). Cannot backup or export.
What: Encrypted sync across Apple devices (iPhone, iPad, Mac).
Security: AES-256 encryption, each device has its own encryption key.
Use: Non-critical keys, recovery codes, backups.
Trade-off: Requires iCloud account. Keys at rest in Apple's cloud. Device loss triggers sync delays.
What: App sandbox with file-level encryption.
Security: Class-based protection: Complete, Protected, or Protected Unless Open.
Use: Share data, temporary keys, recovery workflows.
Trade-off: Local-only. Lost if device is reset. Backed up to iCloud or encrypted backups.
What: Local encrypted backup to computer (Desktop/Laptop).
Security: Optional password protection, stored on trusted computer.
Use: Offline backup of Keychain and sensitive data.
Trade-off: Requires manual setup. Only as secure as the backup computer.
1. Secure Enclave: No backup, maximum isolation. For master keys only.
2. iCloud Keychain: Encrypted cloud sync. For recovery and secondary keys.
3. Filesystem (Protected): Device-local encryption. For MPC party shares.
4. Encrypted Backup: External storage. For disaster recovery.
iOS devices can coordinate cryptographic operations via Bluetooth using the MultipeerConnectivity framework (peer-to-peer) or via a commitment server (network-coordinated).
✓ No server required
✓ Fast (Bluetooth range ~100m)
✓ Direct peer-to-peer trust
✗ Proximity required
✗ Both devices online simultaneously
✗ No transaction history
Co-located device setup
Initial 2-party DKG ceremony
Emergency recovery (nearby devices)
✓ Devices don't need proximity
✓ Asynchronous messaging
✓ Audit trail available
✗ Server can observe metadata
✗ Server downtime = blocked signing
✗ Requires server deployment
Distributed multi-device setup
Continuous signing operations
Cloud-backed MPC
In a 2-party MPC scheme, the commitment server acts as Party 1, with the iOS device as Party 2. The server is "committed" because it cannot collude with the device without revealing the scheme.
Party 1 (Server):
Party 2 (iOS Device):
Trust Model: Server and device are honest-but-curious. Neither can forge a signature alone. Both must be compromised to steal the key.
For maximum redundancy, MPC shares can be backed up to external USB-C storage or via iCloud. The following strategies balance convenience with security.
Option A (Highest Redundancy): Party 2 share on device AND on encrypted USB. If phone is lost, recover from USB.
Option B (iCloud Sync): Party 2 share syncs to other devices via Keychain. Seamless multi-device access.
Combined (Recommended): Party 2 on Secure Enclave + USB backup + iCloud Keychain for redundancy across 3 locations.
USB drives can be lost, stolen, or corrupted. Always pair USB backup with either iCloud Keychain sync OR a second USB drive stored separately. Never rely on a single USB as the only backup.
When generating keys for 2-party MPC, the user configures where each party's share is stored and how backups are handled.
Select all that apply for redundancy
For distributed setups with 3+ parties, each holding a share of an encryption key, we can combine AND/OR logic to create flexible redundancy strategies.
Credible Minimum: The smallest threshold where no single party can unilaterally sign or reveal the secret. In 2-of-3, you need ANY 2 out of 3 parties to recover.
Distribution:
Recovery Scenarios:
Combine portable (A) + physical (B) + cloud (C). Tolerates any 1 loss. Recommended for most users.
2-of-4 scheme. Tolerates 2 losses. Highest security for institutional use.
| Aspect | iPhone iCloud Backup | 2-of-3 MPC Shares | USB + iCloud Hybrid |
|---|---|---|---|
| Restore Time | Minutes (cloud sync) | Minutes (reconstruct) | Minutes (hybrid) |
| Loss Tolerance | Depends on iCloud account | Lose 1 part, recover with 2 | Tolerate 1-2 losses |
| Single Point of Failure | iCloud account compromise | No single point (distributed) | No single point (distributed) |
| Offline Recovery | Requires internet | Air-gapped (fully offline) | Air-gapped (fully offline) |
| Best For | Day-to-day recovery | Cold storage vault | Optimal: both strategies |
Recommendation: Use iCloud backup for convenience and 2-of-3 MPC shares for security redundancy. Both can coexist: iCloud for daily recovery, USB-C shares for emergency vault storage.
When setting up MPC on iOS, the app presents a series of options leading to a recommended configuration. Below is the decision tree.
The user's answers determine whether to recommend Secure Enclave only, iCloud sync, USB backup, or full 2-of-3 distributed scheme.
Party 2 Share: Secure Enclave (primary) + iCloud Keychain (sync) + USB-C (optional emergency)
Party 1 Server: Commitment server with HTTPS and audit logging
Signing: Require biometric (Face ID/Touch ID) + server authentication
Recovery: Reconstruct via iCloud + USB if phone lost; reconstruct via server + USB if both devices compromised