​
Architecture Overview

Dynamic’s TSS-MPC implementation uses a default 2-of-2 threshold signature scheme, where:

​
Key Share Management

During Wallet Creation:

  1. The User Share is generated and stored locally on their device (on web, this is done in an iFrame)
  2. The Dynamic Server Share is generated and stored by Dynamic in encrypted form
  3. An encrypted copy of the User Share is stored by Dynamic using User Share Backup Options
  4. The backup is encrypted using the Encryption Proxy Service
  5. Dynamic cannot decrypt the backup without the user
  6. Users can optionally add Passcode Encryption for additional backup security

When Signing Transactions:

  1. The User Share signs from their local device
  2. The encrypted Dynamic Server Share is decrypted and used for signing within a TEE (Trusted Execution Environment)
  3. The complete private key never exists, even within the TEE

This Architecture Ensures That:

  • No single party has complete control of the private key
  • Users maintain self-custody of their wallet
  • Recovery is possible if a user loses access to their device
  • The system is resistant to compromise of any single party
  • All sensitive signing operations are protected within a TEE for additional security

For advanced recovery options including cloud backup (Google Drive/iCloud) and upgrading to a 2-of-3 setup, see our Recovery documentation.

​
Technical Implementation

​
Distributed Key Generation (DKG)

The wallet creation process begins with Distributed Key Generation, where multiple parties work together to generate key shares without ever constructing the complete private key. Each participant produces random values and engages in a secure protocol to generate their portion of the key, ensuring that no single party ever has access to the complete private key.

​
Communication Security Using MPC Relay

All communication between parties during key generation and signing is secured through our MPC Relay infrastructure. The relay:

  • Ensures authenticated and encrypted communication channels
  • Manages session establishment and party coordination
  • Provides fault tolerance and retry mechanisms
  • Implements rate limiting and abuse prevention

​
Key Management Operations

To maintain security over time, two key management operations are available:

  • Key Resharing: Modifies the existing parties or updates the threshold signature scheme
  • Key Refreshing: Rotates existing key shares to generate new cryptographically equivalent shares

​
Protocols

We employ the following TSS-MPC cryptographic protocols in our SDK using audited libraries:

​
Signature Schemes