Securing the Seed Phrase

Since we leave seed phrase storage up to the client's application, it is important to be strategic with encryption factors for that seed phrase. The encryption factors determine the user experience when setting up the wallet and signing transactions. They also affect the security of the system. Since our system generates private keys from the master seed, balancing security and accessibility of the seed is essential.

SDK Implementation

Our default SDK implementation utilizes storage on the wallet holder's browser OR mobile device and a three part encryption:

1. a wallet holder's input such as a password/pin/biometric key that is not stored on any participating system (only known by the user)

2. an encryption key generated & stored on the user's device

3. a Wallaby salt value which is only accessible with valid authentication to Wallaby which requires that key from the user's device & a JWT from your system

This structure assumes that the existing authentication system used to generate your JWT is secure. You should be utilizing an MFA (preferably a TOTP) and expiring the session in a reasonable period of time.

API Implementation

The API implementation lets you choose your own encryption factors and storage location for the seed phrase. To decide what makes the most sense for your use case, you will want to evaluate the level of security you require, compare storage locations, and identify possible encryption factors.

To ensure you remain non-custodial, your decisions on storage location and encryption factors should leave you unable to independently access the seed phrase. If you would like to discuss your specific use case, please reach out to us.