Skip to content
Logo

Passkey vault

The vault keeps a wallet's seed sealed under each of its passkeys, so that the same passkey restores the wallet on a new device. It can't open the seed.

Restoring

  1. The wallet asks the vault for a challenge.
  2. The passkey signs it, and gives its PRF output in the same prompt.
  3. The vault checks the signature and returns the sealed seed.
  4. The PRF output opens it on the device.

Only Outis

The browser or the phone writes the caller's origin into what the passkey signs. The vault hands the sealed seed only to Outis's own extension and Android app. Another extension that uses the passkey signs with its own origin, and is refused.

What it keeps

  • For each wallet: the wallet key's public key, which says nothing about the accounts.
  • For each passkey: its ID, public key and provider, the day it was added, and the sealed seed.

No email, address or IP. Adding a passkey takes a signature from the wallet key and one from the new passkey; removing one takes the wallet key's.