Skip to main content
Para uses a 2-of-2 Multi-Party Computation (MPC) system. When a user creates a wallet, the private key is generated in a distributed process; it is never assembled in one place at any point in its lifecycle.

​
Key Shares

The two key shares are:
  1. User Share: stored on the user’s device, protected by their passkey and biometrics. Acts like a hot wallet for immediate signing.
  2. Para Share: stored in Para’s cloud hardware security modules (HSMs). Provides a secure off-device backup and enables recovery.
To sign a transaction, both shares participate in a cryptographic signing ceremony that produces a valid signature without ever reconstructing the full private key. Neither share alone can produce a signature.
Neither Para nor the integrating application ever sees the full private key. This is true during key generation, signing, and recovery.

​
MPC Implementation

Para uses the DKLS19 MPC algorithm, leveraging an for core functions including distributed key generation (DKG), signing ceremonies, and non-custodial wallet generation. Distributed Key Generation (DKG): When a user creates a wallet, Para initiates a DKG process that generates the User Share and Para Share without ever assembling the full private key. This ensures no single party has access to the complete key, even during generation. Signature structure: Para uses the EIP-712 transaction signature interface. For Ethereum-based integrations, Para publishes an EIP-1193 Provider, most commonly used via Wagmi Connectors.

​
Hardware Secure Enclaves and Passkeys

Modern devices include hardware secure enclaves: dedicated, isolated processors for storing and protecting sensitive data. These enclaves support the secp256r1 elliptic curve, while most blockchains use secp256k1. Para bridges this gap by generating a passkey (secp256r1) stored in the device’s secure enclave. This passkey authorizes access to the Para Share, which then participates in a secp256k1 signing ceremony. The result: users authenticate with device-native biometrics (Face ID, fingerprint, etc.) while the system produces blockchain-compatible signatures.
PropertyDetails
Hardware-level protectionAuthentication key lives in the device’s secure enclave, isolated from the OS
Biometric confirmationEvery sensitive operation requires physical presence via Face ID, fingerprint, or device PIN
WebAuthn compliancePasskeys follow the WebAuthn standard for phishing-resistant authentication

​
MPC vs Multi-sig

MPCMulti-sig
How it worksSplits a single private key across multiple parties. Parties jointly compute a signature without ever reconstructing the keyRequires multiple separate private keys to approve a transaction. Each key is complete on its own
Key exposureThe full key never exists in memory at any pointEach individual key is a complete private key that could be compromised independently
On-chain footprintProduces a standard single signature, indistinguishable from a regular walletRequires a smart contract or multi-sig scheme visible on-chain
These approaches are complementary, not competing. Para can serve as signer infrastructure on a multi-sig setup using Safe or as a signer for ERC-4337 smart accounts. This combination offers MPC-level key security for each signer while still benefiting from multi-sig governance or smart account features like gas sponsorship and batched transactions.

​
Key Management FAQs

Para uses the DKLS19 MPC algorithm and leverages an open-source implementation for core functions like distributed key generation, signing ceremonies, and non-custodial wallet generation.
Para uses the EIP-712 transaction signature interface. Para also publishes an EIP-1193 Provider, most commonly used via Wagmi Connectors, ensuring compatibility with a wide range of Ethereum-based applications and tools.
The biometric key is stored on-device in a secure enclave. For Ethereum-based transactions, Para uses secp256k1 curve signatures. The secure enclave supports the secp256r1 curve, so Para generates a secp256r1 key that authorizes a secp256k1 curve signature for ECDSA signatures, bridging this compatibility gap securely.
Multi-sigs require separate private keys to approve a transaction. MPC splits a single private key across multiple parties, and parties jointly sign without ever reconstructing the key. Para can also serve as signer infrastructure on a multi-sig setup using Safe or ERC-4337 smart accounts.

Security & Trust Model

Full security overview including authentication, encryption, and audits

Wallet Recovery

How key shares are recovered after device loss