Overview

The Wallet Master Key shares are generated via multiparty computation (MPC) when Institutional Vault launches for the first time. All other keys and addresses are derived from those Master Key shares. Institutional Vault uses the Emergency Recovery System (ERS) to produce encrypted recovery material that can reconstruct the master key. You generate an RSA key pair, supply the public key in wallet or Policy Node configuration (or via Vault APIs), and store the private key offline.

📘

Note:

Anyone who holds both the ERS private key and the encrypted backup material can retrieve the master key.

ERS encrypts key shares on each Policy Node. For recovery tooling and procedures, see Emergency Recovery. Generate the ERS key pair before install with Create ERS Key.

Before the wallet can be used in production, recovery material must be downloaded and stored securely. On first admin login the UI prompts for an initial Backup Master Key download. You can run additional backups later through Vault APIs (see Repeat backups via Vault APIs).

How to Backup Master Key (UI)

To complete the initial backup from the Vault UI:

1. Click Settings on the main navigation menu.

2. Click the Backup Key control (shown during first-time setup, or where your deployment still exposes it in Settings).

3. Your browser downloads the backup key as a .JSON file. Store it separately from the live system and from the ERS private key.

Repeat backups via Vault APIs

Master key backup is not limited to a single download. After the initial UI backup, authorized API callers can start another backup with:

POST /api/cwp/operations/start/backupMasterKey

Request body includes the master key Name (and optional start metadata such as OperationID / InitiatorID). Poll operation status until completion, then store the encrypted key-share output offline.

Typical reasons to re-backup:

• Refresh stored recovery material after operational change.
• Produce a new blob after rotating the ERS public key through POST /api/cwp/operations/start/setERSPublicKey (when the ERS key is managed in the data store rather than only in Policy Node config).
• Re-run a recovery drill with current ciphertext.

📘

Note:

Backup requires a configured ERS public key. Backup fails if an ERS public key is present in both Policy Node configuration and the data store at once. Prefer a single source of truth for the ERS public key, and keep every historical backup blob with the private key that can decrypt it.

API reference: Backup Master Key and your deployment Swagger UI at /swagger.html.