🔐Wallet Security / 2FA

Next-Gen Key Management System using 2FA to safeguard SOL withdrawal and private key export functionality

Overview: BONKbot's Next-Generation Key Management System (KMS) is a custom-built software and hardware solution designed to enhance the security of crypto transactions. It includes a Hardware Security Module (HSM) specifically tailored for this purpose.

Hardware Components:

  • Server Hardware: BONKbot uses dedicated servers equipped with AMD processors and Trusted Platform Modules (TPM) Version 2.

  • Secure Boot: Only BONKbot-signed images can be booted, ensuring that unauthorized software cannot run on the servers.

  • RAM Encryption: RAM encryption is enabled to protect data even if hardware is compromised.

Software Components:

  • Custom Unikernel: BONKbot's KMS software is built as a custom unikernel, combining the Linux kernel with the KMS application into a single, secure binary.

  • TPM-Based Security: The TPM measures and verifies each stage of the boot process, ensuring that only authorized firmware, kernel, and application versions can access critical keys.

Key Management:

  • Master Key: The KMS master key encrypts and authenticates all other keys managed by the system. It is never exposed to engineers and can only be decrypted by authorized systems.

  • Key Isolation: The KMS application is divided into three isolated processes:

    1. Message Bridge: Synchronizes encrypted keys and manages communication with BONKbot's business logic.

    2. HTTPS Client Pool: Ensures secure communication with Telegram.

    3. Signer: Manages encrypted private keys and handles signature requests securely.

User Interaction & Security:

  • Transaction Verification: When a transaction signature is requested, the KMS generates a human-readable description of the transaction and sends it to the user via Telegram. The user confirms their intent by selecting a response that is securely transmitted back to the KMS.

  • Master Key Protection: To protect against attacks, the master key is stored using a method that requires specific memory pages to be accessed in the correct order.

  • Additional Security: Users can enable 2FA or Passkey (e.g., Face ID) for added security. These features ensure that even if a Telegram account is compromised, the user's funds remain secure.

Backup and Rollout:

  • Private Key Backup: Users will have the opportunity to back up their private keys. This step is essential for maintaining control over assets and is necessary for upcoming features like multiwallet support.

  • Three-Phase Rollout:

    1. Phase 1: Gradual migration of user keys to the new system without any need for user intervention.

    2. Phase 2: Users will be prompted to back up their private keys and enable 2FA, ensuring they have secure control over their assets.

    3. Phase 3: Users will receive new private keys, and can choose to transfer their assets to the new key gradually or all at once.

Conclusion:

BONKbot's new KMS sets a new standard for security while maintaining the user-friendly experience that our users love. This is just the beginning of what BONKbot has in store, and we’re excited to share more in the future!

Last updated