πWallet Security / 2FA
Next-Gen Key Management System using 2FA to safeguard SOL withdrawal and private key export functionality
Overview: BONKbot's Next-Generation Key Management System (KMS) is a custom-built software and hardware solution designed to enhance the security of crypto transactions. It includes a Hardware Security Module (HSM) specifically tailored for this purpose.
Hardware Components:
Server Hardware: BONKbot uses dedicated servers equipped with AMD processors and Trusted Platform Modules (TPM) Version 2.
Secure Boot: Only BONKbot-signed images can be booted, ensuring that unauthorized software cannot run on the servers.
RAM Encryption: RAM encryption is enabled to protect data even if hardware is compromised.
Software Components:
Custom Unikernel: BONKbot's KMS software is built as a custom unikernel, combining the Linux kernel with the KMS application into a single, secure binary.
TPM-Based Security: The TPM measures and verifies each stage of the boot process, ensuring that only authorized firmware, kernel, and application versions can access critical keys.
Key Management:
Master Key: The KMS master key encrypts and authenticates all other keys managed by the system. It is never exposed to engineers and can only be decrypted by authorized systems.
Key Isolation: The KMS application is divided into three isolated processes:
Message Bridge: Synchronizes encrypted keys and manages communication with BONKbot's business logic.
HTTPS Client Pool: Ensures secure communication with Telegram.
Signer: Manages encrypted private keys and handles signature requests securely.
User Interaction & Security:
Transaction Verification: When a transaction signature is requested, the KMS generates a human-readable description of the transaction and sends it to the user via Telegram. The user confirms their intent by selecting a response that is securely transmitted back to the KMS.
Master Key Protection: To protect against attacks, the master key is stored using a method that requires specific memory pages to be accessed in the correct order.
Additional Security: Users can enable 2FA or Passkey (e.g., Face ID) for added security. These features ensure that even if a Telegram account is compromised, the user's funds remain secure.
Backup and Rollout:
Private Key Backup: Users will have the opportunity to back up their private keys. This step is essential for maintaining control over assets and is necessary for upcoming features like multiwallet support.
Three-Phase Rollout:
Phase 1: Gradual migration of user keys to the new system without any need for user intervention.
Phase 2: Users will be prompted to back up their private keys and enable 2FA, ensuring they have secure control over their assets.
Phase 3: Users will receive new private keys, and can choose to transfer their assets to the new key gradually or all at once.
Conclusion:
BONKbot's new KMS sets a new standard for security while maintaining the user-friendly experience that our users love. This is just the beginning of what BONKbot has in store, and weβre excited to share more in the future!
Last updated