Overview

The backup and recovery process for the collateral workspace differs from the standard process because independent access to the collateral workspace's private keys would bypass the collateral locking mechanism and impact the exchange's ability to provide you with the available balance for trading.

As part of the Off-Exchange onboarding process, unless the exchange exempts you, a DRS kit for your collateral workspace is created and delivered to CoinCover.

All collateral workspaces are backed up using CoinCover. The workspace key backup occurs automatically between CoinCover, the exchange, and Fireblocks. You are not required to take any action beyond the workspace Owner approving the backup.

Workspace key backup

Collateral workspace backups use:

• An Auto-Generated Passphrase (AGP) for the owner’s mobile key share
• An RSA public key provided by the exchange for the two cloud co-signer key shares

The diagram below provides an overview of the Workspace Key Backup sent to CoinCover.

In this workflow:

1. Before initiating the backup process, the Off-Exchange partner generates a public-private key pair and shares the public key with Fireblocks Support (the OE Backup Public Key).
2. Fireblocks Support initiates the backup process using the OE Backup Public Key.
3. Fireblocks requests a separate public key from CoinCover (the CC Backup Public Key).
4. The CC Backup Public Key is then sent to the collateral workspace's Owner device. The Owner is prompted to approve the backup on their Fireblocks mobile app, and once approved, the app securely generates an Auto-Generated Passphrase (AGP), which is used to encrypt the owner's key shares (AGP-Encrypted Mobile Key Shares or AGP-EMKS).
5. The AGP is then encrypted with CC Backup Public Key (Encrypted Auto-Generated Passphrase or EAGP). Both AGP-EMKS and EAGP are sent to the Fireblocks backup service.
6. The OE Backup Public Key is then sent to Fireblocks’ trusted core services. The two cloud co-signers encrypt the collateral workspace’s cloud key shares, and the encrypted cloud key shares are sent to the Fireblocks backup service.
7. The Fireblocks backup service then creates a zip package that includes the EAGP, AGP-EMKS, and the encrypted cloud co-signer key shares. The package is securely sent to CoinCover.

The Key Recovery Process

The key recovery process is subject to the terms and conditions defined between CoinCover, the exchange, and your organization.

The recovery process is as follows:

1. The exchange (or the exchange together with Fireblocks) may approach CoinCover to initiate recovery of the DRS kits.
2. CoinCover independently verifies the outage.
3. CoinCover delivers the DRS kits to the exchange and notifies Fireblocks.
4. The exchange performs the recovery and moves the assets from Off-Exchange CVAs to regular exchange accounts.