Disaster Recovery Service (DRS) with CoinCover protects you with two backups: one for a permanent Fireblocks outage, and one for a lost Owner passphrase.
Fireblocks has partnered with CoinCover to offer DRS. Each backup is designed so that CoinCover can't open all of your key shares on its own.
What's included in the service
DRS includes two separate backups. They protect against different situations and are encrypted differently.
| Workspace key backup | Key share backup for Owners | |
|---|---|---|
| Protects against | Fireblocks becomes permanently unavailable | The Owner loses their device and forgets their recovery passphrase |
| CoinCover holds | Your encrypted workspace key backup | The encrypted auto-generated passphrase only |
| Fireblocks holds | Nothing | The Owner's key share, encrypted with the auto-generated passphrase |
| Owner's recovery passphrase | Required | Not required |
Workspace key backup
The workspace key backup lets you rebuild your workspace keys and keep access to your assets if Fireblocks becomes permanently unavailable. CoinCover holds this backup, so you don't need to store and maintain an offline, air-gapped machine in advance. You only need an offline machine to rebuild your keys if a disaster occurs.
In this backup, the Owner's mobile key share remains encrypted with the Owner's recovery passphrase. The Owner's recovery passphrase stays with the Owner. It is not sent to CoinCover. This means CoinCover can't open all of your key shares on its own. Recovery needs both the CoinCover backup and the Owner's recovery passphrase.
You can ask CoinCover to replace or destroy your workspace key backup at any time. If the Owner forgets their recovery passphrase, Fireblocks recommends resetting the passphrase and creating a new backup. A full workspace key recovery is rarer than a key share recovery.
Key share backup for Owners
The key share backup for Owners lets the Owner recover their key share on a new device after losing both their device and their recovery passphrase. Fireblocks stores the Owner's key share, encrypted with an auto-generated passphrase. CoinCover holds only that passphrase, encrypted with CoinCover's Backup Public Key. Neither party can restore the key share alone.
The Owner can lose access to the key share when:
- You change your device's biometric settings or lose your Fireblocks mobile app PIN.
- You lose or damage your device.
- You are replacing your device.
- You delete the Fireblocks mobile app from your device.
This backup applies only when the Owner has also forgotten the recovery passphrase.
To recover the key share:
- Contact Fireblocks Support. Support puts the Owner in DRS recovery mode.
- On the new device, the Owner receives the key share, encrypted with the auto-generated passphrase.
- The Owner gets the auto-generated passphrase from CoinCover and enters it on the new device to restore the key share.
Onboarding to CoinCover
Step 1: Legal and commercial agreements
- Contact your Customer Success Manager to ask to onboard with CoinCover.
- Sign a Fireblocks Third Party Letter Agreement.
- Sign CoinCover's Terms and Conditions, which your Customer Success Manager provides.
- Use the link from your Customer Success Manager to set up your Access Control List (ACL).
Step 2: Complete the workspace key backup
- Make sure the Owner's device is activated and fully enrolled with the MPC key share.
- Make sure the Owner's Fireblocks mobile app is on the latest version.
- Submit a Fireblocks Support ticket with the name of the workspace that needs the backup.
- Wait for the confirmation that CoinCover received your workspace key backup from Fireblocks.
Step 3: Complete the key share backup
When your workspace key backup is sent to CoinCover, the Owner receives a notification on their mobile device, and an action card appears in the mobile app. The Owner then completes the key share backup:
- Select the notification or the card.
- Select Create backup.
- Enter your PIN.
- Authenticate with your phone's biometrics.
- Wait for the message that confirms the backup is complete.
The Owner must complete these steps manually. Until they do, the key share backup is incomplete. If the Owner's recovery passphrase is reset, the workspace Owner changes to a different user, or the Owner wants to run a test, contact Fireblocks Support to create a new workspace key backup and key share backup for CoinCover.
Related articles
To learn more about key share backup and workspace key backup, see: