Overview
MPC-CMP is the most secure protocol to hold and transfer digital assets. MPC-CMP has been fully available for all Fireblocks customers since February 2022.
Fireblocks is requiring all users who can sign transactions to update to MPC-CMP by July 31st, 2023. This applies to all users including API users with an Owner, Admin, or Signer user role using any device.
Follow the instructions below to complete migration to MPC-CMP for the Fireblocks mobile app and API Co-Signer instances.
Confirming MPC-CMP status
To confirm that the signing keys have been updated to MPC-CMP for any user, a workspace owner, admin, or non-signing admin can navigate to the settings page of the Fireblocks Console and view the Users page. The page lists all users including API users in the workspace and their status.
If a user recently completed their MPC-CMP update, you may need to refresh the User Settings page of the Fireblocks Console in your browser to view their current status.
Users assigned a signer role can contact their workspace owner, an admin, or a non-signing admin to confirm their status.
Updating the Fireblocks mobile app
In order to update the Fireblocks mobile app, take the following steps:
- Make sure your Fireblocks mobile app is up to date using your device settings. If it is not the latest version, please update it using the App Store for iOS devices or Google Play for Android devices.
Fireblocks recommends enabling automatic app updates on your device. More information about enabling automatic updates can be found in the official documentation: - A new request labeled “Finish App Update” will appear in your device notifications and in your Fireblocks mobile app. Select Open to verify and complete the update.
Notes:- Each user linked to a Fireblocks mobile app receives this request separately. In order to see all linked users in your Fireblocks app, go to Settings > Linked Users.
- Most Fireblocks users are already using MPC-CMP. This includes anyone who has already performed this update and most users that joined a new workspace after December 12, 2021. In this case, their keys have already been generated using MPC-CMP. They will not receive a request to finish the app update and may skip the rest of the steps in this article.
- Click Verify identity in order to re-generate your key share with MPC-CMP and continue.
- Enter your Fireblocks app passcode to confirm.
- Confirm the request for biometric authentication. Use either your fingerprint or face identification depending on your mobile device to continue.
- The Fireblocks app requests your recovery passphrase to proceed. This is the recovery passphrase that you set when you linked your mobile app to your workspace (see: User Setup). If you forgot your recovery passphrase, you can generate a new passphrase at this step.
- You will receive confirmation that the update is complete and your key share is now protected using MPC-CMP.
Updating the Fireblocks API Co-Signer
If your API Co-Signer instance requires updating, you will need to re-install the API Co-Signer.
Copy the API Co-Signer installation link from the Admin Settings in your Fireblocks Console as described in the API Co-Signer setup article and as shown here:
After copying the API Co-Signer installation script, follow the instructions in the API Co-Signer Update (December 2021) article.
Once installation is complete, use the Fireblocks Console to confirm that the API User's key is updated to MPC-CMP by following the instructions above.
FAQ
Is there any expected downtime during the enablement of MPC-CMP?
Enabling MPC-CMP happens on a per-workspace basis, is immediate, and has no downtime.
I received the “Finish App Update” request. How long should it take to re-generate the key share?
Re-generating your Fireblocks mobile key share should take less than 1 minute.
Should all mobile users and API Co-Signers finish migration to MPC-CMP at the same time?
Fireblocks workspaces do not need to coordinate simultaneous updates, however, all devices must migrate to MPC-CMP by July 31st, 2023.
What will happen after the July 31st, 2023 cutoff date?
Users that have not completed the MPC-CMP update will be able to update their Fireblocks app after the cutoff date and resume signing transactions.
API Keys associated with API Co-Signers will be able to re-install an updated version of the API Co-Signer software and resume signing transactions once the update is complete.
Fireblocks highly recommends updating all relevant devices before the cutoff date to avoid interruptions to daily operations.
Do I need to back up the new signing keys for my whole workspace?
The Fireblocks backup and recovery tool continues to support non-MPC-CMP keys. Fireblocks recommends downloading the most recent version of the Key Backup and Recovery tool occasionally to receive stability updates and bug fixes. However, there are currently no plans to end backup and recovery support for non-MPC-CMP keys. Additionally, the Backup and Recovery tool is open-source, and older versions are available to download from Github.
I have received a message about key expiration from Fireblocks Support, but I don’t see a notification in my Fireblocks Console.
Fireblocks Support has sent the key expiration message to all customers that have at least one mainnet or testnet workspace with at least one user with expiring keys. Please make sure to log in to all available workspaces and navigate to the Users page to identify which users have not completed their MPC-CMP update in each workspace.
What if I forgot my recovery passphrase?
You can select Forgot Passphrase? and create a new recovery passphrase when requested to enter your recovery passphrase during the update.
Note
Users with an Owner user role who change their mobile recovery passphrase must still remember their existing mobile recovery passphrase for workspace key recovery. If the workspace owner forgot their mobile recovery passphrase, they should contact Fireblocks Support.
My phone lost power and shut itself down during the update, will I be able to recover this process?
If you received the “Finish App Update” notification, selected Open, started verification, and your phone battery died at any point before completing the update, you can manually resume the process. Complete the app update after powering up your mobile device by doing the following:
- Open Fireblocks mobile app
- Select Settings > Linked Users.
- A Complete Setup button should be next to every linked user with an incomplete app update. Select this button when you are ready to complete the update.
- Fireblocks will ask you to complete the steps that were not previously finished. If all steps were entered and the app has not completed the migration to Fireblocks MPC-CMP, you are asked to re-enter your recovery passphrase.
Why did I receive the “Finish App Update” request more than once?
If there are multiple users linked to your Fireblocks mobile app, you will receive this request for each linked user. Some linked users may receive this request at different times than other linked users on the same device. In most cases, all users that are part of the same workspace are updated at the same time. To see all users linked to your Fireblocks mobile app, select Settings > Linked Users.
Why did I receive two requests on my Fireblocks mobile app: Complete MPC Setup and Finish App Update?
In most cases, you should only receive one of these requests.
Complete MPC Setup happens after the workspace owner approves signing privileges for your mobile device. Typically this happens when pairing a new mobile device to a workspace.
Finish App Update happens after Fireblocks enables MPC-CMP for existing users.
Some Fireblocks users may receive both of these requests one after another. This happens when:
- Fireblocks enables MPC-CMP for all members of a workspace.
- The workspace owner receives a Finish App Update request and Approve Signing Privileges request and approves the signing privileges first.
In this case, users receive a Complete MPC Setup request followed by a Finish App Update request.