Open-source · Self-hosted · 2-of-3 MPC signer

A signature no one can forge, steal, or sign alone.

SOVRA is a t-of-n threshold signer that splits your private key into three shards — two active cosigners and a cold recovery shard — on hardware you own. Malware, a rogue AI agent, or full penetration of any single machine yields at most one share: never enough to sign. Lose a machine, and the cold shard restores the quorum.

Threshold ECDSA · DKLs23 · Ethereum

Institutional-grade custody, on hardware you own.

MPC threshold signing is the industry standard behind Fireblocks, Copper, and Taurus. SOVRA is the open-source, self-hosted alternative — the same signing scheme, with no SaaS, no vendor lock-in, and no one else's cloud in your custody path.

Signing schemeDKLs23 threshold ECDSA
DeploymentYour machines, every component
SourceOpen · auditable
ChainEthereum (for now)
01 — The concept

The key that was never whole.

A one-time Distributed Key Generation ceremony creates three independent shards on three machines. The complete private key is never assembled — not at generation, not at signing, not for an instant.

To sign, any two cosigners run the DKLs23 rounds directly peer-to-peer. The key exists only as mathematics distributed across the parties. Compromise one machine, and you hold exactly one share of nothing.

02 — Recovery

Lose a machine. Keep the address.

Disk failure, theft, fire — losing a cosigner is survivable by design. The cold shard bridges the outage, and a re-share ceremony rebuilds the lost shard at the same address while making the stolen one worthless.

Bridge
The cold shard steps in

The surviving cosigner and the cold recovery party keep signing immediately — the quorum never drops below two.

Re-share
Rebuild at the same address

A recovery ceremony regenerates the lost shard on a fresh host and re-randomizes every other shard — no funds move, no address change.

Revoke
The stolen shard dies

Re-randomization invalidates the entire previous generation — the lost or stolen shard, and every old backup, becomes mathematically useless.

03 — The threat model

One shard is never enough.

A1
An AI agent goes rogue on your laptop
It can reach one shard. It cannot produce a signature without a second party's independent consent.
Funds safe
A2
One machine is fully penetrated
The attacker extracts a single shard — mathematically useless on its own, and revocable by re-share.
Funds safe
A3
A cosigner host is lost outright
The cold shard restores the quorum at once; the recovery ceremony rebuilds the lost shard at the same address.
Funds safe
A4
A malicious transaction reaches the signers
Every cosigner decodes the transaction itself and checks its own signing policy — chain, recipient, value, calldata. Any selected party alone vetoes.
Refused
Policy engine

Per-cosigner allowlists for chain, recipients, value, and calldata — evaluated independently, fail-closed, one veto is final.

mTLS everywhere

Every internal socket requires mutual TLS pinned to a project CA. A process without its certificates refuses to start.

Sealed shards

Shards can be XChaCha20-Poly1305-sealed at rest — fail-closed, never falling back to plaintext — for any shard that leaves your desk.

04 — How it works

Three moves to a verified transaction.

Step 01 · DKG
Generate

A one-time ceremony derives three shards over the DKLs23 protocol. Each machine keeps its own; the derived address is verified independently by the operator.

Step 02 · Sign
Cosign

The orchestrator selects two ready cosigners — cold party last. They run the threshold rounds peer-to-peer and return one valid ECDSA signature.

Step 03 · Broadcast
Settle

The assembled signature is verified and broadcast to the network — publicly auditable on-chain, indistinguishable from any other signature.