Secure key management practices

• Hardware Security Modules (HSMs)
• Offline vaults
• Separate geographic devices
• Never co-locate multiple keys on the same machine or cloud account
• Deploy well-audited multisig frameworks (e.g. Gnosis Safe)
• OpenZeppelin Defender for notifying access control
• use HSM with MPCs

Hardware Security Modules (HSMs)

• HSM (Hardware Security Module): tamper-resistant hardware where keys are generated/stored/used (perform cryptographic operations (e.g. signing), keys never leave the device). Banks use HSMs for FIPS 140-2/3 assurance and dual control.
• PKCS#11: a standard API to talk to HSMs (create keys, sign, decrypt). Your signer (e.g., EthSigner) uses PKCS#11 to perform signing inside the HSM.
• Keys never leave the hardware in plaintext. FIPS 140‑2/3 Level 3+ physically and logically protected. They can auto‑erase on tampering, enforce MFA and RBAC, and provide audit logging.
• Common in high‑assurance banking environments for cold storage custody, PCI‑compliance, and legacy HSM ecosystems
• For HSM: implement high-availability clusters, automated failover, backup key escrow, and recovery plans.

Multi Party Computation (MPC)

• Day to day use
• Splitting a private key into multiple shares distributed across independent nodes. Signing is performed collaboratively, ensuring no single share holder ever has the full key
• supports flexible governance: withdrawal limits, whitelisting, policy checks integrated into signing flow
• In MPC setups, enforce threshold signing, policy validation, and cryptographic logging: who signed, what policy applied, quorum used, transaction hash—and ensure auditability under regulations like DORA (Digital Operational Resilience Act, EU)

HSM with MPC