The internet's own root of trust is a ceremony.

ICANN's DNSSEC root key ceremony

Trusted officers, smartcards, safes, tamper-evident bags, filmed for the world to audit. IANA · Root KSK Ceremony 61

So what do the rest of us do?

A hardware wallet is a signing device, not long-term storage, so the real backup falls to you.

A seed on a card at home is cash under the mattress.

What we try, and where it breaks.

I needed something chain-agnostic and disaster-resilient.

Insider risk for the self-custodian.

• Can you trust yourself?
• They're family, not security experts
• Self-custody is a privilege and a burden

The $5 wrench beats $5,000 of cryptography.

Data: Jameson Lopp · github.com/jlopp/physical-bitcoin-attacks

“The human brain is quite poorly suited for remembering passwords and tracking paper wallets, but it's an ASIC for keeping track of relationships with other people.”

Vitalik Buterin · “Why we need wide adoption of social recovery wallets,” 2021

What goes in a paper vault?

• Your 2FA recovery codes
• The disk-encryption key when you unbox a new laptop
• Anything that doesn't naturally fit in a password manager…
• …like the password to your password manager.

Where do you keep the password to your password manager?

It comes down to four functions.

import { split, combine } from 'shamir-secret-sharing';

export class EncryptionService {
  // 1. AES-256-GCM encrypt (Web Crypto API)
  static encrypt(secret, password) { … }
  // 2. split the key into m-of-n shares
  static splitKey(key, shares, threshold) {
    return split(key, shares, threshold);
  }
  // 3. combine a threshold of shares back into the key
  static combineShares(shares) {
    return combine(shares);
  }
  // 4. decrypt with the recovered key
  static decrypt(data, key, iv) { … }
}

Native Web Crypto API for encryption, Privy's audited shamir-secret-sharing for key splitting.

The same gear institutions use.