> For the complete documentation index, see [llms.txt](https://argon-4.gitbook.io/argon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argon-4.gitbook.io/argon-docs/suresign/keys-and-vault.md).

# Keys and the vault

How SureSign generates and derives keys, how the vault encrypts them, what a password and a passkey each do, and what lives in memory while the wallet is unlocked.

SureSign owns every secret in Enclave: the recovery phrase, the seed derived from it, every private key derived from the seed, and the key that encrypts them at rest. None of these ever crosses into TypeScript, a content script, a log, or a page.

## Phrase and seed

A new wallet is a 24-word BIP39 phrase generated by the kernel from operating-system randomness. Restoring accepts 12 or 24 words, with an optional BIP39 passphrase. The phrase becomes a 64-byte seed; the seed is what the vault protects.

The phrase is shown once, at creation, and again only through **Reveal phrase** after the password is entered. It is never written to disk in the clear and is never asked for by anything other than the Restore screen.

## Derivation

Keys follow the Kaspa standard used by the reference wallet, so phrases are portable in both directions.

| Purpose                                             | Path                             |
| --------------------------------------------------- | -------------------------------- |
| Receive addresses                                   | `m/44'/111111'/{account}'/0/{i}` |
| Change addresses                                    | `m/44'/111111'/{account}'/1/{i}` |
| Igra address                                        | `m/44'/111111'/{account}'/2/0`   |
| Deal Desk identities (first is `…/3/0`; one active) | `m/44'/111111'/{account}'/3/{n}` |

Kaspa addresses are Schnorr P2PK over secp256k1. The Igra address is the Ethereum-style Keccak address of the same curve's key on its own branch, so a single phrase yields both without any second secret. The Deal Desk address is a Schnorr key that serves as both the messaging identity and the wallet's covenant role key.

The kernel derives on demand and holds private keys only for the duration of a signing call, in zeroizing containers that wipe their memory when dropped.

## The vault

The vault is an **envelope**: one random 256-bit data encryption key (DEK) encrypts the seed, and independent **unlock slots** each wrap that same DEK under a key the user can produce.

```
                    ┌───────────────────────────┐
  password ─Argon2id─► KEK ─wraps─►  DEK  ◄─wraps─ KEK ◄─HKDF─ passkey PRF
                    │              │            │
                    │     XChaCha20-Poly1305    │
                    │              ▼            │
                    │     encrypted seed        │
                    └───────────────────────────┘
```

| Element                  | Construction                                                                                                                                             |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authenticated encryption | XChaCha20-Poly1305, 24-byte nonces, everywhere in the envelope                                                                                           |
| Password slot            | Argon2id with a per-slot random salt; production parameters are 64 MiB of memory, 3 iterations, 1 lane, stored with the slot so they can be raised later |
| Passkey slot             | HKDF-SHA256 over the 32-byte output of the WebAuthn PRF extension, bound to the wallet id                                                                |
| Wallet id                | A 16-byte identifier derived at creation, used to bind slots and authorizations to this vault                                                            |

The envelope is stored as ciphertext in the extension's local storage. Theft of the stored bytes yields nothing without the password or the passkey. Adding a passkey, or changing the password, re-wraps the DEK; it does not re-encrypt the seed and does not change your keys.

Argon2id is deliberately slow. Unlock takes a moment by design, and the parameters are not lowered to make it feel instant.

## Unlocking

Unlocking produces the DEK, then the seed, inside the kernel. From that point the kernel can derive and sign; nothing about the vault changes on disk.

Enclave has three surfaces (popup, sidebar, Studio) and each runs its own instance of the kernel. So that unlocking one unlocks all, a hidden extension page holds the unlock secret in memory only, together with the shared auto-lock clock. A surface that opens while the wallet is unlocked obtains the secret from that page over an internal channel that only extension pages can use, and unlocks its own kernel. **Lock**, the auto-lock timer, and the browser closing clear that memory; nothing decrypted is ever persisted.

Auto-lock defaults to five minutes of inactivity and can be set to 2, 5, or 15 minutes, or off.

## Passkeys

A passkey (Touch ID, Windows Hello, a security key, a phone) adds an unlock slot. Enclave asks the authenticator for the PRF extension; the 32-byte output is stretched with HKDF into a key that wraps the DEK. The authenticator never sees the seed and the extension never stores the PRF output.

Adding a passkey requires the password once. A passkey unlocks the vault on this device; it is not a backup and cannot restore the wallet elsewhere. More than one passkey may be enrolled.

## What is never done

* No key material is derived, encrypted, or signed with in TypeScript. The extension bundles no JavaScript cryptography for wallet secrets.
* No secret enters a content script, an injected provider, a log line, an exception report, or any persisted plaintext.
* No secret is sent to a server, because there is no server.
* The kernel is compiled with `unsafe` code forbidden.

## Watch-only

Addresses you watch without holding their keys are recorded as plain addresses. The kernel knows them as watch-only and refuses to select their Notes for spending.