Key restructuring in MPC is the process of redistributing key shares among a new set of participants without ever reconstructing the original private key. This is crucial for maintaining long-term security, adapting to organizational changes, or replacing compromised participants in an MPC quorum.
In Threshold Signature Schemes (TSS), key restructuring allows a set of existing signers to securely transfer their key shares to a new group while preserving the same private key. You can modify the quorum (for example, by adding or replacing nodes) without generating a completely new key. Restructuring doesn't change the number of required signers.
This ensures operational continuity while improving resilience against:
- Key compromise
- Insider threats
- System upgrades
- Organizational changes
Ripple Custody (Wallet)'s implementation of key restructuring allows organizations to seamlessly rotate signers, ensuring that access control remains dynamic, secure, and breach-resistant without ever exposing the private key.
Key restructuring is appropriate when you need to:
| Use case | Description |
|---|---|
| Expand the quorum | Add more participants so the quorum tolerates more lost devices (the number of required signatures stays the same) |
| Replace a participant | Swap out a device or user without changing the key, for example when a team member leaves |
| Respond to incidents | Replace a lost or potentially compromised device |
| Adapt to org changes | Update quorum membership as team members change, for example by adding a new team member's device |
The key restructuring process follows these steps:
- Initiate restructuring: Administrator starts the key restructuring operation
- Define new quorum: Specify the new participants (the threshold stays the same)
- Generate new key shares: The system computes and distributes new shares
- Update quorum policy: The system applies the new configuration
- Invalidate old shares: Previous key shares become obsolete
Throughout this process, the private key is never reconstructed.
A company uses Ripple Custody (Wallet) MPC with a (2-of-3) quorum:
- CloudSign 1 (cloud-based signing node)
- CloudSign 2 (cloud-based signing node)
- CloudSign 3 (cloud-based signing node)
Currently, two out of three participants must approve to sign a transaction. To tolerate the loss of more nodes, the company decides to expand to a (2-of-4) quorum.
Initiate restructuring: The administrator starts a key restructuring operation, adding CloudSign 4 to move from (2-of-3) to (2-of-4)
Generate new key shares: The system securely computes and distributes new key shares:
- CloudSign 1 receives a refreshed key share
- CloudSign 2 receives a refreshed key share
- CloudSign 3 receives a refreshed key share
- CloudSign 4 (new) receives a newly generated key share
Update quorum policy: The new configuration still requires two participants, now out of four, to approve transactions
Invalidate old shares: The system retires the old key shares from the (2-of-3) quorum
✅ The private key remains unchanged, with no disruption to wallets or smart contracts
✅ The quorum is now (2-of-4), so it can lose two nodes and still sign
✅ CloudSign 4 is now part of the quorum
✅ Old key shares are no longer valid, which prevents unauthorized use
A company uses Ripple Custody (Wallet) MPC with a (2-of-3) quorum:
- CloudSign 1 (cloud-based signing node)
- CloudSign 2 (cloud-based signing node)
- CloudSign 3 (cloud-based signing node)
The organization needs to replace CloudSign 3 with CloudSign 4 because the host that runs CloudSign 3 is going out of service.
Initiate restructuring: The administrator triggers a key restructuring operation
Generate new key shares: The system computes and distributes new key shares:
- CloudSign 1 receives a refreshed key share
- CloudSign 2 receives a refreshed key share
- CloudSign 4 receives a newly generated key share
Retire CloudSign 3: Its previous key share becomes obsolete and can no longer participate in signing
Quorum remains intact: The (2-of-3) quorum remains operational with the updated participants
✅ The private key remains unchanged, with no impact on wallets or authentication
✅ CloudSign 4 now participates in signing, replacing CloudSign 3
✅ The system remains resilient to insider threats because no one can reuse the old key shares
Required role: Owner or Administrator.
Restructuring is self-service in the console only for Cloud quorums running CloudSign version 1.10.0 or later. Ripple Custody (Wallet) rejects restructuring for Mobile and Mixed quorums in production. If you need to change one, contact Ripple support. If Restructure quorum doesn't appear in the Actions menu, contact Ripple support to coordinate the restructure.
Before you start:
- Pair every device you plan to add, and have an owner or administrator approve it. Restructuring only lets you add devices that are already paired and approved. The Key shard holders list in the console includes every Cloud device in your organization, including unpaired and disabled ones, but Ripple Custody (Wallet) rejects a restructure that adds a device that isn't approved and enabled. See Add and manage devices.
- Make sure all devices that the restructure needs, current and new, are online and available.
To restructure a quorum:
- Go to Controls in the console and select the MPC Quorums tab.
- Select the quorum you want to restructure to open its detail page.
- Open the Actions menu (three dots next to the status badge) and select Restructure quorum.
- Review the current membership and make changes:
- Add new devices to the quorum.
- Remove existing devices. You must retain at least as many original members as the current required-signatures threshold, and the new quorum must have at least as many members as the current one. Removing devices only works together with adding at least one new device. Ripple Custody (Wallet) rejects a restructure that only removes devices.
- You can't change the threshold. To use a different threshold, create a new quorum.
- Select Save changes.
- Review the proposed changes in the confirmation dialog.
- Type the quorum name to confirm.
- Select Confirm.
The system then distributes new key shares to the new set of participants. Any newly added key shard holders receive a request to join the quorum. After all members accept, each member of the restructured quorum receives a request to update its key share, and then a final request to confirm and apply the quorum update.
During restructuring, the quorum and all wallets that use it can't sign, and transactions for those wallets fail. Plan restructuring during a maintenance window. You can't reverse the process after it starts.
When restructuring removes a device, the removed device no longer participates in the active quorum. Treat any key material on that device as obsolete sensitive material until you disable or decommission the device through your device lifecycle process.
- Plan restructuring carefully: Document the changes before initiating
- Ensure device availability: All current and new participants should be available
- Communicate with stakeholders: Inform relevant team members of the change
- Test in sandbox first: Verify the process in a test environment
- Refresh node backups after restructuring: CloudSign node database snapshots from before the restructure contain obsolete key shares, so don't restore them. Encrypted key shard backups in S3 stay valid, because Ripple Custody (Wallet) binds each one to the wallet's key ID and quorum ID, and neither of them changes. The backup file doesn't store the quorum ID, so keep it in your offline wallet inventory
- Key resharing – Refresh key shares without changing participants
- MPC quorums – Create and manage quorums
- Understanding MPC-TSS – How MPC-TSS works
- MPC terminology – Key terms and definitions