Palma Security Layer

Our security is multi-layered, combining ZKPs for privacy and MPC for user-friendly key recovery.

• Zero-Knowledge Proofs (ZKP) for Authentication

  • Purpose: To prove identity without revealing how you are proving it.
  • Flow: When a user needs to authenticate, they scan their palm. The key is derived locally on their device. The device then generates a ZKP to prove it possesses the correct key without ever sending the key or biometric data off the device.
  • Benefit: Provides perfect privacy, prevents man-in-the-middle attacks, and forms the core of our Sybil-resistant Proof-of-Humanity protocol.

• Multi-Party Computation (MPC) for Seedless Recovery

  • Purpose: To eliminate the traditional “lost seed phrase” problem.

  • Flow: The Palma Wallet’s private key is not a single entity. It is split into multiple shares using MPC (e.g., requiring 2-of-3 shares to sign a transaction):

    • Share 1 (Biometric): Derived from the user’s palmprint.
    • Share 2 (Device): Stored securely in the device’s enclave (e.g., Secure Enclave on iOS).
    • Share 3 (Recovery): A backup share, stored securely with a trusted server or via social recovery.

  • Benefit: Users can recover their wallet on a new device simply by using their palm (something they are) and their recovery share (something they have).
    This provides a seamless, “seedless” recovery experience.