Private Key Storage

Outrive does not store plaintext private keys.

Wallet Generation

When a Telegram user starts Outrive, a standard EVM wallet is generated locally.

The wallet address is derived from the public key. The private key is converted to raw bytes only for encryption.

Wallet Private Key Encryption

Wallet private keys use envelope encryption.

AWS KMS generates a 256-bit data encryption key.
The plaintext data key encrypts the wallet private key with AES-256-GCM.
The encrypted wallet private key is stored.
The encrypted data key returned by KMS is stored.
The AES-GCM nonce, cipher name, and KMS key id are stored as encryption metadata.
The plaintext private key bytes and plaintext data key bytes are cleared after encryption.

The stored wallet record contains encrypted key material, not the plaintext private key.

Wallet Private Key Decryption

When the wallet key is needed:

The encrypted data key is sent to AWS KMS for decryption.
KMS returns the plaintext data key.
The plaintext data key decrypts the wallet private key with AES-256-GCM.
The decrypted private key is used for the requested operation.
The plaintext data key and private key bytes are cleared after use.

This flow is used for wallet operations that require the funding wallet key, including bridge signing, Hyperliquid agent approval, and private key export.

Telegram Auth Secret

Each Telegram user also has an auth secret used to sign protected Telegram requests.

The auth secret is generated as random bytes and encrypted with the same KMS-backed AES-256-GCM pattern before storage.

The auth secret exists so protected Telegram routes do not trust a raw Telegram ID by itself.

Hyperliquid Agent Key

Outrive creates a separate Hyperliquid agent wallet for trading.

The agent key is a separate EVM keypair. It is encrypted before storage with AES-256-GCM using a KMS-protected application key.

The agent key signs Hyperliquid trading actions after the user's funding wallet approves it.

The funding wallet and agent wallet are separate:

the funding wallet controls deposits, withdrawals, private key export, and agent approval
the agent wallet signs trading actions

Private Key Export

Private key export decrypts the wallet private key only after the user requests export from the Telegram flow.

Anyone with that exported key can control the wallet outside Outrive.