Skip to main content
When you recover key material through CoinCover Control, you supply a GPG public key with the request. CoinCover encrypts the recovered material to that key, so only the holder of the matching private key can open it. This guide shows you how to create the pair, hand the public key to CoinCover, and decrypt the package once it’s returned.
CoinCover never receives or holds your private key. If you lose the private key or its passphrase, the recovered material can’t be opened — by you or by CoinCover — and you’d have to raise a new recovery. Decide who will hold the private key, and back it up, before you need it.

​
Choose a tool

GPG is an open standard with free tools for every platform:
  • macOS — GPG Suite, which installs the GPG Keychain app.
  • Windows — Gpg4win, which installs the Kleopatra app.
  • Any platform — the gpg command line.

​
Generate your key pair

1

Install and open GPG Keychain

Download GPG Suite from gpgtools.org, install it, and open the GPG Keychain app.
2

Create a new key

Click New on the toolbar. Enter your name and the email address you want the key associated with, set a strong passphrase, and click Create Key.
3

Export the public key

Right-click your new key in the list and choose Export. Make sure Include secret key in exported file is unticked — you’re sending only the public half. Save the .asc file.

​
Give the public key to CoinCover

When you start a recovery request, paste the public key or upload the exported .asc file. Control checks the key is valid before the request goes ahead.
Only ever share the public key. Your private key never leaves your machine and is never sent to CoinCover.

​
Decrypt the recovery package

Once your recovery is approved and you’ve downloaded the package from Control, decrypt it with the private key you already hold.
In Finder, right-click the package CoinCover returned and choose Services → OpenPGP: Decrypt File (installed by GPG Suite). Enter your key passphrase when prompted. A decrypted copy is written alongside the original.
The package can only be opened on a machine that holds the private key matching the public key you supplied, by someone who knows its passphrase. In Control, any member with recovery permission can download the package — but only the holder of the private key can decrypt it. If a different person will collect and open it, make sure they hold that private key.

​
What’s next

Recover key material

Where you supply this public key and collect the encrypted package.

Approve a recovery request

The approver’s side of a recovery.