Encrypted Private Key Roaming for Multi-Device E2EE Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current End-To-End Encryption (E2EE) systems face challenges when users switch client devices, as private keys are typically generated and stored exclusively at one client-side endpoint, leading to loss of access to server-stored data and disruptions in communication.
Innovation Solution
Storing an encrypted private key on a server that can be accessed by multiple client devices using user-provided credentials, ensuring the key remains undecryptable by the server and is decrypted only on the client device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the private key is stored exclusively at one client-side endpoint, then security is maintained, but access to encrypted data is lost when switching devices
Solution Approach 1:
The system segments the private key functionality by storing only an encrypted version of the private key on the server, while the decryption capability remains distributed to multiple client devices through secure credential verification. This allows the key material to be split between server storage and client decryption capabilities.
Solution Approach 2:
The server acts as an intermediary that stores encrypted private keys and facilitates access across devices without having the capability to decrypt them. The server mediates between the encrypted key storage and multiple client devices, enabling cross-device access while maintaining security through the intermediary's inability to access the actual key material.
2Adaptability or versatility
If the encrypted private key is stored on the server, then multi-device access is enabled, but security may be compromised if the server can decrypt it
Solution Approach 1:
The server is given the specific quality of storing encrypted data without the capability to decrypt it. The decryption capability is localized exclusively to client devices that possess the appropriate credentials. This differentiation in capabilities between server and client ensures that while the server enables multi-device access through storage, it cannot compromise security through decryption.
Solution Approach 2:
Instead of the server having full access to private keys and trusting clients with decryption, the system inverts the model by giving the server only encrypted key storage capability while distributing decryption capability to clients. This inversion ensures the server cannot access user data even though it stores the encrypted keys.
3Reliability
If the private key is encrypted client-side with a passphrase before storing server-side, then security is improved, but the passphrase transmission over TLS during authentication remains vulnerable
Solution Approach 1:
The system performs preliminary encryption of the private key on the client device before any transmission to the server. The encrypted private key is then stored on the server without requiring subsequent passphrase transmission. This preliminary action eliminates the vulnerability of passphrase transmission during authentication while maintaining security.
Data Source
AI summary
Systems and methods relating to end to end encryption. Encrypted data stored on a server or transmitted by way of a server can be accessed from any number of authenticated client devices by storing an encrypted private key on the server. The encrypted data can only be decrypted by the decrypted version of the encrypted private key. The encrypted private key is undecryptable by the server and can only be decrypted using user provided credentials (e.g. a user provided password/passphrase). For the user to access the encrypted data, the client device used by the user downloads the encrypted private key along with the encrypted data. The encrypted private key is then decrypted using user provided credentials and the decrypted private key is used to decrypt the downloaded encrypted data. The decrypted private key never leaves the client device and is never used by the server.