Encrypted Private Key Roaming for Secure E2EE Device Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current End-to-End Encryption (E2EE) systems face challenges when users switch client devices, as private keys are typically generated and stored exclusively at one endpoint, leading to loss of access to server-stored data and disruptions in communication, and storing keys server-side risks compromising security.
Innovation Solution
Storing an encrypted private key on a server that can be accessed by multiple authenticated client devices, decryptable only with user credentials, ensuring the key remains encrypted and never leaves the client device, maintaining secure data access across devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the private key is stored exclusively at one client endpoint, then security is maintained, but the user loses access to server-stored data when switching devices
Solution Approach 1:
The private key is segmented into two parts: an encrypted version stored on the server and a decryption key stored locally on the client device. This segmentation allows the encrypted key to be accessible from multiple devices while the decryption capability remains securely localized, resolving the contradiction between data accessibility and device switching capability.
Solution Approach 2:
An encrypted version of the private key serves as an intermediary between the server and the client device. The server stores this encrypted key, which can be retrieved by multiple devices, while the actual decryption requires the local decryption key. This intermediary enables cross-device access without compromising security or requiring the server to store plaintext keys.
2Adaptability or versatility
If the private key is stored server-side, then device switching is enabled, but security is compromised as the server could access encrypted communications
Solution Approach 1:
The private key is divided into an encrypted portion stored on the server and a decryption portion kept locally on the client device. This ensures the server cannot access the actual private key while still enabling it to provide the encrypted version to multiple devices, thus maintaining both security and device switching capability.
Solution Approach 2:
Instead of storing the plaintext private key on the server (which would enable access but compromise security), the system stores the encrypted version of the private key on the server. The decryption capability is inverted and placed locally on the client device, ensuring the server cannot access communications while still supporting multiple devices.
3Reliability
If the private key is encrypted client-side with passphrase before server storage, then security is improved, but TLS authentication still exposes the passphrase to potential server interception
Solution Approach 1:
The decryption key is extracted from the authentication process and stored separately as a distinct local credential. This extraction eliminates the need to transmit or store the passphrase in a way that exposes it during TLS authentication, as the decryption key operates independently from the authentication credentials.
Solution Approach 2:
The system introduces a separate decryption key as an intermediary between the passphrase and the encrypted private key. This intermediary allows the encrypted key to be stored and retrieved without requiring the passphrase to be exposed during server communication, as the decryption key handles the decryption process locally without involving the passphrase in server-side operations.
Data Source
AI summary
Systems and methods relating to end to end encryption. Encrypted data stored on a server or transmitted by way of a server can be accessed from any number of authenticated client devices by storing an encrypted private key on the server. The encrypted data can only be decrypted by the decrypted version of the encrypted private key. The encrypted private key is undecryptable by the server and can only be decrypted using user provided credentials (e.g. a user provided password/passphrase). For the user to access the encrypted data, the client device used by the user downloads the encrypted private key along with the encrypted data. The encrypted private key is then decrypted using user provided credentials and the decrypted private key is used to decrypt the downloaded encrypted data. The decrypted private key never leaves the client device and is never used by the server.