Split Recovery Keys for Wallet Access After Device Loss
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
When a user private key is lost or inaccessible due to device loss or password forgetfulness, existing systems lack a method to recover the cryptographic digital credentials, rendering them permanently inaccessible.
Innovation Solution
A system for key recovery and storage that divides a recovery encryption key into two shares, encrypting each share with different public keys and storing them on separate trusted systems, allowing recovery only through identity validation checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user private key is stored on a user device with password encryption, then the key is secure during normal use, but the key cannot be recovered if the device is lost or the password is forgotten
Solution Approach 1:
The recovery key is divided into multiple shares that are distributed to different trusted third parties. Each share is encrypted with a different public key and stored separately. To recover the private key, multiple shares must be combined through a threshold mechanism, enabling recovery without accessing the original device or knowing the password.
Solution Approach 2:
Trusted third parties serve as intermediaries who hold encrypted shares of the recovery key. These intermediaries enable key recovery by providing shares to the user when needed, without compromising the security of the original private key or requiring access to the user's device or password.
2Device complexity
If the user private key is stored only on the user device, then the system is simple, but the credentials become permanently inaccessible if the device is lost
Solution Approach 1:
The recovery key is segmented into multiple shares distributed across different trusted third parties. This segmentation enables redundancy and continued access to credentials even if the user's device is lost, while maintaining relative simplicity by using standard cryptographic key sharing mechanisms.
Solution Approach 2:
The system performs preliminary action by pre-distributing encrypted key shares to trusted third parties before the user loses access to their device. This advance preparation ensures that recovery is possible without requiring complex real-time intervention or device access during the recovery event.
3Reliability
If a password-encrypted backup copy of the user private key is stored, then the key is protected, but the backup becomes inaccessible if the password is forgotten
Solution Approach 1:
Trusted third parties act as intermediaries who hold encrypted shares of the recovery key. These intermediaries enable backup accessibility by providing shares to the user during recovery, eliminating the need for the user to remember the password while maintaining strong protection through encryption.
Solution Approach 2:
The system enables self-service recovery by allowing the user to initiate the recovery process and receive shares from trusted third parties without requiring manual intervention to provide the password. The user can autonomously recover their key through the distributed share mechanism.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for split keys for wallet recovery includes an interface configured to receive a request to recover a user private key, and a processor configured to provide a request to a credential issuing authority for a first encrypted recovery key share, wherein the request includes a first identification credential, receive the first encrypted recovery key share from the credential issuing authority, provide a request to a trusted organization for a second encrypted recovery key share, wherein the request includes a second identification credential, receive the second encrypted recovery key share from the trusted organization, combine the first encrypted recovery key share and the second encrypted recovery key share to determine a recovered encryption key, and determine the user private key using the recovered encryption key.