Abstract
Last updated
Last updated
Luka Perčič
Črt Vavroš
The only security that is not exposed to human error and can stand on its own is based on Public-key cryptography. Private keys are long, random, and should never leave the end-user machine. Even if the encrypted data is leaked to the public, it is still useless without the private key. They are about decentralized control of the encrypted data, communications, and value.
But if you lose your keys, you lose everything that was encrypted with it. All your data, credentials or value. This is why encrypted services provide nerve-wrecking experience for most people. Some services are trying to solve this problem with recovery codes, which should be printed out and put into a safe drawer. It is safe to say that there is no mobile printer on your phones, and there is no mobile safe drawer. Most people don't have "safe drawers", not even in their homes. In reality, this approach work as an excuse, that services use to shift the blame to the user, thus avoiding legal and reputational liability.
ZeroPass will remove fear from the equation for end-users and liability for service providers. It ensures consistency of private keys, recovery codes and answers to security questions over long periods of time (10 years+). You can't lose your keys with ZeroPass, you can even ensure inheritance of them. And all that without giving access to your keys.
This paper explains the procedures and algorithms used by ZeroPass to achieve that step by step.