1. Authentication Key HMAC(MK, “auth”) Server Encryption Key HMAC(MK, “server_enc”) User Password Master Key (MK) Client Encryption Key HMAC(MK, “client_enc”) A hash that is computed from the user password using PBKDF2 (SHA- 1, iterated 10,000 times) is used as the master key. The master key is never stored or transferred to the client or server. The master key is used to derive additional keys for different functions. MK = PBKDF2(salt, password) Derived keys are computed using the HMAC (SHA-256) of the master key and a designated string. With derived keys, we are able to use multiple keys for different functions, but only require the user to keep track of one password. The derived keys are stored on the server, and may be transferred to the client or server when requested. HMAC-based Extract-and-Expand Key Derivation Function (HKDF) Why this approach? The HKDF approach allows greater security for a few reasons: Both the master key and the password are not stored on the server or client Both the master key and the password are not sent over network traffic between the client and the server (except during registration and salt/password reset, only the master key is sent over) Only the salt that the server computed, the authentication key, and the client encryption key may be sent over the network. Only the authentication key is stored on the client.

2. Registration ClientServer Send username, MK, user information Compute salt Compute MK with salt & user password Compute derived keys using MK Store information in database Encrypt database record with server encryption key* Respond with success/failure Proceed with first-time login *The server encryption key is stored in a separate database that is encrypted with a private key on the server. The server encryption key is used to decrypt the database record to verify the authentication key. Request salt Respond with salt

3. First-Time Login *The authentication key is only saved if the user chooses to save his or her login credentials. ClientServer Request salt Respond with salt Compute MK with salt & user password Compute authentication key using MK Send authentication key Verify authentication key Respond with success/failure Save authentication key for next time*

4. N-Time Login ClientServer Send authentication key Verify authentication key Respond with success/failure Save authentication key for next time* *The authentication key is only saved if the user chooses to save his or her login credentials.

5. Reset Master Key ClientServer Request new salt Decrypt database Send current MK, new MK Compute derived keys using new MK Re-encrypt database record with new server encryption key Verify password by computing authentication key with old MK and authenticating Respond with success/failure Proceed with first-time login Security Precautions Since only the authentication key is stored on the device (and not the master key or password), the malicious user does not know the password. We can authenticate the legitimate user by using the password to compute a master key, and then an authentication key and verifying it against the one stored on the server. Compute current MK with salt & user password Request current salt Respond with salt Compute new MK with new salt & user password Respond with new generated salt Replace old salt with new salt in DB