Your identity is defined by your unique secret password. This unlocks all your doors.
Your input [name] is necessary for identification. Your input [secret password] is a prove of knowledge
to authenticate your identity and represents the key. Together, they create a cryptographic identifier
that is unique to every authenticated user. We call this union Master Criptographic Key. The SCRYPT
cryptographic function is employed to derive a 64-byte Master Cryptographic Key
from the user’s [name] and [secret password] using a fixed set of parameters. Fixed parameters
are: N = 32768, r = 8 and p = 2 and scope (see Key scopes and templates) are chosen according
to time and resources consumption.
masterKey = SCRYPT( key, seed, N, r, p, dkLen )
key = [secret password]
seed = scope . LEN([name]) . [name]
N = 32768
r = 8
p = 2
dkLen = 64
To know more about SCRYPT Criptographic Algorithm see Stronger Key Derivation Via Sequential Memory-Hard Functions.
Site key
Your site key is a derivative from your secret key when it
is used to unlock the door to a specific site. Your site key is the result of three components: your [site name], your
Master Cryprographic Key (see Identity) and your [site counter]. Your Master Cryptographic Key establishes a unique string of bits
to create your site passwords. The site counter ensures you can easily create new password for the site if that password were
compromised. Together, they create a cryptographic identifier that is unique to your account at a given site. The HMAC-SHA-256
cryptographic function to derive a 64-byte Cryptographic Site Key from the site name and Master Cryptographic Key scoped to
a given counter value.
siteKey = HMAC-SHA-256 (key, seed)
key = [master key]
seed = scope . LEN([site name]) . [site name] . [counter]
To know more about HMAC-SHA-256 see Secure Hash Standard and The Keyed-Hash Message Authentication Code.
Site password
Your site password is an identifier derived from your site key in compilance with the
site password policy and user's will. The purpose of this step is to render the site's cryptographic key
into a format that the site password input will accept and user can be relaxed about strength against
dictonary or brute force attack. Stateless Vault declares ten site password formats and uses pre-defined
password "templates" to render site key legible composed by letters, numbers or symbols. The template is
resolved to generate password from site key's first byte. When the selected template is selected, it is
used to translate site key bytes into password characters. The result is a site password in the form defined
by the site template scoped to our site key. Finally the generated password can be used
to authenticate user for his account at the given site.
template = templates [ siteKey[0] % LEN( templates ) ]
for i in 0..LEN( template )
passChars = templateChars [ template[i] ]
passWord[i] = passChars[ site key[i+1] % LEN( passChars )]
Key scopes and templates
Stateless Vault algorithm defines several key scopes.
These scopes are used to scope the key generation to a specific purpose.
These purpose are defined:
- The authentication scope is used when genrating a key that is used for
authenticating the user, such as a password.
Authentication scope identifier = it.unimi.statelessvault
- The identification scope is used when generating a key that is
intended for the purpose of identifying the user.
Identification scope identifier = it.unimi.statelessvault.login
- The recovery scope is used for generating fall-back identifiers
for use in access recovery when the primary authentication mechanism has failed.
Recovery scope identifier = it.unimi.statelessvault.answer
Stateless Vault defines ten password templates to make a best-effort attempt at generating
site passwords that adheres to accepted formats by websites and ensures memorability of
chosen format, while also keeping its output entropy as high as possible under
the constraints.
USER.templates = {
// 30 characters: letters, numbers and symbols
maximum: [
"xnoxxnxAzxxxxzxxxAxxxnxzxozxxz",
"xxxxnxxxxoxxxxxxaxxxAnxxxxnozx",
"xxxzxzaxxxxxAxxzxxxzxxxoxxxnaz",
"xoxxxxnxAxzxxzxxxnoxaxxxaxxxxz",
"xxxxxoxzzxxxCxxzxoxxxAxxxoxzxa"
],
// 20 characters: letters, numbers and symbols
long: [
"avcxvnoCxxvcvaxvcvxx",
"avxcvCxvxcvnxoCxvcvx",
"axvcvCvcxvCxvxcvxnxo",
"avcxcnoxCvcxxxvCxvcv",
"avxccCxxvcvnoCxxvxcv",
"avcxcxCvcxvCxvcvnxxo",
"avcvnoCvcxxxcCvcvxxx",
"avxcvCvxxxccnoxCxvcv",
"axxvcvxCvccCxvcvxxno",
"avcxvnxoxCxvcvxxCvcc",
"axvxcxvxCxvcvnxoCvcc",
"avcvxCvcxxvxCvccxxno",
"avccnoCvxcxcxCxvxcxv",
"axvxccCvccnxxoxxCvcv",
"avccCxxvccxxCvcxxvno",
"avcxxvnoxxCvccxxCvcc",
"avcxxvCvxzccnoCxxvcc",
"axvcvCvcxcxxCvccnoxx",
"axxvccnoxCvxcvCvcxxc",
"avxccCxxxvcvxnoCxxvc",
"avcxcCvxcxxvCvxccxxn"
],
// 12 characters: letters, numbers and symbols
medium: [
"CacnoxxxxCvc",
"CacCxxxxvcno",
"CaxxoxCnnxxx"
],
// 8 characters: letters, numbers and symbols
light: [
"zvnanona",
"zVnCaCan",
"znoaCcCo"
],
// 8 characters: letters and numbers
basic: [
"aaanaaan",
"aannaaan",
"aaannaaa"
],
// 4 characters: letters and numbers
short: [
"Cvcn",
"NCnc",
"cnCc",
"mcCa"
],
// 4 numbers
pin: [
"nnnn",
"nNnN",
"mnNm",
"nmmN"
],
// 6 numbers
pin6: [
"nmnNnN",
"nnnnnn",
"NnNmnn",
"mNnmmN"
],
// 8 numbers
pin8: [
"mNnmNnmn",
"NnnmNnnm",
"nmnNnnNm",
"nnnnnnnn"
],
phrase: [
"cvcc cvc cvccvcv cvc",
"cvc cvccvcvcv cvcv",
"cv cvccv cvc cvcvccv"
]
};
Stateless Vault template is a string of characters, where each character identifies a certain character class. As such, the template spesificies that the output password should be formed by substituing each of the template's character class charcters by a chosen character from character class.
// The password character mapping
// c in template becomes bcdfghjklmnpqrstvwxyz
USER.passchars = {
V: "AEIOU",
C: "BCDFGHJKLMNPQRSTVWXYZ",
v: "aeiou",
c: "bcdfghjklmnpqrstvwxyz",
A: "AEIOUBCDFGHJKLMNPQRSTVWXYZ",
a: "AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz",
N: "01234",
m: "56789",
n: "0123456789",
o: "@&%?,=[]_:-+*$£#!'^;()/.\|{}<>°",
z: "AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789",
x: "AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789@&%?,=[]_:-+*$£#!'^;()/.\|{}<>°",
}
