GhostlineGhostline

Key Management

Key Management

Ghostline uses advanced key management techniques to secure user data and maintain privacy.

Key Hierarchy

Master Identity Key

The root key for your Ghostline identity:

  • Generated during identity creation
  • Used to derive all other keys
  • Stored encrypted locally
  • Never transmitted to servers

Derived Keys

Keys derived from the master identity key:

  • Messaging Keys: Signal protocol keys
  • Wallet Keys: MPC wallet key shares
  • Browser Keys: Browser encryption keys
  • Banking Keys: Neobank encryption keys
  • Recovery Keys: Backup and recovery keys

Key Generation

Random Number Generation

  • Cryptographically Secure: Hardware RNG when available
  • Entropy Sources: Multiple entropy sources
  • Key Stretching: PBKDF2 or Argon2 for password-based keys
  • Validation: Key validation before use

Key Storage

Local Storage

Encrypted Storage:

  • Keys encrypted before storage
  • Encryption key derived from master key
  • Secure storage mechanisms
  • Hardware security when available

Storage Locations:

  • Device secure storage
  • Hardware security modules
  • Encrypted databases
  • Secure keychains

Server Storage

MPC Key Shares:

  • Encrypted key shares on servers
  • No full key on servers
  • Hardware security modules
  • Redundant storage

No Key Material:

  • Servers don't store full keys
  • Only encrypted shares
  • Cannot decrypt without client
  • Zero-knowledge architecture

Key Exchange

Signal Protocol

X3DH Key Exchange:

  • Initial key exchange protocol
  • Pre-key distribution
  • Identity key verification
  • Forward secrecy

Double Ratchet:

  • Automatic key rotation
  • Perfect forward secrecy
  • Deniable authentication
  • Asynchronous messaging

MPC Key Management

Key Share Distribution:

  • Client generates share
  • Server generates share
  • Shares never combined
  • Distributed signing

Key Share Recovery:

  • Recovery through backup
  • Social recovery
  • Hardware key recovery
  • Secure regeneration

Key Rotation

Automatic Rotation

  • Signal Protocol: Automatic per-message
  • Session Keys: Regular rotation
  • Master Keys: User-initiated rotation
  • Recovery Keys: Periodic rotation

Rotation Process

  1. Generate new key
  2. Encrypt with old key
  3. Update systems
  4. Delete old key
  5. Verify new key

Security Considerations

Key Protection

  • Hardware Security: Hardware security modules
  • Encryption: Encrypted key storage
  • Access Control: Limited key access
  • Audit Logs: Key access logging

Key Compromise

Prevention:

  • Strong key generation
  • Secure storage
  • Limited key access
  • Regular rotation

Detection:

  • Anomaly detection
  • Access monitoring
  • Security alerts
  • Incident response

Response:

  • Immediate key rotation
  • Access revocation
  • Security investigation
  • User notification

Best Practices

For Users

  • Secure backup storage
  • Use hardware keys
  • Enable multi-factor auth
  • Regular security reviews
  • Keep app updated

For Developers

  • Follow key management guidelines
  • Use secure key generation
  • Implement proper key storage
  • Regular security audits
  • Key rotation procedures

Next Steps