A story of four protection layers, secret handshakes, and envelopes that burn after reading
The internet is full of snoops, thieves, and nosy neighbours! You can't just send a key in a plain envelope. It needs four layers of protection: encryption, vault-specific binding, and segmentation into tiny pieces. Anyone who grabs the package mid-transit gets nothing but gibberish!
UPP: The raw key blueprint: never leaves the Key Maker's workshop. PPP: Wrapped in encryption, scrambled with a secret code. BPP: Bound to YOUR vault: only your chip can unlock it. SBPP: Chopped into 255-byte pieces so even memory-tiny vaults can handle the delivery!
At the heart of the protection is a mathematical magic trick. Both your vault and the Key Maker create one-time key pairs, exchange public halves, then independently calculate the same shared secret. It's like two people mixing paint: both end up with the same final colour, but an observer only saw the public mixes!
Two locking strategies exist: Lock on Demand (encrypt just-in-time with your session keys) and Pre-Locked (bulk-produce protected profiles, wrap in your session later). Both use Perfect Forward Secrecy: even if someone steals the vault's master key years later, they STILL can't decrypt old profiles!
The final layer is Segmented BPP: the package is chopped into 255-byte pieces so even the tiniest vaults can handle it. Piece by piece, your Assistant feeds it to the vault. After installation, the vault signs an unforgeable receipt: cryptographic proof that's saved to permanent memory, surviving even power loss!
The encryption has Perfect Forward Secrecy. Even if someone steals the vault's long-term master key years later, they STILL can't decrypt profiles downloaded in the past. Each download session creates fresh, disposable keys destroyed right after use. It's like burning the envelope after reading the letter: no trace left behind!
📋 Next: The Vault's Rulebook →