Kintsugi: Decentralized E2EE Key Recovery

TL;DR

Kintsugi introduces a decentralized protocol for end-to-end encrypted key recovery that distributes trust among multiple nodes, enhancing security and resilience without relying on centralized servers.

Contribution

It presents a novel decentralized key recovery protocol that tolerates collusion and offline nodes, operating securely in asynchronous networks without specialized hardware.

Findings

Supports threshold-based key recovery with multiple nodes

Protects against offline brute-force attacks

Operates securely in asynchronous, trust-distributed environments

Abstract

Kintsugi is a protocol for key recovery, allowing a user to regain access to end-to-end encrypted data after they have lost their device, but still have their (potentially low-entropy) password. Existing E2EE key recovery methods, such as those deployed by Signal and WhatsApp, centralize trust by relying on servers administered by a single provider. Kintsugi is decentralized, distributing trust over multiple recovery nodes, which could be servers run by independent parties, or end user devices in a peer-to-peer setting. To recover a user's keys, a threshold $t+1$ of recovery nodes must assist the user in decrypting a shared backup. Kintsugi is password-authenticated and protects against offline brute-force password guessing without requiring any specialized secure hardware. Kintsugi can tolerate up to $t$ honest-but-curious colluding recovery nodes, as well as $n - t - 1$ offline nodes, and operates safely in an asynchronous network model where messages can be arbitrarily delayed.