How can i realize password authenticated key retrieval? I found some description of PAKR:

A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, client), who has a memorable password, to retrieve a long-term static key in an exchange of messages with at least one other party (say, server) that has a private key associated with the password.

But i can't figure out why use "retrieve" a long-term static key. Is it meaning that i can find my private key through negotiating servers with some message associated password? If is the case, why we need to store private key in server?

1 Answer 1


Storing a key on a server rather than a client has some advantages, for example that I can move seamlessly between clients, or don't have to store the key on a client. As an example, consider a Dropbox-style site offering encrypted storage: with some PAKR scheme I can access my data from another device, but only have to know my password.

Other scenarios:

  • a cloud-based password manager that lets me sync keys between devices, without having to trust the server with my plaintext passwords
  • an E2E encrypted messaging web app that I can access from any browser
  • a cloud-based Bitcoin wallet
  • secure backup

There are different approaches to store the key on one or more servers without giving any server access to the key.

For example, I have a passphrase and a main key. To store the main key on a single server:

  • I use a key derivation function to derive a key from this passphrase.
  • I encrypt the main key with the derived key.
  • I store the encrypted key on the server.

To retrieve the main key:

  • I derive the key from my passphrase.
  • I load the encrypted key from the server.
  • I decrypt the main key with my derived key.

This scheme requires that this passphrase is only used to derive the key, but not to log in to the server: at no point may the server get the passphrase or they could access the plaintext key. However, authentication is possible without transmitting the password, e.g. challenge-response techniques with a shared secret derived from the passphrase, or a public/private key derived from the passphrase.

With web-based software, another problem is that the server storing the encrypted key often also provides the software to encrypt the key. If the server is compromised, the encryption software could be modified to exfiltrate the plaintext key or the passphrase.

There are also approaches that divide parts of a key over multiple partially-trusted servers. To compromise the entire key, multiple servers would have to be compromised. To access the key parts, I need to authenticate myself to at least as many servers in order to reassemble the full key. I can use separate key derivation functions to generate per-server authentication tokens from a single passphrase.

As a practical example, read the whitepaper for the 1Password password manager, in which clients use the login password + a secret key to derive a Master Unlock Key which can then be used to decrypt keys/passwords from cloud based storage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.