Encryption and key management
Magnus Box protects your data with end-to-end encryption: everything is encrypted on the client before it reaches storage, and the keys that protect it are derived from your account password so they are never sent to Magnus Box in plaintext. The sections below describe how those keys are generated, stored, and used.
Zero-knowledge ratchet
Your account password is used to derive two 192-bit keys (the "L" and "R" keys) via PBKDF2-SHA512, with hard-coded parameters for repeatable output.
- The L-key is used to log in to the Management Console in place of the real password. The Management Console stores only a bcrypt(sha512) hash of this L-key.
- The R-key never leaves the client, and is used to encrypt secret keys stored within your profile on the server.
This means one password can be used for all client-side account operations, while preventing servers from uncovering client-only secrets.
Storage Vault encryption keys
When Magnus Box sets up a Storage Vault for the first time, it generates two high-entropy random keys (the 256-bit "A" and 128-bit "E" keys). All data in the Storage Vault is stored encrypted with the A-key using AES-256 in CTR mode, and authenticated using Poly1305 in AEAD (encrypt-then-MAC) mode.
The permanent A-key is stored inside the Storage Vault, encrypted with the E-key. The E-key is then encrypted with the R-key and stored in your profile on the Management Console. When a backup runs, the client uses your password to derive the private R-key, to decrypt the E-key from the vault, to decrypt the A-key for data storage. This extra level of indirection enables some key rotation scenarios, as a new E-key can be generated without needing to re-encrypt all the data in the Storage Vault.
Data location access keys
If the Storage Vault is on Magnus Box cloud storage (the Comet Server vault type), a high-entropy random 128-bit PSK is used to gate access to the bucket. The storage server stores only a bcrypt(sha512) hash of this PSK. The client encrypts this PSK with the R-key and stores it in your profile on the Management Console.