They can't steal what isn't there.
Most systems try to protect keys. Lokblok® removes them.
Phantom Secrets™ replaces stored secrets with ephemeral, hardware-bound reconstruction, created only when needed, used once, and destroyed immediately.
No keys at rest. No shares to steal. No recovery backdoors.
The Lokblok® Approach
Replace stored secrets with
Phantom Secrets controlled reconstruction.
Lokblok® doesn't store keys. It reconstructs them only at the moment of use, under strict conditions.
Phantom Secrets are never stored
Not in devices, cloud, or backups. There is no key at rest to exfiltrate.
Public, Non-sensitive Data
All persistent data is public Regen Tokens, cryptographically useless on their own.
Quorum-Based Recovery
Reconstruction requires a quorum of independent participants. No single point of failure.
Hardware-Enforced Security
Reconstruction happens only inside secure hardware (Toughkey™). Keys never leave the secure element.
Ephemeral by Design
The key exists ephemerally, then is immediately destroyed. No participant holds a key.
Policy-Driven Access
Access based on conditions: identity verified, event confirmed, quorum achieved, device attested.
Biometric and Workflow Verification
Identity is confirmed through biometric attestation and verified workflow conditions before any reconstruction is permitted.
Delegation
Grant access to a secret without ever transferring it. Delegation is policy-controlled, time-bound, and auditable, with no key ever leaving secure hardware.
Core Principles
Five architectural guarantees.
Every Lokblok® product enforces these principles in certified hardware and cryptography, not policy.
01
No Persistent Secrets
Secrets only exist at the exact moment they are needed, then disappear.
This removes:
- Theft at rest
- Backup compromise
- Insider access risk
02
Public, Useless Data
All stored artifacts are public, non-sensitive, and cryptographically useless on their own.
Regen tokens are:
- Public
- Non-sensitive
- Cryptographically useless on their own
They enable reconstruction only when quorum conditions are met, not before.
03
Quorum Without Custody
Recovery agents hold nothing sensitive and cannot act alone.
Recovery agents:
- Hold no key shares
- Cannot reconstruct anything alone
- Don't even know the full quorum
This eliminates collusion and targeting risk.
04
Hardware-Enforced Security
All reconstruction happens inside certified secure hardware (Toughkey™).
Guarantees:
- Keys never leave the secure element
- Device integrity is cryptographically verified
- Secrets exist only in protected memory
05
Policy-Driven Cryptography
Access isn't based on who has a key. It's based on whether conditions are satisfied.
Conditions required:
- Identity verified (ToughID™)
- Event confirmed (death, sale, approval)
- Quorum achieved
- Device attested
If the conditions aren't met, the key simply cannot exist.
Five products. One connected architecture.
Every Lokblok® product is designed to work in concert, creating a complete zero-trust security ecosystem for cryptographic operations.
Delegation Without Custody
Give access. Not the secret.
Traditional delegation means handing over a key, which means losing control. Lokblok® enables delegation without ever transferring the secret.
- Permanent delegation: Ownership transfers only when conditions are met (e.g. inheritance, asset sale)
- Temporary delegation: A user can act with a key without being transferred ownership of said key
- Delegation becomes controlled capability, not key sharing
Conditions Set
Policy conditions are defined: who can access, when, and under what circumstances.
Identity Verified
ToughID™ confirms the identity of the requesting party using hardware attestation.
Quorum Achieved
The required number of independent participants authorize the reconstruction.
Key Reconstructed
The secret is reconstructed inside secure hardware, with no exposure at any point.
Operation Performed
The signing or decryption operation completes. The key is immediately destroyed.
Real-World Use Cases
Where Lokblok® matters most
Digital Asset Custody
Private keys are never stored, eliminating the primary attack surface. Bybit-proof architecture for exchanges and custodians.
Inheritance (Transfer on Death)
Assets transfer securely only after verified attestation and quorum approval. Estate planning for digital assets.
Asset Sale (Transfer on Sale)
Keys are regenerated only after escrow and compliance conditions are proven. Trustless transfers with no intermediary.
Enterprise Governance
Enforce real-world approval structures cryptographically: CFO + CEO + Compliance must all approve.
Authentication (Phantom Gate™)
No passwords, no tokens, no stored credentials. Keys exist only for the session, then are destroyed.
Banking & Finance
Zero-persistence secrets for internal systems. Hardware-bound identity. Multi-party approval workflows.
Code Signing & CI/CD Pipelines
Signing keys are never stored in build servers or repositories. Reconstructed at the moment of signing, used once, then destroyed, eliminating supply chain attacks.
Secure File Storage
File access governed by identity attestation and quorum policy. No stored credentials can unlock files without meeting verified conditions.
Integration
Works with your existing stack
Lokblok integrates as a middleware layer. You don't need to replace your systems.
It works with what you already have
- HSMs and MPC
- Cloud KMS and vaults
- Wallets and applications
- Identity platforms
Nothing to rip out
Your infrastructure stays the same. Lokblok simply changes one thing: how secrets are created and used.
- No keys stored
- No credentials to manage
- No recovery material to protect
Fast to deploy
API-first. No data migration. No disruption.
You don't rebuild your system. You just remove the part that creates the risk.
Why This Matters
Most breaches don't break encryption.
They exploit stored secrets. Lokblok® removes the thing attackers target, eliminating key theft, seed phrase loss, backup compromise, insider misuse, and custodian risk.
Lokblok® removes:
Practitioner reading: eliminating stored private keys, alternatives to MPC custody, and recovery without seed phrases. See all insights or browse the glossary.