Technical Documentation
Architecture & Technical Reference
Zero-persistence. Hardware-bound. Cryptographically verified. How Phantom Secrets™ removes the target rather than defending it.
Technical Resources
Evaluating Phantom Secrets™ on the merits? Jump straight to the materials your security and engineering teams need.
Architectural Overview
Zero Standing Secrets
Lokblok's Phantom Secrets platform is built on a zero-persistence, non-custodial architecture. As defined in the technical white paper, this introduces a third model beyond storage and encryption: secrets reconstructed on demand, executed inside hardware, and destroyed the moment the operation completes.
What is eliminated
What replaces it
Zero-Persistence Architecture
Traditional systems store secrets, protect them, rotate them, and eventually lose them. Lokblok never stores secrets at all. Secrets exist only during a verified operation window, are reconstructed inside secure hardware, and are destroyed immediately after use.Attack surface at rest = zero.
Trust Architecture
Lokblok® Trust Fabric
An Integrated Sovereign Security Architecture
Business Applications — Third-party & Custom Build
Services & Orchestration Layer
API & SDK Gateway
Hardware Root of Trust
Managed HSM / Edge Gateway
Decentralized MPC Root of Trust
Sharded Secret Parties
FIDO2 Hardware Token
Rugged Biometric Key
System Components
Six layers. One unified protocol.
01 HARDWARE ROOT OF TRUST
Toughkey™
02 ORCHESTRATION
Phantom Secrets API Service
03 IDENTITY & WORKFLOW
ToughID™
04 DISTRIBUTED RECONSTRUCTION
Recovery Agents
05 GOVERNANCE
Policy & Delegation Engine
06 API & SDK GATEWAY
Phantom Gate™
Proven Foundations · Threat Model
Built on Proven Cryptography
Lokblok is not built on experimental cryptography. It is a novel composition of well-established technologies, including threshold cryptography, secure hardware, and hardware attestation, combined in a way that removes the need for stored secrets.
The innovation is in how they are combined. Much like Bitcoin, Lokblok does not rely on a single breakthrough. It connects existing technologies to create a new security model.
From Components to Architecture
Individually, these technologies
- Secure keys
- Distribute trust
- Verify identity
Combined, they enable
- Zero-persistence cryptography
- No stored secrets
- No custodial risk
- No static attack surface
Why This Matters
Because the system is built on proven components:
- It is auditable and understandable
- It avoids reliance on untested assumptions
- It can be deployed in regulated and high-assurance environments
Cryptographic Architecture
Threshold reconstruction. No stored shares.
Phantom Secrets is built on a Shamir's Secret Sharing-derived threshold model. A polynomial of degree k-1 is defined over a finite field, where evaluating any k points permits reconstruction of the secret S. What Lokblok changes is where those points come from.
RECONSTRUCTION MODEL
f(x) = S + a1x + a2x2 + ⋯ + ak−1xk−1SThe secretkThreshold (minimum participants)f(x)is the polynomial used for reconstructionCONVENTIONAL SYSTEMS
Store shares (y-values). Those shares become persistent attack targets. Compromise any storage location and the reconstruction is within reach.
LOKBLOK
Stores nothing. Recomputes inputs dynamically from verified identities, public datasets, hardware attestations, and session entropy. Shares exist only during reconstruction, then immediately destroyed.
ABSCISSAE ARE DERIVED FROM
After reconstruction: shares are destroyed, wiped, and gone. No backups. No logs. No "just in case."
Operational Flow
Eight steps from zero to zero.
Every operation begins and ends with no attack surface. The steps in between are cryptographically verified at every transition.
Session Initiation
User authenticates via Toughkey™. Hardware attestation generated.
Identity Verification
Biometric and liveness check. Cryptographic identity binding.
Administrative Approval
Optional secondary verification for high-risk actions.
Data / Event Validation
External condition verified (e.g. sale confirmed, death attested, approval received).
Workflow Validation
Full chain verified by API service. Policy and quorum checked.
Secret Reconstruction
Occurs inside secure hardware. Never exposed externally.
Execution
Signing, access, or transfer occurs.
Destruction
All intermediate values destroyed. Attack surface returns to zero.
Delegation Models
Use without possession.
PERMANENT DELEGATION
Ownership Transfer
TEMPORARY DELEGATION
Controlled Usage
Security Model
Designed against specific adversaries.
Trust Assumptions
The system's security guarantees hold under four explicit trust assumptions:
Integration Architecture
Lokblok as the foundational layer.
With IAM / Zero Trust
Replaces credentials with ephemeral identity. No standing access tokens.
With PAM
Removes privileged credential storage. Privileged access with no privilege at rest.
With KMS / Vaults
Eliminates stored key material. Retains policy and orchestration layer.
With Cloud Platforms
Enables sovereign cryptographic control independent of cloud provider access.
Compliance & Auditability
Non-repudiable by design.
Every action produces a cryptographically signed record, hardware attestation, and identity verification. The ToughID™ Workflow Chain provides a complete, tamper-evident audit trail. No action is possible without leaving a verifiable, non-repudiable record.
Where this architecture appears
From the cryptographic core to the products and industries that use it.
The threshold-reconstruction architecture above is realised as a small set of products, exposed through a handful of cryptographic features, and deployed across the regulated industries that cannot tolerate stored keys.
Products that implement this architecture
- Phantom Secrets™: zero-persistence private-key reconstruction
- Phantom Gate™: policy enforcement at the cryptographic boundary
- Secure Terminal: encrypted local storage and signing surface
- ToughID™: hardware-attested identity for share contributors
- Toughkey™: tamper-resistant hardware root for the threshold scheme
Cryptographic features exposed by the architecture
Industries and use cases the architecture serves
- Digital-asset custody: eliminate stored signing keys
- Banking and finance: MiCA-aligned key management
- Payments: zero-persistence keys for HSM-backed payment systems
- Data sovereignty: key control without custodial exposure
- Critical infrastructure: resilient cryptography for OT and grid
- Digital identity: non-custodial key recovery
- Digital inheritance: provable transfer without stored seed phrases
- Enterprise security: insider-threat-resistant key handling
- HSM providers: distributed reconstruction over existing HSMs
- Telecoms: subscriber-key protection without persistent storage
- Security providers: embeddable zero-persistence cryptography
Architectural Summary
The architecture at a glance.
Further reading: HSM vs MPC vs zero-persistence, zero-trust key management, and post-quantum key management. Browse all practitioner insights or the terminology glossary.
The Question
Why do secrets exist at all?
Most systems ask how to secure secrets. Lokblok asks why they need to exist. Then removes them from the architecture. Which, inconveniently for attackers, leaves them with nothing to steal.