Keys without key risk.
With Phantom Secrets™, the Protected Key - the signing key, API key or credential - never exists at rest. No shares to steal. No vendor-held key. It is reconstructed only when a quorum approves, used, then destroyed.
The Problem
Most security systems share one exposure point: where secrets exist over time.
- Stored keys become attack targets
- Backups become liabilities
- Recovery introduces trust
- MPC shares can be accumulated
- Even well-engineered systems keep the secret somewhere, encrypted, between uses.
The Phantom Secrets™ Model
Phantom Secrets™ replaces storage with ephemeral reconstruction.
Traditional approach
- Private keys stored
- Encrypted backups required
- Persistent key shares
- Custodial exposure
Phantom Secrets™ approach
- Public Regen Tokens stored (safe, useless on their own)
- A quorum of participants authorizes reconstruction
- The key is rebuilt inside secure hardware (Toughkey™)
- Used once, immediately destroyed
- The secret exists only at the moment of use
How It Works
From reconstruction to destruction in a single operation.
Regen Tokens Published
Public, non-sensitive tokens are stored. They are cryptographically useless without the quorum.
Conditions Evaluated
Identity is verified via ToughID™. Policy conditions are checked. Quorum threshold determined.
Quorum Convened
The required number of independent participants authorize the reconstruction event.
Key Reconstructed in Hardware
Lokblok uses a FIPS 140-3 Level 3 and Common Criteria EAL6+ certified security chip. Inside Toughkey™, the Protected Key is mathematically reconstructed. It never leaves the secure element.
Operation & Destruction
The signing or decryption operation completes. The key is immediately destroyed. No key persists.
What Makes This Different
No stored-secret attack surface. No latent secret. No custody model.
No Stored-Secret Attack Surface
There is no key to steal at rest. The moment that creates all others, storing a key, is simply never performed.
No Latent Secret
No stored artifact reduces entropy or enables offline attack. Even if every Regen Token is compromised, the key cannot be reconstructed without the quorum.
No Custody Model
No one holds a key. Not even Lokblok®. Custody is replaced by quorum governance.
Threshold-Based Recovery
Flexible k-of-n threshold schemes. You define how many participants must agree. One compromised participant cannot act alone.
Hardware-Bound Execution
Lokblok uses a FIPS 140-3 Level 3 and Common Criteria EAL6+ certified security chip. Toughkey™ reconstructs the Protected Key in protected memory without exposing it to any software layer.
Policy-Controlled Access
Access requires conditions to be satisfied, not just possession of a credential. Cryptographic policy enforcement, not perimeter defense.
Comparison
Phantom Secrets™ vs. existing approaches
| Approach | Keys at Rest | Single Point of Failure | Exposed if storage is breached | Persistent Key Artefacts |
|---|---|---|---|---|
| Cold Storage | ● | ● | ● | ● |
| MPC / TSS | Shares | Partial | Possible | Shares |
| Phantom Secrets™ | – | – | – | – |
● Present · – Not present
Note: MPC's signing nonces are ephemeral, but its key shares are persistent - a breach of enough share-holders over time still yields the key. Phantom Secrets™ stores neither keys nor shares.
Password managers and Phantom Secrets™
Password managers protect credentials with strong client-side encryption. Phantom Secrets™ is a layer they can build on: the most sensitive item in a vault - the signing key, API key or credential - need never exist at rest, and access can pass to a verified successor through a quorum rather than a single emergency contact.
Phantom Secrets™ is the foundation.
Every other Lokblok® product builds on top of Phantom Secrets to deliver a complete zero-trust cryptographic architecture.
