System and method for decrypting encrypted secret data items without master password

1. A method for decrypting encrypted secret data items without compromised security while a master password becomes unavailable, said method performed by a password manager running on an electronic communication device and comprising:

1) retrieving a master password,

2) deriving, using a key derivation function, an encryption key from said master password;

3) generating a master encryption key;

4) encrypting, using said encryption key and a first set of encryption parameters, said master encryption key to generate a first encrypted master encryption key;

5) encrypting, using a hardware encryption element of said electronic communication device and a second set of encryption parameters, said first encrypted master encryption key and said first set of encryption parameters to generate a second encrypted master encryption key;

6) storing said second encrypted master encryption key and said second set of encryption parameters;

7) generating a second tier encryption key;

8) encrypting, using said second tier encryption key and a third set of encryption parameters, said master encryption key to generate a third encrypted master encryption key;

9) encrypting, using said hardware encryption element and a fourth set of encryption parameters, said third encrypted master encryption key to generate a fourth encrypted master encryption key,

10) storing, said fourth encrypted master encryption key and said fourth set of encryption parameters;

11) encrypting, using said hardware encryption element and a fifth set of encryption parameters, said second tier encryption key to generate a first encrypted second tier encryption key;

12) encrypting, using a pre-shared encryption key and a sixth set of encryption parameters, said first encrypted second tier encryption key and said fifth set of encryption parameters to generate a second encrypted second tier encryption key;

13) sending said second encrypted second tier encryption key and said sixth set of encryption parameters to a trusted password manager running on a second electronic communication device over a network;

14) requesting said first encrypted second tier encryption key and said fifth set of encryption parameters from said trusted password manager;

15) receiving said first encrypted second tier encryption key and said fifth set of encryption parameters from said trusted password manager;

16) decrypting, using said hardware encryption element and said fifth set of encryption parameters, said first encrypted second tier encryption key to retrieve said second tier encryption key;

17) retrieving said fourth encrypted master encryption key and said fourth set of encryption parameters;

18) decrypting, using said hardware encryption element and said fourth set of encryption parameters, said fourth encrypted master encryption key to retrieve said third encrypted master encryption key and said third set of encryption parameters;

19) decrypting, using said second tier encryption key and said third set of encryption parameters, said third encrypted master encryption key to retrieve said master encryption key; and

20) decrypting, using said master encryption key, said encrypted secret data items to retrieve secret data items, wherein said electronic communication device having:

a) a processing unit:

b) a memory operatively coupled to said processing unit;

c) a network interface operatively coupled to said processing unit;

d) a video output interface operatively coupled to said processing unit;

e) a hardware security element operatively coupled to said processing unit; and

f) a storage element operatively coupled to said processing unit.

2. The method of claim 1 wherein:

1) said key derivation function is a Password-Based Key Derivation Function 2 function or an Argon2 function;

2) said encryption key is an Advanced Encryption Standard (AES) 128-bit key, an AES 192-bit key or an AES 256-bit key;

3) said master encryption key is an AES 128-bit key, an AES 192-bit key or an AES 256-bit key; and

4) said hardware encryption element is a Secure Element, wherein said Secure Element is a microprocessor chip of said electronic communication device.

3. The method of claim 2 wherein:

1) said first set of encryption parameters includes a first initialization vector;

2) said second set of encryption parameters includes a second initialization vector;

3) said third set of encryption parameters includes a third initialization vector;

4) said fourth set of encryption parameters includes a fourth initialization vector;

5) said fifth set of encryption parameters includes a fifth initialization vector; and

6) said sixth set of encryption parameters includes a sixth initialization vector.

4. The method of claim 2 wherein said second encrypted master encryption key, said second set of encryption parameters, said fourth encrypted master encryption key and said fourth set of encryption parameters are stored into said storage element.

5. The method of claim 4 further comprising generating a new master encryption key.

6. The method of claim 5 further comprising causing a new master password generated.

7. The method of claim 2 further comprising:

1) Sending said second encrypted second tier encryption key and said sixth set of encryption parameters to a second trusted password manager running on a third electronic communication device over a network; and

2) Requesting said first encrypted second tier encryption key and said fifth set of encryption parameters from said second trusted password manager.

8. The method of claim 7 further comprising receiving said first encrypted second tier encryption key and said fifth set of encryption parameters from said second trusted password manager.

9. The method of claim 1 further comprising generating a new master encryption key.

10. The method of claim 9 further comprising causing a new master password generated.

11. The method of claim 1 further comprising:

1) Sending said second encrypted second tier encryption key and said sixth set of encryption parameters to a second trusted password manager running on a third electronic communication device over a network; and

2) Requesting said first encrypted second tier encryption key and said fifth set of encryption parameters from said second trusted password manager.

12. The method of claim 11 further comprising receiving said first encrypted second tier encryption key and said fifth set of encryption parameters from said second trusted password manager.

13. The method of claim 1 wherein said key derivation function is a Password-Based Key Derivation Function 2 function or an Argon2 function.

14. The method of claim 1 wherein said encryption key is an Advanced Encryption Standard (AES) 128-bit key, an AES 192-bit key or an AES 256-bit key.

15. The method of claim 1 wherein said master encryption key is an Advanced Encryption Standard (AES) 128-bit key, an AES 192-bit key or an AES 256-bit key.

16. The method of claim 1 wherein said hardware encryption element is a Secure Element, wherein said Secure Element is a microprocessor chip of said electronic communication device.

17. The method of claim 1 wherein at least one of said first set of encryption parameters, said second set of encryption parameters, said third set of encryption parameters, said fourth set of encryption parameters, said fifth set of encryption parameters, and said sixth set of encryption parameters includes an initialization vector.

18. The method of claim 1 wherein said first set of encryption parameters, said second set of encryption parameters, said third set of encryption parameters, said fourth set of encryption parameters, said fifth set of encryption parameters, and said sixth set of encryption parameters each include a respective initialization vector.

19. The method of claim 1 wherein said second encrypted master encryption key, said second set of encryption parameters, said fourth encrypted master encryption key and said fourth set of encryption parameters are stored into said storage element.