Accessory assisted account recovery
Embodiments described herein enable a user to bypass the use of one-time keys or account recovery codes by providing techniques for accessory assisted account recovery. In various embodiments, accessory assisted account recovery makes use of an accessory device of a user, where the accessory device can be any device having a secure processor, cryptographic engine, public key accelerator, or is otherwise able to accelerate cryptographic operations or perform cryptographic operations in a secure execution environment. An account recovery key can be split into multiple portions. At least one portion of the recovery key is then encrypted. The accessory device is then configured to be uniquely capable of decrypting the encrypted portion of an account recovery key.
1. A method, the method comprising:
at an electronic device having a processor and memory, the electronic device to facilitate recovery of a user account:
receiving a first randomized value;
generating a second randomized value;
computing a cryptographic seed based on the first randomized value and the second randomized value;
storing the cryptographic seed in storage on the electronic device;
generating a key pair using the cryptographic seed and transmitting a public key from the key pair to a second electronic device associated with the user account;
receiving an encrypted portion of an account recovery key from the second electronic device;
determining whether the encrypted portion of the account recovery key is associated with the electronic device;
in response to a determination that the encrypted portion of the account recovery key is associated with the electronic device, performing decryption of the encrypted portion of the account recovery key with a private key from the key pair; and
sending, to the second electronic device, a portion of the account recovery key resulting from performing decryption.
2. The method of claim 1 , wherein the second electronic device is associated with the electronic device.
3. The method of claim 1 , wherein performing decryption of the account recovery key enables recovery of at least one of the user account associated with the second electronic device or data associated with the user account.
4. The method of claim 1 , the method further comprising:
transferring the public key of the key pair in response to an event on the electronic device.
5. The method of claim 4 , wherein the event on the electronic device includes establishing a short-range wireless network connection with the second electronic device.
6. The method of claim 1 , the method further comprising:
receiving, from the second electronic device or a server, the first randomized value, wherein the first randomized value comprises at least a first portion of a recovery key for the user account.
7. The method of claim 1 , the method further comprising:
generating the second randomized value using a random number generator; and
generating the cryptographic seed with the first randomized value, the second
randomized value, and a hardware identifier for the electronic device.
8. A non-transitory machine-readable medium storing instructions to cause one or more processors on an electronic device to perform operations comprising:
at the electronic device having the one or more processors and memory, the electronic device to facilitate recovery of a user account:
receiving a first randomized value;
generating a second randomized value;
computing a cryptographic seed based on the first randomized value and the second randomized value;
storing the cryptographic seed in storage on the electronic device;
generating a key pair using the cryptographic seed and transmitting a public key from the key pair to a second electronic device associated with the user account;
receiving an encrypted portion of an account recovery key from the second electronic device;
determining whether the encrypted portion of the account recovery key is associated with the electronic device;
in response to a determination that the encrypted portion of the account recovery key is associated with the electronic device, performing decryption of the encrypted portion of the account recovery key with a private key from the key pair; and
sending, to the second electronic device, a portion of the account recovery key resulting from performing decryption.
9. The non-transitory machine-readable medium as in claim 8 ,
wherein the second electronic device is associated with the electronic device.
10. The non-transitory machine-readable medium as in claim 8 , wherein performing decryption of the account recovery key enables recovery of at least one of the user account associated with the second electronic device or data associated with the user account.
11. The non-transitory machine-readable medium as in claim 8 , the operations additionally comprising:
transferring the public key of the key pair in response to an event on the electronic device.
12. The non-transitory machine-readable medium as in claim 11 , wherein the event on the electronic device includes establishing a short-range wireless network connection with the second electronic device.
13. The non-transitory machine-readable medium as in claim 8 , the operations additionally comprising:
receiving, from the second electronic device or a server, the first randomized value, wherein the first randomized value comprises at least a first portion of a recovery key for the user account.
14. The non-transitory machine-readable medium as in claim 8 , the operations additionally comprising:
generating the second randomized value using a random number generator; and
generating the cryptographic seed with the first randomized value, the second
randomized value, and a hardware identifier for the electronic device.
15. An electronic device, the electronic device comprising:
a memory to store instructions; and
at least one application processor coupled with the memory, the at least one application processor to execute instructions stored in the memory, wherein the
at least one application processor is to:
receive a first randomized value;
generate a second randomized value;
compute a cryptographic seed based on the first randomized value and the second randomized value;
store the cryptographic seed in storage on the electronic device;
generate a key pair using the cryptographic seed and transmitting a public key from the key pair to a second electronic device associated with a user account;
receive an encrypted portion of an account recovery key from the second electronic device;
determine whether the encrypted portion of the account recovery key is associated with the electronic device;
in response to a determination that the encrypted portion of the account recovery key is associated with the electronic device, perform decryption of the encrypted portion of the account recovery key with a private key from the key pair; and
send, to the second electronic device, a portion of the account recovery key resulting from performing decryption.
16. The electronic device as in claim 15 ,
wherein the second electronic device is associated with the electronic device.
17. The electronic device as in claim 15 , wherein performing decryption of the account recovery key-enables recovery of at least one of the user account associated with the second electronic device or data associated with the user account.
18. The electronic device as in claim 15 , the at least one application processor to provide:
transfer the public key of the key pair in response to an event on the electronic device.
19. The electronic device as in claim 18 , wherein the event on the electronic device includes establishing a short-range wireless network connection with the second electronic device.
20. The electronic device as in claim 15 , the at least one application processor to provide:
generate the second randomized value using a random number generator; and
generate the cryptographic seed with the first randomized value, the second
randomized value, and a hardware identifier for the electronic device.