Abstract: The disclosed embodiments include a passwordless method for securing data-at-rest. The method includes encrypting and/or decrypting data with a cryptographic key. For example, the encrypted data can be stored on a non-transitory computer memory of a first device. The method can include generating key shards based on the cryptographic key, which can be reconstituted from the key shards, and distributing the key shards among devices such that the encrypted data is secured at the first device because the first device is incapable of decrypting the encrypted data due to an absence of the cryptographic key.

Abstract: A method comprises: receiving, at a first device, a request to decrypt data encrypted with a symmetric key, the encrypted data stored on a memory device and determining if the request is part of an active session based on configuration parameters and session status. In response to determining the request is part of an active session, the method further comprises: requesting, by the first device, decryption by a plurality of devices of shards of the symmetric key, the shards encrypted with public keys from the plurality of devices, wherein decryption of the data requires reconstituting the symmetric key from a threshold number of the shards; receiving decrypted shards until the threshold number of shards is reached; updating the session status; reconstituting, by the first device, the symmetric key from the decrypted shards; and decrypting, by the first device, the encrypted data with the symmetric key.

Abstract: The disclosed embodiments include a passwordless method for securing data-at-rest. The method includes encrypting and/or decrypting data with a cryptographic key. For example, the encrypted data can be stored on a non-transitory computer memory of a first device. The method can include generating key shards based on the cryptographic key, which can be reconstituted from the key shards, and distributing the key shards among devices such that the encrypted data is secured at the first device because the first device is incapable of decrypting the encrypted data due to an absence of the cryptographic key.