Abstract: Novel tools and techniques are provided for implementing transfer of high entropy keys. In examples, a trusted device may generate a first key pair including a first ephemeral public key and a first ephemeral private key. A camera of the trusted device may capture a graphic code displayed by an untrusted device. The trusted device may extract a second ephemeral public key from the graphic code. The trusted device may generate a first instance of a symmetric key based on the first ephemeral private key and the second ephemeral public key, and may encrypt a high entropy key with the first instance of the symmetric key. The trusted device may send the encrypted high entropy key and the first ephemeral public key to a server for transfer to the untrusted device, which may decrypt the encrypted high entropy key using a second instance of the symmetric key.

Abstract: A system and method for providing secure Single-Sign-On (SSO) authentication in a zero-knowledge architecture. A first server component may operate as a first relying party in a first SSO flow. When the user of an application successfully authenticates to a first identity provider, a first part of a secret key may be provided to the application. Additionally, a second server component may operate as a second relying party in a second SSO flow. When the first part of the secret key is received by the application, authentication information may be provided to a second identity provider. Based on a successful authentication, a second part of the secret key may be provided to the application. The first and second parts of the secret key may be combined by the application to generate a final secret key that may be used to decipher encrypted user data.

Abstract: A system and method for providing secure Single-Sign-On (SSO) authentication in a zero-knowledge architecture. A first server component may operate as a first relying party in a first SSO flow. When the user of an application successfully authenticates to a first identity provider, a first part of a secret key may be provided to the application. Additionally, a second server component may operate as a second relying party in a second SSO flow. When the first part of the secret key is received by the application, authentication information may be provided to a second identity provider. Based on a successful authentication, a second part of the secret key may be provided to the application. The first and second parts of the secret key may be combined by the application to generate a final secret key that may be used to decipher encrypted user data.