Don't trust us. Verify the architecture. Zero‑knowledge security, explained down to the primitives.
How Veridenti encrypts, what our servers actually hold, what happens if the encrypted vault is stolen — including the quantum question — and exactly where zero-knowledge ends and your responsibility begins. Written for security engineers; readable by the executives they report to.
Executive summary
Three claims. Each one is checkable.
"Zero-knowledge" is an over-used phrase. This paper defines precisely what it means at Veridenti — as architecture you can verify, not policy you must trust. It reduces to three claims, and the rest of this document is the evidence for each.
We cannot read your secrets
Every vault item is encrypted with AES-256-GCM on the device, under keys derived from a master password we never receive. Our servers hold ciphertext and salted verifiers — nothing decryptable.
We cannot recover your secrets
There is no vendor master key and no support back-door. Organizational recovery uses M-of-N Shamir secret sharing held by your designated officers. We cannot be breached, bribed, or compelled into producing a key we do not hold.
We cannot rewrite history
Administrative actions land in a tamper-evident, hash-chained audit log. Each entry commits to the one before it, so any deletion or edit breaks the chain — and the break is independently verifiable.
One more property follows from the same design: no phone-home by default. Posture analysis — including leaked-password and breached-domain monitoring — is computed on the endpoint. Telemetry is strictly opt-in. A security product should not itself be a data-exfiltration channel.
The zero-knowledge model
One password in. Two keys out. Only one ever leaves.
The heart of the design is a deliberate split. The master password is stretched through a memory-hard key derivation function, then domain-separated into two independent values: an encryption key that never leaves the device, and an authentication verifier that is all the server ever sees. Knowing the verifier tells you nothing about the key.
Figure 1 — The zero-knowledge split. The KDF output is domain-separated: the authentication verifier and the Master Key are cryptographically independent, so possession of everything the server stores — verifier and ciphertext — yields nothing decryptable. TLS protects transport, but it is not what protects the vault: the vault is sealed before it ever touches the network.
Why the split matters
Many "encrypted" services derive a single value from your password and send it to the server, meaning a server compromise plus a password guess unlocks everything in one step. Veridenti's separation means the server-side verifier is useless for decryption, the client-side key is never transmitted, and an attacker who takes the entire server estate still faces the full offline-guessing problem analyzed in the next sections — against a memory-hard function tuned to make every single guess expensive.
Cryptographic architecture
Boring, standard, layered. Exactly as it should be.
Veridenti invents no cryptography. Every layer is a well-studied, standards-track primitive, composed conservatively: symmetric authenticated encryption at the core, asymmetric key agreement only where sharing requires it, and threshold secret sharing for recovery. Each layer can fail independently without unsealing the one below.
Figure 2 — The layer stack. Sharing and recovery are grafted onto the key hierarchy by wrapping keys, never by duplicating plaintext. Compromise of the asymmetric wrapping layer (the future quantum concern) does not by itself unseal item ciphertext, which is purely symmetric.
Primitive-by-primitive
| Primitive | Role & properties |
|---|---|
AES-256-GCM |
Item encryption — confidentiality and integrity in one operation. Authenticated encryption means a flipped bit anywhere in the ciphertext causes decryption to fail loudly rather than yield silently corrupted secrets. Every item is sealed under a unique 96-bit nonce; associated data binds ciphertext to its record so entries cannot be swapped or replayed. |
Memory-hard KDF |
Master-password stretching — the economic wall. An Argon2id-class function with per-user salt and tuned memory and time cost. Memory-hardness is the point: it collapses the GPU/ASIC advantage that makes fast hashes guessable at billions per second. Parameters follow NIST SP 800-63B guidance and are revisited as hardware evolves. |
ECDH-ES · P-256 |
Key wrapping — sharing without disclosure. Ephemeral-static ECDH wraps vault keys to a device's or teammate's public key, so shared vaults and multi-device sync move keys, never plaintext. This is the layer with a long-horizon quantum exposure; the hybrid post-quantum plan is covered below. |
Shamir M-of-N |
Recovery — threshold trust, customer-held. The recovery secret is split so that any M of N shards reconstruct it and fewer than M reveal mathematically nothing — not "hard to use," but information-theoretically nothing. Your organization chooses the officers and the threshold. Veridenti holds zero shards. |
SHA-256 chain |
Audit integrity — tamper-evidence you can verify. Each audit entry includes the hash of its predecessor. Deleting, reordering, or editing any entry invalidates every subsequent hash. Verification requires only the log itself and a hash function — no trust in our export tooling. |
CSPRNG |
Randomness — keys, salts, nonces, generated passwords. All random material comes from the platform's cryptographically secure generator. Generated passwords are produced locally on the device; no generation service ever sees them. |
Governance boundary
The work/personal line is cryptographic, not administrative.
The boundary between an employee's private data and the company's isn't a policy setting that an admin could quietly flip — it is a difference in which keys exist.
A personal vault is sealed under a key derived on the user's own device; no Org Recovery Key is ever wrapped to it, so it is unrecoverable by anyone but the user — including Veridenti and any organization. A work vault on an enrolled profile additionally wraps its vault key to the organization's recovery public key, whose private half is Shamir-split (M‑of‑N, threshold ≥ 2) across officers the customer designates. A quorum of those officers — and only that quorum, with every step written to the hash-chained audit log — can reconstruct the recovery key and decrypt the work vault. Veridenti holds zero shares and has no decrypt path to either vault type.
Stated precisely: “work” is the set of items the customer's own officer quorum can recover; “personal” is the set no one but the user can. A work vault is zero-knowledge to Veridenti — not to the organization that owns it. We would rather you read that here than infer it in a security review.
Threat analysis
Assume the worst: the encrypted vault is stolen tonight.
This is the scenario zero-knowledge is built for, so let's walk it honestly. An attacker exfiltrates every byte we store — full vault ciphertext, verifiers, metadata. What are their options? There are exactly three, and they are not created equal.
Brute-force AES-256
The key space is 2256 ≈ 1077. Checking even a trillion trillion keys per second consumes cosmological time — the math predates and survives the AI era, because AI accelerates computation, not the size of a key space, and a correctly implemented cipher leaks no gradient to learn from. No serious adversary attempts this.
Guess the master password offline
The practical attack is not on the cipher but on the human input to the KDF: run candidate passwords through the derivation until one decrypts. This is the fight the memory-hard KDF is designed to win — and why master-password strength is the one thing that remains yours to control.
Wait for a quantum computer
"Harvest now, decrypt later" is a rational strategy against some systems. Below we separate what quantum computing actually threatens here (the P-256 wrapping layer, eventually) from what it does not (the AES-256 vault core), and what we are doing about the former.
Path 2, quantified: why memory-hardness changes the economics
Offline guessing speed is entirely a function of how the password was stretched. Against a raw fast hash, commodity GPU rigs test billions of candidates per second. Against an iterated hash, millions. Against a memory-hard KDF, each guess must occupy a large block of RAM for real time — the massive parallelism of GPUs and ASICs collapses, because memory bandwidth, not arithmetic, becomes the bottleneck:
Figure 3 — The economic wall. Figures are order-of-magnitude illustrations for a single modern rig; absolute numbers vary with hardware and parameters, the ratio does not. Combine the wall with a strong, unique master password — which enterprise policy can require and measure — and offline guessing stops being a business case for the attacker.
Path 3, honestly: the quantum question
Two quantum algorithms matter, and they land very differently on this architecture. Grover's algorithm attacks symmetric ciphers, but only quadratically: it halves effective key strength, taking AES-256 to roughly 128-bit security — a level still far beyond feasible attack, which is precisely why 256-bit keys were chosen. The vault core is not the quantum problem. Shor's algorithm is different: a sufficiently large fault-tolerant quantum computer would break elliptic-curve cryptography outright, which eventually threatens the P-256 key-wrapping layer used for sharing and device sync. Our response is the industry's response, applied where it matters: a hybrid post-quantum scheme on the roadmap — NIST-standardized ML-KEM key encapsulation layered alongside ECDH, so wrapped keys are protected unless both the classical and post-quantum layers fail. Because item ciphertext is purely symmetric, a harvested vault blob does not become retroactively readable the day large quantum machines arrive.
“Our breach-day claim is deliberately narrow and therefore checkable: the attacker holds ciphertext they cannot decrypt, verifiers they cannot invert, and a log they cannot rewrite. Everything else in this paper exists to make that sentence true.”
Veridenti security engineeringScope, honestly
What zero-knowledge protects — and what it can't.
A vendor that claims its encryption solves everything is telling you it doesn't understand its own threat model. Zero-knowledge is a precise guarantee about our side of the trust boundary. On your side of it, different controls apply — and pretending otherwise would be the real security risk.
Figure 4 — The honest split. The left column is guaranteed by construction and holds even against Veridenti itself. The right column is where enterprise policy, endpoint security, and Veridenti's posture tooling — strength scoring, reuse detection, on-device breach monitoring — work together to shrink what remains.
Shared responsibility
| Veridenti guarantees | Your organization controls |
|---|---|
| Client-side encryption of every secretAES-256-GCM before any byte leaves the device | Master-password policylength and uniqueness requirements, enforced and measured via posture scoring |
| No vendor-held keys, everrecovery is M-of-N Shamir among your officers | Recovery officer designationchoose officers and threshold; rehearse recovery before you need it |
| Memory-hard stretching, maintainedKDF parameters tuned and revisited as hardware evolves | Endpoint security & MFAdevice hygiene, screen-lock policy, MFA on identity-provider sign-in |
| Tamper-evident audit & SIEM deliveryhash-chained log, streamed to your monitoring stack | Monitoring & responsealert on anomalies; act on the posture findings the console surfaces |
| On-device breach monitoringleaked-password and breached-domain checks computed locally — no phone-home | Rotation disciplinerotate flagged credentials; retire stale and exported secrets |
Audit integrity
A log that tells on anyone who touches it.
Audit trails are only as trustworthy as their mutability. Veridenti's audit log is hash-chained: every entry commits to the SHA-256 digest of the entry before it, so the log's integrity is a property you can recompute — not a promise you have to accept.
Figure 5 — Tamper-evidence in practice. Auditors and incident responders can verify chain integrity independently. The same stream feeds your SIEM: Splunk HEC and Datadog natively, Microsoft Sentinel and any other SIEM via a generic HTTPS collector — so the evidence lives in your infrastructure, not only ours.
Standards & assurance
Built to standards. Assured in the open.
We would rather tell you exactly where we are than round up. The engineering standards below are design inputs today; the assurance programs are stated with their real status — because a security vendor's credibility is spent fastest on its own claims.
NIST SP 800-63BDesign input
Memory-hard stretching, salted verifiers, breached-password screening, and no arbitrary composition rules — the digital-identity guideline, followed rather than cited.
OWASP ASVSDesign input
The Application Security Verification Standard frames our secure-development checklist for the extension, clients, and control plane.
SOC 2Readiness in progress
A formal SOC 2 readiness program is underway, with a Type I report targeted first. Control documentation is available to prospective customers under NDA.
ISO/IEC 27001On roadmap
Certification is planned on the roadmap; our information-security policy pack is already structured to map onto the Annex A control families.
Enterprise contracting, stated plainly: SSO (SAML/OIDC) and SCIM provisioning are included on Enterprise plans (50+ seats) and available as an at-cost add-on for smaller teams. Vault data is region-pinned and fails closed — global today, with EU/US and per-country residency on Enterprise contract. DPA and BAA are available at contracting, counsel-approved. Breach monitoring covers leaked passwords and breached domains, computed on-device with no phone-home.
Next step
Put this paper in front of your hardest reviewer.
Every claim here is architectural, which means every claim is testable. Bring your security team's hardest questions — the design review is the part of the sales process we enjoy most.
Security review kit
Deep divesales@veridenti.com — architecture walkthrough with security engineering
Documentationcontrol & policy pack under NDA; DPA/BAA at contracting
Start nowveridenti.com — the zero-knowledge core ships in every plan