SSO Without Giving the Server Your Keys

Single sign-on (SSO) is a common solution for authentication, but it poses challenges when dealing with applications that encrypt data at the browser level. MindMapVault, a platform offering end-to-end encryption, faced this issue. To overcome this, they employed a unique approach that eliminates the need for users to manually enter passphrases.

The concept centers around deriving an encryption key from a user's passphrase within the browser. This master key, generated using Argon2id, is then utilized to encrypt and unlock various keys and vaults. The server only stores the ciphertext and a hash of the authentication token, never having access to the master key or any user's private keys.

When integrating an identity provider, users authenticate through the provider and receive an OIDC token, which only confirms their identity and not the decryption key. The server cannot access the user's actual data without the master key.

The user experience involves two sign-ins: the first through the identity provider and subsequent sign-ins through the MindMapVault. A single passphrase is required initially when signing in, after which the user's machine is remembered for subsequent logins. If a new laptop is used, the user only needs to enter the passphrase once. Thus, the passphrase is entered as often as one purchases a new computer.

The authentication flow is straightforward, starting with the OIDC flow, followed by a redirect back to the server, where the user is redirected to the vault after successful verification. The ID token is then verified for signature, issuer, audience, expiry, and nonce. Upon successful verification, the server unlocks the vault locally, using a key that the server has never seen.

The integration of passkeys (cryptographic keys stored on devices) enhances the security and user experience, with the wrapping key generated in the browser and never exposed. The server only stores encrypted copies of the master key, each associated with a specific unlock method. The database is designed to store unlock methods, including the kind, label, wrapped master key, creation, and last usage timestamps.

In summary, the key takeaway from this SSO implementation is that the master key, derived from the user's passphrase, is never exposed to the server, ensuring end-to-end encryption and maintaining zero-knowledge trust. By adding passkeys as an unlock method, the system becomes even more secure and user-friendly.