Security Center → Key Management
How Key Release Works
LifeWyn does not hand over plaintext. It waits for your rules, verifies the event, calculates recipient scope, and releases only encrypted key material that nominees unwrap locally.
Release Flow
From sealed vault to scoped nominee access
The release path is intentionally staged. Every step narrows risk before any wrapped key-shares are delivered.
The server coordinates release, but cannot read the vault.
LifeWyn stores ciphertext, rule state, audit evidence, and encrypted key envelopes. The useful key material is reconstructed only when the configured threshold is met by authorized parties.
Release invariant
No approved case, no threshold, no local unwrap means no readable data.
How Threshold Sharing Works
A Threshold You Choose — No Single Point of Failure
Your vault key is split using Shamir's Secret Sharing. You pick how many shares exist and how many are needed; below is one common arrangement. No single party, including LifeWyn, holds enough material.
Your Device
Held in the OS key store; in a browser, in memory only
Backup Device
Wrapped to your trusted device
Nominee 1 (Spouse)
Encrypted for nominee's public key
Nominee 2 (Child)
Encrypted for nominee's public key
Trusted Contact
Encrypted for contact's public key
Any threshold-many of these shares reconstruct the master key
LifeWyn stores encrypted share envelopes and audit state, not a usable plaintext share
Key Derivation Hierarchy
Master Key → Category Keys → Asset Keys
HKDF-SHA-256 with domain separation ensures cryptographic isolation between key types.
Level 0: Master Key (MK)
256-bit • scrypt(vault passphrase, salt, N=2^15, r=8, p=1)
Never leaves the device • In a browser it is held in memory for the session only
Vault Key (CK)
HKDF(MK, 'vault')
Root vault encryption
Credentials Key (CK)
HKDF(MK, 'credentials')
Password manager keys
Documents Key (CK)
HKDF(MK, 'documents')
Document encryption
Assets Key (CK)
HKDF(MK, 'assets')
Asset metadata keys
Bank Account
DEK = random 256-bit
Wrapped by Category Key
Insurance Policy
DEK = random 256-bit
Wrapped by Category Key
Will Document
DEK = random 256-bit
Wrapped by Category Key
Crypto Wallet
DEK = random 256-bit
Wrapped by Category Key
Property Deed
DEK = random 256-bit
Wrapped by Category Key
Investment
DEK = random 256-bit
Wrapped by Category Key
Medical Record
DEK = random 256-bit
Wrapped by Category Key
Digital Account
DEK = random 256-bit
Wrapped by Category Key
Cross-Device Sync
Secure Multi-Device Access
Your vault unlocks on every device without ever exposing the master key to our servers.
- 1Generate device keypair
- 2Scan QR / approve push
- 3Receive wrapped master key
- 4Decrypt locally with biometric
- 1Encrypt change with category key
- 2Send ciphertext to server
- 3Push to other devices
- 4Decrypt & apply locally
- 1Mark device revoked
- 2Rotate device keypair
- 3Re-wrap shares for new key
- 4Push update to all devices
Key Rotation
Forward Secrecy Through Periodic Rotation
Category keys rotate annually. Asset keys rotate on modification. Compromised keys don't decrypt past data.
Key Type
Master Key
Frequency
Never (user-controlled)
Trigger
Manual password change only
Impact
Re-derives all category keys
Key Type
Category Keys
Frequency
Annually (automated)
Trigger
Time-based or security event
Impact
Re-wraps all DEKs in category
Key Type
Asset Keys (DEKs)
Frequency
On modification
Trigger
Content change detected
Impact
New DEK generated, old retired
Key Type
Device Keys
Frequency
30 days or on revocation
Trigger
Time-based or manual revoke
Impact
New device keypair generated
Key Type
Threshold Shares
Frequency
On key rotation
Trigger
Category/master key change
Impact
New Shamir polynomial generated
Your Keys. Your Control. Always.
LifeWyn never holds your master key. You decide who gets shares, when they rotate, and when to revoke.