I am glad to read that the data I store in 1Password are encrypted locallly before tranmission

lorennerol

However, I am curious to know how the private key used for encryption is selected and stored; does the end user choose/manage this, is it randomly generated, etc?

MikeT

Hi @lorennerol,

The master encryption key is randomly generated on the fly using your system's pseudo-random generator and then re-encrypted with a derived key that's built from the master password you use. We take your password and scramble it tens of thousands of times before we derive a key from it. What's left is an encrypted key file that once decrypted with your password, reveals the encryption key to decrypt your data.

You might be interested in reading our basic security design guide here: https://support.1password.com/secure-by-design/ with links to more technical design docs.

lorennerol

Thank you. I'd read that page, but I don't think it included the info about how the key is generated. How is the private key transmitted to other devices to which my list of passwords is synchronized?

MikeT

Hi @lorennerol,

You're right, it's not that easy to find the info right off the bat, it's mentioned in a complex setup in this section that shows how many keys are involved and how they're all involved. I'll file a request for our security docs team to include that information or simplify it further in our basic guide.

How is the private key transmitted to other devices to which my list of passwords is synchronized?

Your vault file includes both the encrypted key file and your encrypted data together.

For the older Agile Keychain vaults, it is stored in its own key files inside the vault directory. For OPvault, it is stored in your profile.js file, you can see its structure here: https://support.1password.com/opvault-design/#profile-js

lorennerol

Thanks. How can new devices decrypt the data if the private key is encrypted with itself?

MikeT

Hi @lorennerol,

They cannot without your help. That's where your master password comes in, 1Password will take it, derive a key from it and use it to decrypt the key file before it can start decrypting your data.

That's why you must remember your master password and why there's no way to reset your password if you forget it.

lorennerol

So if just the master password is used to encrypt the first layer of the file to obtain the private key, what's the point of the private key at all? The master password exposes it, so it can be used to decrypt the rest of the file, so why not just use the master password for all the encryption? Sorry if I'm being dense here, I genuinely want to understand the process/system.

MikeT

Hi @lorennerol,

No need to apologize, this stuff is hard to explain because it's not a simple process, we have a lot of technical algorithms that we do for each step of the whole process.

Why we use private keys instead of master passwords is mainly because we need a strong and unique key that's based on randomness, not on easy to guess passwords, people don't often pick strong enough passwords. The said key will not change since you need the same key to unlock the safe, so the focus is on protecting that key by encrypting it with a different key, your password. It's really a two-key approach to this (note that in the whole process, there are more keys involved as well like I mentioned earlier).