E2EAuth
Your Keys. Your Devices. Fully Protected.
Overview
E2EAuth is an open-source, cross-platform authenticator specification designed to provide secure, private, and reliable management of multi-factor authentication credentials across desktop and mobile devices. It supports Time-Based One-Time Passwords (TOTP) and HMAC-Based One-Time Passwords (HOTP), with end-to-end encrypted synchronization, local-first storage, and social recovery through trusted contacts.
E2EAuth is designed around user ownership, zero-knowledge architecture, interoperability, transparent security practices, and freedom from vendor lock-in. Authentication secrets remain under user control, and synchronization or recovery services must not gain independent access to the user's credential vault.
Core Principles
- Security First: Protect authentication secrets throughout storage, synchronization, recovery, and use.
- End-to-End Encryption: Ensure that only authorized user devices can decrypt the credential vault.
- Local-First Operation: Allow users to generate authentication codes without an internet connection.
- User Ownership: Give users control over credentials, devices, encryption keys, backups, and recovery arrangements.
- Cross-Platform Compatibility: Support secure access across desktop and mobile environments.
- Zero-Knowledge Architecture: Prevent servers, service operators, and recovery contacts from independently reading vault contents.
- Open Source Transparency: Enable public review of the specification, implementation, security controls, and changes.
- Interoperability: Support established authentication standards and portable credential migration.
- Resilient Recovery: Provide secure recovery options without introducing unauthorized access or centralized recovery backdoors.
- Auditable Operations: Maintain transparent records of security-relevant actions without unnecessarily exposing authentication secrets.
Core Modules
Authentication Credential Management
- Support TOTP credentials in accordance with RFC 6238.
- Support HOTP credentials in accordance with RFC 4226.
- Allow users to add credentials by scanning compatible QR codes.
- Support manual entry of issuer names, account identifiers, shared secrets, algorithms, digit lengths, and other required parameters.
- Validate imported credential parameters and identify unsupported configurations.
- Generate authentication codes locally using the appropriate algorithm and credential parameters.
- Display countdown indicators for time-based codes.
- Track HOTP counter state and synchronize counter updates safely across authorized devices.
- Support credential names, issuer information, account labels, icons, categories, tags, and notes.
- Provide search, sorting, filtering, and favorites.
- Display code expiration and regeneration status clearly.
- Support secure copying of authentication codes with configurable clipboard-clearing behavior.
- Minimize exposure of secrets and codes in application logs, notifications, crash reports, and diagnostic output.
- Clearly identify invalid, expired, unsupported, or potentially conflicting credentials.
- Preserve credential functionality when the device is offline.
Secure Vault and Local Storage
- Store authentication credentials in a protected local vault.
- Encrypt sensitive credential data at rest.
- Separate vault encryption keys from stored credential data.
- Use secure platform facilities for protecting device-specific key material when available.
- Support a user-controlled vault unlock mechanism.
- Support strong password-based key derivation where passwords are used.
- Provide optional biometric unlocking through supported operating-system security facilities.
- Apply configurable automatic locking after inactivity or application backgrounding.
- Require reauthentication for sensitive operations according to user-defined security policies.
- Protect against accidental exposure through application previews, screenshots where supported, clipboard history, and notification content.
- Provide secure vault locking and session termination.
- Avoid storing plaintext authentication secrets in logs, temporary files, or unprotected backups.
- Communicate the limitations of device-level protection and the risks of compromised operating systems.
End-to-End Encryption and Key Management
- Encrypt vault contents before they leave the originating device.
- Ensure synchronization providers cannot independently decrypt credential data.
- Use established, independently reviewed cryptographic algorithms and protocols.
- Define authenticated encryption, secure key derivation, nonce handling, and key rotation requirements.
- Establish authenticated device identities and secure key exchange for device pairing.
- Prevent unauthorized devices from joining a user's synchronization network.
- Protect synchronized data against tampering, replay, and unauthorized modification.
- Bind encrypted records to appropriate contextual metadata to prevent unintended substitution between vaults or records.
- Separate authentication, encryption, device identity, and recovery responsibilities.
- Prevent passwords, encryption keys, recovery shares, and authentication secrets from appearing in telemetry or diagnostic output.
- Support revocation of device access and rotation of relevant encryption keys.
- Clearly communicate that previously authorized or compromised devices may retain information they have already decrypted.
- Document cryptographic assumptions, threat models, key lifecycles, and recovery limitations.
Cross-Device Synchronization
- Synchronize credentials between authorized desktop and mobile devices.
- Support synchronization through peer-to-peer connections, encrypted cloud services, or user-operated infrastructure.
- Preserve end-to-end encryption regardless of the selected synchronization method.
- Allow users to choose, change, or disable synchronization providers.
- Support secure device pairing with explicit user authorization.
- Display paired devices, device identifiers, last synchronization status, and relevant security information.
- Notify users about new device enrollment and significant synchronization security events.
- Support synchronization recovery after temporary disconnection or extended offline operation.
- Detect conflicting changes and provide safe resolution mechanisms.
- Preserve credential metadata and configuration during synchronization.
- Handle HOTP counter updates carefully to reduce duplicate codes, counter rollback, and inconsistent state across devices.
- Prevent stale or replayed synchronization data from silently overwriting newer security-relevant state.
- Allow users to revoke lost, stolen, or no longer trusted devices.
- Ensure device revocation prevents future authorized synchronization and access to newly protected vault data.
- Explain that revocation cannot erase previously downloaded information from a device that is no longer under the user's control.
roxanne_ardary/e2eauth
