Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Qatsi: Stateless Secret Generation via Hierarchical Memory-Hard Key Derivation

René Coignard, Anton Rygin

TL;DR

Qatsi addresses the need for reproducible, non-persistent secrets in high-security contexts by hierarchically chaining Argon2id derivations from a single master secret. It couples memory-hard KDF with context-aware layers and provable uniform sampling for both mnemonic and password generation, achieving $103$–$312$ bits of effective entropy while resisting GPU-based attacks under realistic memory constraints. The authors provide a Rust implementation with zeroization, compile-time wordlist integrity checks, and extensive tests, and they validate practical performance on Apple $M1$ Pro hardware. The approach is well-suited to air-gapped systems and master-credential workflows where deterministic regeneration is acceptable and traditional vaults expose unnecessary surfaces.

Abstract

We present Qatsi, a hierarchical key derivation scheme using Argon2id that generates reproducible cryptographic secrets without persistent storage. The system eliminates vault-based attack surfaces by deriving all secrets deterministically from a single high-entropy master secret and contextual layers. Outputs achieve 103-312 bits of entropy through memory-hard derivation (64-128 MiB, 16-32 iterations) and provably uniform rejection sampling over 7776-word mnemonics or 90-character passwords. We formalize the hierarchical construction, prove output uniformity, and quantify GPU attack costs: $2.4 \times 10^{16}$ years for 80-bit master secrets on single-GPU adversaries under Paranoid parameters (128 MiB memory). The implementation in Rust provides automatic memory zeroization, compile-time wordlist integrity verification, and comprehensive test coverage. Reference benchmarks on Apple M1 Pro (2021) demonstrate practical usability with 544 ms Standard mode and 2273 ms Paranoid mode single-layer derivations. Qatsi targets air-gapped systems and master credential generation where stateless reproducibility outweighs rotation flexibility.

Qatsi: Stateless Secret Generation via Hierarchical Memory-Hard Key Derivation

TL;DR

Qatsi addresses the need for reproducible, non-persistent secrets in high-security contexts by hierarchically chaining Argon2id derivations from a single master secret. It couples memory-hard KDF with context-aware layers and provable uniform sampling for both mnemonic and password generation, achieving – bits of effective entropy while resisting GPU-based attacks under realistic memory constraints. The authors provide a Rust implementation with zeroization, compile-time wordlist integrity checks, and extensive tests, and they validate practical performance on Apple Pro hardware. The approach is well-suited to air-gapped systems and master-credential workflows where deterministic regeneration is acceptable and traditional vaults expose unnecessary surfaces.

Abstract

We present Qatsi, a hierarchical key derivation scheme using Argon2id that generates reproducible cryptographic secrets without persistent storage. The system eliminates vault-based attack surfaces by deriving all secrets deterministically from a single high-entropy master secret and contextual layers. Outputs achieve 103-312 bits of entropy through memory-hard derivation (64-128 MiB, 16-32 iterations) and provably uniform rejection sampling over 7776-word mnemonics or 90-character passwords. We formalize the hierarchical construction, prove output uniformity, and quantify GPU attack costs: years for 80-bit master secrets on single-GPU adversaries under Paranoid parameters (128 MiB memory). The implementation in Rust provides automatic memory zeroization, compile-time wordlist integrity verification, and comprehensive test coverage. Reference benchmarks on Apple M1 Pro (2021) demonstrate practical usability with 544 ms Standard mode and 2273 ms Paranoid mode single-layer derivations. Qatsi targets air-gapped systems and master credential generation where stateless reproducibility outweighs rotation flexibility.
Paper Structure (30 sections, 4 theorems, 12 equations, 7 tables, 2 algorithms)

This paper contains 30 sections, 4 theorems, 12 equations, 7 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Memory-Hard Key Derivation
  4. Deterministic Password Schemes
  5. Unbiased Sampling
  6. Hierarchical Derivation
  7. Definitions
  8. Configuration Profiles
  9. Output Generation
  10. Uniformity Analysis
  11. Rejection Rate
  12. Security Analysis
  13. Threat Model
  14. Attack Cost Estimation
  15. Hardware Attack Benchmarks
  16. ...and 15 more sections

Key Result

Lemma 1

Let $n \in \mathbb{N}$ and $b \in \mathbb{N}$ such that $n \leq 2^b$. Define $T = \lfloor 2^b / n \rfloor \times n$. Sampling $r$ uniformly from $[0, 2^b)$ and accepting if $r < T$ with output $r \bmod n$ produces uniform distribution over $[0, n)$.

Theorems & Definitions (10)

  • Definition 1: Hierarchical Key Derivation Function
  • Definition 2: Salt Preprocessing
  • Definition 3: Input Normalization
  • Lemma 1: Rejection Sampling Uniformity
  • proof
  • Theorem 2: Output Entropy
  • proof
  • Proposition 3: Expected Samples
  • proof
  • Theorem 4: Brute-Force Resistance