- Passwordless Authentication - WebAuthn passkeys eliminate password vulnerabilities
- End-to-End Encryption - Your data is encrypted before it leaves your device
- Zero-Knowledge Architecture - The server cannot decrypt your data
Security Layers
Authentication Layer
WebAuthn passkeys provide phishing-resistant authentication using your device’s biometric sensors or security keys.
- No passwords to steal or guess
- Resistant to phishing and man-in-the-middle attacks
- Hardware-backed cryptographic verification
Encryption Layer
End-to-end encryption ensures only you can read your data.
- AES-256-GCM encryption
- Master keys never leave your device in plaintext
- Each user generates their own encryption keys
Recovery Layer
Multiple recovery mechanisms ensure you never lose access.
- Trust codes for account recovery
- Multi-device login approval
- PRF extension for seamless passkey-based recovery
What the Server Cannot See
Ave’s zero-knowledge architecture means the server stores encrypted data it cannot decrypt:Never Sent in Plaintext
- Master encryption keys
- Security question answers (removed)
- Decrypted user data
- Trust code plaintext
Server Can See
- Hashed passkey challenges (WebAuthn protocol)
- Encrypted master key backups
- Hashed trust codes
- Session tokens and device info
- Activity logs (actions, not content)
The server stores encrypted blobs that only you can decrypt with your master key. Even if the database were compromised, your data remains protected.
Data Protection Guarantees
Client-Side Operations
All sensitive cryptographic operations happen in your browser:- Key Generation: Master keys are generated using
crypto.subtle.generateKey()with 256-bit AES-GCM - Encryption: Data is encrypted before transmission using the Web Crypto API
- Key Derivation: Trust codes derive encryption keys using PBKDF2 with 100,000 iterations
Server-Side Security
The server handles authentication and stores encrypted data:- Passkey Verification: WebAuthn responses are verified using
@simplewebauthn/server - Hash Storage: Trust codes and session tokens are stored as SHA-256 hashes
- Encrypted Backups: Master key backups are stored encrypted, only decryptable with trust codes
Authentication Methods
Ave supports multiple authentication methods for different scenarios:| Method | Use Case | Security Level | Requires |
|---|---|---|---|
| Passkey | Primary login | Highest | Device biometric/PIN |
| Device Approval | New device setup | High | Existing logged-in device |
| Trust Code | Account recovery | Medium | Saved recovery code |
Security Best Practices
For Users
- Save Trust Codes: Store your trust codes in a secure location immediately after registration
- Enable Biometrics: Use Touch ID, Face ID, or Windows Hello for passkey protection
- Monitor Devices: Regularly review active devices and revoke unknown sessions
- Use Multiple Passkeys: Register passkeys on multiple devices for redundancy
For Developers
When integrating with Ave:- Respect E2EE: If an OAuth app doesn’t support E2EE, it won’t receive encrypted data
- Validate Origins: Always verify WebAuthn challenges come from expected origins
- Use HTTPS: WebAuthn requires secure contexts (HTTPS or localhost)
- Handle Expiration: Sessions expire after 30 days; implement token refresh
Security Audit Trail
All security-related actions are logged in the activity log:- Account creation and recovery
- Login attempts (successful and failed)
- Passkey additions and removals
- Trust code regeneration
- Device authorizations and revocations
info- Normal operations (login, passkey added)warning- Security-relevant actions (trust code used, passkey removed)danger- Critical security events (account recovered, all devices revoked)
Threat Model
Ave is designed to protect against: ✅ Phishing Attacks - Passkeys are origin-bound and cannot be phished ✅ Credential Stuffing - No passwords to reuse or steal ✅ Server Compromise - Encrypted data remains protected even if database is leaked ✅ Man-in-the-Middle - WebAuthn and HTTPS prevent interception ✅ Session Hijacking - Tokens are hashed and scoped to devices ⚠️ Device Compromise - If an attacker gains access to your unlocked device, they can use your stored master key. Use device encryption and lock screens. ⚠️ Trust Code Theft - Protect trust codes like passwords. Anyone with a code can recover your account.Next Steps
WebAuthn Implementation
Learn how passkeys work in Ave
Encryption Model
Deep dive into E2EE architecture
Key Management
Master key generation and recovery
Testing Guide
Test security workflows end-to-end