Recovery Code And Device Approval

Encryption Keys decrypt your synced graphs. They are a Graph Key for each synced graph you own or have joined, plus identity keys for invites, and they belong to your EtherPK Account, not to any one device. The owner of a shared graph and its Players, the people who joined it, hold the same Graph Key. See Sharing A Graph for more information.

The Sync Server stores your Encryption Keys sealed and cannot read them, and each device unlocks them for itself, once. Until then, synced graphs do not open on that device, and a graph it does not have yet is listed with a note in place of its name. If you try to open a synced graph there, you see the unlock dialog. If the device keeps your keys behind a Device Passcode, you see a passcode prompt instead, and entering the passcode opens the graph without the unlock dialog. Closing either one takes you back to the Graphs page, where the Graphs tab offers Unlock Encryption Keys.

You usually unlock a device with device approval from another of your devices that is already unlocked, or with the Recovery Code if none is. Your account has one Recovery Code, created with your keys and shown to you once. Because the keys belong to the account, that one code covers every synced graph, including any you join later.

Signing in to your EtherPK Account proves who you are but decrypts nothing, so your keys and Recovery Code stay as they are when your sign-in ends or you reset your password. Since the Sync Server cannot read your keys and never sees the code, nobody, EtherPK included, can decrypt your notes if you lose both the code and every unlocked device. Graphs that only you hold are then gone, but a shared graph survives with its other members, because they hold its Graph Key.

The Sync tab of the Graphs page has three actions that change the code or the keys, and each costs more than the last. Regenerating the Recovery Code changes only the code, while replacing the keys changes both and locks out your other devices. Resetting deletes the keys and every graph you own, so a shared graph you own survives only if you first transfer it to a Player.

Your Recovery Code, your account password and the protection passphrase for Protected Documents are separate, and none of them recovers another. See How Encryption Works for more information.

Before you begin

• An EtherPK Account, signed in on each device where you use your Encryption Keys.
• Synced graphs on Managed Sync.

Save the Recovery Code

The app creates your Encryption Keys the first time you need them: for your first synced graph, for an import into synced storage, or when you select Create Encryption Keys on the Sync tab. It uploads nothing until you select Continue, so if you close the tab or reload before then, you lose nothing and can start again.

1. In the Save your Recovery Code dialog, select Copy or Download.
2. Store the code somewhere safe.
3. Select the checkbox I have saved my Recovery Code for {host} somewhere safe.
4. Select Continue.

Download saves a text file that also names your account and the Sync Server. Continue stays disabled until you select the checkbox.

Unlock a new device

On a locked device, the unlock dialog opens when you select Unlock Encryption Keys or when an action needs your keys. It asks your other devices for approval and shows "Waiting for another device…" until one of them answers.

1. On a device where your keys are unlocked, open EtherPK and keep it in view.
2. If that device has a Device Passcode, open a synced graph there and enter the passcode.
3. When Approve a new device? appears, check that both screens show the same code, such as 7Q4M-KX2A.
4. On the unlocked device, select Approve.
5. On the new device, select The codes match.

Approve sends your keys encrypted so that only the new device can read them. You can do steps 4 and 5 in either order, and the new device unlocks once both are done.

Both devices go into the code, so if the codes differ, or you did not start the request, someone else is trying to get in. Reject it with Reject on the unlocked device or They don't match on the new device.

Unlock with the Recovery Code

1. In the unlock dialog, under No other device unlocked?, select Use your Recovery Code.
2. In the Recovery Code field, enter your code.
3. Select Unlock.

Before it keeps anything on this device, the app checks the code against your keys on the Sync Server. If the code is mistyped, retired or wrong, the app refuses it with "Could not unlock your Encryption Keys. That Recovery Code was not accepted. Check it character by character - only the most recently issued code is valid." Correct the code in the field and try again, or select approve from another device under the field to go back to device approval.

Unlocked devices

On the Sync tab, Encryption Keys on this device shows whether your keys are unlocked here. Unless you set a Device Passcode, they stay unlocked in new tabs and after you close the browser. Signing out locks them, and you unlock the device again when you sign back in. Removing your synced graphs from this browser or clearing its data also locks them.

Unlock Encryption Keys also works on a device that is already unlocked: it checks your keys against the ones on the Sync Server and replaces the copy on this device. Use it when the app says your keys were replaced or reset on another device, then approve this device from one that has the new keys, or enter the new Recovery Code.

Regenerate the Recovery Code

If you did not save your Recovery Code or have lost it, regenerate it on a device where your keys are still unlocked.

1. On the Sync tab, under Recovery Code, select Regenerate Recovery Code.
2. In the Save your new Recovery Code dialog, copy or download the new code.
3. Select the checkbox I have saved my new Recovery Code for {host} somewhere safe.
4. Select Retire old code and use this one.

Until you confirm, your current code keeps working and Keep current code changes nothing. After that the old code stops working, but devices that are already unlocked stay unlocked.

Regenerating does not change your keys, so anyone with your old code and an old copy of your keys can still open that copy. If someone else might have seen your code, replace your keys instead.

Replace Encryption Keys

Replace your Encryption Keys if someone might have copied them or your Recovery Code, or if a device that is still unlocked is lost or no longer yours.

1. On the Sync tab, under Replace Encryption Keys, select Replace Encryption Keys and lock out other devices.
2. Select Continue.
3. In the dialog, copy or download the new Recovery Code.
4. Select the checkbox I have saved my new Recovery Code for {host} somewhere safe.
5. Select Replace Encryption Keys and use this code.

Your current keys and code keep working until the last step, so Cancel or Keep current Encryption Keys changes nothing.

Once you confirm, the old code and the keys on your other devices stop working, and you unlock those devices again with the new code or by approval. A device that is still signed in to your EtherPK Account can reach the Sync Server, and although it cannot unlock the new keys, it could reset them. Sign a lost device out under Sessions on the Account page (see Your EtherPK Account).

Each graph you own gets a new Graph Key, and the app shows your new security fingerprint. Before their app uses the new Graph Key, Players who accepted your invite or received a Graph Key from you must compare fingerprints with you and select Verify. Tell them before you replace your keys.

Invites you sent or received were made with the old keys, so they are cancelled and have to be sent again. Agents you set up with The Headless Client are also signed out and need a new Agent Setup Code.

Recovering access

• If one of your devices is still unlocked, approve the new device from it, then select Regenerate Recovery Code there. Your keys and graphs stay as they are.
• If the problem is on one device only, a reset will not fix it, because a reset deletes the keys for the whole account. Use Add to this device instead for a graph marked Not on this device (see Synced Graphs), or Unlock Encryption Keys for keys that stopped working here.
• If you have no unlocked device and no code, nothing can decrypt your notes. Transfer each shared graph you own to one of its Players, then reset.

You can transfer a shared graph even while locked out, because ownership is a record on the Sync Server and needs no keys. A graph with no other Player cannot be recovered, since nobody else holds its Graph Key. To transfer a graph, select Transfer ownership in its row on the Graphs tab, or Transfer… in the reset dialog, and follow the steps on Sharing A Graph.

Reset Encryption Keys

Reset only if you have lost the Recovery Code and none of your devices is still unlocked. A reset cannot be undone. You can start one even while your keys are locked.

1. On the Sync tab, under Danger zone, select Reset Encryption Keys.
2. For each shared graph you own and want to keep, select Transfer….
3. Select Continue to reset.
4. Type the phrase the dialog shows, such as DELETE 2 GRAPHS.
5. Select Permanently reset.

If you own no graphs by then, the phrase is RESET MY ENCRYPTION KEYS. Permanently reset stays disabled until you type the phrase exactly.

The reset permanently deletes your Encryption Keys, your identity on the Sync Server and every graph you still own after the transfers. It also signs out every agent, and each one then needs a new Agent Setup Code. You leave graphs that other people own, and their content is untouched. To start again, select Create Encryption Keys or create a synced graph. Either way, you get new keys, a new identity and a new Recovery Code.