Public key authentication and vault key substitution

The paper discusses both the lack of robust public-key authentication and a vault-key-substitution scenario under a malicious-server model. These are not separate classes of weakness in our view, but manifestations of the same architectural consideration: server-mediated key distribution without strong key provenance guarantees. Our Security Design White Paper (Appendix C: Verifying public keys) explicitly documents this limitation: At present, there’s no robust method for a user to verify that the public key they’re encrypting data to belongs to their intended recipient. As a consequence, it would be possible for a malicious or compromised 1Password server to provide dishonest public keys to the user and run a successful attack. ” Addressing this class of issue requires broader structural work, including: A mechanism for public key verificationA group encryption and management model that separates trust in long-term vault data from trust in user-owned keys that may rotate over time While this set of architectural concerns is notoriously difficult to address, it’s important to note that this reflects broader industry-wide challenges in end-to-end encrypted systems.

We have publicly discussed improvements in key verification mechanisms in our automated provisioning and account governance capabilities. We remain committed to continually strengthening our security architecture and evaluating it against advanced threat models, including malicious-server scenarios like those described in the research, and evolving it over time to maintain the protections our users rely on.