💻 computer science

VA-DAR: A PQC-Ready, Vendor-Agnostic Deterministic Artifact Resolution for Serverless, Enumeration-Resistant Wallet Recovery

VA-DAR is a vendor- and chain-agnostic protocol that enables secure, enumeration-resistant serverless wallet recovery by mapping privacy-preserving, passphrase-derived discovery identifiers to immutable, post-quantum-ready backup artifacts stored on decentralized networks.

Original authors: Jian Sheng Wang

Published 2026-03-04

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jian Sheng Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a digital vault containing all your money, identity, and secrets. You want to access it from any device (your phone, your laptop, a friend's tablet), but you don't want to trust a big company (like Apple or Google) to hold the keys, and you don't want a public directory where anyone can see if you own a vault just by knowing your email address.

This paper, VA-DAR, proposes a new way to build that vault system. It's like creating a universal, private, and un-hackable "Find My Phone" service for your crypto wallet, but without a central boss.

Here is the breakdown using simple analogies:

1. The Problem: The "Public Phone Book" Flaw

Currently, if you lose your phone, you might use a "seed phrase" (a list of 12 words) to recover your wallet. It's like writing your password on a sticky note and hiding it under a rock. It works, but it's clumsy and easy to lose.

Some new systems use "Passkeys" (like FaceID or fingerprint) which are great for your specific phone, but if you lose that phone, you're stuck unless you trust a cloud server to sync your data.

The Catch: If you try to make a public list of "Who has a wallet?" using just their email, hackers can run a computer program to guess every email in the world and see which ones are real. This is called Enumeration. It's like a thief walking down a street checking every mailbox to see which one has a letter inside.

2. The Solution: VA-DAR (The "Secret Handshake" Directory)

VA-DAR solves this by making the directory private by default. You can't look up a wallet unless you already know the secret password.

Think of it like a high-security hotel:

The Lobby (Public Registry): Anyone can walk in and see a list of room numbers.
The Room Numbers (Discovery IDs): But the room numbers aren't your name. They are a code generated by a Secret Handshake.
The Handshake: To get the code for "John Doe's Room," you need two things:
1. John's Name (Email).
2. The Secret Password (The Primary Passphrase).

If a hacker tries to guess "John Doe's Room" without the password, the computer spits out gibberish. They can't tell if the room exists or not. The directory is effectively invisible to anyone who doesn't know the secret.

3. The Three "Keys" (Artifacts)

The paper describes three types of "sealed boxes" (artifacts) that hold your data. Imagine them as three different safes:

Safe A (Local): This is locked with your FaceID/Fingerprint. It's on your current phone. It's super fast and convenient for daily use, but if you lose the phone, this safe is useless.
Safe B (The Backup): This is the hero. It is locked only with your Master Password. It lives on a decentralized network (like a global, un-killable cloud). Because it doesn't need your specific phone's FaceID, you can open it on any new device as long as you have your password.
Safe C (The New Local): Once you use the Backup (Safe B) to get your data on a new phone, the system immediately creates a new FaceID-locked safe (Safe C) on that new phone.

Why this is genius: You get the best of both worlds. Daily use is fast (FaceID), but recovery is possible anywhere (Password), without needing a central server.

4. How It Stops Hackers (The "Magic Salt")

The paper uses some fancy math (Argon2id and HMAC), but here's the simple version:

The Salt: Imagine your password is mixed with a unique, invisible "salt" that changes every time you try to look up a name.
The Cost: To guess the password, a hacker has to do a massive amount of computer work for every single guess. It's like trying to crack a safe where every wrong attempt takes 10 minutes of heavy lifting.
The Result: Even if a hacker has a supercomputer, they can't guess your password fast enough to check if you have a wallet.

5. Updating the Map (Rollback Protection)

What if you change your password? Or what if a hacker tries to trick the system into pointing to an old, fake backup?

VA-DAR uses a Monotonic Version Counter.

Think of the registry record as a page in a diary.
Every time you update your backup, you write a new entry with a higher page number (Version 1, Version 2, Version 3).
The system refuses to go back to a lower page number.
If a hacker tries to trick your phone into reading "Version 1" (an old, compromised backup), your phone checks the diary, sees that "Version 5" is the current one, and says, "Nope, that's outdated. I'm not listening to you."

6. The "Post-Quantum" Promise

The paper mentions "PQC-Ready" (Post-Quantum Cryptography).

The Fear: In the future, super-computers (Quantum Computers) might be able to break current encryption.
The Fix: VA-DAR is built like a modular Lego set. The core structure (the directory and the backup) is designed so that when new, unbreakable "Quantum-Proof" locks become available, you can just swap the lock without having to rebuild the whole house.

Summary: Why Should You Care?

VA-DAR is a blueprint for a wallet recovery system that is:

Private: No one can spy on your wallet existence without your password.
Portable: You can recover your wallet on any device, anywhere, without trusting a company.
Safe: It prevents hackers from tricking you into using old backups or stealing your identity.
Future-Proof: It's ready for the next generation of computers.

It's essentially the ultimate "Forgot Password" button for the internet, designed so that only you can press it, and no one else can even see that the button exists.

1. Problem Statement

The paper addresses the critical trade-off in decentralized wallet recovery between portability, usability, and privacy.

Current Limitations: Traditional mnemonic seed phrases are portable but prone to user error and poor custody. Passkeys (WebAuthn) offer strong local security but are often device-bound or vendor-locked, failing the "no centralized server" requirement for true decentralization.
The Enumeration Threat: Existing decentralized recovery solutions often rely on public registries where user identifiers (e.g., emails) are hashed and stored. Naive hashing allows attackers to perform enumeration attacks: by guessing common identifiers and checking the public registry, an attacker can determine if a user exists and potentially target them, leaking membership privacy.
The Gap: There is a lack of a protocol that enables cross-device recovery using only a user-provided identifier and a passphrase, while simultaneously preventing public directory enumeration and resisting post-quantum threats.

2. Methodology: The VA-DAR Protocol

VA-DAR (Vendor-Agnostic Deterministic Artifact Resolution) is a discovery-and-recovery layer built on top of the ACE-GF (Artifact-Compliant Encryption - Generic Framework) specification. It introduces a keyed-discovery mechanism where the registry lookup key is derived from the user's passphrase, making it impossible to compute without knowing the secret.

Core Architecture

The system relies on three distinct Sealed Artifacts (SA):

SA1 (Local): Sealed by a device-bound Passkey PRF. Used for daily biometric unlock on a specific device.
SA2 (Backup): Sealed only by the user's Primary Passphrase. This is the portable artifact stored in decentralized storage (e.g., Arweave) and is the key to cross-device recovery.
SA3 (New Local): A new local artifact generated on a recovered device, sealed by that device's Passkey PRF.

Key Derivation & Domain Separation

To ensure security and prevent key reuse, VA-DAR employs a strict two-stage derivation process with domain separation:

Stage A (Lookup): Derives a Klookup key from the Identifier ( $I$ ) and Passphrase ( $P$ ) using a memory-hard KDF (Argon2id) with a specific salt. This key is used to generate the DiscoveryID.
Stage B (Decryption): After fetching the backup artifact, a separate Ksealroot is derived using a different salt embedded in the artifact.
Key Separation: Independent keys are derived via HKDF for:
- Ksa: Sealing the backup artifact.
- Kidx: Generating the DiscoveryID for registry lookup.
- Kreg: Authorizing registry updates.

Discovery Mechanism

Instead of hashing the identifier directly, the system computes a Keyed Discovery Identifier:
$\text{DiscoveryID} = \text{HMAC}(K_{idx}, \text{ctx}_{did} \parallel \text{Norm}(I))$
Because $K_{idx}$ is derived from the secret Passphrase $P$ , an attacker cannot compute the DiscoveryID to query the registry without knowing $P$ . This effectively turns the public registry into a private, passphrase-gated directory.

Registry & Update Authorization

The public registry maps the DiscoveryID to a Content Identifier (CID) of the backup artifact.

Update Options:
- Option A (HMAC): Uses a passphrase-derived key for authorization. Requires off-chain verification or ZK-proofs for on-chain validation.
- Option B (Signatures - Primary): Stores an owner public key. Updates require a digital signature. This is the recommended deployment for immediate L2 smart contract compatibility.
Rollback Resistance: The registry enforces a monotonic version counter. Updates are only accepted if the new version number is strictly greater than the previous one, preventing attackers from reverting mappings to older, compromised artifacts.

3. Key Contributions

Enumeration-Resistant Discovery: A novel construction where the registry lookup key is computationally infeasible to derive without the user's passphrase, preventing public directory enumeration.
Strict Domain Separation: A key schedule that prevents cross-role key reuse between artifact sealing, discovery indexing, and registry authorization, mitigating key-compromise risks.
Versioned Commitment Protocol: A registry update mechanism that combines monotonic versioning with artifact commitments (hashes) to ensure integrity and prevent rollback attacks.
PQC Readiness: The protocol is algorithm-agnostic. It inherits ACE-GF's agility, allowing the identity layer to migrate to Post-Quantum Cryptography (PQC) algorithms without disrupting the recovery flow, provided the registry authorization (Option B) uses PQ-secure signatures.
Formal Security Proofs: The authors define cryptographic games for enumeration resistance, mapping integrity, and rollback safety, proving security under standard assumptions (memory-hard KDF, PRF, EUF-CMA signatures).

4. Results & Security Guarantees

The paper provides formal theorems demonstrating that VA-DAR meets its security goals:

Enumeration Resistance (Theorem 1): An adversary cannot distinguish a valid user's DiscoveryID from a random string without guessing the passphrase. The cost of guessing is bounded by the memory-hardness of Argon2id.
Mapping Integrity (Theorem 2): Unauthorized updates to the registry are infeasible. In the primary model (Option B), this relies on the unforgeability of digital signatures; in the derived model, it relies on the hardness of the passphrase/KDF.
Rollback Safety (Theorem 3): The system resists reverting to older artifacts. Successful tampering requires either breaking the hash collision resistance or violating the registry's monotonic versioning rules.
Recoverability (Corollary 1): Legitimate users can recover their Root Entity Value (REV) on any new device using only the Identifier and Passphrase, with no dependency on vendor-specific servers or device-bound secrets.

5. Significance

VA-DAR represents a significant advancement in decentralized identity and wallet recovery:

Solves the "Serverless" Paradox: It enables cross-device recovery without relying on centralized servers for state synchronization, while maintaining the privacy of a private directory.
Privacy-Preserving: It eliminates the risk of "wallet enumeration," a major privacy flaw in many current decentralized solutions where attackers can scan public chains to identify active users.
Future-Proof: By decoupling the discovery layer from the underlying cryptographic primitives, it offers a clear migration path to Post-Quantum Cryptography, ensuring long-term security against quantum threats.
Practical Deployment: The design is vendor-agnostic and chain-agnostic, making it suitable for integration into various wallet ecosystems and blockchain networks (L1/L2) without requiring changes to the underlying smart contract standards.

In conclusion, VA-DAR provides a robust, mathematically verified framework for secure, private, and portable wallet recovery that balances the usability of passphrases with the security requirements of a decentralized, post-quantum future.