Work / 01
CardNest
Stores payment card details locally or synced to an account. Always encrypted.
— Notes
Checking out online usually means finding the physical card, digging up a photo of it, or waiting on a slow banking app. CardNest keeps card details one tap away without handing them to anyone in readable form.
How it works
Cards start out on the device only. Setting a PIN turns on encryption, using two keys:
- A random data encryption key encrypts the card data.
- A key encryption key, derived from the PIN, encrypts that data key.
Only the encrypted data and the encrypted data key are stored. Changing the PIN re-wraps one small key instead of re-encrypting every card.
Signing in with Google adds sync. The user sets a separate 12-character password, which derives another key encryption key for the same data key. What reaches the server is ciphertext it has no way to read.
Cryptography
- Key derivation: PBKDF2 with HMAC-SHA-512, 210,000 iterations, 128-bit salt, 256-bit keys.
- Encryption: AES-GCM with 256-bit keys, a 128-bit IV and a 128-bit authentication tag.
Everything runs in the browser through the Web Crypto API.