To allow external partner services like Trip.Express to store highly sensitive credentials, passes, or tickets into the User's Vault without compromising privacy, we utilize an End-to-End Encrypted (E2EE) Hybrid Cryptography model:
1. Public Key Retrieval
Trip.Express retrieves the user's RSA Public Key associated with their device from UID.one.
2. Hybrid Encryption
A random symmetric key (AES-GCM-256) is generated on the Trip.Express server to encrypt the ticket payload. The symmetric key is then encrypted using the User's RSA-OAEP Public Key.
3. Zero-Knowledge Storage
The encrypted payload and encrypted key are stored on the UID.one coordination server. The server acts as a zero-knowledge data store, unable to read or decrypt the plaintext payload.
4. Client-Side Decryption
The user's device retrieves the payload, decrypts the AES key inside the Secure Enclave / StrongBox hardware HSM, and decrypts the ticket locally.
