Last Updated June 8, 2026
To allow external partner services like Trip.Express to store highly sensitive credentials, passes, or tickets into the User's Vault without compromising privacy, we utilize an End-to-End Encrypted (E2EE) Hybrid Cryptography model:
Trip.Express retrieves the user's RSA Public Key associated with their device from UID.one.
A random symmetric key (AES-GCM-256) is generated on the Trip.Express server to encrypt the ticket payload. The symmetric key is then encrypted using the User's RSA-OAEP Public Key.
The encrypted payload and encrypted key are stored on the UID.one coordination server. The server acts as a zero-knowledge data store, unable to read or decrypt the plaintext payload.
The user's device retrieves the payload, decrypts the AES key inside the Secure Enclave / StrongBox hardware HSM, and decrypts the ticket locally.
Was this article helpful?
