Key Management

Anon uses a tiered key architecture designed so that sensitive key material is never persisted to disk in plaintext, and different operations use the minimum key privilege required.

The Key Hierarchy

Device authenticator (passkey / password)
        │
        ▼
    Root secret            ← PRF / Argon2id; session memory
        │
    HKDF derivation
       / \
      /   \
Railgun    IDB CryptoKey
  key      (AES-GCM)

PRF Key (Root)

When you authenticate with a passkey, the authenticator provides a Pseudo-Random Function (PRF) that outputs a deterministic secret tied to your passkey credential. Storage and synchronization depend on the authenticator. This PRF output is the root of your key hierarchy. It is never written to disk — it exists only in memory during your session.

When you authenticate with a password, Argon2id derives an equivalent root secret from your password and a stored salt.

HKDF Derivation

From the PRF key, Anon derives two keys using HKDF (HMAC-based Key Derivation Function):

• Railgun key (anon:railgun:full:v1) — a single key used for both balance decryption (viewing) and zk-SNARK proof generation (spending). Loaded on authentication and held in memory for the session.
• IDB CryptoKey (anon:secrets:indexeddb:v1) — an AES-256-GCM key used to encrypt and decrypt sensitive data in IndexedDB (mnemonic, account data). Loaded on authentication and held in memory for the session.

KeyVault (In-Memory Cache)

The KeyVault is an in-memory singleton that holds the session's active keys. It is:

• Populated on successful authentication
• Never written to disk
• Automatically evicted on logout or window close
• Protected from background-page access patterns that don't require spending keys

What's Stored Where

Recovery

If you lose access to your device, you can restore your wallet from your 12-word mnemonic phrase. The mnemonic regenerates all keys. Keep it offline and in a secure location.

Further Reading

• Authentication
• Encryption