What is EviScramble?

EviScramble is a technique that can scramble any type of secret, such as passwords, encryption keys, SSH keys, access codes, and more, by adding random characters and using a position code. The position code indicates the number and locations of the characters to be removed to reconstitute the original secret. The scrambled secret and the position code can be transmitted to the recipient, who can use a dedicated application to enter the code and retrieve the original secret. The secret can then be used for its intended purpose, such as securing an encryption key.

Serverless and databaseless operation

How EviScramble works

EviScramble is a technology that works without a server or a database in real time. It uses secure enclaves, such as the Keychain/Keystore of Android or iPhone phones, or HSM or NFC HSM devices, to store the segment that acts as the key for scrambling and de-scrambling. This segment is a part of the position code that shows which characters to remove to restore the original secret. EviScramble enhances the security level, by naturally and effectively preventing many remote, close-range or spying attacks. In fact, EviScramble never stores the secret in plain text in a computer, phone or information system. The user does not need to know it to use it. They just need to have the scrambling code in a NFC HSM and/or HSM and/or Keychain and/or Keystore. EviScramble provides a simple, fast and secure way to scramble and de-scramble any kind of secret, without relying on a server or a database. EviScramble lowers the costs, risks and complexity involved in managing secrets.

Why EviScramble is more secure than other solutions

Serverless and databaseless technology also protects against sophisticated attacks that target servers and databases, such as SQL injection, denial-of-service, ransomware, phishing, etc. These attacks are impossible with EviScramble, because it does not use any server or database to operate. EviScramble always keeps the secret scrambled, without needing it to be in plain text. The only requirement is that the key segment (scrambling) and de-scrambling code is secured in a NFC HSM and/or HSM and/or Keychain and/or Keystore of the Android or iPhone phone.

How EviScramble prevents server and database attacks

EviScramble is a serverless and databaseless technology that scrambles and de-scrambles secrets in real time. It uses secure enclaves, such as the Keychain/Keystore of Android or iPhone phones, or HSM or NFC HSM devices, to store the key segment that is used for scrambling and de-scrambling. This key segment is a part of the position code that shows which characters to remove to restore the original secret. EviScramble does not store the secret in plain text in any computer, phone or information system. The user does not need to know the secret to use it. They just need to have the scrambling code in a NFC HSM and/or HSM and/or Keychain and/or Keystore.

By using this technology, EviScramble protects against various attacks that target servers and databases, such as:

• Ransomware: EviScramble does not rely on any server or database to operate, so it cannot be blocked or encrypted by ransomware. The user can always access their secrets, even if their system is infected by ransomware.
• Denial-of-service: EviScramble does not depend on any server or database to function, so it cannot be overloaded or crashed by denial-of-service attacks. The user can always use their secrets, even if their system is under attack.
• SQL injection: EviScramble does not use any database to store or process secrets, so it cannot be compromised or manipulated by SQL injection attacks. The user’s secrets are safe from unauthorized access or modification.
• IP spoofing: EviScramble does not communicate with any server or database to scramble or de-scramble secrets, so it cannot be fooled or hijacked by IP spoofing attacks. The user’s secrets are secure from interception or redirection.
• DNS cache poisoning: EviScramble does not rely on any server or database to operate, so it cannot be affected or corrupted by DNS cache poisoning attacks. The user’s secrets are immune from misdirection or substitution.
• Trojan horses: EviScramble does not store the secret in plain text in any computer, phone or information system, so it cannot be stolen or exploited by Trojan horses. The user’s secrets are hidden from detection or extraction.
• Man-in-the-middle: EviScramble does not communicate with any server or database to scramble or de-scramble secrets, so it cannot be spied or altered by man-in-the-middle attacks. The user’s secrets are confidential from eavesdropping or tampering.
• Phishing: EviScramble does not require the user to know the secret to use it, so it cannot be disclosed or leaked by phishing attacks. The user’s secrets are protected from deception or divulgence.
• Drive-by download: EviScramble does not depend on any web browser or plugin to operate, so it cannot be infected or damaged by drive-by download attacks. The user’s secrets are resilient from contamination or destruction.
• Password cracking: EviScramble does not use any password to scramble or de-scramble secrets, so it cannot be guessed or cracked by password cracking attacks. The user’s secrets are strong from brute force or dictionary attacks.

EviScramble Security

Level of Resistance against Attacks

Brute Force

EviScramble offers considerable resistance against brute force attacks due to the complexity added to the scrambling process. Even if attackers have access to the scrambled password, they will find it extremely difficult to decipher the secret without the appropriate de-scrambling code. The combination of random characters and the de-scrambling code makes brute force ineffective. Indeed, the scrambled password has a length of 39 characters, which corresponds to an entropy of 256 bits. Entropy is a measure of the uncertainty or disorder of a system. The higher the entropy, the more unpredictable and difficult to guess the system is. To crack a scrambled password by brute force, it would be necessary to test all possible combinations of 39 characters among the 95 printable ASCII characters. The number of possible combinations is 95^39, or about 10^77. This represents an astronomical number, which exceeds the number of atoms in the observable universe. Even with a very powerful computer, capable of testing a billion combinations per second, it would take more than 10^60 years to find the scrambled password. This is much more than the age of the universe, estimated at about 14 billion years. Therefore, EviScramble makes brute force practically impossible, and ensures optimal security for secrets.

Phishing and Social Engineering

Definition and risks

Since the scrambled password is difficult to understand without the de-scrambling code, EviScramble offers protection against phishing and social engineering attacks. Users can share the scrambled password without exposing the secret, thus reducing the risk of accidental disclosure or manipulation by malicious attackers. Phishing is a technique that consists of sending fraudulent messages, often by email, to entice users to reveal their personal or confidential information, such as their passwords, their credit card numbers, etc. Social engineering is a technique that consists of exploiting human psychology, such as trust, curiosity, fear, etc., to influence users to disclose their information or to perform actions that compromise their security.

Solution and benefits

With EviScramble, users do not need to communicate their secret, but only their scrambled password and their de-scrambling code. The scrambled password has no meaning without the de-scrambling code, and the de-scrambling code has no value without the scrambled password. Thus, even if an attacker manages to obtain one or the other of these elements, he will not be able to access the secret or the encrypted data. Moreover, users can choose the mode of transmission of the scrambled password and the de-scrambling code, for example by SMS, by email or by QR code. They can thus avoid potentially compromised or suspicious channels, and verify the identity of their interlocutor. In addition, according to this implementation, neither the password creator, nor the recipient have knowledge of the secret, they use it transparently thanks to the scrambling code they have entered. As a result, they cannot physically transmit to the attacker by phishing or social engineering a non-scrambled secret that they do not have access to, nor have knowledge of. They use it transparently. EviScramble therefore allows users to easily change their scrambled password and de-scrambling code, in case of doubt or suspicion. They can thus strengthen their security and confidence.

Espionage and Man-in-the-Middle Attack

The scrambling and de-scrambling process is performed by a secure application that uses the EviScramble algorithm. The application limits the risks of espionage and man-in-the-middle attacks. The communications between the Password Creator and the Password Recipient are protected by robust security measures, which make it difficult for attackers to intercept or manipulate the data transmitted.

Espionage is a technique that consists of monitoring the activities or communications of users, without their consent, to collect sensitive or confidential information. Man-in-the-middle is a technique that consists of inserting oneself between two parties who communicate, without them realizing it, to listen, modify or divert the data exchanged.

With EviScramble, users do not have to worry about these threats, because their scrambled password and their de-scrambling code are encrypted and secured by the application.

Moreover, the communications between the Password Creator and the Password Recipient are independent of the security protocols used by the networks or servers. Even if these protocols are corrupted or bypassed, this does not affect the security of the secret, because it is scrambled with EviScramble. Thus, EviScramble ensures that the scrambled password and the de-scrambling code are not intercepted or altered by attackers who would place themselves between the Password Creator and the Password Recipient.

Solution and benefits

With EviScramble, the application encrypts the secret and the data with the scrambled password and the de-scrambling code, and transmits them securely to the recipient. The application also verifies the integrity and authenticity of the secret and the data, and decrypts them with the de-scrambling code entered by the recipient. The application prevents any unauthorized access or modification by third parties, and ensures the confidentiality and reliability of the secret and the data. Moreover, the application does not store the secret or the data on the device or on the cloud, but only in a Keystore/Keychain, a secure location for storing encryption keys. The application thus avoids any leakage or hacking of the secret or the data, and allows the user to delete them at any time. EviScramble therefore allows users to secure and share their secret and their data without exposing or entering them in clear, and without being spied on or attacked by malicious actors.

How Does EviScramble Work?

EviScramble works by performing four main functions: secret generation, secret scrambling, secret de-scrambling, and secret verification. These functions are performed by a robust algorithm that ensures the security and integrity of the secret throughout the process. The algorithm can generate a random secret on an ascii base of 95 printable characters, or use an existing secret provided by the user. The algorithm then adds random characters on the same base between the original characters of the secret, and determines the number and locations of the added characters. The algorithm then generates a position code that indicates the positions of the characters to be removed to reconstitute the original secret. The position code can also be freely chosen by the user. The algorithm then transmits the scrambled secret and the position code to the recipient, who can use a dedicated application to enter the code and retrieve the original secret. The algorithm then verifies the secret by the application, and uses it for its intended purpose, such as securing an encryption key. The algorithm then transmits the encryption key to the recipient, who can use the secret to decrypt it. The algorithm then stores the encryption key in a Keystore/ keychain, a secure location for storing encryption keys.

EviScramble Functions

EviScramble has four main functions: secret generation, secret scrambling, secret de-scrambling, and secret verification. These functions are performed by a robust algorithm that ensures the security and integrity of the secret throughout the process. The following table summarizes the main features and benefits of each function:

Feature Added Values of EviScramble

Feature Added Values of EviScramble

EviScramble is a versatile technique that can be integrated into different products and technologies that need to secure and share secrets. Some examples of using EviScramble are:

• EviBadge technology: EviBadge is a technology developed by Freemindtronic that allows you to create, modify, exchange, and share digital badges without contact and wirelessly. EviBadge uses EviScramble to scramble the data of the badges, such as names, photos, contact details, or access information. EviBadge protects the privacy and identity of the users, and facilitates the management of the badges without a server or a database.
• Cardokey Pro product: Cardokey Pro is a manager of events, contacts, vCard, NFC vCard, and HSM and NFC HSM access badges.

EviScramble can be used in various contexts and industries to secure and share secrets, such as:

• Personal data security: EviScramble can help users protect their personal data, such as passwords, access codes, or encryption keys, from unauthorized access or theft. Users can obfuscate their secrets and store them in a secure location, such as a Keystore/Keychain, or share them with trusted parties using the position code. Users can also use EviScramble to create strong and random secrets that are resistant to brute force or dictionary attacks.
• Financial applications: EviScramble can help financial institutions and customers secure and share sensitive information, such as account numbers, PIN codes, or transaction details. EviScramble can obfuscate the information and provide a position code that can be used to verify the identity of the sender or the recipient, or to authorize a transaction. EviScramble can also prevent phishing or social engineering attacks by ensuring that the information is not exposed or manipulated by malicious actors.
• Healthcare: EviScramble can help healthcare providers and patients secure and share medical records, such as prescriptions, test results, or diagnoses. EviScramble can obfuscate the records and provide a position code that can be used to access the records by authorized parties, such as doctors, nurses, or pharmacists. EviScramble can also ensure the privacy and confidentiality of the records, by preventing espionage or man-in-the-middle attacks that could compromise the data or the patient’s health.

Overview patent

EviScramble is a patented innovation that is protected by a patent filed on February 27, 2017 in France and on February 26, 2018 internationally (WO2018154258A12).

Patent Status

Issued internationally in regions including the European Union, the United States (US20210136579), South Korea, Japan, China, and Algeria.

System Overview: This system is designed for authenticating applications accessible via a computer, where access is controlled by an authentication datum.

Operational Mechanism

The system involves a main mobile device and a main token, with the authentication datum recorded on the main token. The main mobile device recovers the authentication datum from the main token using a pairing key segmented into multiple parts.

• Segment Storage: The first segment of the pairing key is stored on the main mobile device, and additional segments are stored on a secondary mobile device and/or a secondary token.
• Key Reconstitution: The main mobile device is configured to retrieve these additional segments to reconstitute the complete pairing key, which is then presented to the main token for authentication.

The patent covers the following aspects of EviScramble:

The authentication method with segmented keys by coded removal of added segments, which includes:

• Adding segments randomly or manually between the characters, for example ASCII, of an original secret
• Determining the number of segments to add manually or randomly
• Choosing the type of character used to characterize the segment to add, such as the ASCII base
• Generating a position code that indicates the positions of the added segments to remove
• Using this method to transmit the scrambled secret and the position code to the recipient
• Reconstituting the secret from the scrambled secret and the position code