Remote authentication and passwordless password reset

A trusted device, comprising:

• a memory including instructions and a key bag;
• and
• one or more processors to execute the instructions to:
• initiate a first transmission of a password reset request, the password reset request to request replacement of a first password with a new password without provision of the first password;
• derive an online key encryption key based on a cloud key obtained from a network device;
• decrypt a local storage key using the online key encryption key;
• decrypt the key bag using the local storage key to obtain at least a content encryption key;
• in response to decrypting the key bag, decrypt information encrypted by the content encryption key, using the content encryption key;
• obtain the new password;
• derive a new online key encryption key from the new password;
• re-encrypt the content encryption key with the new online key encryption key;
• derive a new authentication token using the new password;
• and
• initiate a second transmission of the new authentication token and the re-encrypted content encryption key to the network device, to enable authentication of a user at the network device using the new password.

A method, comprising:

• initiating, at a trusted device, a first transmission of a password reset request, the password reset request to request replacement of a first password with a new password without provision of the first password;
• deriving an online key encryption key based on a cloud key obtained from a network device;
• decrypting a local storage key using the online key encryption key;
• decrypting a key bag local to the trusted device using the local storage key to obtain a content encryption key;
• in response to decrypting the key bag, decrypting information encrypted by the content encryption key, using the content encryption key;
• obtaining the new password;
• deriving a new online key encryption key from the new password;
• re-encrypting the content encryption key with the new online key encryption key;
• deriving a new authentication token using the new password;
• and
• initiating a second transmission of the new authentication token and the re-encrypted content encryption key to the network device, to enable authentication of a user at the network device using the new password.

At least one of a storage device or a storage disk comprising instructions that, when executed, cause a trusted machine to at least:

• generate a key encryption key based on a key encryption key salt from a network device and a master password from a user of the trusted machine;
• decrypt an encrypted content encryption key using the key encryption key, the encrypted content encryption key from the network device;
• generate a local storage key based on a cloud key obtained from the network device, the cloud key associated with the trusted machine;
• encrypt information with the decrypted content encryption key;
• encrypt a key bag of secure storage on the trusted machine using the local storage key;
• store the decrypted content encryption key in the key bag;
• and
• encrypt the local storage key using an online encryption key obtained from the network device.