I recently came across MindYourPass.io and my curiosity was triggered on how it worked. So I read the website which sounded intruiging, but did not seem to contain a lot of nitty gritty technical details. The website does mention that the solution is based on patented technology.
Now this sounds like a nice opportunity to brush op on potential legal-speak as well as understanding a software solution by reading instead of going down the technical route. As an added bonus, we can take one of those fancy GenAI things for a spin and see if it helps to quickly digest patent text.
Do note that since a patent walks a fine line between claiming the idea and not giving away all the information, that my conclusions and interpretation may be incorrect. This risk is increased due to the use of GenAI. Which is used as an experiment to better understand the advantages or limitations of using GenAI for summarization and interpretation of patents.
After talking a bit with Gemini I was pretty amazed that it summarized the gist of the patent pretty well. I skimmed through the patent myself and without verifying all details it seems to make sense (yes I know the devil is in the details). It didn’t even take that many questions to obtain a general understanding of the key components of the patent. The following questions represent my entire conversation:
- are you familiar with mindyourpass?
- Do you have any sources for a whitepaper and corresponding patents?
- yes, I would like to have a more technical summary
- does the patent describe which factors are used exactly and in which order they are processed?
- Would it be fair to summarize this invention as a Key Derivation Function, which retrieves the inputs from different places?
- Can you represent the patent in a python function? Since after all, it concerns a KDF as the basis for the concept?
The code result for the last question can be seen below:
import hashlib
def calculate_mindyourpass_password(
user_master_secret: str, # Factor 1: The key known only by the user
application_domain: str, # Factor 2: Uniquely identifies the website (e.g., 'amazon.com')
device_id_token: str, # Factor 3: Unique key from the authorized device
backend_static_salt: str, # Factor 4: Key retrieved from the backend (distributed secret)
password_policy: dict # Factors 5/6: Formatting rules (min_len, special chars, etc.)
) -> str:
"""
Conceptual implementation of the MindYourPass deterministic, distributed KDF.
This function simulates the process described in US11947658B2:
It takes distributed inputs, hashes them deterministically, and formats the output.
"""
# --- Step 1: Combine Distributed Factors ---
# The actual proprietary formula uses 6 factors combined in a specific, secret order.
# We conceptually concatenate the primary inputs here.
# We include the application's required length/policy to ensure the hash input
# changes if the requirements change (e.g., a site updates its minimum length).
policy_str = f"len:{password_policy.get('min_length', 16)}_chars:{password_policy.get('charset_type', 'complex')}"
# The factors are combined deterministically (order is crucial)
combined_input = (
user_master_secret +
application_domain +
device_id_token +
backend_static_salt +
policy_str
)
# Encode the input string to bytes for hashing
input_bytes = combined_input.encode('utf-8')
# --- Step 2: Cryptographic Hashing (SHA-512) ---
# The patent specifies 512-bit SHA2 hashing.
raw_hash_output = hashlib.sha512(input_bytes).hexdigest()
# --- Step 3: Formatting & Post-Processing ---
# The final password must conform to the target application's policy.
# This example truncates and enforces a simple character set conversion.
target_length = password_policy.get('min_length', 16)
# Truncate and use as the deterministic password (e.g., first 16 chars)
password = raw_hash_output[:target_length]
# NOTE: The actual implementation involves sophisticated mapping
# to enforce capitalization and special characters dynamically.
# This step is highly complex in the real product.
return password
# --- Example Usage ---
# 1. Define the distributed inputs (retrieved from different places)
USER_KEY = "MyEasyToRememberPhrase!"
SITE_ID = "MyBankingSite.com"
DEVICE_TOKEN = "ABCD-1234-EFGH-5678" # Only this device can generate it
SERVER_SALT = "aHk57gJmT8pQ4zR" # A distributed secret key
# 2. Define the application's policy rules
BANK_POLICY = {
'min_length': 20,
'charset_type': 'complex'
}
# 3. Calculate the password
derived_password = calculate_mindyourpass_password(
USER_KEY,
SITE_ID,
DEVICE_TOKEN,
SERVER_SALT,
BANK_POLICY
)
print(f"Input: {USER_KEY}, {SITE_ID}, {SERVER_SALT[:5]}...")
print(f"Generated Password (Length {len(derived_password)}): {derived_password}")
Of course, this is an over simplification, since I’m assuming that the actual software uses more cryptography for individual steps to for example slow down potential attacks that might involve brute forcing parts of the process. However the core concepts does become pretty clear, pretty fast.
All in all, using patents as part of your reconnaissance into software was always a good idea. Now with GenAI it has become even more accessible and more important, it has become fast! You still need to manually revise the patent, to understand if GenAI makes sense, but the big picture can be obtained pretty darn fast.
DiabloHorn 