GeoVault: leveraging human spatial memory for secure cryptographic key management

Corn, Marko (avtor), Podržaj, Primož (avtor)

Practical failures of cryptographic key management rarely stem from weak algorithms: they arise from the difficulty users face in memorizing and reliably recalling high-entropy secrets. Password-based and brainwallet approaches collapse under selection bias, while machine-generated mnemonics such as BIP-39 impose a significant memory burden. This paper introduces GeoVault, a key derivation framework that uses remembered geographic locations as the cryptographic input. Keys are derived from a small set of user-selected map points, encoded deterministically using a geospatial scheme and hardened with the Argon2id memory-hard function. We develop a formal entropy model that distinguishes nominal from effective spatial entropy under attacker-prioritized geographic dictionaries and quantifies the additional reduction caused by demographic selection bias. Through information-theoretic analysis and CPU-GPU benchmarking, we show that spatial secrets carry a substantially higher effective entropy floor than human-chosen passwords, and that Argon2id creates a strong asymmetry between legitimate users and offline adversaries: at a memory cost of 1 GiB, an attacker using a high-end GPU can test approximately 66 candidate secrets per one defender key derivation. This residual throughput advantage is, however, overwhelmed by the exponential growth of the search space when multiple locations are selected. Selecting �≥3 geographic points is necessary and sufficient to achieve cryptographic-strength brute-force resistance under the global attacker prior across all evaluated Argon2id configurations. Against a demographically targeted attacker with city-level knowledge of the user, �=3 maintains Human-Scale Secure resistance; �=4 with a chaining depth of �=6 restores the Super Secure zone at an ≈8 s user-side wait. Single-point configurations remain insecure regardless of memory cost hardening.

• Jezik: Angleški jezik
• Ključne besede: cryptographic key management, spatial memory, mnemonic security, entropy modeling, memory-hard key derivation, Argon2, brainwallet security, human-centered cryptography
• Vrsta gradiva: Članek v reviji
• Tipologija: 1.01 - Izvirni znanstveni članek
• Organizacija: FS - Fakulteta za strojništvo
• Status publikacije: Objavljeno
• Različica publikacije: Objavljena publikacija
• Leto izida: 2026
• Št. strani: 37 str.
• Številčenje: Vol. 14, issue 10, art. 1653
• PID: 20.500.12556/RUL-182654
• UDK: 621.391:004.056.55
• ISSN pri članku: 2227-7390
• DOI: 10.3390/math14101653
• COBISS.SI-ID: 278756867
• Datum objave v RUL: 20.05.2026

Gradivo je del revije

• Naslov: Mathematics
• Skrajšan naslov: Mathematics
• Založnik: MDPI AG
• ISSN: 2227-7390
• COBISS.SI-ID: 523267865

Licence

• Licenca: CC BY 4.0, Creative Commons Priznanje avtorstva 4.0 Mednarodna
• Povezava: http://creativecommons.org/licenses/by/4.0/deed.sl
• Opis: To je standardna licenca Creative Commons, ki daje uporabnikom največ možnosti za nadaljnjo uporabo dela, pri čemer morajo navesti avtorja.

Sekundarni jezik

• Jezik: Slovenski jezik
• Ključne besede: upravljanje kriptografskih ključev, prostorski spomin, varnost besednih zapisov, modeliranje entropije, pomnilniki

Projekti

• Financer: ARRS - Agencija za raziskovalno dejavnost Republike Slovenije
• Številka projekta: P2-0270
• Naslov: Proizvodni sistemi, laserske tehnologije in spajanje materialov

• Financer: Drugi - Drug financer ali več financerjev
• Program financ.: Ministry of Higher Education, Science and Innovation of the Republic of Slovenia
• Številka projekta: 100-15-0510