### Terms and Conditions
- [x] I agree to the [Grant Agreement](https://9ba4718…c-5c73-47c3-a024-4fc4e5278803.usrfiles.com/ugd/9ba471_f81ef4e4b5f040038350270590eb2e42.pdf) terms if funded
- [x] I agree to [Provide KYC information](https://9ba4718c-5c73-47c3-a024-4fc4e5278803.usrfiles.com/ugd/9ba471_7d9e73d16b584a61bae92282b208efc4.pdf) if funded above $50,000 USD
- [x] I agree to disclose conflicts of interest
- [x] I agree to adhere to the [Code of Conduct](https://forum.zcashcommunity.com/t/zcg-code-of-conduct/41787) and [Communication Guidelines](https://forum.zcashcommunity.com/t/zcg-communication-guidelines/44284)
- [x] I understand all milestone deliverables will be validated and accepted by their intended users or their representatives, who will confirm that the deliverables meet the required quality, functionality, and usability for each user story.
- [x] I agree to post request details on the [Community Forum](https://forum.zcashcommunity.com/c/grants/33)
- [x] I understand it is my responsibility to post a link to this issue on the [Zcash Community Forums](https://forum.zcashcommunity.com/c/grants/33) after this application has been submitted so the community can give input. I understand this is required in order for ZCG to discuss and vote on this grant application.
### Application Owners (@Octocat, @Octocat1)
@VCNinc @Autoparallel
### Organization Name
Multifactor, Inc., a Public Benefit Corporation
### How did you learn about Zcash Community Grants
We had a great conversation about MFKDF2 with Matthew, Artkor, Brian, and Pacu from the Zcash community grants team, who encouraged us to apply for a grant!
### Requested Grant Amount (USD)
$39,000
### Category
Research & Development
### Project Lead
```project-lead.yaml
Name: Vivek Nair
Role: Co-Principal Investigator, MFKDF2
Background: Vivek Nair, Ph.D., has over a decade of experience researching applied cryptographic techniques to secure critical systems. Dr. Nair previously served as a Technical Lead within elite cyber units of the Central Intelligence Agency (CIA) and US Department of Defense (DoD), where he received the Directorate’s Exceptional Performance Award for advancing the frontiers of US cyber operations. He completed his Ph.D. in Computer Science at UC Berkeley at the age of 22, supported by prestigious fellowships from the National Science Foundation, the National Physical Sciences Consortium, and the Fannie and John Hertz Foundation. His work has been prominently featured in The Washington Post, Forbes, Bloomberg, and more.
Responsibilities: MFKDF2 Protocol Design, Documentation, Demos, Publication
```
### Additional Team Members
```team-members.yaml
- Name: Colin Roberts
Role: Co-Principal Investigator, MFKDF2
Background: Colin Roberts, Ph.D., is a mathematician with a passion for creating provably secure cryptographic solutions and systems. Dr. Roberts has years of experience supporting innovative applied cryptography research, including in Staff Research Engineer roles at Web3 startups Pluto and Primitive where he audited and designed smart contract systems and developed proving schemes for verifiable TLS attestations. He earned his Ph.D. in Mathematics from Colorado State University, and the open-source cryptography, mathematics, and simulation repositories he maintains have thousands of combined GitHub stars.
Responsibilities: MFKDF2 Rust Implementation, Testing, Mathematical Proofs
- Name: Dawn Song
Role: Senior Research Advisor, MFKDF2
Background: Dawn Song, Ph.D., is a Professor of Computer Science at UC Berkeley and the co-director of the Center for Responsible, Decentralized Intelligence (RDI). Her primary research interests are in deep learning and computer security. Her prolific academic publications in these fields have received over 130,000 citations. She is the recipient of fellowships from the Association for Computing Machinery, the Institute of Electrical and Electronics Engineers, the John D. and Catherine T. MacArthur Foundation, the John Simon Guggenheim Memorial Foundation, and the Alfred P. Sloan Foundation, and has received various awards for her work, including the NSF CAREER Award, the MIT Technology Review Top 35 Innovators under 35 (TR35) award, the ACM SIGSAC Outstanding Innovation Award, and the AMiner Most Influential Scholar Award for being the most cited scholar in Computer Security. She obtained her Ph.D. from UC Berkeley in 2002. Prior to joining UC Berkeley as a faculty member, she was an Assistant Professor at Carnegie Mellon University from 2002 to 2007.
Responsibilities: Project Oversight, Research Support
```
### Project Summary
MFKDF2 is an innovative open-source cryptographic primitive for fast, flexible, secure, usable key derivation that uniquely expands upon password-based key derivation functions (PBKDFs) with support for using other popular authentication factors like TOTP, HOTP, and hardware tokens like YubiKeys in the key derivation process. In doing so, it enables the creation of “best-of-both-worlds” cryptocurrency wallets that inherit the friendly UI and UX of custodial wallets while in fact being private, non-custodial, and providing an exponential security improvement over PBKDFs alone.
[MFKDF2 Detailed Plan (2025) - Zcash.pdf](https://github.com/user-attachments/files/21069772/MFKDF2.Detailed.Plan.2025.-.Zcash.pdf)
### Project Description
The Multi-Factor Key Derivation Function (MFKDF) is a fast, flexible, secure, & practical key management solution that uniquely expands upon password-based key derivation functions (PBKDFs) with support for using other popular authentication factors like TOTP, HOTP, and hardware tokens like YubiKeys in the key derivation process. In doing so, it provides an exponential security improvement over PBKDFs with negligible overhead. MFKDF additionally offers a k-of-n threshold construction and “key stacking” primitive that can be used together to cryptographically enforce arbitrarily specific key derivation policies. The result is a paradigm shift toward direct cryptographic protection of user data using all available authentication factors, with no noticeable change to the user experience. Motivated by the need for new cryptographic primitives to support secure crypto wallet design, MFKDF offers proven security and usability advantages over existing key management options in the blockchain domain.
Since its release in 2023, academic researchers have conducted and published rigorous red-team cryptanalyses of MFKDF that demonstrate the need for additional work on the algorithm and implementation to reach production maturity. However, there is now a clear and well-defined path to transform the proven value behind MFKDF into a production-ready resource with robust security guarantees for the Web3 community. Therefore, we are proposing MFKDF2, a new and improved version of MFKDF that aims to provide new features and enhanced security, realizing the original potential of MFKDF2 to dramatically improve Web3 usability.
### Proposed Problem
> “Cryptography turns a security problem into a key management problem.”
> — Murphy’s 1st Law of Cryptography
MFKDF2 aims to address the classic problem of usable key management, which has long remained a difficult unsolved challenge in the field of usable security. Since the seminal publication of “Why Johnny Can’t Encrypt” in 1999, researchers have long understood that most internet users lack proficiency with manual cryptographic key management strategies. This translates to cryptocurrency wallets inheriting many of the same usability issues, with private key files and seed phrases feeling alien and uncomfortable to Web3 novices.
While password-based key derivation functions (PBKDFs) are widely used to solve this problem in centralized applications, their low entropy and lack of a recovery mechanism make them unsuitable for use in decentralized contexts. The average cryptocurrency user today therefore faces a difficult choice between centralized custodial wallets, which are notoriously prone to compromise, or cumbersome self-custody solutions, which if not managed properly can cause a total loss of funds.
### Proposed Solution
We propose the Multi-Factor Key Derivation Function v2.0 (MFKDF2), an innovative open-source cryptographic primitive for fast, secure, usable key derivation that addresses these deficiencies by securely incorporating commonly used authentication factors that users are already familiar with, like HOTP/TOTP (e.g., Google Authenticator), Hardware Tokens (e.g., YubiKeys), and out-of-band factors (e.g., Email or SMS), into the key derivation process. In doing so, it provides an exponential security improvement over PBKDFs with negligible overhead. MFKDF additionally offers a k-of-n threshold construction and “key stacking” primitive that can be used together to cryptographically enforce arbitrarily specific key derivation policies, including approaches like risk-based authentication (RBA) and social backup and recovery (SBR) that are commonly used in Web2. The result is a "best of both worlds" cryptocurrency wallet design with cross-chain compatibility, that looks like, and inherits the user experience of, a centralized custodial solution, while in fact being entirely decentralized in design, implementation, and security/privacy properties.
The original MFKDF was released in 2022 as a research prototype, but received significant community interest and commendations for its innovative approach to key derivation and its recognized potential to improve the accessibility and ease of use of self-custody cryptocurrency wallets by creating an identical experience to custodial wallets. Now, motivated by the success of MFKDF but the need to make significant feature and security advancements to keep up with the latest developments in cryptanalysis and identity security, we are proposing MFKDF2, a new and improved version of MFKDF that will make major strides in security, features, languages, and supported factors, and take MFKDF from a proven concept to a secure, production-ready tool.
### Solution Format
We’re aiming to provide MFKDF2 as a production-ready Rust library, complete with robust documentation, tutorials, examples, and a red-team audit, making it ready to have a real-world security and usability impact on Zcash wallets. We’ll also aim to produce and publish an academic paper detailing the advancements made by MFKDF2, with strong security arguments and proofs.
### Dependencies
MFKDF2 builds on the strong foundation provided by the original MFKDF paper and implementation, but will be rearchitected from scratch in Rust for compatibility with the Zcash ecosystem. It remains entirely built upon simple, proven cryptographic primitives like SHA256, AES256, Argon2, and Shamir’s Secret Sharing. Importantly, there is no need for a networked third-party component, specialized hardware, or a trusted committee.
### Technical Approach
We will implement MFKDF2 as a general-purpose cryptographic primitive in Rust using UniFFI, allowing it to be utilized in a wide variety of languages, such as Typescript/Javascript, C/C++, Python, Kotlin, Swift, and more.
### Upstream Merge Opportunities
MFKDF2 does not need to be merged into a core Zcash repository to have a significant positive impact on the Zcash ecosystem! Instead, we’re working closely with wallet developers to allow MFKDF2 to be adopted by specific Zcash wallet projects, allowing it to be gradually adopted by the community. See Milestone 5 for more information about how we're ensuring MFKDF2 has a direct, tangible impact on Zcash security and usability.
### Hardware/Software Costs (USD)
$0
### Hardware/Software Justification
N/A
### Service Costs (USD)
$10,000
### Service Costs Justification
We anticipate that third-party cryptographic audits of the MFKDF2 library and implementation will cost around $10,000, and have identified two specific providers who could provide this service. Based on our conversations with the community, these independent audits will be critical to enable the trust in MFKDF2 necessary to achieve widespread adoption.
### Compensation Costs (USD)
$29,000
### Compensation Costs Justification
2 staff FTEs (Colin & Vivek) for 5 months at an extremely modest compensation of $2,900 per month.
### Total Budget (USD)
$39,000
### Previous Funding
No
### Previous Funding Details
N/A
### Other Funding Sources
No
### Other Funding Sources Details
We have not received additional funding for MFKDF2.
### Implementation Risks
We are confident that following the success of the original MFKDF and the lessons learned from that project, we have a strong blueprint for the implementation of a more secure, compatible, and feature-rich MFKDF2. The chief implementation risk is therefore the introduction of new security vulnerabilities during the Rust implementation of MFKDF2, which we will address by commissioning an independent third-party security audit of MFKDF2 prior to its production deployment as detailed in the funding breakdown above and milestones below.
### Potential Side Effects
While MFKDF2 has the chief aim of providing more secure and usable key management for Zcash wallets, it could have the opposite impact if implemented incorrectly (e.g., with weak key derivation policies) by wallet providers. Therefore, significant effort will be put into producing robust documentation, tutorials, examples, and implementation support & guidance to ensure that MFKDF2 is implemented correctly and initialized with strong settings and policies.
### Success Metrics
Peer-reviewed publications also show that MFKDF quantifiably solves the problem of usable key management in the Web3 context, with a large-scale user study [published in ACM CHI](https://dl.acm.org/doi/10.1145/3613904.3642464) demonstrating that MFKDF-based cryptocurrency wallets outperform wallets backed by conventional key management approaches on a large number of both subjective and objective usability metrics.
Replicating at least this level of usability improvement in MFKDF2, while simultaneously achieving more robust security guarantees, features, and authentication factor compatibility, is our key metric for success. A successful MFKDF2 deployment will therefore make a wide variety of Zcash wallets more usable and accessible to Web3 novices (by allowing them to simply “login” to their wallets using familiar, commonly-used authentication factors) while also bringing even more robust security and privacy guarantees than the original MFKDF.
### Startup Funding (USD)
$5k
### Startup Funding Justification
$5k will allow us to hit the ground running on MFKDF2 with the implementation blueprint, project planning, and technical tooling needed to position the project for success.
### Milestone Details
```milestones.yaml
- Milestone: 1 (Design Blueprint & Rust Framework)
Amount (USD): $7.5k
Expected Completion Date: 2025-08-01
Deliverables:
- Basic Rust Cross-Compilation Framework
- Multi-Language Documentation Framework
- Re-Vamped Cryptographic Primitives
- Bytewise Shamir’s Secret Sharing (Bytes Indistinguishable in [0, 256))
- AES-256-ECB for Share Encryption (No Authentication)
- SHA1, SHA256, HMAC-SHA1, HMAC-SHA256 for Factor Constructions
- Argon2id and/or Balloon Hashing for Memory-Hard KDF
- Security Proof Framework
- Re-Implement Original MFKDF Factors & Features in Rust
- MFKDF, MFCHF, & MFDPG modes of operation
Acceptance Criteria: This milestone will be complete when our Rust framework has feature parity with the original MFKDF (as verified by a differential testing suite), is compilable to various languages, and is ready to support the new factors, features, and security model of MFKDF2.
- Milestone: 2 (MFKDF2 Client Implementation)
Amount (USD): $7.5k
Expected Completion Date: 2025-09-01
Deliverables:
- We’ll implement robust security improvements based on the findings of MFKDF.
- We’ll implement new factor compatibility beyond those found in the original MFKDF, including passkeys and biometrics.
- We’ll implement new features beyond those available in MFKDF, including the ability to provide threshold factor hints to users and upgrade KDF parameters over time.
Acceptance Criteria: This milestone will be complete when our Rust MFKDF2 implementation has addressed any known security limitations of the original MFKDF, and has achieved the additional factors and features proposed herein.
- Milestone: 3 (Red-Team Evaluation)
Amount (USD): $10k
Expected Completion Date: 2025-10-01
Deliverables:
- We’ll collaborate with independent evaluators to produce a robust security evaluation of the MFKDF2 Rust implementation to ensure MFKDF2 is ready for real-world use.
Acceptance Criteria: This milestone will be complete when we have published a security report documenting the security of the MFKDF2 Rust implementation.
- Milestone: 4 (Final Publication & Reporting)
Amount (USD): $5k
Expected Completion Date: 2025-11-01
Deliverables:
- We’ll produce new centralized and decentralized demos for MFKDF2, including a proof-of-concept Zcash wallet demo.
- We’ll produce and publish an academic paper on MFKDF2’s algorithms, including robust security arguments.
- We’ll submit MFKDF2 to a third-party artifact evaluation review, if applicable.
- We’ll travel to an academic conference to present MFKDF2 to the community.
- We’ll make presentations, announcements, blog posts, etc., to promote MFKDF2.
Acceptance Criteria: This milestone will be complete when the final MFKDF2 library is ready as a well-documented and production-ready solution.
- Milestone: 5 (Zcash Ecosystem Integrations)
Amount (USD): $4k
Expected Completion Date: 2025-12-01
Deliverables:
- We’ll attempt to implement MFKDF2 as a key management option in Zcash’s CLI tool (https://github.com/zcash/zcash-devtool), as an example to Zcash devs
- We’ll investigate and report on MFKDF2’s compatibility with FROST (ZIP 312), as a complementary secure, usable, multi-user key management strategy.
- We’ll investigate and report on MFKDF2’s utility for Zcash Liberated Payments (ZIP 324), as a way to privately send Zcash to an unregistered “set of factors” (email, phone number, etc.) that can subsequently be easily accepted on-chain.
- We’ll work closely with Zingo, and other Zcash wallet providers who have indicated interest, to move MFKDF2 into production use across the ecosystem.
Acceptance Criteria: This milestone will culminate in a report, and may result in follow-up proposals if ZCG determines follow-on integration efforts are desirable.
```
### Supporting Documents
```files.yaml
MFKDF2 Detailed Plan: More details about our plan for MFKDF2 and how it improves upon the original MFKDF in various respects.
[MFKDF2 Detailed Plan (2025) - Zcash.pdf](https://github.com/user-attachments/files/21069772/MFKDF2.Detailed.Plan.2025.-.Zcash.pdf)
```
I’m interested in usability and security, and I looked into MFKDF a little, and I have some questions.