Frequently Asked Questions

• Secured at start-up: VM controller changes all password and blocks all ports except port 22.
• No VM access: direct connections, SSH logins, or other remote servers do not work, access to VM is via a tiCrypt proxy only.
• Encrypted drives: data is always encrypted, away from admins.
• FIPS-180 compliant TLS tunnels: traffic moves through a public-key-based authentication tunnel, more restrictive than SSH.
• Restricted internet access: protection against accidental or intentional information leaks.

A default-open security model allows access unless it is explicitly restricted.

• Relies on firewalls, perimeter defenses, and access control lists (ACLs).
• Common in traditional solutions and architectures.

A default-shut security model denies access unless it is explicitly allowed.

• Uses public-key cryptography (PKC) and end-to-end encryption.
• Built within the tiCrypt protection layer.

Users can recover their lost private keys through a process called escrow (see whitepaper). Escrowing is slow and traditional to prevent social engineering.

Users do provide a password to attach their private key to tiCrypt. However, authentication does not rely on the password itself. Instead, the system validates the user by verifying the hash of the digital signature of their private key, similar to how blockchain systems like Bitcoin confirm ownership.