Delayed legacy release is not password recovery

Claim: inactivity opens a package, not the vault

Password-reset culture trained everyone to expect a second door: email a code, talk to support, prove identity, get back in. For a zero-knowledge vault, that door is an oracle. If the provider can restore unlock, the provider can decrypt.

Digital legacy and emergency access tempt the same oracle in softer language. “What if something happens to me?” becomes “please hold a key for my heirs.”

NT²’s answer is a different shape: a pre-encrypted legacy package, built while the owner is alive and unlocked, designated for a secure contact, and released only after a local inactivity threshold—not after a help-desk decision.

The claim: delayed release is Share-shaped cryptography on a timer. It is not password recovery, estate legal advice, or operator-side decrypt.

That sits beside no password reset, by design. Unlock cannot be reconstructed by NT². Legacy must not smuggle unlock power into a “family emergency” feature.

Constraint: emergency access wants an oracle

Estate features fail in predictable ways when products chase reassurance.

If the provider can unlock for heirs, zero-knowledge ended. Any procedure that reconstructs the master password, vault key material, or threshold recovery factors for a third party is a reset desk with better copy. Compulsion, breach, and insider risk follow the capability—not the policy slide.

If the legacy package contains Share_rec, vault key material, or unwrapped Key DID privates, the package is a recovery kit in disguise. Threshold vaults split custody on purpose. A legacy Share package should carry encrypted content snapshots the owner chose—items and fields—not the factors that reconstruct the vault root.

If “inactivity” is measured only on a server clock with no client heartbeat model, the edge becomes a silent judge of death. The honest design keeps the threshold in owner-controlled terms: the vault records unlock activity locally; optional blind relay metadata carries release-not-before timestamps derived from client heartbeats—metadata only, never secrets. The server still cannot open the package.

If legacy is marketed as legal estate validity, the product lies. Cryptographic release is not probate. NT² must never imply that opening a package substitutes for law, wills, or jurisdiction.

If heirs receive the master password through “legacy mode,” every other refusal collapses. Master password stays the unlock root for the owner’s vault. Legacy recipients get a package sealed for them—share-style crypto—not remote custody of the owner’s unlock secret.

Design: designate, pre-encrypt, wait, release

Legacy extends Modes B/C package semantics and secure contacts—not a new unlock path.

1. Designate a trusted contact (peer connection when the recipient is another NT² vault).
2. Pre-build an encrypted legacy package: selected items/fields under share-package crypto (passphrase or vault-to-vault addressing as the mode requires).
3. Configure a local inactivity threshold—N days without unlock on the owner’s vault posture the product defines.
4. Deliver via offline file (.nt2legacy / file mode as the baseline) and optionally via blind relay that enforces release-not-before from heartbeat-derived metadata.
5. Release surfaces to the designated party (Inbox message or file open path) only when the threshold says the package may be available—still requiring whatever share secret or peer material the package was sealed to.

flowchart TD
  Owner[Owner unlocked vault]
  Owner -->|select fields / items| Pkg[Encrypted legacy package]
  Owner -->|heartbeat metadata only| Relay[Blind relay optional]
  Owner -->|inactivity threshold| Gate{Release not before?}
  Gate -->|yes| Recip[Designated contact]
  Pkg --> Recip
  Relay -.->|ciphertext + release time| Recip
  Recip -->|decrypt with package secret / peer keys| Content[Chosen content snapshot]

Package ≠ vault. The recipient obtains what the owner sealed into the legacy package. They do not obtain a support-driven unlock of the owner’s entire vault, and they must not receive threshold recovery factors as “helpful extras.”

File mode stays sovereign. Offline delivery does not require Premium cloud. Relay-gated release is a convenience layer for holders who want time enforcement without mailing a USB stick—still blind to package plaintext.

Outbox correlation. The sender can see legacy plan lifecycle in the same honesty model as other shares—create, pause, revoke, release—without a provider reading the package. See revoke what you already sent.

Elite cloud legacy is a product tier, not a decrypt tier. Paying for relay-gated release buys infrastructure and policy enforcement on ciphertext timing. It does not buy a human who can open the vault.

Trade-off: less reassurance, more true custody

Delayed legacy is harder to market than “we’ll help your family get in.”

Owners must choose content while they can still unlock. They must maintain a designated contact relationship. Inactivity thresholds can false-trigger if someone stops using a vault for travel—pause and revoke exist for that reason. Heirs who expected a password reset will be disappointed on purpose.

We accept the disappointment because the alternative is an oracle. A provider that can unlock for grief can unlock for everyone else who finds the same door.

Threshold posture stays strict: legacy packages follow the same refusal as recovery-kit hygiene—no Share_rec, no vaultKeyMaterial, no unwrapped signing keys inside the package. Content snapshots only.

What we refuse

We refuse provider-held master password recovery framed as legacy. No help-desk decrypt for heirs.

We refuse Share_rec, vault key material, or unwrapped Key DID privates inside legacy packages. Those are unlock/recovery factors, not estate content.

We refuse implying legal estate validity. Cryptographic release is not probate.

We refuse a server that decrypts packages when a death certificate arrives. Blind relay may enforce release-not-before on ciphertext; it must not learn the package key.

We refuse silent full-vault handoff disguised as legacy. Mode-shaped packages and explicit designation—not “give them my unlock.”

Close: time-delayed Share, not a second unlock

Cross-vault sharing usually means someone else needs something now. Legacy means someone else may need something later, under rules you set while you still hold the keys.

Peer connections name who. Outbox tracks what you already sent. Legacy stretches Share across inactivity without inventing a password-reset desk. Mode B/C handoff mechanics—files, links, and machine-handoff passphrases—close this series next.

If you want emergency access that fails closed instead of minting an oracle, explore NT² Vault.