[Cfrg] A different approach to key escrow

[Phillip Hallam-Baker <[e-mail]>]

[ccd to CFRG for comment]

At the moment, the approach used to escrow Mesh keys is

* Generate a master secret of at least 128 bits
* Use the master secret to derive an AES 256 encryption key and
initialization vector under which the private key information is encrypted.
* Use a content digest of the master secret as the identifier under which
the escrow record is stored on some sort of service (TBS).
* Use Shamir secret sharing to split the master secret  n out of m ways

This works with any public key algorithm but it requires a service. It has
since occurred to me that I may have gone down a blind alley because I
designed this part of the system back when RSA was still the default
algorithm (we were discussing the CFRG curves at the time). I am now
thinking about using this approach:

* Generate a master secret of at least 128 bits
* Use a KDF to generate the master key pairs for Encryption and Signature
from the master secret
* Use Shamir secret sharing to split the master secret  n out of m ways

Thoughts?

One side benefit of this approach is that it becomes quite easy to give
test vectors, just give the master secret used to generate the key pairs.

I know 128 bits is short, my preference is for 256 bits. But given the
number of times this ends up going through SHA-2-512, I am not really
worried.